TradingView_Premium_Desktop_(password_github).zip
- SHA256 feb66eecd8ed9f95ad977b149d22b4a29062673881b0b999ad8648e5a2e5edfb
Password
github
Overview
overview
8Static
static
8binfmts/fr...an.ps1
windows11-ltsc_2024-x64
3binfmts/fr...sh.ps1
windows11-ltsc_2024-x64
3binfmts/fr...sh.ps1
windows11-ltsc_2024-x64
3binfmts/fr...og.ps1
windows11-ltsc_2024-x64
3binfmts/fr...ai.ps1
windows11-ltsc_2024-x64
3binfmts/fr...se.ps1
windows11-ltsc_2024-x64
3binfmts/fr...sh.ps1
windows11-ltsc_2024-x64
3binfmts/fr...an.ps1
windows11-ltsc_2024-x64
3binfmts/fr...ur.ps1
windows11-ltsc_2024-x64
3binfmts/fr...in.ps1
windows11-ltsc_2024-x64
3binfmts/fr...ek.ps1
windows11-ltsc_2024-x64
3binfmts/fr...se.ps1
windows11-ltsc_2024-x64
3gems/2.7.0...rse.so
windows11-ltsc_2024-x64
3gems/2.7.0...ext.so
windows11-ltsc_2024-x64
3ispell/Sou...SC.exe
windows11-ltsc_2024-x64
3ispell/Sou...cp.sys
windows11-ltsc_2024-x64
3ispell/Sou...cp.sys
windows11-ltsc_2024-x64
3ispell/Sou...ns.sys
windows11-ltsc_2024-x64
3ispell/Sou...ns.sys
windows11-ltsc_2024-x64
3ispell/Sou...tp.sys
windows11-ltsc_2024-x64
3ispell/Sou...tp.sys
windows11-ltsc_2024-x64
3ispell/Sou...ps.sys
windows11-ltsc_2024-x64
3ispell/Sou...ps.sys
windows11-ltsc_2024-x64
3ispell/Sou...ds.sys
windows11-ltsc_2024-x64
3ispell/Sou...ds.sys
windows11-ltsc_2024-x64
3ispell/Sou...FP.sys
windows11-ltsc_2024-x64
3ispell/Sou...FP.sys
windows11-ltsc_2024-x64
3ispell/Sou...SL.sys
windows11-ltsc_2024-x64
3ispell/Sou...p3.sys
windows11-ltsc_2024-x64
3ispell/Sou...p3.sys
windows11-ltsc_2024-x64
3ispell/Sou...ot.sys
windows11-ltsc_2024-x64
3ispell/Sou...ot.sys
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
binfmts/frame/langs/Slovenian.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
binfmts/frame/langs/Spanish.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
binfmts/frame/langs/Swedish.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
binfmts/frame/langs/Tagalog.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
binfmts/frame/langs/Thai.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
binfmts/frame/langs/TradChinese.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
binfmts/frame/langs/Turkish.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
binfmts/frame/langs/Ukrainian.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
binfmts/frame/langs/Uyghur.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
binfmts/frame/langs/UyghurLatin.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
binfmts/frame/langs/Uzbek.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
binfmts/frame/langs/Vietnamese.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/racc/cparse.so
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/unf_ext.so
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
ispell/Sounds/DG/PAV3WSC.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
ispell/Sounds/Drivers/NNSDhcp/NNSDhcp.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
ispell/Sounds/Drivers/NNSDhcp/WVista/NNSDhcp.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
ispell/Sounds/Drivers/NNSDns/NNSDns.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
ispell/Sounds/Drivers/NNSDns/WVista/NNSDns.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
ispell/Sounds/Drivers/NNSHttp/NNSHttp.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
ispell/Sounds/Drivers/NNSHttp/WVista/NNSHttp.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
ispell/Sounds/Drivers/NNSHttps/NNSHttps.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
ispell/Sounds/Drivers/NNSHttps/WVista/NNSHttps.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
ispell/Sounds/Drivers/NNSIds/NNSIds.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
ispell/Sounds/Drivers/NNSIds/WVista/NNSIds.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
ispell/Sounds/Drivers/NNSNHWFP/NNSNHWFP.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
ispell/Sounds/Drivers/NNSNHWFP/W8/NNSNHWFP.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
ispell/Sounds/Drivers/NNSNahsL/W8/NNSNAHSL.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
ispell/Sounds/Drivers/NNSPop3/NNSPop3.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
ispell/Sounds/Drivers/NNSPop3/WVista/NNSPop3.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
ispell/Sounds/Drivers/NNSProt/NNSProt.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
ispell/Sounds/Drivers/NNSProt/WVista/NNSProt.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target TradingView_Premium_Desktop_(password_github).zip
- Size 131.9MB
- Sample261107-txf6wses2k
- SHA256 feb66eecd8ed9f95ad977b149d22b4a29062673881b0b999ad8648e5a2e5edfb
- MD5 0d72994df627a83ea2f6d1170769d875
- SHA1 aedfe713260a45158049fe9fe8142a0499c58140
- SHA512 cd00ea6728ff4fe0b09c5f8e3d6e8a58e6aa4240fba39036bf59ac9c35eaa36a9737cb198b92e770e726f75e82723eb47618d95b9a7fd6662f6a97dcae906f46
- SSDEEP 3145728:ggOcxM/7xKr66Ktlch1JUaE9Rvy3zPIOhfwvS1c:ggOcU7xVtOJUHvyjPrwKe
- TLSH T15D68331F7304549BE6F6AF3CF46682606F79A90197777A1B196800812ED9F483F1B38E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/apt/SysWOW64/Com/comempty.dat office_xlm_macros - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/openvr_api.dll - Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/apt/SysWOW64/Com/comempty.dat - Unsigned PE 665 IoCs
Checks for missing Authenticode signature.
resource unpack001/apt/SysWOW64/APHostClient.dll unpack001/apt/SysWOW64/AarSvc.dll unpack001/apt/SysWOW64/AboveLockAppHost.dll unpack001/apt/SysWOW64/AcGenral.dll unpack001/apt/SysWOW64/AcLayers.dll unpack001/apt/SysWOW64/AcSpecfc.dll unpack001/apt/SysWOW64/AcWinRT.dll unpack001/apt/SysWOW64/AcXtrnal.dll unpack001/apt/SysWOW64/AccountsRt.dll unpack001/apt/SysWOW64/ActionCenter.dll unpack001/apt/SysWOW64/ActionCenterCPL.dll unpack001/apt/SysWOW64/ActionCenterCPL.dll.mun unpack001/apt/SysWOW64/ActivationClient.dll unpack001/apt/SysWOW64/ActivationManager.dll unpack001/apt/SysWOW64/ActiveSyncProvider.dll unpack001/apt/SysWOW64/AdaptiveCards.dll unpack001/apt/SysWOW64/AddressParser.dll unpack001/apt/SysWOW64/AdmTmpl.dll unpack001/apt/SysWOW64/AnalogCommonProxyStub.dll unpack001/apt/SysWOW64/ApiSetHost.AppExecutionAlias.dll unpack001/apt/SysWOW64/AppExtension.dll unpack001/apt/SysWOW64/AppIdPolicyEngineApi.dll unpack001/apt/SysWOW64/AppInstallerPrompt.Desktop.dll unpack001/apt/SysWOW64/AppLockerCSP.dll unpack001/apt/SysWOW64/AppManagementConfiguration.dll unpack001/apt/SysWOW64/Apphlpdm.dll unpack001/apt/SysWOW64/AppointmentActivation.dll unpack001/apt/SysWOW64/AppointmentApis.dll unpack001/apt/SysWOW64/AppxSip.dll unpack001/apt/SysWOW64/AssignedAccessRuntime.dll unpack001/apt/SysWOW64/AuditNativeSnapIn.dll unpack001/apt/SysWOW64/AuditPolicyGPInterop.dll unpack001/apt/SysWOW64/AuthBroker.dll unpack001/apt/SysWOW64/AuthBrokerUI.dll unpack001/apt/SysWOW64/AuthExt.dll unpack001/apt/SysWOW64/AuthFWGP.dll unpack001/apt/SysWOW64/AuthFWGP.dll.mun unpack001/apt/SysWOW64/AuthFWSnapin.dll unpack001/apt/SysWOW64/AuthFWWizFwk.dll unpack001/apt/SysWOW64/AutomaticAppSignInPolicy.dll unpack001/apt/SysWOW64/AzSqlExt.dll unpack001/apt/SysWOW64/AzureSettingSyncProvider.dll unpack001/apt/SysWOW64/BTAGService.dll unpack001/apt/SysWOW64/BWContextHandler.dll unpack001/apt/SysWOW64/BackgroundMediaPolicy.dll unpack001/apt/SysWOW64/BamSettingsClient.dll unpack001/apt/SysWOW64/BcastDVRBroker.dll unpack001/apt/SysWOW64/BcastDVRClient.dll unpack001/apt/SysWOW64/BcastDVRCommon.dll unpack001/apt/SysWOW64/BingMaps.dll unpack001/apt/SysWOW64/BingMaps.dll.mun unpack001/apt/SysWOW64/BingOnlineServices.dll unpack001/apt/SysWOW64/BioCredProv.dll unpack001/apt/SysWOW64/BitLockerCsp.dll unpack001/apt/SysWOW64/BitsProxy.dll unpack001/apt/SysWOW64/BluetoothApis.dll unpack001/apt/SysWOW64/BrowserSettingSync.dll unpack001/apt/SysWOW64/BthTelemetry.dll unpack001/apt/SysWOW64/CHxReadingStringIME.dll unpack001/apt/SysWOW64/CIWmi.dll unpack001/apt/SysWOW64/C_G18030.DLL unpack001/apt/SysWOW64/C_IS2022.DLL unpack001/apt/SysWOW64/C_ISCII.DLL unpack001/apt/SysWOW64/CallButtons.ProxyStub.dll unpack001/apt/SysWOW64/CallButtons.dll unpack001/apt/SysWOW64/CallHistoryClient.dll unpack001/apt/SysWOW64/CameraCaptureUI.dll unpack001/apt/SysWOW64/CapabilityAccessManagerClient.dll unpack001/apt/SysWOW64/CastingShellExt.dll unpack001/apt/SysWOW64/CertEnroll.dll unpack001/apt/SysWOW64/CertEnrollUI.dll unpack001/apt/SysWOW64/CertPKICmdlet.dll unpack001/apt/SysWOW64/CertPolEng.dll unpack001/apt/SysWOW64/Chakra.dll unpack001/apt/SysWOW64/Chakra.dll.mun unpack001/apt/SysWOW64/Chakradiag.dll unpack001/apt/SysWOW64/Chakrathunk.dll unpack001/apt/SysWOW64/ChatApis.dll unpack001/apt/SysWOW64/ClipboardServer.dll unpack001/apt/SysWOW64/Com/MigRegDB.exe unpack001/apt/SysWOW64/Com/comadmin.dll unpack001/apt/SysWOW64/Com/comrepl.exe unpack001/apt/SysWOW64/Com/en-US/comrepl.exe.mui unpack001/apt/SysWOW64/Com/mtsadmin.tlb unpack001/apt/SysWOW64/Com/ru-RU/MigRegDB.exe.mui unpack001/apt/SysWOW64/Com/ru-RU/comrepl.exe.mui unpack001/apt/SysWOW64/DDORes.dll.mun unpack001/apt/SysWOW64/DataExchange.dll.mun unpack001/apt/SysWOW64/DeviceCenter.dll.mun unpack001/apt/SysWOW64/DevicePairing.dll.mun unpack001/apt/SysWOW64/DevicePairingFolder.dll.mun unpack001/apt/SysWOW64/DiagSvcs/DiagnosticsHub.StandardCollector.Proxy.dll unpack001/apt/SysWOW64/DiagSvcs/KernelTraceControl.dll unpack001/apt/SysWOW64/Dism/FfuProvider.dll unpack001/apt/SysWOW64/Dism/en-US/AppxProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/AssocProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/DismCore.dll.mui unpack001/apt/SysWOW64/Dism/en-US/DismProv.dll.mui unpack001/apt/SysWOW64/Dism/en-US/FolderProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/IBSProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/LogProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/MsiProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/SetupPlatformProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/SysprepProvider.dll.mui unpack001/apt/SysWOW64/Dism/en-US/TransmogProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/AppxProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/AssocProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/CbsProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/DismCore.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/DismProv.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/DmiProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/FfuProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/FolderProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/GenericProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/ImagingProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/IntlProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/LogProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/MsiProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/OSProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/OfflineSetupProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/ProvProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/SetupPlatformProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/SmiProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/TransmogProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/UnattendProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/VhdProvider.dll.mui unpack001/apt/SysWOW64/Dism/ru-RU/WimProvider.dll.mui unpack001/apt/SysWOW64/DxpTaskSync.dll.mun unpack001/apt/SysWOW64/ETWCoreUIComponentsResources.dll.mun unpack001/apt/SysWOW64/EapTeapExt.dll.mun unpack001/apt/SysWOW64/EaseOfAccessDialog.exe.mun unpack001/apt/SysWOW64/ExplorerFrame.dll.mun unpack001/apt/SysWOW64/F12/DiagnosticsHub.DataWarehouse.dll unpack001/apt/SysWOW64/F12/DiagnosticsHub.ScriptedSandboxPlugin.dll unpack001/apt/SysWOW64/F12/DiagnosticsHub_is.dll unpack001/apt/SysWOW64/F12/DiagnosticsTap.dll unpack001/apt/SysWOW64/F12/F12App.dll unpack001/apt/SysWOW64/F12/F12AppFrame.dll unpack001/apt/SysWOW64/F12/F12AppFrame2.dll unpack001/apt/SysWOW64/F12/F12Platform.dll unpack001/apt/SysWOW64/F12/F12Platform2.dll unpack001/apt/SysWOW64/F12/F12Script.dll unpack001/apt/SysWOW64/F12/F12Tab.dll unpack001/apt/SysWOW64/F12/IEChooser.exe unpack001/apt/SysWOW64/F12/MemoryAnalyzer.dll unpack001/apt/SysWOW64/F12/Timeline.dll unpack001/apt/SysWOW64/F12/Timeline_is.dll unpack001/apt/SysWOW64/F12/ru-RU/F12Platform.dll.mui unpack001/apt/SysWOW64/F12/ru-RU/F12Platform2.dll.mui unpack001/apt/SysWOW64/F12/ru-RU/F12Script.dll.mui unpack001/apt/SysWOW64/F12/ru-RU/IEChooser.exe.mui unpack001/apt/SysWOW64/FirewallControlPanel.dll.mun unpack001/apt/SysWOW64/LaunchTM.exe.mun unpack001/apt/SysWOW64/Magnify.exe.mun unpack001/apt/SysWOW64/NPSMDesktopProvider.dll.mun unpack001/apt/SysWOW64/PortableDeviceStatus.dll.mun unpack001/apt/SysWOW64/SearchIndexer.exe.mun unpack001/apt/SysWOW64/SensorsCpl.dll.mun unpack001/apt/SysWOW64/SndVolSSO.dll.mun unpack001/apt/SysWOW64/SrpUxNativeSnapIn.dll.mun unpack001/apt/SysWOW64/SyncCenter.dll.mun unpack001/apt/SysWOW64/Taskmgr.exe.mun unpack001/apt/SysWOW64/TtlsExt.dll.mun unpack001/apt/SysWOW64/VAN.dll.mun unpack001/apt/SysWOW64/Vault.dll.mun unpack001/apt/SysWOW64/Windows.Data.Pdf.dll.mun unpack001/apt/SysWOW64/Windows.UI.Immersive.dll.mun unpack001/apt/SysWOW64/Winlangdb.dll.mun unpack001/apt/SysWOW64/WlanMM.dll.mun unpack001/apt/SysWOW64/aadauthhelper.dll unpack001/apt/SysWOW64/aadtb.dll unpack001/apt/SysWOW64/accessibilitycpl.dll unpack001/apt/SysWOW64/accessibilitycpl.dll.mun unpack001/apt/SysWOW64/accountaccessor.dll unpack001/apt/SysWOW64/acledit.dll unpack001/apt/SysWOW64/aclui.dll unpack001/apt/SysWOW64/aclui.dll.mun unpack001/apt/SysWOW64/acppage.dll unpack001/apt/SysWOW64/activeds.dll unpack001/apt/SysWOW64/activeds.tlb unpack001/apt/SysWOW64/actxprxy.dll unpack001/apt/SysWOW64/acwow64.dll unpack001/apt/SysWOW64/adprovider.dll unpack001/apt/SysWOW64/adrclient.dll unpack001/apt/SysWOW64/adsldp.dll unpack001/apt/SysWOW64/adsldpc.dll unpack001/apt/SysWOW64/adsmsext.dll unpack001/apt/SysWOW64/adsnt.dll unpack001/apt/SysWOW64/adtschema.dll unpack001/apt/SysWOW64/advapi32res.dll unpack001/apt/SysWOW64/advpack.dll unpack001/apt/SysWOW64/aeevts.dll unpack001/apt/SysWOW64/aepic.dll unpack001/apt/SysWOW64/agentactivationruntime.dll unpack001/apt/SysWOW64/agentactivationruntimewindows.dll unpack001/apt/SysWOW64/altspace.dll unpack001/apt/SysWOW64/amsi.dll unpack001/apt/SysWOW64/amstream.dll unpack001/apt/SysWOW64/apds.dll unpack001/apt/SysWOW64/apphelp.dll unpack001/apt/SysWOW64/appmgmts.dll unpack001/apt/SysWOW64/appmgr.dll unpack001/apt/SysWOW64/apprepapi.dll unpack001/apt/SysWOW64/appwiz.cpl unpack001/apt/SysWOW64/appwiz.cpl.mun unpack001/apt/SysWOW64/ar-SA/SyncRes.dll.mui unpack001/apt/SysWOW64/ar-SA/cdosys.dll.mui unpack001/apt/SysWOW64/ar-SA/comctl32.dll.mui unpack001/apt/SysWOW64/ar-SA/quickassist.exe.mui unpack001/apt/SysWOW64/ar-SA/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/archiveint.dll unpack001/apt/SysWOW64/asferror.dll unpack001/apt/SysWOW64/asycfilt.dll unpack001/apt/SysWOW64/atl.dll unpack001/apt/SysWOW64/atlthunk.dll unpack001/apt/SysWOW64/atmlib.dll unpack001/apt/SysWOW64/audiodev.dll unpack001/apt/SysWOW64/auditpolcore.dll unpack001/apt/SysWOW64/auditpolmsg.dll unpack001/apt/SysWOW64/authfwcfg.dll unpack001/apt/SysWOW64/authui.dll unpack001/apt/SysWOW64/authui.dll.mun unpack001/apt/SysWOW64/authz.dll unpack001/apt/SysWOW64/autoplay.dll unpack001/apt/SysWOW64/avicap32.dll unpack001/apt/SysWOW64/avifil32.dll unpack001/apt/SysWOW64/azroles.dll unpack001/apt/SysWOW64/azroles.dll.mun unpack001/apt/SysWOW64/azroleui.dll unpack001/apt/SysWOW64/batmeter.dll unpack001/apt/SysWOW64/batmeter.dll.mun unpack001/apt/SysWOW64/bcastdvr.proxy.dll unpack001/apt/SysWOW64/bdaplgin.ax unpack001/apt/SysWOW64/bg-BG/SyncRes.dll.mui unpack001/apt/SysWOW64/bg-BG/comctl32.dll.mui unpack001/apt/SysWOW64/bg-BG/quickassist.exe.mui unpack001/apt/SysWOW64/bg-BG/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/bidispl.dll unpack001/apt/SysWOW64/bitsperf.dll unpack001/apt/SysWOW64/browcli.dll unpack001/apt/SysWOW64/browseui.dll unpack001/apt/SysWOW64/bthprops.cpl unpack001/apt/SysWOW64/btpanui.dll unpack001/apt/SysWOW64/c_GSM7.DLL unpack001/apt/SysWOW64/cabapi.dll unpack001/apt/SysWOW64/cabview.dll unpack001/apt/SysWOW64/capiprovider.dll unpack001/apt/SysWOW64/capisp.dll unpack001/apt/SysWOW64/catsrv.dll unpack001/apt/SysWOW64/catsrvps.dll unpack001/apt/SysWOW64/catsrvut.dll unpack001/apt/SysWOW64/cca.dll unpack001/apt/SysWOW64/cdosys.dll unpack001/apt/SysWOW64/cdp.dll unpack001/apt/SysWOW64/cdprt.dll unpack001/apt/SysWOW64/cemapi.dll unpack001/apt/SysWOW64/cero.rs unpack001/apt/SysWOW64/certCredProvider.dll unpack001/apt/SysWOW64/certCredProvider.dll.mun unpack001/apt/SysWOW64/certca.dll unpack001/apt/SysWOW64/certcli.dll unpack001/apt/SysWOW64/certenc.dll unpack001/apt/SysWOW64/certmgr.dll unpack001/apt/SysWOW64/cewmdm.dll unpack001/apt/SysWOW64/cfgbkend.dll unpack001/apt/SysWOW64/cfmifsproxy.dll unpack001/apt/SysWOW64/chartv.dll unpack001/apt/SysWOW64/cic.dll unpack001/apt/SysWOW64/clb.dll unpack001/apt/SysWOW64/cldapi.dll unpack001/apt/SysWOW64/clfsw32.dll unpack001/apt/SysWOW64/cliconfg.dll unpack001/apt/SysWOW64/cliconfg.rll unpack001/apt/SysWOW64/clrhost.dll unpack001/apt/SysWOW64/clusapi.dll unpack001/apt/SysWOW64/cmcfg32.dll unpack001/apt/SysWOW64/cmdext.dll unpack001/apt/SysWOW64/cmdial32.dll unpack001/apt/SysWOW64/cmgrcspps.dll unpack001/apt/SysWOW64/cmintegrator.dll unpack001/apt/SysWOW64/cmlua.dll unpack001/apt/SysWOW64/cmpbk32.dll unpack001/apt/SysWOW64/cmstplua.dll unpack001/apt/SysWOW64/cmutil.dll unpack001/apt/SysWOW64/cngcredui.dll unpack001/apt/SysWOW64/cngprovider.dll unpack001/apt/SysWOW64/cnvfat.dll unpack001/apt/SysWOW64/cob-au.rs unpack001/apt/SysWOW64/colbact.dll unpack001/apt/SysWOW64/colorui.dll unpack001/apt/SysWOW64/colorui.dll.mun unpack001/apt/SysWOW64/comcat.dll unpack001/apt/SysWOW64/comdlg32.dll unpack001/apt/SysWOW64/comdlg32.dll.mun unpack001/apt/SysWOW64/compstui.dll.mun unpack001/apt/SysWOW64/comres.dll.mun unpack001/apt/SysWOW64/connect.dll.mun unpack001/apt/SysWOW64/crypt32.dll.mun unpack001/apt/SysWOW64/cryptui.dll.mun unpack001/apt/SysWOW64/cryptuiwizard.dll.mun unpack001/apt/SysWOW64/cs-CZ/APHostRes.dll.mui unpack001/apt/SysWOW64/cs-CZ/SyncRes.dll.mui unpack001/apt/SysWOW64/cs-CZ/cdosys.dll.mui unpack001/apt/SysWOW64/cs-CZ/comctl32.dll.mui unpack001/apt/SysWOW64/cs-CZ/quickassist.exe.mui unpack001/apt/SysWOW64/cs-CZ/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/cttune.exe.mun unpack001/apt/SysWOW64/da-DK/APHostRes.dll.mui unpack001/apt/SysWOW64/da-DK/SyncRes.dll.mui unpack001/apt/SysWOW64/da-DK/cdosys.dll.mui unpack001/apt/SysWOW64/da-DK/comctl32.dll.mui unpack001/apt/SysWOW64/da-DK/quickassist.exe.mui unpack001/apt/SysWOW64/da-DK/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/dccw.exe.mun unpack001/apt/SysWOW64/de-DE/APHostRes.dll.mui unpack001/apt/SysWOW64/de-DE/SyncRes.dll.mui unpack001/apt/SysWOW64/de-DE/cdosys.dll.mui unpack001/apt/SysWOW64/de-DE/comctl32.dll.mui unpack001/apt/SysWOW64/de-DE/quickassist.exe.mui unpack001/apt/SysWOW64/de-DE/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/dfrgui.exe.mun unpack001/apt/SysWOW64/directml.dll.mun unpack001/apt/SysWOW64/dmdskres.dll.mun unpack001/apt/SysWOW64/drivers/afunix.sys unpack001/apt/SysWOW64/drivers/en-US/wfplwfs.sys.mui unpack001/apt/SysWOW64/drivers/ru-RU/NdisImPlatform.sys.mui unpack001/apt/SysWOW64/drivers/ru-RU/ndiscap.sys.mui unpack001/apt/SysWOW64/drivers/ru-RU/wfplwfs.sys.mui unpack001/apt/SysWOW64/dsquery.dll.mun unpack001/apt/SysWOW64/dsuiext.dll.mun unpack001/apt/SysWOW64/dwmcore.dll.mun unpack001/apt/SysWOW64/edgehtml.dll.mun unpack001/apt/SysWOW64/edputil.dll.mun unpack001/apt/SysWOW64/el-GR/APHostRes.dll.mui unpack001/apt/SysWOW64/el-GR/SyncRes.dll.mui unpack001/apt/SysWOW64/el-GR/cdosys.dll.mui unpack001/apt/SysWOW64/el-GR/comctl32.dll.mui unpack001/apt/SysWOW64/el-GR/quickassist.exe.mui unpack001/apt/SysWOW64/el-GR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/en-GB/SyncRes.dll.mui unpack001/apt/SysWOW64/en-GB/comctl32.dll.mui unpack001/apt/SysWOW64/en-GB/quickassist.exe.mui unpack001/apt/SysWOW64/en-GB/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/en-US/APHostRes.dll.mui unpack001/apt/SysWOW64/en-US/AccountAccessor.dll.mui unpack001/apt/SysWOW64/en-US/AccountsRT.dll.mui unpack001/apt/SysWOW64/en-US/ActiveSyncProvider.dll.mui unpack001/apt/SysWOW64/en-US/AzureSettingSyncProvider.dll.mui unpack001/apt/SysWOW64/en-US/DavSyncProvider.dll.mui unpack001/apt/SysWOW64/en-US/DevicePairingProxy.dll.mui unpack001/apt/SysWOW64/en-US/DeviceUxRes.dll.mui unpack001/apt/SysWOW64/en-US/DismApi.dll.mui unpack001/apt/SysWOW64/en-US/ETWCoreUIComponentsResources.dll.mui unpack001/apt/SysWOW64/en-US/MCCSEngineShared.dll.mui unpack001/apt/SysWOW64/en-US/MessagingDataModel2.dll.mui unpack001/apt/SysWOW64/en-US/MsCtfMonitor.dll.mui unpack001/apt/SysWOW64/en-US/NetworkHelper.dll.mui unpack001/apt/SysWOW64/en-US/Ninput.dll.mui unpack001/apt/SysWOW64/en-US/PackageStateRoaming.dll.mui unpack001/apt/SysWOW64/en-US/PeerDistSh.dll.mui unpack001/apt/SysWOW64/en-US/RMActivate.exe.mui unpack001/apt/SysWOW64/en-US/RMActivate_isv.exe.mui unpack001/apt/SysWOW64/en-US/RMActivate_ssp.exe.mui unpack001/apt/SysWOW64/en-US/RMActivate_ssp_isv.exe.mui unpack001/apt/SysWOW64/en-US/RemoveDeviceElevated.dll.mui unpack001/apt/SysWOW64/en-US/SyncController.dll.mui unpack001/apt/SysWOW64/en-US/SyncRes.dll.mui unpack001/apt/SysWOW64/en-US/SyncUtil.dll.mui unpack001/apt/SysWOW64/en-US/WWAApi.dll.mui unpack001/apt/SysWOW64/en-US/Windows.Gaming.Input.dll.mui unpack001/apt/SysWOW64/en-US/Windows.Graphics.Printing.3D.dll.mui unpack001/apt/SysWOW64/en-US/Windows.Networking.Proximity.dll.mui unpack001/apt/SysWOW64/en-US/Windows.Storage.ApplicationData.dll.mui unpack001/apt/SysWOW64/en-US/Windows.UI.Input.Inking.dll.mui unpack001/apt/SysWOW64/en-US/Winrs.exe.mui unpack001/apt/SysWOW64/en-US/Wisp.dll.mui unpack001/apt/SysWOW64/en-US/adrclient.dll.mui unpack001/apt/SysWOW64/en-US/adsmsext.dll.mui unpack001/apt/SysWOW64/en-US/apphelp.dll.mui unpack001/apt/SysWOW64/en-US/at.exe.mui unpack001/apt/SysWOW64/en-US/bootcfg.exe.mui unpack001/apt/SysWOW64/en-US/cdosys.dll.mui unpack001/apt/SysWOW64/en-US/comctl32.dll.mui unpack001/apt/SysWOW64/en-US/dabapi.dll.mui unpack001/apt/SysWOW64/en-US/dot3cfg.dll.mui unpack001/apt/SysWOW64/en-US/fwpuclnt.dll.mui unpack001/apt/SysWOW64/en-US/gpapi.dll.mui unpack001/apt/SysWOW64/en-US/gpsvc.dll.mui unpack001/apt/SysWOW64/en-US/ifmon.dll.mui unpack001/apt/SysWOW64/en-US/mi.dll.mui unpack001/apt/SysWOW64/en-US/mibincodec.dll.mui unpack001/apt/SysWOW64/en-US/msacm32.drv.mui unpack001/apt/SysWOW64/en-US/msscript.ocx.mui unpack001/apt/SysWOW64/en-US/neth.dll.mui unpack001/apt/SysWOW64/en-US/netsh.exe.mui unpack001/apt/SysWOW64/en-US/nshwfp.dll.mui unpack001/apt/SysWOW64/en-US/osbaseln.dll.mui unpack001/apt/SysWOW64/en-US/p2pnetsh.dll.mui unpack001/apt/SysWOW64/en-US/quickassist.exe.mui unpack001/apt/SysWOW64/en-US/reg.exe.mui unpack001/apt/SysWOW64/en-US/register-cimprovider.exe.mui unpack001/apt/SysWOW64/en-US/rpcnsh.dll.mui unpack001/apt/SysWOW64/en-US/rpcping.exe.mui unpack001/apt/SysWOW64/en-US/rtutils.dll.mui unpack001/apt/SysWOW64/en-US/sc.exe.mui unpack001/apt/SysWOW64/en-US/schtasks.exe.mui unpack001/apt/SysWOW64/en-US/shellstyle.dll.mui unpack001/apt/SysWOW64/en-US/shutdown.exe.mui unpack001/apt/SysWOW64/en-US/srm.dll.mui unpack001/apt/SysWOW64/en-US/srmshell.dll.mui unpack001/apt/SysWOW64/en-US/sxs.dll.mui unpack001/apt/SysWOW64/en-US/sxstrace.exe.mui unpack001/apt/SysWOW64/en-US/systeminfo.exe.mui unpack001/apt/SysWOW64/en-US/taskkill.exe.mui unpack001/apt/SysWOW64/en-US/tasklist.exe.mui unpack001/apt/SysWOW64/en-US/taskschd.dll.mui unpack001/apt/SysWOW64/en-US/termmgr.dll.mui unpack001/apt/SysWOW64/en-US/user32.dll.mui unpack001/apt/SysWOW64/en-US/wecsvc.dll.mui unpack001/apt/SysWOW64/en-US/wecutil.exe.mui unpack001/apt/SysWOW64/en-US/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/en-US/winsrv.dll.mui unpack001/apt/SysWOW64/es-ES/APHostRes.dll.mui unpack001/apt/SysWOW64/es-ES/SyncRes.dll.mui unpack001/apt/SysWOW64/es-ES/cdosys.dll.mui unpack001/apt/SysWOW64/es-ES/comctl32.dll.mui unpack001/apt/SysWOW64/es-ES/quickassist.exe.mui unpack001/apt/SysWOW64/es-ES/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/es-MX/SyncRes.dll.mui unpack001/apt/SysWOW64/es-MX/comctl32.dll.mui unpack001/apt/SysWOW64/es-MX/quickassist.exe.mui unpack001/apt/SysWOW64/es-MX/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/et-EE/SyncRes.dll.mui unpack001/apt/SysWOW64/et-EE/comctl32.dll.mui unpack001/apt/SysWOW64/et-EE/quickassist.exe.mui unpack001/apt/SysWOW64/et-EE/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/fdprint.dll.mun unpack001/apt/SysWOW64/fi-FI/APHostRes.dll.mui unpack001/apt/SysWOW64/fi-FI/SyncRes.dll.mui unpack001/apt/SysWOW64/fi-FI/cdosys.dll.mui unpack001/apt/SysWOW64/fi-FI/comctl32.dll.mui unpack001/apt/SysWOW64/fi-FI/quickassist.exe.mui unpack001/apt/SysWOW64/fi-FI/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/filemgmt.dll.mun unpack001/apt/SysWOW64/fr-CA/SyncRes.dll.mui unpack001/apt/SysWOW64/fr-CA/comctl32.dll.mui unpack001/apt/SysWOW64/fr-CA/quickassist.exe.mui unpack001/apt/SysWOW64/fr-CA/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/fr-FR/APHostRes.dll.mui unpack001/apt/SysWOW64/fr-FR/SyncRes.dll.mui unpack001/apt/SysWOW64/fr-FR/cdosys.dll.mui unpack001/apt/SysWOW64/fr-FR/comctl32.dll.mui unpack001/apt/SysWOW64/fr-FR/quickassist.exe.mui unpack001/apt/SysWOW64/fr-FR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/gpedit.dll.mun unpack001/apt/SysWOW64/he-IL/SyncRes.dll.mui unpack001/apt/SysWOW64/he-IL/cdosys.dll.mui unpack001/apt/SysWOW64/he-IL/comctl32.dll.mui unpack001/apt/SysWOW64/he-IL/quickassist.exe.mui unpack001/apt/SysWOW64/he-IL/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/hr-HR/SyncRes.dll.mui unpack001/apt/SysWOW64/hr-HR/comctl32.dll.mui unpack001/apt/SysWOW64/hr-HR/quickassist.exe.mui unpack001/apt/SysWOW64/hr-HR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/hu-HU/APHostRes.dll.mui unpack001/apt/SysWOW64/hu-HU/SyncRes.dll.mui unpack001/apt/SysWOW64/hu-HU/cdosys.dll.mui unpack001/apt/SysWOW64/hu-HU/comctl32.dll.mui unpack001/apt/SysWOW64/hu-HU/quickassist.exe.mui unpack001/apt/SysWOW64/hu-HU/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/icsigd.dll.mun unpack001/apt/SysWOW64/ieapfltr.dll.mun unpack001/apt/SysWOW64/ieframe.dll.mun unpack001/apt/SysWOW64/imageres.dll.mun unpack001/apt/SysWOW64/imagesp1.dll.mun unpack001/apt/SysWOW64/inetcpl.cpl.mun unpack001/apt/SysWOW64/intl.cpl.mun unpack001/apt/SysWOW64/ipsecsnp.dll.mun unpack001/apt/SysWOW64/iscsicli.exe.mun unpack001/apt/SysWOW64/iscsicpl.dll.mun unpack001/apt/SysWOW64/iscsicpl.exe.mun unpack001/apt/SysWOW64/it-IT/APHostRes.dll.mui unpack001/apt/SysWOW64/it-IT/SyncRes.dll.mui unpack001/apt/SysWOW64/it-IT/cdosys.dll.mui unpack001/apt/SysWOW64/it-IT/comctl32.dll.mui unpack001/apt/SysWOW64/it-IT/quickassist.exe.mui unpack001/apt/SysWOW64/it-IT/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/ja-JP/APHostRes.dll.mui unpack001/apt/SysWOW64/ja-JP/SyncRes.dll.mui unpack001/apt/SysWOW64/ja-JP/cdosys.dll.mui unpack001/apt/SysWOW64/ja-JP/comctl32.dll.mui unpack001/apt/SysWOW64/ja-JP/quickassist.exe.mui unpack001/apt/SysWOW64/ja-JP/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/keymgr.dll.mun unpack001/apt/SysWOW64/ko-KR/APHostRes.dll.mui unpack001/apt/SysWOW64/ko-KR/SyncRes.dll.mui unpack001/apt/SysWOW64/ko-KR/cdosys.dll.mui unpack001/apt/SysWOW64/ko-KR/comctl32.dll.mui unpack001/apt/SysWOW64/ko-KR/quickassist.exe.mui unpack001/apt/SysWOW64/ko-KR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/lt-LT/SyncRes.dll.mui unpack001/apt/SysWOW64/lt-LT/comctl32.dll.mui unpack001/apt/SysWOW64/lt-LT/quickassist.exe.mui unpack001/apt/SysWOW64/lt-LT/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/lv-LV/SyncRes.dll.mui unpack001/apt/SysWOW64/lv-LV/comctl32.dll.mui unpack001/apt/SysWOW64/lv-LV/quickassist.exe.mui unpack001/apt/SysWOW64/lv-LV/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/main.cpl.mun unpack001/apt/SysWOW64/mdminst.dll.mun unpack001/apt/SysWOW64/mfplat.dll.mun unpack001/apt/SysWOW64/mmcbase.dll.mun unpack001/apt/SysWOW64/mmcndmgr.dll.mun unpack001/apt/SysWOW64/mmres.dll.mun unpack001/apt/SysWOW64/mmsys.cpl.mun unpack001/apt/SysWOW64/moricons.dll.mun unpack001/apt/SysWOW64/msctf.dll.mun unpack001/apt/SysWOW64/msdt.exe.mun unpack001/apt/SysWOW64/mshtml.dll.mun unpack001/apt/SysWOW64/mspaint.exe.mun unpack001/apt/SysWOW64/mssvp.dll.mun unpack001/apt/SysWOW64/mstask.dll.mun unpack001/apt/SysWOW64/mstsc.exe.mun unpack001/apt/SysWOW64/mstscax.dll.mun unpack001/apt/SysWOW64/msutb.dll.mun unpack001/apt/SysWOW64/msxml3.dll.mun unpack001/apt/SysWOW64/mycomput.dll.mun unpack001/apt/SysWOW64/mydocs.dll.mun unpack001/apt/SysWOW64/nb-NO/APHostRes.dll.mui unpack001/apt/SysWOW64/nb-NO/SyncRes.dll.mui unpack001/apt/SysWOW64/nb-NO/cdosys.dll.mui unpack001/apt/SysWOW64/nb-NO/comctl32.dll.mui unpack001/apt/SysWOW64/nb-NO/quickassist.exe.mui unpack001/apt/SysWOW64/nb-NO/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/netcenter.dll.mun unpack001/apt/SysWOW64/netshell.dll.mun unpack001/apt/SysWOW64/networkexplorer.dll.mun unpack001/apt/SysWOW64/newdev.dll.mun unpack001/apt/SysWOW64/nl-NL/APHostRes.dll.mui unpack001/apt/SysWOW64/nl-NL/SyncRes.dll.mui unpack001/apt/SysWOW64/nl-NL/cdosys.dll.mui unpack001/apt/SysWOW64/nl-NL/comctl32.dll.mui unpack001/apt/SysWOW64/nl-NL/quickassist.exe.mui unpack001/apt/SysWOW64/nl-NL/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/notepad.exe.mun unpack001/apt/SysWOW64/ntshrui.dll.mun unpack001/apt/SysWOW64/onexui.dll.mun unpack001/apt/SysWOW64/pl-PL/APHostRes.dll.mui unpack001/apt/SysWOW64/pl-PL/SyncRes.dll.mui unpack001/apt/SysWOW64/pl-PL/cdosys.dll.mui unpack001/apt/SysWOW64/pl-PL/comctl32.dll.mui unpack001/apt/SysWOW64/pl-PL/quickassist.exe.mui unpack001/apt/SysWOW64/pl-PL/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/powercpl.dll.mun unpack001/apt/SysWOW64/printui.dll.mun unpack001/apt/SysWOW64/prnfldr.dll.mun unpack001/apt/SysWOW64/propsys.dll.mun unpack001/apt/SysWOW64/psr.exe.mun unpack001/apt/SysWOW64/pt-BR/APHostRes.dll.mui unpack001/apt/SysWOW64/pt-BR/SyncRes.dll.mui unpack001/apt/SysWOW64/pt-BR/cdosys.dll.mui unpack001/apt/SysWOW64/pt-BR/comctl32.dll.mui unpack001/apt/SysWOW64/pt-BR/quickassist.exe.mui unpack001/apt/SysWOW64/pt-BR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/pt-PT/APHostRes.dll.mui unpack001/apt/SysWOW64/pt-PT/SyncRes.dll.mui unpack001/apt/SysWOW64/pt-PT/cdosys.dll.mui unpack001/apt/SysWOW64/pt-PT/comctl32.dll.mui unpack001/apt/SysWOW64/pt-PT/quickassist.exe.mui unpack001/apt/SysWOW64/pt-PT/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/qedwipes.dll.mun unpack001/apt/SysWOW64/raschapext.dll.mun unpack001/apt/SysWOW64/rasdlg.dll.mun unpack001/apt/SysWOW64/rasgcw.dll.mun unpack001/apt/SysWOW64/rasplap.dll.mun unpack001/apt/SysWOW64/rastls.dll.mun unpack001/apt/SysWOW64/rastlsext.dll.mun unpack001/apt/SysWOW64/remotepg.dll.mun unpack001/apt/SysWOW64/ro-RO/SyncRes.dll.mui unpack001/apt/SysWOW64/ro-RO/comctl32.dll.mui unpack001/apt/SysWOW64/ro-RO/quickassist.exe.mui unpack001/apt/SysWOW64/ro-RO/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/sethc.exe.mun unpack001/apt/SysWOW64/setup/cmmigr.dll unpack001/apt/SysWOW64/setup/comsetup.dll unpack001/apt/SysWOW64/setup/tssysprep.dll unpack001/apt/SysWOW64/shell32.dll.mun unpack001/apt/SysWOW64/shrpubw.exe.mun unpack001/apt/SysWOW64/shsvcs.dll.mun unpack001/apt/SysWOW64/sk-SK/SyncRes.dll.mui unpack001/apt/SysWOW64/sk-SK/comctl32.dll.mui unpack001/apt/SysWOW64/sk-SK/quickassist.exe.mui unpack001/apt/SysWOW64/sk-SK/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/sl-SI/SyncRes.dll.mui unpack001/apt/SysWOW64/sl-SI/comctl32.dll.mui unpack001/apt/SysWOW64/sl-SI/quickassist.exe.mui unpack001/apt/SysWOW64/sl-SI/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/sppcomapi.dll.mun unpack001/apt/SysWOW64/sr-Latn-RS/SyncRes.dll.mui unpack001/apt/SysWOW64/sr-Latn-RS/comctl32.dll.mui unpack001/apt/SysWOW64/sr-Latn-RS/quickassist.exe.mui unpack001/apt/SysWOW64/sr-Latn-RS/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/srchadmin.dll.mun unpack001/apt/SysWOW64/stobject.dll.mun unpack001/apt/SysWOW64/sud.dll.mun unpack001/apt/SysWOW64/sv-SE/APHostRes.dll.mui unpack001/apt/SysWOW64/sv-SE/SyncRes.dll.mui unpack001/apt/SysWOW64/sv-SE/cdosys.dll.mui unpack001/apt/SysWOW64/sv-SE/comctl32.dll.mui unpack001/apt/SysWOW64/sv-SE/quickassist.exe.mui unpack001/apt/SysWOW64/sv-SE/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/sysdm.cpl.mun unpack001/apt/SysWOW64/sysmon.ocx.mun unpack001/apt/SysWOW64/systemcpl.dll.mun unpack001/apt/SysWOW64/tapiui.dll.mun unpack001/apt/SysWOW64/th-TH/SyncRes.dll.mui unpack001/apt/SysWOW64/th-TH/comctl32.dll.mui unpack001/apt/SysWOW64/th-TH/quickassist.exe.mui unpack001/apt/SysWOW64/th-TH/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/themecpl.dll.mun unpack001/apt/SysWOW64/themeui.dll.mun unpack001/apt/SysWOW64/timedate.cpl.mun unpack001/apt/SysWOW64/tquery.dll.mun unpack001/apt/SysWOW64/tr-TR/APHostRes.dll.mui unpack001/apt/SysWOW64/tr-TR/SyncRes.dll.mui unpack001/apt/SysWOW64/tr-TR/cdosys.dll.mui unpack001/apt/SysWOW64/tr-TR/comctl32.dll.mui unpack001/apt/SysWOW64/tr-TR/quickassist.exe.mui unpack001/apt/SysWOW64/tr-TR/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/twinui.appcore.dll.mun unpack001/apt/SysWOW64/twinui.dll.mun unpack001/apt/SysWOW64/uk-UA/SyncRes.dll.mui unpack001/apt/SysWOW64/uk-UA/comctl32.dll.mui unpack001/apt/SysWOW64/uk-UA/quickassist.exe.mui unpack001/apt/SysWOW64/uk-UA/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/usercpl.dll.mun unpack001/apt/SysWOW64/wcnwiz.dll.mun unpack001/apt/SysWOW64/wdc.dll.mun unpack001/apt/SysWOW64/wiadefui.dll.mun unpack001/apt/SysWOW64/wiashext.dll.mun unpack001/apt/SysWOW64/wlangpui.dll.mun unpack001/apt/SysWOW64/wpdshext.dll.mun unpack001/apt/SysWOW64/wscui.cpl.mun unpack001/apt/SysWOW64/wsecedit.dll.mun unpack001/apt/SysWOW64/wuapi.dll.mun unpack001/apt/SysWOW64/zh-CN/APHostRes.dll.mui unpack001/apt/SysWOW64/zh-CN/SyncRes.dll.mui unpack001/apt/SysWOW64/zh-CN/cdosys.dll.mui unpack001/apt/SysWOW64/zh-CN/comctl32.dll.mui unpack001/apt/SysWOW64/zh-CN/quickassist.exe.mui unpack001/apt/SysWOW64/zh-CN/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/zh-TW/APHostRes.dll.mui unpack001/apt/SysWOW64/zh-TW/SyncRes.dll.mui unpack001/apt/SysWOW64/zh-TW/cdosys.dll.mui unpack001/apt/SysWOW64/zh-TW/comctl32.dll.mui unpack001/apt/SysWOW64/zh-TW/quickassist.exe.mui unpack001/apt/SysWOW64/zh-TW/windows.ui.xaml.dll.mui unpack001/apt/SysWOW64/zipfldr.dll.mun unpack001/ispell/Sounds/Drivers/PSINDvct/WVista/PSINDvct.sys unpack001/ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.sys unpack001/ispell/Sounds/iFilters/ooofilt.dll unpack001/ispell/profiles/Drivers/prl_net_inst.exe unpack001/ispell/profiles/Drivers/prl_net_install.dll unpack001/libswscale-8.dll unpack001/libx264-142.dll - Untrusted Codesign Signers 42 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/TradingView Premium Desktop.exe unpack001/apt/SysWOW64/atl110.dll unpack001/binfmts/Shared/KeyFile/1033/sqlsysclrtypes_keyfile.dll unpack001/binfmts/Shared/KeyFile/1049/sqlsysclrtypes_keyfile.dll unpack001/binfmts/Shared/SDK/Assemblies/Microsoft.SqlServer.Types.dll unpack001/binfmts/Shared/SDK/Assemblies/ru/Microsoft.SqlServer.Types.Resources.dll unpack001/ispell/Sounds/iFilters/msvcp90.dll unpack001/ispell/Sounds/iFilters/msvcr90.dll unpack001/ispell/profiles/Drivers/prl_dd/amd64/prl_gldd.dl6 unpack001/ispell/profiles/Drivers/prl_dd/amd64/prl_kmdd.sys unpack001/ispell/profiles/Drivers/prl_dd/amd64/prl_umdd.dl6 unpack001/ispell/profiles/Drivers/prl_dd/amd64/prl_umdd10.dl6 unpack001/ispell/profiles/Drivers/prl_dd/i386/prl_gldd.dl3 unpack001/ispell/profiles/Drivers/prl_dd/i386/prl_umdd.dl3 unpack001/ispell/profiles/Drivers/prl_dd/i386/prl_umdd10.dl3 unpack001/ispell/profiles/Drivers/prl_eth5/amd64/prl_eth5.sys unpack001/ispell/profiles/Drivers/prl_fs/amd64/prl_fs.sys unpack001/ispell/profiles/Drivers/prl_fs/amd64/prl_np.dl6 unpack001/ispell/profiles/Drivers/prl_fs/i386/prl_np.dl3 unpack001/ispell/profiles/Drivers/prl_fs/upgrade_temp/prl_fs.sys unpack001/ispell/profiles/Drivers/prl_memdev/amd64/prl_memdev.sys unpack001/ispell/profiles/Drivers/prl_mouf/amd64/prl_mouf.sys unpack001/ispell/profiles/Drivers/prl_pv/amd64/prl_pv64.sys unpack001/ispell/profiles/Drivers/prl_scsi/prl_scsi.sys unpack001/ispell/profiles/Drivers/prl_sound/amd64/prl_sound.sys unpack001/ispell/profiles/Drivers/prl_strg/amd64/prl_strg.sys unpack001/ispell/profiles/Drivers/prl_tg/amd64/prl_tg.sys unpack001/ispell/profiles/Drivers/prl_time/amd64/prl_time.sys unpack001/ispell/profiles/Drivers/prl_va/amd64/prl_gl.dl6 unpack001/ispell/profiles/Drivers/prl_va/amd64/prl_vadd.dll unpack001/ispell/profiles/Drivers/prl_va/amd64/prl_vamp.sys unpack001/ispell/profiles/Drivers/prl_va/i386/prl_gl.dl3 unpack001/ispell/profiles/SIA/SharedIntApp.exe unpack001/ispell/profiles/SIA/mapi32.exe unpack001/ispell/profiles/Services/Plugins/UserInputEmulation.dll unpack001/ispell/profiles/Services/WoW/coherence.exe unpack001/ispell/profiles/Services/WoW/prl_hook.dll unpack001/ispell/profiles/Services/coherence.exe unpack001/ispell/profiles/Services/prl_hook.dll unpack001/ispell/profiles/Services/prl_tools.exe unpack001/ispell/profiles/Services/prl_tools_service.exe unpack001/ispell/profiles/Services/prl_vss_provider.dll
File Explorer
-
TradingView_Premium_Desktop_(password_github).zip.zip 131.9MB
-
TradingView Premium Desktop.exe.exe 141.6MB
-
apt/SysWOW64/12520437.cpx2KB
-
apt/SysWOW64/12520850.cpx2KB
-
apt/SysWOW64/@AppHelpToast.png.png 232B
-
apt/SysWOW64/@AudioToastIcon.png.png 308B
-
apt/SysWOW64/@EnrollmentToastIcon.png.png 330B
-
apt/SysWOW64/@VpnToastIcon.png.png 404B
-
apt/SysWOW64/@WirelessDisplayToast.png.png 691B
-
apt/SysWOW64/APHostClient.dll.dll 45KB
-
apt/SysWOW64/AUDIOKSE.dll.dll 367KB
-
apt/SysWOW64/AarSvc.dll.dll 344KB
-
apt/SysWOW64/AboveLockAppHost.dll.dll 323KB
-
apt/SysWOW64/AcGenral.dll.dll 2.3MB
-
apt/SysWOW64/AcLayers.dll.dll 375KB
-
apt/SysWOW64/AcSpecfc.dll.dll 451KB
-
apt/SysWOW64/AcWinRT.dll.dll 67KB
-
apt/SysWOW64/AcXtrnal.dll.dll 84KB
-
apt/SysWOW64/AccountsRt.dll.dll 334KB
-
apt/SysWOW64/ActionCenter.dll.dll 249KB
-
apt/SysWOW64/ActionCenterCPL.dll.dll 123KB
-
apt/SysWOW64/ActionCenterCPL.dll.mun.dll 425KB
-
apt/SysWOW64/ActivationClient.dll.dll 42KB
-
apt/SysWOW64/ActivationManager.dll.dll 641KB
-
apt/SysWOW64/ActiveSyncProvider.dll.dll 1.4MB
-
apt/SysWOW64/AdaptiveCards.dll.dll 41KB
-
apt/SysWOW64/AddressParser.dll.dll 52KB
-
apt/SysWOW64/AdmTmpl.dll.dll 418KB
-
apt/SysWOW64/AnalogCommonProxyStub.dll.dll 17KB
-
apt/SysWOW64/ApiSetHost.AppExecutionAlias.dll.dll 82KB
-
apt/SysWOW64/AppContracts.dll.dll 753KB
-
apt/SysWOW64/AppExtension.dll.dll 132KB
-
apt/SysWOW64/AppIdPolicyEngineApi.dll.dll 279KB
-
apt/SysWOW64/AppInstallerPrompt.Desktop.dll.dll 37KB
-
apt/SysWOW64/AppLockerCSP.dll.dll 266KB
-
apt/SysWOW64/AppManagementConfiguration.dll.dll 122KB
-
apt/SysWOW64/AppResolver.dll.dll 459KB
-
apt/SysWOW64/AppVClientPS.dll.dll 27KB
-
apt/SysWOW64/AppVEntSubsystems32.dll.dll 1.4MB
-
apt/SysWOW64/AppVSentinel.dll.dll 14KB
-
apt/SysWOW64/AppVTerminator.dll.dll 18KB
-
apt/SysWOW64/AppXDeploymentClient.dll.dll 764KB
-
apt/SysWOW64/Apphlpdm.dll.dll 29KB
-
apt/SysWOW64/AppointmentActivation.dll.dll 112KB
-
apt/SysWOW64/AppointmentApis.dll.dll 635KB
-
apt/SysWOW64/AppxAllUserStore.dll.dll 286KB
-
apt/SysWOW64/AppxApplicabilityEngine.dll.dll 200KB
-
apt/SysWOW64/AppxPackaging.dll.dll 1.6MB
-
apt/SysWOW64/AppxProvisioning.xml.xml 3KB
-
apt/SysWOW64/AppxSip.dll.dll 257KB
-
apt/SysWOW64/AssignedAccessRuntime.dll.dll 46KB
-
apt/SysWOW64/AudioEng.dll.dll 1.8MB
-
apt/SysWOW64/AudioSes.dll.dll 1.2MB
-
apt/SysWOW64/AuditNativeSnapIn.dll.dll 214KB
-
apt/SysWOW64/AuditPolicyGPInterop.dll.dll 55KB
-
apt/SysWOW64/AuthBroker.dll.dll 164KB
-
apt/SysWOW64/AuthBrokerUI.dll.dll 84KB
-
apt/SysWOW64/AuthExt.dll.dll 38KB
-
apt/SysWOW64/AuthFWGP.dll.dll 27KB
-
apt/SysWOW64/AuthFWGP.dll.mun.dll 268KB
-
apt/SysWOW64/AuthFWSnapin.dll.dll 4.9MB
-
apt/SysWOW64/AuthFWWizFwk.dll.dll 110KB
-
apt/SysWOW64/AutomaticAppSignInPolicy.dll.dll 43KB
-
apt/SysWOW64/AzSqlExt.dll.dll 24KB
-
apt/SysWOW64/AzureSettingSyncProvider.dll.dll 1.2MB
-
apt/SysWOW64/BCP47Langs.dll.dll 281KB
-
apt/SysWOW64/BCP47mrm.dll.dll 126KB
-
apt/SysWOW64/BOOTVID.DLL.dll 23KB
-
apt/SysWOW64/BTAGService.dll.dll 716KB
-
apt/SysWOW64/BWContextHandler.dll.dll 52KB
-
apt/SysWOW64/BackgroundMediaPolicy.dll.dll 53KB
-
apt/SysWOW64/BamSettingsClient.dll.dll 12KB
-
apt/SysWOW64/BcastDVRBroker.dll.dll 80KB
-
apt/SysWOW64/BcastDVRClient.dll.dll 356KB
-
apt/SysWOW64/BcastDVRCommon.dll.dll 181KB
-
apt/SysWOW64/BingMaps.dll.dll 6.6MB
-
apt/SysWOW64/BingMaps.dll.mun.dll 111KB
-
apt/SysWOW64/BingOnlineServices.dll.dll 563KB
-
apt/SysWOW64/BioCredProv.dll.dll 293KB
-
apt/SysWOW64/BitLockerCsp.dll.dll 169KB
-
apt/SysWOW64/BitsProxy.dll.dll 48KB
-
apt/SysWOW64/BluetoothApis.dll.dll 140KB
-
apt/SysWOW64/BrowserSettingSync.dll.dll 111KB
-
apt/SysWOW64/BthTelemetry.dll.dll 24KB
-
apt/SysWOW64/CHxReadingStringIME.dll.dll 10KB
-
apt/SysWOW64/CIWmi.dll.dll 31KB
-
apt/SysWOW64/COLORCNV.DLL.dll 173KB
-
apt/SysWOW64/C_G18030.DLL.dll .ps1 220KB
-
apt/SysWOW64/C_IS2022.DLL.dll 14KB
-
apt/SysWOW64/C_ISCII.DLL.dll 12KB
-
apt/SysWOW64/CallButtons.ProxyStub.dll.dll 17KB
-
apt/SysWOW64/CallButtons.dll.dll 65KB
-
apt/SysWOW64/CallHistoryClient.dll.dll 140KB
-
apt/SysWOW64/CameraCaptureUI.dll.dll 92KB
-
apt/SysWOW64/CapabilityAccessManagerClient.dll.dll 168KB
-
apt/SysWOW64/CastingShellExt.dll.dll 85KB
-
apt/SysWOW64/CertEnroll.dll.dll 2.7MB
-
apt/SysWOW64/CertEnrollUI.dll.dll 289KB
-
apt/SysWOW64/CertPKICmdlet.dll.dll 54KB
-
apt/SysWOW64/CertPolEng.dll.dll 134KB
-
apt/SysWOW64/Chakra.dll.dll 5.6MB
-
apt/SysWOW64/Chakra.dll.mun.dll 108KB
-
apt/SysWOW64/Chakradiag.dll.dll 112KB
-
apt/SysWOW64/Chakrathunk.dll.dll 103KB
-
apt/SysWOW64/ChatApis.dll.dll 547KB
-
apt/SysWOW64/ClipboardServer.dll.dll 167KB
-
apt/SysWOW64/Clipc.dll.dll 138KB
-
apt/SysWOW64/CloudExperienceHostCommon.dll.dll 1.0MB
-
apt/SysWOW64/CloudExperienceHostUser.dll.dll 199KB
-
apt/SysWOW64/Com/MigRegDB.exe.exe 11KB
-
apt/SysWOW64/Com/comadmin.dll.dll 207KB
-
apt/SysWOW64/Com/comempty.dat.msi 60KB
-
apt/SysWOW64/Com/comrepl.exe.exe 14KB
-
apt/SysWOW64/Com/en-US/comrepl.exe.mui.dll 2KB
-
apt/SysWOW64/Com/mtsadmin.tlb.dll 19KB
-
apt/SysWOW64/Com/ru-RU/MigRegDB.exe.mui.dll 2KB
-
apt/SysWOW64/Com/ru-RU/comrepl.exe.mui.dll 2KB
-
apt/SysWOW64/DDORes.dll.mun.dll 15.0MB
-
apt/SysWOW64/DataExchange.dll.mun.dll 118KB
-
apt/SysWOW64/DeviceCenter.dll.mun.dll 210KB
-
apt/SysWOW64/DevicePairing.dll.mun.dll 248KB
-
apt/SysWOW64/DevicePairingFolder.dll.mun.dll 120KB
-
apt/SysWOW64/DiagSvcs/DiagnosticsHub.StandardCollector.Proxy.dll.dll 20KB
-
apt/SysWOW64/DiagSvcs/KernelTraceControl.dll.dll 168KB
-
apt/SysWOW64/Dism/AppxProvider.dll.dll 390KB
-
apt/SysWOW64/Dism/AssocProvider.dll.dll 87KB
-
apt/SysWOW64/Dism/CbsProvider.dll.dll 645KB
-
apt/SysWOW64/Dism/DismCore.dll.dll 326KB
-
apt/SysWOW64/Dism/DismCorePS.dll.dll 89KB
-
apt/SysWOW64/Dism/DismHost.exe.exe 112KB
-
apt/SysWOW64/Dism/DismProv.dll.dll 192KB
-
apt/SysWOW64/Dism/DmiProvider.dll.dll 309KB
-
apt/SysWOW64/Dism/FfuProvider.dll.dll 463KB
-
apt/SysWOW64/Dism/FolderProvider.dll.dll 48KB
-
apt/SysWOW64/Dism/GenericProvider.dll.dll 113KB
-
apt/SysWOW64/Dism/IBSProvider.dll.dll 48KB
-
apt/SysWOW64/Dism/ImagingProvider.dll.dll 163KB
-
apt/SysWOW64/Dism/IntlProvider.dll.dll 230KB
-
apt/SysWOW64/Dism/LogProvider.dll.dll 62KB
-
apt/SysWOW64/Dism/MsiProvider.dll.dll 158KB
-
apt/SysWOW64/Dism/OSProvider.dll.dll 114KB
-
apt/SysWOW64/Dism/OfflineSetupProvider.dll.dll 131KB
-
apt/SysWOW64/Dism/ProvProvider.dll.dll 590KB
-
apt/SysWOW64/Dism/SetupPlatformProvider.dll.dll 121KB
-
apt/SysWOW64/Dism/SmiProvider.dll.dll 213KB
-
apt/SysWOW64/Dism/SysprepProvider.dll.dll 564KB
-
apt/SysWOW64/Dism/TransmogProvider.dll.dll 1.1MB
-
apt/SysWOW64/Dism/UnattendProvider.dll.dll 176KB
-
apt/SysWOW64/Dism/VhdProvider.dll.dll 428KB
-
apt/SysWOW64/Dism/WimProvider.dll.dll 446KB
-
apt/SysWOW64/Dism/en-US/AppxProvider.dll.mui.dll 22KB
-
apt/SysWOW64/Dism/en-US/AssocProvider.dll.mui.dll 8KB
-
apt/SysWOW64/Dism/en-US/DismCore.dll.mui.dll 7KB
-
apt/SysWOW64/Dism/en-US/DismProv.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/en-US/FolderProvider.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/en-US/IBSProvider.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/en-US/LogProvider.dll.mui.dll 6KB
-
apt/SysWOW64/Dism/en-US/MsiProvider.dll.mui.dll 15KB
-
apt/SysWOW64/Dism/en-US/SetupPlatformProvider.dll.mui.dll 5KB
-
apt/SysWOW64/Dism/en-US/SysprepProvider.dll.mui.dll 3KB
-
apt/SysWOW64/Dism/en-US/TransmogProvider.dll.mui.dll 16KB
-
apt/SysWOW64/Dism/ru-RU/AppxProvider.dll.mui.dll 24KB
-
apt/SysWOW64/Dism/ru-RU/AssocProvider.dll.mui.dll 8KB
-
apt/SysWOW64/Dism/ru-RU/CbsProvider.dll.mui.dll 55KB
-
apt/SysWOW64/Dism/ru-RU/DismCore.dll.mui.dll 7KB
-
apt/SysWOW64/Dism/ru-RU/DismProv.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/ru-RU/DmiProvider.dll.mui.dll 18KB
-
apt/SysWOW64/Dism/ru-RU/FfuProvider.dll.mui.dll 9KB
-
apt/SysWOW64/Dism/ru-RU/FolderProvider.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/ru-RU/GenericProvider.dll.mui.dll 5KB
-
apt/SysWOW64/Dism/ru-RU/ImagingProvider.dll.mui.dll 19KB
-
apt/SysWOW64/Dism/ru-RU/IntlProvider.dll.mui.dll 30KB
-
apt/SysWOW64/Dism/ru-RU/LogProvider.dll.mui.dll 6KB
-
apt/SysWOW64/Dism/ru-RU/MsiProvider.dll.mui.dll 16KB
-
apt/SysWOW64/Dism/ru-RU/OSProvider.dll.mui.dll 3KB
-
apt/SysWOW64/Dism/ru-RU/OfflineSetupProvider.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/ru-RU/ProvProvider.dll.mui.dll 4KB
-
apt/SysWOW64/Dism/ru-RU/SetupPlatformProvider.dll.mui.dll 5KB
-
apt/SysWOW64/Dism/ru-RU/SmiProvider.dll.mui.dll 2KB
-
apt/SysWOW64/Dism/ru-RU/TransmogProvider.dll.mui.dll 16KB
-
apt/SysWOW64/Dism/ru-RU/UnattendProvider.dll.mui.dll 5KB
-
apt/SysWOW64/Dism/ru-RU/VhdProvider.dll.mui.dll 8KB
-
apt/SysWOW64/Dism/ru-RU/WimProvider.dll.mui.dll 29KB
-
apt/SysWOW64/DriverStore/en-US/prnms003.inf_loc176B
-
apt/SysWOW64/DriverStore/ru-RU/ntprint.inf_loc140B
-
apt/SysWOW64/DxpTaskSync.dll.mun.dll 1.1MB
-
apt/SysWOW64/ETWCoreUIComponentsResources.dll.mun.dll 151KB
-
apt/SysWOW64/EapTeapExt.dll.mun.dll 2KB
-
apt/SysWOW64/EaseOfAccessDialog.exe.mun.dll 205KB
-
apt/SysWOW64/ExplorerFrame.dll.mun.dll 1.2MB
-
apt/SysWOW64/F12/DiagnosticsHub.DataWarehouse.dll.dll 458KB
-
apt/SysWOW64/F12/DiagnosticsHub.ScriptedSandboxPlugin.dll.dll 119KB
-
apt/SysWOW64/F12/DiagnosticsHub_is.dll.dll 48KB
-
apt/SysWOW64/F12/DiagnosticsTap.dll.dll 176KB
-
apt/SysWOW64/F12/F12App.dll.dll 110KB
-
apt/SysWOW64/F12/F12AppFrame.dll.dll 254KB
-
apt/SysWOW64/F12/F12AppFrame2.dll.dll 268KB
-
apt/SysWOW64/F12/F12Platform.dll.dll 555KB
-
apt/SysWOW64/F12/F12Platform2.dll.dll 377KB
-
apt/SysWOW64/F12/F12Script.dll.dll 7.0MB
-
apt/SysWOW64/F12/F12Tab.dll.dll 170KB
-
apt/SysWOW64/F12/IEChooser.exe.exe 157KB
-
apt/SysWOW64/F12/MemoryAnalyzer.dll.dll 1.7MB
-
apt/SysWOW64/F12/Timeline.cpu.xml.xml 2KB
-
apt/SysWOW64/F12/Timeline.dll.dll 207KB
-
apt/SysWOW64/F12/Timeline_is.dll.dll 131KB
-
apt/SysWOW64/F12/msdbg2.dll.dll 294KB
-
apt/SysWOW64/F12/pdm.dll.dll 481KB
-
apt/SysWOW64/F12/pdmproxy100.dll.dll 97KB
-
apt/SysWOW64/F12/ru-RU/F12Platform.dll.mui.dll 2KB
-
apt/SysWOW64/F12/ru-RU/F12Platform2.dll.mui.dll 2KB
-
apt/SysWOW64/F12/ru-RU/F12Script.dll.mui.dll 90KB
-
apt/SysWOW64/F12/ru-RU/IEChooser.exe.mui.dll 3KB
-
apt/SysWOW64/FirewallControlPanel.dll.mun.dll 591KB
-
apt/SysWOW64/LaunchTM.exe.mun.dll 171KB
-
apt/SysWOW64/Licenses/neutral/OEM/Professional/de-license.rtf.rtf 113KB
-
apt/SysWOW64/Licenses/neutral/OEM/Professional/license.rtf.rtf 113KB
-
apt/SysWOW64/Licenses/neutral/Volume/Professional/license.rtf.rtf 539B
-
apt/SysWOW64/Licenses/neutral/_Default/Professional/de-license.rtf.rtf 113KB
-
apt/SysWOW64/Licenses/neutral/_Default/Professional/license.rtf.rtf 113KB
-
apt/SysWOW64/Magnify.exe.mun.dll 112KB
-
apt/SysWOW64/NPSMDesktopProvider.dll.mun.dll 654KB
-
apt/SysWOW64/Nui/FaceAnalysisColor.mdl3.7MB
-
apt/SysWOW64/PortableDeviceStatus.dll.mun.dll 361KB
-
apt/SysWOW64/SearchIndexer.exe.mun.dll 191KB
-
apt/SysWOW64/SensorsCpl.dll.mun.dll 1.3MB
-
apt/SysWOW64/SndVolSSO.dll.mun.dll 574KB
-
apt/SysWOW64/SrpUxNativeSnapIn.dll.mun.dll 268KB
-
apt/SysWOW64/SyncCenter.dll.mun.dll 2.8MB
-
apt/SysWOW64/Taskmgr.exe.mun.dll 366KB
-
apt/SysWOW64/TtlsExt.dll.mun.dll 22KB
-
apt/SysWOW64/VAN.dll.mun.dll 214KB
-
apt/SysWOW64/Vault.dll.mun.dll 418KB
-
apt/SysWOW64/Windows.Data.Pdf.dll.mun.dll 581KB
-
apt/SysWOW64/Windows.UI.Immersive.dll.mun.dll 605KB
-
apt/SysWOW64/Winlangdb.dll.mun.dll 226KB
-
apt/SysWOW64/WlanMM.dll.mun.dll 334KB
-
apt/SysWOW64/aadWamExtension.dll.dll 148KB
-
apt/SysWOW64/aadauthhelper.dll.dll 334KB
-
apt/SysWOW64/aadtb.dll.dll 1.2MB
-
apt/SysWOW64/accessibilitycpl.dll.dll 218KB
-
apt/SysWOW64/accessibilitycpl.dll.mun.dll 3.4MB
-
apt/SysWOW64/accountaccessor.dll.dll 198KB
-
apt/SysWOW64/acledit.dll.dll 8KB
-
apt/SysWOW64/aclui.dll.dll 431KB
-
apt/SysWOW64/aclui.dll.mun.dll 634KB
-
apt/SysWOW64/acppage.dll.dll 73KB
-
apt/SysWOW64/activeds.dll.dll 212KB
-
apt/SysWOW64/activeds.tlb.dll 109KB
-
apt/SysWOW64/actxprxy.dll.dll 279KB
-
apt/SysWOW64/acwow64.dll.dll 37KB
-
apt/SysWOW64/adprovider.dll.dll 48KB
-
apt/SysWOW64/adrclient.dll.dll 98KB
-
apt/SysWOW64/adsldp.dll.dll 194KB
-
apt/SysWOW64/adsldpc.dll.dll 205KB
-
apt/SysWOW64/adsmsext.dll.dll 82KB
-
apt/SysWOW64/adsnt.dll.dll 281KB
-
apt/SysWOW64/adtschema.dll.dll 849KB
-
apt/SysWOW64/advapi32.dll.dll 495KB
-
apt/SysWOW64/advapi32res.dll.dll 2KB
-
apt/SysWOW64/advpack.dll.dll 118KB
-
apt/SysWOW64/aeevts.dll.dll 30KB
-
apt/SysWOW64/aepic.dll.dll 488KB
-
apt/SysWOW64/agentactivationruntime.dll.dll 656KB
-
apt/SysWOW64/agentactivationruntimewindows.dll.dll 631KB
-
apt/SysWOW64/altspace.dll.dll 159KB
-
apt/SysWOW64/amsi.dll.dll 77KB
-
apt/SysWOW64/amstream.dll.dll 75KB
-
apt/SysWOW64/apds.dll.dll 202KB
-
apt/SysWOW64/apphelp.dll.dll 639KB
-
apt/SysWOW64/appidapi.dll.dll 54KB
-
apt/SysWOW64/appmgmts.dll.dll 157KB
-
apt/SysWOW64/appmgr.dll.dll 396KB
-
apt/SysWOW64/apprepapi.dll.dll 10KB
-
apt/SysWOW64/appwiz.cpl.dll 462KB
-
apt/SysWOW64/appwiz.cpl.mun.dll 381KB
-
apt/SysWOW64/ar-SA/SyncRes.dll.mui.dll 25KB
-
apt/SysWOW64/ar-SA/cdosys.dll.mui.dll 46KB
-
apt/SysWOW64/ar-SA/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/ar-SA/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/ar-SA/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/archiveint.dll.dll 563KB
-
apt/SysWOW64/asferror.dll.dll 2KB
-
apt/SysWOW64/aspnet_counters.dll.dll 23KB
-
apt/SysWOW64/asycfilt.dll.dll 73KB
-
apt/SysWOW64/atl.dll.dll 79KB
-
apt/SysWOW64/atl100.dll.dll 148KB
-
apt/SysWOW64/atl110.dll.dll 151KB
-
apt/SysWOW64/atlthunk.dll.dll 36KB
-
apt/SysWOW64/atmlib.dll.dll 40KB
-
apt/SysWOW64/audiodev.dll.dll 237KB
-
apt/SysWOW64/auditpolcore.dll.dll 57KB
-
apt/SysWOW64/auditpolmsg.dll.dll 93KB
-
apt/SysWOW64/authfwcfg.dll.dll 364KB
-
apt/SysWOW64/authui.dll.dll 182KB
-
apt/SysWOW64/authui.dll.mun.dll 245KB
-
apt/SysWOW64/authz.dll.dll 183KB
-
apt/SysWOW64/autoplay.dll.dll 173KB
-
apt/SysWOW64/avicap32.dll.dll 68KB
-
apt/SysWOW64/avifil32.dll.dll 93KB
-
apt/SysWOW64/avrt.dll.dll 27KB
-
apt/SysWOW64/azman.msc.msc .xml 40KB
-
apt/SysWOW64/azroles.dll.dll .vbs 487KB
-
apt/SysWOW64/azroles.dll.mun.dll .vbs 271KB
-
apt/SysWOW64/azroleui.dll.dll 316KB
-
apt/SysWOW64/basecsp.dll.dll 194KB
-
apt/SysWOW64/batmeter.dll.dll 32KB
-
apt/SysWOW64/batmeter.dll.mun.dll 1.6MB
-
apt/SysWOW64/bcastdvr.proxy.dll.dll 127KB
-
apt/SysWOW64/bcd.dll.dll 105KB
-
apt/SysWOW64/bcrypt.dll.dll 95KB
-
apt/SysWOW64/bcryptprimitives.dll.dll 375KB
-
apt/SysWOW64/bdaplgin.ax.dll 74KB
-
apt/SysWOW64/bg-BG/SyncRes.dll.mui.dll 31KB
-
apt/SysWOW64/bg-BG/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/bg-BG/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/bg-BG/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/bidispl.dll.dll 52KB
-
apt/SysWOW64/bitsperf.dll.dll 26KB
-
apt/SysWOW64/biwinrt.dll.dll 255KB
-
apt/SysWOW64/boot.sdi3.0MB
-
apt/SysWOW64/bopomofo.uce22KB
-
apt/SysWOW64/browcli.dll.dll 42KB
-
apt/SysWOW64/browseui.dll.dll 11KB
-
apt/SysWOW64/bthprops.cpl.dll 216KB
-
apt/SysWOW64/btpanui.dll.dll 111KB
-
apt/SysWOW64/c_GSM7.DLL.dll 12KB
-
apt/SysWOW64/cabapi.dll.dll 75KB
-
apt/SysWOW64/cabinet.dll.dll 117KB
-
apt/SysWOW64/cabview.dll.dll 149KB
-
apt/SysWOW64/capauthz.dll.dll 247KB
-
apt/SysWOW64/capiprovider.dll.dll 52KB
-
apt/SysWOW64/capisp.dll.dll 20KB
-
apt/SysWOW64/catsrv.dll.dll 374KB
-
apt/SysWOW64/catsrvps.dll.dll 23KB
-
apt/SysWOW64/catsrvut.dll.dll 397KB
-
apt/SysWOW64/cca.dll.dll 69KB
-
apt/SysWOW64/cdosys.dll.dll 813KB
-
apt/SysWOW64/cdp.dll.dll 4.2MB
-
apt/SysWOW64/cdprt.dll.dll 1.3MB
-
apt/SysWOW64/cemapi.dll.dll 198KB
-
apt/SysWOW64/cero.rs.dll 34KB
-
apt/SysWOW64/certCredProvider.dll.dll 36KB
-
apt/SysWOW64/certCredProvider.dll.mun.dll 278KB
-
apt/SysWOW64/certca.dll.dll 639KB
-
apt/SysWOW64/certcli.dll.dll 347KB
-
apt/SysWOW64/certenc.dll.dll 53KB
-
apt/SysWOW64/certlm.msc.msc .xml 61KB
-
apt/SysWOW64/certmgr.dll.dll 1.9MB
-
apt/SysWOW64/certmgr.msc.msc .xml 61KB
-
apt/SysWOW64/cewmdm.dll.dll 229KB
-
apt/SysWOW64/cfgbkend.dll.dll 62KB
-
apt/SysWOW64/cfgmgr32.dll.dll 234KB
-
apt/SysWOW64/cfmifs.dll.dll 34KB
-
apt/SysWOW64/cfmifsproxy.dll.dll 11KB
-
apt/SysWOW64/chartv.dll.dll 103KB
-
apt/SysWOW64/chs_singlechar_pinyin.dat163KB
-
apt/SysWOW64/cic.dll.dll 158KB
-
apt/SysWOW64/clb.dll.dll 14KB
-
apt/SysWOW64/clbcatq.dll.dll 493KB
-
apt/SysWOW64/cldapi.dll.dll 97KB
-
apt/SysWOW64/clfsw32.dll.dll 65KB
-
apt/SysWOW64/cliconfg.dll.dll 76KB
-
apt/SysWOW64/cliconfg.rll.dll 36KB
-
apt/SysWOW64/clrhost.dll.dll 13KB
-
apt/SysWOW64/clusapi.dll.dll 803KB
-
apt/SysWOW64/cmcfg32.dll.dll 31KB
-
apt/SysWOW64/cmdext.dll.dll 20KB
-
apt/SysWOW64/cmdial32.dll.dll 479KB
-
apt/SysWOW64/cmgrcspps.dll.dll 29KB
-
apt/SysWOW64/cmifw.dll.dll 85KB
-
apt/SysWOW64/cmintegrator.dll.dll 29KB
-
apt/SysWOW64/cmlua.dll.dll 34KB
-
apt/SysWOW64/cmpbk32.dll.dll 23KB
-
apt/SysWOW64/cmstplua.dll.dll 16KB
-
apt/SysWOW64/cmutil.dll.dll 44KB
-
apt/SysWOW64/cngcredui.dll.dll 102KB
-
apt/SysWOW64/cngprovider.dll.dll 54KB
-
apt/SysWOW64/cnvfat.dll.dll 33KB
-
apt/SysWOW64/cob-au.rs.dll 30KB
-
apt/SysWOW64/colbact.dll.dll 66KB
-
apt/SysWOW64/coloradapterclient.dll.dll 46KB
-
apt/SysWOW64/colorui.dll.dll 69KB
-
apt/SysWOW64/colorui.dll.mun.dll 520KB
-
apt/SysWOW64/combase.dll.dll 2.5MB
-
apt/SysWOW64/comcat.dll.dll 8KB
-
apt/SysWOW64/comctl32.dll.dll 555KB
-
apt/SysWOW64/comdlg32.dll.dll 670KB
-
apt/SysWOW64/comdlg32.dll.mun.dll 344KB
-
apt/SysWOW64/compstui.dll.mun.dll 189KB
-
apt/SysWOW64/comres.dll.mun.dll 1.2MB
-
apt/SysWOW64/connect.dll.mun.dll 1.0MB
-
apt/SysWOW64/crypt32.dll.mun.dll 802KB
-
apt/SysWOW64/cryptui.dll.mun.dll 307KB
-
apt/SysWOW64/cryptuiwizard.dll.mun.dll 257KB
-
apt/SysWOW64/cs-CZ/APHostRes.dll.mui.dll 15KB
-
apt/SysWOW64/cs-CZ/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/cs-CZ/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/cs-CZ/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/cs-CZ/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/cs-CZ/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/cttune.exe.mun.dll 236KB
-
apt/SysWOW64/da-DK/APHostRes.dll.mui.dll 16KB
-
apt/SysWOW64/da-DK/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/da-DK/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/da-DK/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/da-DK/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/da-DK/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/dccw.exe.mun.dll 549KB
-
apt/SysWOW64/de-DE/APHostRes.dll.mui.dll 18KB
-
apt/SysWOW64/de-DE/SyncRes.dll.mui.dll 33KB
-
apt/SysWOW64/de-DE/cdosys.dll.mui.dll 51KB
-
apt/SysWOW64/de-DE/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/de-DE/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/de-DE/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/dfrgui.exe.mun.dll 462KB
-
apt/SysWOW64/directml.dll.mun.dll 4.1MB
-
apt/SysWOW64/dmdskres.dll.mun.dll 1.0MB
-
apt/SysWOW64/downlevel/API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Core-Kernel32-Private-L1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/API-MS-Win-Core-Kernel32-Private-L1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-EventLog-Legacy-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Controller-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Legacy-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Provider-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Security-Lsalookup-L2-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-Security-Lsalookup-L2-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-file-l2-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-file-l2-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-localization-obsolete-l1-2-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-string-l2-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-string-obsolete-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-core-xstate-l2-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/API-MS-Win-devices-config-L1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/API-MS-Win-devices-config-L1-1-1.dll.dll 12KB
-
apt/SysWOW64/downlevel/API-MS-Win-security-lsapolicy-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/API-MS-Win-security-provider-L1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-base-util-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-com-l1-1-0.dll.dll 14KB
-
apt/SysWOW64/downlevel/api-ms-win-core-comm-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-console-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-datetime-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-datetime-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-debug-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-debug-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-delayload-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-errorhandling-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-errorhandling-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-fibers-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-fibers-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-1-0.dll.dll 14KB
-
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-2-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-2-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-handle-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-heap-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-interlocked-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-io-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-io-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-kernel32-legacy-l1-1-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-core-kernel32-legacy-l1-1-1.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-libraryloader-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-libraryloader-l1-1-1.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-localization-l1-2-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-core-localization-l1-2-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-1.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-2.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-namedpipe-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-privateprofile-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-privateprofile-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processenvironment-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processenvironment-l1-2-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-1.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-2.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-processtopology-obsolete-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-profile-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-realtime-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-registry-l1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-core-registry-l2-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-core-rtlsupport-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-shlwapi-legacy-l1-1-0.dll.dll 15KB
-
apt/SysWOW64/downlevel/api-ms-win-core-shlwapi-obsolete-l1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-core-shutdown-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-string-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-stringansi-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-stringloader-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-synch-l1-1-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-core-synch-l1-2-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-2-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-2-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-l1-2-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-legacy-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-private-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-timezone-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-url-l1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-core-util-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-version-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-core-wow64-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-core-xstate-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-conio-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-convert-l1-1-0.dll.dll 14KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-environment-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-filesystem-l1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-heap-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-locale-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-math-l1-1-0.dll.dll 21KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-multibyte-l1-1-0.dll.dll 18KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-private-l1-1-0.dll.dll 64KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-process-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-runtime-l1-1-0.dll.dll 15KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-stdio-l1-1-0.dll.dll 16KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-string-l1-1-0.dll.dll 17KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-time-l1-1-0.dll.dll 13KB
-
apt/SysWOW64/downlevel/api-ms-win-crt-utility-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-eventing-consumer-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-security-base-l1-1-0.dll.dll 16KB
-
apt/SysWOW64/downlevel/api-ms-win-security-cryptoapi-l1-1-0.dll.dll 12KB
-
apt/SysWOW64/downlevel/api-ms-win-security-sddl-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-service-core-l1-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-service-core-l1-1-1.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-service-management-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-service-management-l2-1-0.dll.dll 10KB
-
apt/SysWOW64/downlevel/api-ms-win-service-private-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-service-private-l1-1-1.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-service-winsvc-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/api-ms-win-shcore-stream-l1-1-0.dll.dll 11KB
-
apt/SysWOW64/downlevel/ucrtbase.dll.dll 1.1MB
-
apt/SysWOW64/drivers/afunix.sys.sys 30KB
-
apt/SysWOW64/drivers/en-US/wfplwfs.sys.mui.dll 3KB
-
apt/SysWOW64/drivers/gm.dls3.3MB
-
apt/SysWOW64/drivers/gmreadme.txt646B
-
apt/SysWOW64/drivers/ru-RU/NdisImPlatform.sys.mui.dll 14KB
-
apt/SysWOW64/drivers/ru-RU/ndiscap.sys.mui.dll 7KB
-
apt/SysWOW64/drivers/ru-RU/wfplwfs.sys.mui.dll 3KB
-
apt/SysWOW64/dsquery.dll.mun.dll 262KB
-
apt/SysWOW64/dsuiext.dll.mun.dll 589KB
-
apt/SysWOW64/dwmcore.dll.mun.dll 171KB
-
apt/SysWOW64/edgehtml.dll.mun.dll 781KB
-
apt/SysWOW64/edputil.dll.mun.dll 140KB
-
apt/SysWOW64/el-GR/APHostRes.dll.mui.dll 17KB
-
apt/SysWOW64/el-GR/SyncRes.dll.mui.dll 34KB
-
apt/SysWOW64/el-GR/cdosys.dll.mui.dll 51KB
-
apt/SysWOW64/el-GR/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/el-GR/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/el-GR/windows.ui.xaml.dll.mui.dll 19KB
-
apt/SysWOW64/en-GB/SyncRes.dll.mui.dll 28KB
-
apt/SysWOW64/en-GB/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/en-GB/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/en-GB/windows.ui.xaml.dll.mui.dll 15KB
-
apt/SysWOW64/en-US/APHostRes.dll.mui.dll 14KB
-
apt/SysWOW64/en-US/AccountAccessor.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/AccountsRT.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/ActiveSyncProvider.dll.mui.dll 35KB
-
apt/SysWOW64/en-US/AzureSettingSyncProvider.dll.mui.dll 5KB
-
apt/SysWOW64/en-US/DavSyncProvider.dll.mui.dll 11KB
-
apt/SysWOW64/en-US/DevicePairingProxy.dll.mui.dll 2KB
-
apt/SysWOW64/en-US/DeviceUxRes.dll.mui.dll 6KB
-
apt/SysWOW64/en-US/DismApi.dll.mui.dll 4KB
-
apt/SysWOW64/en-US/ETWCoreUIComponentsResources.dll.mui.dll 105KB
-
apt/SysWOW64/en-US/MCCSEngineShared.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/MessagingDataModel2.dll.mui.dll 2KB
-
apt/SysWOW64/en-US/MsCtfMonitor.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/NetworkHelper.dll.mui.dll 7KB
-
apt/SysWOW64/en-US/Ninput.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/PackageStateRoaming.dll.mui.dll 23KB
-
apt/SysWOW64/en-US/PeerDistSh.dll.mui.dll 43KB
-
apt/SysWOW64/en-US/RMActivate.exe.mui.dll 2KB
-
apt/SysWOW64/en-US/RMActivate_isv.exe.mui.dll 2KB
-
apt/SysWOW64/en-US/RMActivate_ssp.exe.mui.dll 2KB
-
apt/SysWOW64/en-US/RMActivate_ssp_isv.exe.mui.dll 3KB
-
apt/SysWOW64/en-US/RemoveDeviceElevated.dll.mui.dll 2KB
-
apt/SysWOW64/en-US/SyncController.dll.mui.dll 13KB
-
apt/SysWOW64/en-US/SyncRes.dll.mui.dll 28KB
-
apt/SysWOW64/en-US/SyncUtil.dll.mui.dll 5KB
-
apt/SysWOW64/en-US/WWAApi.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/Windows.Gaming.Input.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/Windows.Graphics.Printing.3D.dll.mui.dll 7KB
-
apt/SysWOW64/en-US/Windows.Networking.Proximity.dll.mui.dll 7KB
-
apt/SysWOW64/en-US/Windows.Storage.ApplicationData.dll.mui.dll 8KB
-
apt/SysWOW64/en-US/Windows.UI.Input.Inking.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/Winrs.exe.mui.dll 18KB
-
apt/SysWOW64/en-US/Wisp.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/adrclient.dll.mui.dll 4KB
-
apt/SysWOW64/en-US/adsmsext.dll.mui.dll 2KB
-
apt/SysWOW64/en-US/apphelp.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/at.exe.mui.dll 8KB
-
apt/SysWOW64/en-US/bootcfg.exe.mui.dll 86KB
-
apt/SysWOW64/en-US/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/en-US/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/en-US/dabapi.dll.mui.dll 2KB
-
apt/SysWOW64/en-US/dot3cfg.dll.mui.dll 32KB
-
apt/SysWOW64/en-US/fwpuclnt.dll.mui.dll 145KB
-
apt/SysWOW64/en-US/gpapi.dll.mui.dll 4KB
-
apt/SysWOW64/en-US/gpsvc.dll.mui.dll 49KB
-
apt/SysWOW64/en-US/ifmon.dll.mui.dll 65KB
-
apt/SysWOW64/en-US/mi.dll.mui.dll 6KB
-
apt/SysWOW64/en-US/mibincodec.dll.mui.dll 20KB
-
apt/SysWOW64/en-US/msacm32.drv.mui.dll 2KB
-
apt/SysWOW64/en-US/msscript.ocx.mui.dll 5KB
-
apt/SysWOW64/en-US/neth.dll.mui.dll 70KB
-
apt/SysWOW64/en-US/netsh.exe.mui.dll 18KB
-
apt/SysWOW64/en-US/nshwfp.dll.mui.dll 61KB
-
apt/SysWOW64/en-US/osbaseln.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/p2pnetsh.dll.mui.dll 38KB
-
apt/SysWOW64/en-US/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/en-US/reg.exe.mui.dll 38KB
-
apt/SysWOW64/en-US/register-cimprovider.exe.mui.dll 9KB
-
apt/SysWOW64/en-US/rpcnsh.dll.mui.dll 15KB
-
apt/SysWOW64/en-US/rpcping.exe.mui.dll 41KB
-
apt/SysWOW64/en-US/rtutils.dll.mui.dll 3KB
-
apt/SysWOW64/en-US/sc.exe.mui.dll 72KB
-
apt/SysWOW64/en-US/schtasks.exe.mui.dll 75KB
-
apt/SysWOW64/en-US/shellstyle.dll.mui.dll 29KB
-
apt/SysWOW64/en-US/shutdown.exe.mui.dll 10KB
-
apt/SysWOW64/en-US/srm.dll.mui.dll 144KB
-
apt/SysWOW64/en-US/srmshell.dll.mui.dll 7KB
-
apt/SysWOW64/en-US/sxs.dll.mui.dll 25KB
-
apt/SysWOW64/en-US/sxstrace.exe.mui.dll 15KB
-
apt/SysWOW64/en-US/systeminfo.exe.mui.dll 13KB
-
apt/SysWOW64/en-US/taskkill.exe.mui.dll 16KB
-
apt/SysWOW64/en-US/tasklist.exe.mui.dll 15KB
-
apt/SysWOW64/en-US/taskschd.dll.mui.dll 7KB
-
apt/SysWOW64/en-US/termmgr.dll.mui.dll 4KB
-
apt/SysWOW64/en-US/user32.dll.mui.dll 17KB
-
apt/SysWOW64/en-US/wecsvc.dll.mui.dll 6KB
-
apt/SysWOW64/en-US/wecutil.exe.mui.dll 48KB
-
apt/SysWOW64/en-US/windows.ui.xaml.dll.mui.dll 15KB
-
apt/SysWOW64/en-US/winsrv.dll.mui.dll 5KB
-
apt/SysWOW64/es-ES/APHostRes.dll.mui.dll 17KB
-
apt/SysWOW64/es-ES/SyncRes.dll.mui.dll 31KB
-
apt/SysWOW64/es-ES/cdosys.dll.mui.dll 50KB
-
apt/SysWOW64/es-ES/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/es-ES/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/es-ES/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/es-MX/SyncRes.dll.mui.dll 31KB
-
apt/SysWOW64/es-MX/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/es-MX/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/es-MX/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/et-EE/SyncRes.dll.mui.dll 27KB
-
apt/SysWOW64/et-EE/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/et-EE/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/et-EE/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/fdprint.dll.mun.dll 105KB
-
apt/SysWOW64/fi-FI/APHostRes.dll.mui.dll 16KB
-
apt/SysWOW64/fi-FI/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/fi-FI/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/fi-FI/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/fi-FI/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/fi-FI/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/filemgmt.dll.mun.dll 173KB
-
apt/SysWOW64/fr-CA/SyncRes.dll.mui.dll 33KB
-
apt/SysWOW64/fr-CA/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/fr-CA/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/fr-CA/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/fr-FR/APHostRes.dll.mui.dll 18KB
-
apt/SysWOW64/fr-FR/SyncRes.dll.mui.dll 33KB
-
apt/SysWOW64/fr-FR/cdosys.dll.mui.dll 51KB
-
apt/SysWOW64/fr-FR/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/fr-FR/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/fr-FR/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/gpedit.dll.mun.dll 518KB
-
apt/SysWOW64/he-IL/SyncRes.dll.mui.dll 23KB
-
apt/SysWOW64/he-IL/cdosys.dll.mui.dll 45KB
-
apt/SysWOW64/he-IL/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/he-IL/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/he-IL/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/hr-HR/SyncRes.dll.mui.dll 28KB
-
apt/SysWOW64/hr-HR/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/hr-HR/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/hr-HR/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/hu-HU/APHostRes.dll.mui.dll 17KB
-
apt/SysWOW64/hu-HU/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/hu-HU/cdosys.dll.mui.dll 48KB
-
apt/SysWOW64/hu-HU/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/hu-HU/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/hu-HU/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/icsigd.dll.mun.dll 127KB
-
apt/SysWOW64/icsxml/cmnicfg.xml.xml 5KB
-
apt/SysWOW64/icsxml/ipcfg.xml.xml 13KB
-
apt/SysWOW64/icsxml/osinfo.xml.xml 780B
-
apt/SysWOW64/icsxml/potscfg.xml.xml 2KB
-
apt/SysWOW64/icsxml/pppcfg.xml.xml 14KB
-
apt/SysWOW64/ieapfltr.dll.mun.dll 692KB
-
apt/SysWOW64/ieframe.dll.mun.dll 5.5MB
-
apt/SysWOW64/imageres.dll.mun.dll 19.8MB
-
apt/SysWOW64/imagesp1.dll.mun.dll 678KB
-
apt/SysWOW64/inetcpl.cpl.mun.dll 1.5MB
-
apt/SysWOW64/intl.cpl.mun.dll 257KB
-
apt/SysWOW64/ipsecsnp.dll.mun.dll 422KB
-
apt/SysWOW64/iscsicli.exe.mun.dll 105KB
-
apt/SysWOW64/iscsicpl.dll.mun.dll 129KB
-
apt/SysWOW64/iscsicpl.exe.mun.dll 110KB
-
apt/SysWOW64/it-IT/APHostRes.dll.mui.dll 17KB
-
apt/SysWOW64/it-IT/SyncRes.dll.mui.dll 28KB
-
apt/SysWOW64/it-IT/cdosys.dll.mui.dll 52KB
-
apt/SysWOW64/it-IT/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/it-IT/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/it-IT/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/ja-JP/APHostRes.dll.mui.dll 11KB
-
apt/SysWOW64/ja-JP/SyncRes.dll.mui.dll 17KB
-
apt/SysWOW64/ja-JP/cdosys.dll.mui.dll 38KB
-
apt/SysWOW64/ja-JP/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/ja-JP/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/ja-JP/windows.ui.xaml.dll.mui.dll 13KB
-
apt/SysWOW64/keymgr.dll.mun.dll 110KB
-
apt/SysWOW64/ko-KR/APHostRes.dll.mui.dll 10KB
-
apt/SysWOW64/ko-KR/SyncRes.dll.mui.dll 17KB
-
apt/SysWOW64/ko-KR/cdosys.dll.mui.dll 42KB
-
apt/SysWOW64/ko-KR/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/ko-KR/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/ko-KR/windows.ui.xaml.dll.mui.dll 12KB
-
apt/SysWOW64/lt-LT/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/lt-LT/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/lt-LT/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/lt-LT/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/lv-LV/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/lv-LV/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/lv-LV/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/lv-LV/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/main.cpl.mun.dll 563KB
-
apt/SysWOW64/mdminst.dll.mun.dll 100KB
-
apt/SysWOW64/mfplat.dll.mun.dll 124KB
-
apt/SysWOW64/mmcbase.dll.mun.dll 162KB
-
apt/SysWOW64/mmcndmgr.dll.mun.dll 599KB
-
apt/SysWOW64/mmres.dll.mun.dll 9.1MB
-
apt/SysWOW64/mmsys.cpl.mun.dll 414KB
-
apt/SysWOW64/moricons.dll.mun.dll 181KB
-
apt/SysWOW64/msctf.dll.mun.dll 264KB
-
apt/SysWOW64/msdt.exe.mun.dll 1.1MB
-
apt/SysWOW64/mshtml.dll.mun.dll 768KB
-
apt/SysWOW64/mspaint.exe.mun.dll 2.4MB
-
apt/SysWOW64/mssvp.dll.mun.dll 419KB
-
apt/SysWOW64/mstask.dll.mun.dll 107KB
-
apt/SysWOW64/mstsc.exe.mun.dll 2.0MB
-
apt/SysWOW64/mstscax.dll.mun.dll 891KB
-
apt/SysWOW64/msutb.dll.mun.dll 218KB
-
apt/SysWOW64/msxml3.dll.mun.dll 173KB
-
apt/SysWOW64/mycomput.dll.mun.dll 135KB
-
apt/SysWOW64/mydocs.dll.mun.dll 112KB
-
apt/SysWOW64/nb-NO/APHostRes.dll.mui.dll 15KB
-
apt/SysWOW64/nb-NO/SyncRes.dll.mui.dll 28KB
-
apt/SysWOW64/nb-NO/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/nb-NO/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/nb-NO/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/nb-NO/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/netcenter.dll.mun.dll 987KB
-
apt/SysWOW64/netshell.dll.mun.dll 2.2MB
-
apt/SysWOW64/networkexplorer.dll.mun.dll 1.1MB
-
apt/SysWOW64/newdev.dll.mun.dll 310KB
-
apt/SysWOW64/nl-NL/APHostRes.dll.mui.dll 16KB
-
apt/SysWOW64/nl-NL/SyncRes.dll.mui.dll 31KB
-
apt/SysWOW64/nl-NL/cdosys.dll.mui.dll 48KB
-
apt/SysWOW64/nl-NL/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/nl-NL/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/nl-NL/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/notepad.exe.mun.dll 103KB
-
apt/SysWOW64/ntshrui.dll.mun.dll 291KB
-
apt/SysWOW64/onexui.dll.mun.dll 951KB
-
apt/SysWOW64/pl-PL/APHostRes.dll.mui.dll 17KB
-
apt/SysWOW64/pl-PL/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/pl-PL/cdosys.dll.mui.dll 48KB
-
apt/SysWOW64/pl-PL/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/pl-PL/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/pl-PL/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/powercpl.dll.mun.dll 292KB
-
apt/SysWOW64/printui.dll.mun.dll 508KB
-
apt/SysWOW64/prnfldr.dll.mun.dll 246KB
-
apt/SysWOW64/propsys.dll.mun.dll 753KB
-
apt/SysWOW64/psr.exe.mun.dll 366KB
-
apt/SysWOW64/pt-BR/APHostRes.dll.mui.dll 16KB
-
apt/SysWOW64/pt-BR/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/pt-BR/cdosys.dll.mui.dll 48KB
-
apt/SysWOW64/pt-BR/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/pt-BR/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/pt-BR/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/pt-PT/APHostRes.dll.mui.dll 16KB
-
apt/SysWOW64/pt-PT/SyncRes.dll.mui.dll 31KB
-
apt/SysWOW64/pt-PT/cdosys.dll.mui.dll 48KB
-
apt/SysWOW64/pt-PT/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/pt-PT/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/pt-PT/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/qedwipes.dll.mun.dll 716KB
-
apt/SysWOW64/ras/cis.scp735B
-
apt/SysWOW64/ras/pad.inf14KB
-
apt/SysWOW64/ras/pppmenu.scp.vbs 2KB
-
apt/SysWOW64/ras/switch.inf6KB
-
apt/SysWOW64/raschapext.dll.mun.dll 181KB
-
apt/SysWOW64/rasdlg.dll.mun.dll 365KB
-
apt/SysWOW64/rasgcw.dll.mun.dll 411KB
-
apt/SysWOW64/rasplap.dll.mun.dll 259KB
-
apt/SysWOW64/rastls.dll.mun.dll 144KB
-
apt/SysWOW64/rastlsext.dll.mun.dll 152KB
-
apt/SysWOW64/remotepg.dll.mun.dll 117KB
-
apt/SysWOW64/ro-RO/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/ro-RO/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/ro-RO/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/ro-RO/windows.ui.xaml.dll.mui.dll 17KB
-
apt/SysWOW64/sethc.exe.mun.dll 202KB
-
apt/SysWOW64/setup/RasMigPlugin.dll.dll 453KB
-
apt/SysWOW64/setup/cmmigr.dll.dll 55KB
-
apt/SysWOW64/setup/comsetup.dll.dll 199KB
-
apt/SysWOW64/setup/msdtcstp.dll.dll 90KB
-
apt/SysWOW64/setup/pbkmigr.dll.dll 56KB
-
apt/SysWOW64/setup/tssysprep.dll.dll 43KB
-
apt/SysWOW64/shell32.dll.mun.dll 13.7MB
-
apt/SysWOW64/shrpubw.exe.mun.dll 341KB
-
apt/SysWOW64/shsvcs.dll.mun.dll 363KB
-
apt/SysWOW64/sk-SK/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/sk-SK/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/sk-SK/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/sk-SK/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/sl-SI/SyncRes.dll.mui.dll 30KB
-
apt/SysWOW64/sl-SI/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/sl-SI/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/sl-SI/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/spp/tokens/legacy/client-issuance-rac.xrm-ms7KB
-
apt/SysWOW64/spp/tokens/legacy/client-issuance-spc.xrm-ms5KB
-
apt/SysWOW64/spp/tokens/legacy/rac-generic-private.xrm-ms4KB
-
apt/SysWOW64/spp/tokens/legacy/rac-generic-public.xrm-ms3KB
-
apt/SysWOW64/spp/tokens/legacy/spc-generic-private.xrm-ms5KB
-
apt/SysWOW64/spp/tokens/legacy/spc-generic-public.xrm-ms2KB
-
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig-csvlk.xrm-ms17KB
-
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig-downlevel.xrm-ms741KB
-
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig.xrm-ms665KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/DefaultPpd-csvlk-pack-ppdlic.xrm-ms46KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-oob-rtm.xrm-ms12KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-store-rtm.xrm-ms10KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-phn-rtm.xrm-ms19KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-store-rtm.xrm-ms9KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-oob-rtm.xrm-ms12KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-store-rtm.xrm-ms10KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-oob-rtm.xrm-ms12KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-store-rtm.xrm-ms10KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-phn-rtm.xrm-ms19KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-store-rtm.xrm-ms9KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-store-rtm.xrm-ms9KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-store-rtm.xrm-ms9KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-store-rtm.xrm-ms10KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-store-rtm.xrm-ms9KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-pl-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-oob-rtm.xrm-ms11KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-phn-rtm.xrm-ms20KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-store-rtm.xrm-ms10KB
-
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-ppdlic.xrm-ms5KB
-
apt/SysWOW64/sppcomapi.dll.mun.dll 100KB
-
apt/SysWOW64/sppui/phone.inf23KB
-
apt/SysWOW64/sr-Latn-RS/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/sr-Latn-RS/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/sr-Latn-RS/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/sr-Latn-RS/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/srchadmin.dll.mun.dll 164KB
-
apt/SysWOW64/stobject.dll.mun.dll 129KB
-
apt/SysWOW64/sud.dll.mun.dll 493KB
-
apt/SysWOW64/sv-SE/APHostRes.dll.mui.dll 14KB
-
apt/SysWOW64/sv-SE/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/sv-SE/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/sv-SE/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/sv-SE/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/sv-SE/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/sysdm.cpl.mun.dll 199KB
-
apt/SysWOW64/sysmon.ocx.mun.dll 98KB
-
apt/SysWOW64/systemcpl.dll.mun.dll 19KB
-
apt/SysWOW64/tapiui.dll.mun.dll 106KB
-
apt/SysWOW64/th-TH/SyncRes.dll.mui.dll 25KB
-
apt/SysWOW64/th-TH/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/th-TH/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/th-TH/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/themecpl.dll.mun.dll 439KB
-
apt/SysWOW64/themeui.dll.mun.dll 2.4MB
-
apt/SysWOW64/timedate.cpl.mun.dll 276KB
-
apt/SysWOW64/tquery.dll.mun.dll 124KB
-
apt/SysWOW64/tr-TR/APHostRes.dll.mui.dll 15KB
-
apt/SysWOW64/tr-TR/SyncRes.dll.mui.dll 27KB
-
apt/SysWOW64/tr-TR/cdosys.dll.mui.dll 47KB
-
apt/SysWOW64/tr-TR/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/tr-TR/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/tr-TR/windows.ui.xaml.dll.mui.dll 16KB
-
apt/SysWOW64/twinui.appcore.dll.mun.dll 163KB
-
apt/SysWOW64/twinui.dll.mun.dll 675KB
-
apt/SysWOW64/uk-UA/SyncRes.dll.mui.dll 29KB
-
apt/SysWOW64/uk-UA/comctl32.dll.mui.dll 6KB
-
apt/SysWOW64/uk-UA/quickassist.exe.mui.dll 4KB
-
apt/SysWOW64/uk-UA/windows.ui.xaml.dll.mui.dll 18KB
-
apt/SysWOW64/usercpl.dll.mun.dll 629KB
-
apt/SysWOW64/wcnwiz.dll.mun.dll 952KB
-
apt/SysWOW64/wdc.dll.mun.dll 690KB
-
apt/SysWOW64/wiadefui.dll.mun.dll 245KB
-
apt/SysWOW64/wiashext.dll.mun.dll 370KB
-
apt/SysWOW64/winrm/0419/winrm.ini104KB
-
apt/SysWOW64/wlangpui.dll.mun.dll 106KB
-
apt/SysWOW64/wpdshext.dll.mun.dll 1.3MB
-
apt/SysWOW64/wscui.cpl.mun.dll 1.1MB
-
apt/SysWOW64/wsecedit.dll.mun.dll 783KB
-
apt/SysWOW64/wuapi.dll.mun.dll 146KB
-
apt/SysWOW64/zh-CN/APHostRes.dll.mui.dll 9KB
-
apt/SysWOW64/zh-CN/SyncRes.dll.mui.dll 13KB
-
apt/SysWOW64/zh-CN/cdosys.dll.mui.dll 40KB
-
apt/SysWOW64/zh-CN/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/zh-CN/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/zh-CN/windows.ui.xaml.dll.mui.dll 11KB
-
apt/SysWOW64/zh-TW/APHostRes.dll.mui.dll 9KB
-
apt/SysWOW64/zh-TW/SyncRes.dll.mui.dll 13KB
-
apt/SysWOW64/zh-TW/cdosys.dll.mui.dll 40KB
-
apt/SysWOW64/zh-TW/comctl32.dll.mui.dll 5KB
-
apt/SysWOW64/zh-TW/quickassist.exe.mui.dll 3KB
-
apt/SysWOW64/zh-TW/windows.ui.xaml.dll.mui.dll 11KB
-
apt/SysWOW64/zipfldr.dll.mun.dll 112KB
-
apt/emacsen-common/docker/containerd/daemon/io.containerd.metadata.v1.bolt/meta.db32KB
-
apt/emacsen-common/docker/image/overlay2/repositories.json19B
-
apt/emacsen-common/docker/volumes/metadata.db32KB
-
apt/extended_states65KB
-
apt/ieee-data/.lastupdate32B
-
apt/ieee-data/iab.csv28B
-
apt/ieee-data/iab.txt28B
-
apt/ieee-data/mam.csv28B
-
apt/ieee-data/mam.txt28B
-
apt/ieee-data/oui.csv28B
-
apt/ieee-data/oui.txt28B
-
apt/ieee-data/oui36.csv30B
-
apt/ieee-data/oui36.txt30B
-
apt/lists/deb.i2p2.no_dists_unstable_InRelease19KB
-
apt/lists/deb.i2p2.no_dists_unstable_main_binary-amd64_Packages9KB
-
apt/lists/http.kali.org_kali_dists_kali-rolling_InRelease29KB
-
apt/lists/http.kali.org_kali_dists_kali-rolling_contrib_binary-amd64_Packages383KB
-
apt/lists/http.kali.org_kali_dists_kali-rolling_non-free_binary-amd64_Packages895KB
-
apt/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla242B
-
apt/postgresql/13/main/PG_VERSION3B
-
apt/postgresql/13/main/base/1/1128KB
-
apt/postgresql/13/main/base/1/1138KB
-
apt/postgresql/13/main/base/1/124780KB
-
apt/postgresql/13/main/base/1/1247_fsm24KB
-
apt/postgresql/13/main/base/1/1247_vm8KB
-
apt/postgresql/13/main/base/1/1249424KB
-
apt/postgresql/13/main/base/1/1249_fsm24KB
-
apt/postgresql/13/main/base/1/1249_vm8KB
-
apt/postgresql/13/main/base/1/1255648KB
-
apt/postgresql/13/main/base/1/1255_fsm24KB
-
apt/postgresql/13/main/base/1/1255_vm8KB
-
apt/postgresql/13/main/base/1/1259104KB
-
apt/postgresql/13/main/base/1/1259_fsm24KB
-
apt/postgresql/13/main/base/1/1259_vm8KB
-
apt/postgresql/13/main/base/1/1393864KB
-
apt/postgresql/13/main/base/1/13938_fsm24KB
-
apt/postgresql/13/main/base/1/13938_vm8KB
-
apt/postgresql/13/main/base/1/139428KB
-
apt/postgresql/13/main/base/1/139438KB
-
apt/postgresql/13/main/base/1/13943_fsm24KB
-
apt/postgresql/13/main/base/1/13943_vm8KB
-
apt/postgresql/13/main/base/1/139478KB
-
apt/postgresql/13/main/base/1/139488KB
-
apt/postgresql/13/main/base/1/13948_fsm24KB
-
apt/postgresql/13/main/base/1/13948_vm8KB
-
apt/postgresql/13/main/base/1/139528KB
-
apt/postgresql/13/main/base/1/139538KB
-
apt/postgresql/13/main/base/1/13953_fsm24KB
-
apt/postgresql/13/main/base/1/13953_vm8KB
-
apt/postgresql/13/main/base/1/139578KB
-
apt/postgresql/13/main/base/1/1748KB
-
apt/postgresql/13/main/base/1/1758KB
-
apt/postgresql/13/main/base/1/21878KB
-
apt/postgresql/13/main/base/1/23378KB
-
apt/postgresql/13/main/base/1/257916KB
-
apt/postgresql/13/main/base/1/260016KB
-
apt/postgresql/13/main/base/1/2600_fsm24KB
-
apt/postgresql/13/main/base/1/2600_vm8KB
-
apt/postgresql/13/main/base/1/26018KB
-
apt/postgresql/13/main/base/1/2601_fsm24KB
-
apt/postgresql/13/main/base/1/2601_vm8KB
-
apt/postgresql/13/main/base/1/260248KB
-
apt/postgresql/13/main/base/1/2602_fsm24KB
-
apt/postgresql/13/main/base/1/2602_vm8KB
-
apt/postgresql/13/main/base/1/260332KB
-
apt/postgresql/13/main/base/1/2603_fsm24KB
-
apt/postgresql/13/main/base/1/2603_vm8KB
-
apt/postgresql/13/main/base/1/260516KB
-
apt/postgresql/13/main/base/1/2605_fsm24KB
-
apt/postgresql/13/main/base/1/2605_vm8KB
-
apt/postgresql/13/main/base/1/26068KB
-
apt/postgresql/13/main/base/1/2606_fsm24KB
-
apt/postgresql/13/main/base/1/2606_vm8KB
-
apt/postgresql/13/main/base/1/260716KB
-
apt/postgresql/13/main/base/1/2607_fsm24KB
-
apt/postgresql/13/main/base/1/2607_vm8KB
-
apt/postgresql/13/main/base/1/2608456KB
-
apt/postgresql/13/main/base/1/2608_fsm24KB
-
apt/postgresql/13/main/base/1/2608_vm8KB
-
apt/postgresql/13/main/base/1/2609336KB
-
apt/postgresql/13/main/base/1/2609_fsm24KB
-
apt/postgresql/13/main/base/1/2609_vm8KB
-
apt/postgresql/13/main/base/1/261032KB
-
apt/postgresql/13/main/base/1/2610_fsm24KB
-
apt/postgresql/13/main/base/1/2610_vm8KB
-
apt/postgresql/13/main/base/1/26128KB
-
apt/postgresql/13/main/base/1/2612_fsm24KB
-
apt/postgresql/13/main/base/1/2612_vm8KB
-
apt/postgresql/13/main/base/1/26158KB
-
apt/postgresql/13/main/base/1/2615_fsm24KB
-
apt/postgresql/13/main/base/1/2615_vm8KB
-
apt/postgresql/13/main/base/1/261616KB
-
apt/postgresql/13/main/base/1/2616_fsm24KB
-
apt/postgresql/13/main/base/1/2616_vm8KB
-
apt/postgresql/13/main/base/1/2617112KB
-
apt/postgresql/13/main/base/1/2617_fsm24KB
-
apt/postgresql/13/main/base/1/2617_vm8KB
-
apt/postgresql/13/main/base/1/261896KB
-
apt/postgresql/13/main/base/1/2618_fsm24KB
-
apt/postgresql/13/main/base/1/2618_vm8KB
-
apt/postgresql/13/main/base/1/2619144KB
-
apt/postgresql/13/main/base/1/2619_fsm24KB
-
apt/postgresql/13/main/base/1/2619_vm8KB
-
apt/postgresql/13/main/base/1/265016KB
-
apt/postgresql/13/main/base/1/265116KB
-
apt/postgresql/13/main/base/1/265216KB
-
apt/postgresql/13/main/base/1/265340KB
-
apt/postgresql/13/main/base/1/265440KB
-
apt/postgresql/13/main/base/1/265532KB
-
apt/postgresql/13/main/base/1/26568KB
-
apt/postgresql/13/main/base/1/26578KB
-
apt/postgresql/13/main/base/1/2658120KB
-
apt/postgresql/13/main/base/1/265980KB
-
apt/postgresql/13/main/base/1/266016KB
-
apt/postgresql/13/main/base/1/266116KB
-
apt/postgresql/13/main/base/1/266232KB
-
apt/postgresql/13/main/base/1/266348KB
-
apt/postgresql/13/main/base/1/266416KB
-
apt/postgresql/13/main/base/1/266516KB
-
apt/postgresql/13/main/base/1/266616KB
-
apt/postgresql/13/main/base/1/266716KB
-
apt/postgresql/13/main/base/1/266816KB
-
apt/postgresql/13/main/base/1/266916KB
-
apt/postgresql/13/main/base/1/267016KB
-
apt/postgresql/13/main/base/1/2673272KB
-
apt/postgresql/13/main/base/1/2674344KB
-
apt/postgresql/13/main/base/1/2675192KB
-
apt/postgresql/13/main/base/1/267816KB
-
apt/postgresql/13/main/base/1/267916KB
-
apt/postgresql/13/main/base/1/26808KB
-
apt/postgresql/13/main/base/1/268116KB
-
apt/postgresql/13/main/base/1/268216KB
-
apt/postgresql/13/main/base/1/26838KB
-
apt/postgresql/13/main/base/1/268416KB
-
apt/postgresql/13/main/base/1/268516KB
-
apt/postgresql/13/main/base/1/268616KB
-
apt/postgresql/13/main/base/1/268716KB
-
apt/postgresql/13/main/base/1/268840KB
-
apt/postgresql/13/main/base/1/268948KB
-
apt/postgresql/13/main/base/1/269088KB
-
apt/postgresql/13/main/base/1/2691248KB
-
apt/postgresql/13/main/base/1/269216KB
-
apt/postgresql/13/main/base/1/269316KB
-
apt/postgresql/13/main/base/1/269616KB
-
apt/postgresql/13/main/base/1/26998KB
-
apt/postgresql/13/main/base/1/27018KB
-
apt/postgresql/13/main/base/1/27028KB
-
apt/postgresql/13/main/base/1/270332KB
-
apt/postgresql/13/main/base/1/270440KB
-
apt/postgresql/13/main/base/1/275316KB
-
apt/postgresql/13/main/base/1/2753_fsm24KB
-
apt/postgresql/13/main/base/1/2753_vm8KB
-
apt/postgresql/13/main/base/1/275416KB
-
apt/postgresql/13/main/base/1/275516KB
-
apt/postgresql/13/main/base/1/275632KB
-
apt/postgresql/13/main/base/1/275732KB
-
apt/postgresql/13/main/base/1/28318KB
-
apt/postgresql/13/main/base/1/28338KB
-
apt/postgresql/13/main/base/1/28358KB
-
apt/postgresql/13/main/base/1/28378KB
-
apt/postgresql/13/main/base/1/2838480KB
-
apt/postgresql/13/main/base/1/2838_fsm24KB
-
apt/postgresql/13/main/base/1/2838_vm8KB
-
apt/postgresql/13/main/base/1/283916KB
-
apt/postgresql/13/main/base/1/284024KB
-
apt/postgresql/13/main/base/1/2840_fsm24KB
-
apt/postgresql/13/main/base/1/2840_vm8KB
-
apt/postgresql/13/main/base/1/284116KB
-
apt/postgresql/13/main/base/1/29968KB
-
apt/postgresql/13/main/base/1/30798KB
-
apt/postgresql/13/main/base/1/3079_fsm24KB
-
apt/postgresql/13/main/base/1/3079_vm8KB
-
apt/postgresql/13/main/base/1/308016KB
-
apt/postgresql/13/main/base/1/308116KB
-
apt/postgresql/13/main/base/1/308548KB
-
apt/postgresql/13/main/base/1/31198KB
-
apt/postgresql/13/main/base/1/3164104KB
-
apt/postgresql/13/main/base/1/32578KB
-
apt/postgresql/13/main/base/1/32588KB
-
apt/postgresql/13/main/base/1/33518KB
-
apt/postgresql/13/main/base/1/33798KB
-
apt/postgresql/13/main/base/1/33808KB
-
apt/postgresql/13/main/base/1/339416KB
-
apt/postgresql/13/main/base/1/3394_fsm24KB
-
apt/postgresql/13/main/base/1/3394_vm8KB
-
apt/postgresql/13/main/base/1/339516KB
-
apt/postgresql/13/main/base/1/34318KB
-
apt/postgresql/13/main/base/1/34338KB
-
apt/postgresql/13/main/base/1/34408KB
-
apt/postgresql/13/main/base/1/345540KB
-
apt/postgresql/13/main/base/1/3456360KB
-
apt/postgresql/13/main/base/1/3456_fsm24KB
-
apt/postgresql/13/main/base/1/3456_vm8KB
-
apt/postgresql/13/main/base/1/34678KB
-
apt/postgresql/13/main/base/1/34688KB
-
apt/postgresql/13/main/base/1/35028KB
-
apt/postgresql/13/main/base/1/35038KB
-
apt/postgresql/13/main/base/1/35348KB
-
apt/postgresql/13/main/base/1/35418KB
-
apt/postgresql/13/main/base/1/3541_fsm24KB
-
apt/postgresql/13/main/base/1/3541_vm8KB
-
apt/postgresql/13/main/base/1/354216KB
-
apt/postgresql/13/main/base/1/35748KB
-
apt/postgresql/13/main/base/1/35758KB
-
apt/postgresql/13/main/base/1/35978KB
-
apt/postgresql/13/main/base/1/35998KB
-
apt/postgresql/13/main/base/1/36008KB
-
apt/postgresql/13/main/base/1/3600_fsm24KB
-
apt/postgresql/13/main/base/1/3600_vm8KB
-
apt/postgresql/13/main/base/1/36018KB
-
apt/postgresql/13/main/base/1/3601_fsm24KB
-
apt/postgresql/13/main/base/1/3601_vm8KB
-
apt/postgresql/13/main/base/1/36028KB
-
apt/postgresql/13/main/base/1/3602_fsm24KB
-
apt/postgresql/13/main/base/1/3602_vm8KB
-
apt/postgresql/13/main/base/1/360324KB
-
apt/postgresql/13/main/base/1/3603_fsm24KB
-
apt/postgresql/13/main/base/1/3603_vm8KB
-
apt/postgresql/13/main/base/1/360416KB
-
apt/postgresql/13/main/base/1/360516KB
-
apt/postgresql/13/main/base/1/360616KB
-
apt/postgresql/13/main/base/1/360716KB
-
apt/postgresql/13/main/base/1/360816KB
-
apt/postgresql/13/main/base/1/360932KB
-
apt/postgresql/13/main/base/1/371216KB
-
apt/postgresql/13/main/base/1/37648KB
-
apt/postgresql/13/main/base/1/3764_fsm24KB
-
apt/postgresql/13/main/base/1/3764_vm8KB
-
apt/postgresql/13/main/base/1/376616KB
-
apt/postgresql/13/main/base/1/376716KB
-
apt/postgresql/13/main/base/1/39978KB
-
apt/postgresql/13/main/base/1/41448KB
-
apt/postgresql/13/main/base/1/41468KB
-
apt/postgresql/13/main/base/1/41488KB
-
apt/postgresql/13/main/base/1/41508KB
-
apt/postgresql/13/main/base/1/41528KB
-
apt/postgresql/13/main/base/1/41548KB
-
apt/postgresql/13/main/base/1/41568KB
-
apt/postgresql/13/main/base/1/41588KB
-
apt/postgresql/13/main/base/1/41608KB
-
apt/postgresql/13/main/base/1/41628KB
-
apt/postgresql/13/main/base/1/41648KB
-
apt/postgresql/13/main/base/1/41668KB
-
apt/postgresql/13/main/base/1/41688KB
-
apt/postgresql/13/main/base/1/41708KB
-
apt/postgresql/13/main/base/1/41728KB
-
apt/postgresql/13/main/base/1/41748KB
-
apt/postgresql/13/main/base/1/50028KB
-
apt/postgresql/13/main/base/1/5488KB
-
apt/postgresql/13/main/base/1/5498KB
-
apt/postgresql/13/main/base/1/61108KB
-
apt/postgresql/13/main/base/1/61118KB
-
apt/postgresql/13/main/base/1/61128KB
-
apt/postgresql/13/main/base/1/61138KB
-
apt/postgresql/13/main/base/1/61178KB
-
apt/postgresql/13/main/base/1/8278KB
-
apt/postgresql/13/main/base/1/8288KB
-
apt/postgresql/13/main/base/1/PG_VERSION3B
-
apt/postgresql/13/main/base/1/pg_filenode.map512B
-
apt/postgresql/13/main/base/14088/1128KB
-
apt/postgresql/13/main/base/14088/1138KB
-
apt/postgresql/13/main/base/14088/124780KB
-
apt/postgresql/13/main/base/14088/1247_fsm24KB
-
apt/postgresql/13/main/base/14088/1247_vm8KB
-
apt/postgresql/13/main/base/14088/1249424KB
-
apt/postgresql/13/main/base/14088/1249_fsm24KB
-
apt/postgresql/13/main/base/14088/1249_vm8KB
-
apt/postgresql/13/main/base/14088/1255648KB
-
apt/postgresql/13/main/base/14088/1255_fsm24KB
-
apt/postgresql/13/main/base/14088/1255_vm8KB
-
apt/postgresql/13/main/base/14088/1259104KB
-
apt/postgresql/13/main/base/14088/1259_fsm24KB
-
apt/postgresql/13/main/base/14088/1259_vm8KB
-
apt/postgresql/13/main/base/14088/1393864KB
-
apt/postgresql/13/main/base/14088/13938_fsm24KB
-
apt/postgresql/13/main/base/14088/13938_vm8KB
-
apt/postgresql/13/main/base/14088/139428KB
-
apt/postgresql/13/main/base/14088/139438KB
-
apt/postgresql/13/main/base/14088/13943_fsm24KB
-
apt/postgresql/13/main/base/14088/13943_vm8KB
-
apt/postgresql/13/main/base/14088/139478KB
-
apt/postgresql/13/main/base/14088/139488KB
-
apt/postgresql/13/main/base/14088/13948_fsm24KB
-
apt/postgresql/13/main/base/14088/13948_vm8KB
-
apt/postgresql/13/main/base/14088/139528KB
-
apt/postgresql/13/main/base/14088/139538KB
-
apt/postgresql/13/main/base/14088/13953_fsm24KB
-
apt/postgresql/13/main/base/14088/13953_vm8KB
-
apt/postgresql/13/main/base/14088/139578KB
-
apt/postgresql/13/main/base/14088/1748KB
-
apt/postgresql/13/main/base/14088/1758KB
-
apt/postgresql/13/main/base/14088/21878KB
-
apt/postgresql/13/main/base/14088/23378KB
-
apt/postgresql/13/main/base/14088/257916KB
-
apt/postgresql/13/main/base/14088/260016KB
-
apt/postgresql/13/main/base/14088/2600_fsm24KB
-
apt/postgresql/13/main/base/14088/2600_vm8KB
-
apt/postgresql/13/main/base/14088/26018KB
-
apt/postgresql/13/main/base/14088/2601_fsm24KB
-
apt/postgresql/13/main/base/14088/2601_vm8KB
-
apt/postgresql/13/main/base/14088/260248KB
-
apt/postgresql/13/main/base/14088/2602_fsm24KB
-
apt/postgresql/13/main/base/14088/2602_vm8KB
-
apt/postgresql/13/main/base/14088/260332KB
-
apt/postgresql/13/main/base/14088/2603_fsm24KB
-
apt/postgresql/13/main/base/14088/2603_vm8KB
-
apt/postgresql/13/main/base/14088/260516KB
-
apt/postgresql/13/main/base/14088/2605_fsm24KB
-
apt/postgresql/13/main/base/14088/2605_vm8KB
-
apt/postgresql/13/main/base/14088/26068KB
-
apt/postgresql/13/main/base/14088/2606_fsm24KB
-
apt/postgresql/13/main/base/14088/2606_vm8KB
-
apt/postgresql/13/main/base/14088/260716KB
-
apt/postgresql/13/main/base/14088/2607_fsm24KB
-
apt/postgresql/13/main/base/14088/2607_vm8KB
-
apt/postgresql/13/main/base/14088/2608456KB
-
apt/postgresql/13/main/base/14088/2608_fsm24KB
-
apt/postgresql/13/main/base/14088/2608_vm8KB
-
apt/postgresql/13/main/base/14088/2609336KB
-
apt/postgresql/13/main/base/14088/2609_fsm24KB
-
apt/postgresql/13/main/base/14088/2609_vm8KB
-
apt/postgresql/13/main/base/14088/261032KB
-
apt/postgresql/13/main/base/14088/2610_fsm24KB
-
apt/postgresql/13/main/base/14088/2610_vm8KB
-
apt/postgresql/13/main/base/14088/26128KB
-
apt/postgresql/13/main/base/14088/2612_fsm24KB
-
apt/postgresql/13/main/base/14088/2612_vm8KB
-
apt/postgresql/13/main/base/14088/26158KB
-
apt/postgresql/13/main/base/14088/2615_fsm24KB
-
apt/postgresql/13/main/base/14088/2615_vm8KB
-
apt/postgresql/13/main/base/14088/261616KB
-
apt/postgresql/13/main/base/14088/2616_fsm24KB
-
apt/postgresql/13/main/base/14088/2616_vm8KB
-
apt/postgresql/13/main/base/14088/2617112KB
-
apt/postgresql/13/main/base/14088/2617_fsm24KB
-
apt/postgresql/13/main/base/14088/2617_vm8KB
-
apt/postgresql/13/main/base/14088/261896KB
-
apt/postgresql/13/main/base/14088/2618_fsm24KB
-
apt/postgresql/13/main/base/14088/2618_vm8KB
-
apt/postgresql/13/main/base/14088/2619144KB
-
apt/postgresql/13/main/base/14088/2619_fsm24KB
-
apt/postgresql/13/main/base/14088/2619_vm8KB
-
apt/postgresql/13/main/base/14088/265016KB
-
apt/postgresql/13/main/base/14088/265116KB
-
apt/postgresql/13/main/base/14088/265216KB
-
apt/postgresql/13/main/base/14088/265340KB
-
apt/postgresql/13/main/base/14088/265440KB
-
apt/postgresql/13/main/base/14088/265532KB
-
apt/postgresql/13/main/base/14088/26568KB
-
apt/postgresql/13/main/base/14088/26578KB
-
apt/postgresql/13/main/base/14088/2658120KB
-
apt/postgresql/13/main/base/14088/265980KB
-
apt/postgresql/13/main/base/14088/266016KB
-
apt/postgresql/13/main/base/14088/266116KB
-
apt/postgresql/13/main/base/14088/266232KB
-
apt/postgresql/13/main/base/14088/266348KB
-
apt/postgresql/13/main/base/14088/266416KB
-
apt/postgresql/13/main/base/14088/266516KB
-
apt/postgresql/13/main/base/14088/266616KB
-
apt/postgresql/13/main/base/14088/266716KB
-
apt/postgresql/13/main/base/14088/266816KB
-
apt/postgresql/13/main/base/14088/266916KB
-
apt/postgresql/13/main/base/14088/267016KB
-
apt/postgresql/13/main/base/14088/2673272KB
-
apt/postgresql/13/main/base/14088/2674344KB
-
apt/postgresql/13/main/base/14088/2675192KB
-
apt/postgresql/13/main/base/14088/267816KB
-
apt/postgresql/13/main/base/14088/267916KB
-
apt/postgresql/13/main/base/14088/26808KB
-
apt/postgresql/13/main/base/14088/268116KB
-
apt/postgresql/13/main/base/14088/268216KB
-
apt/postgresql/13/main/base/14088/26838KB
-
apt/postgresql/13/main/base/14088/268416KB
-
apt/postgresql/13/main/base/14088/268516KB
-
apt/postgresql/13/main/base/14088/268616KB
-
apt/postgresql/13/main/base/14088/268716KB
-
apt/postgresql/13/main/base/14088/268840KB
-
apt/postgresql/13/main/base/14088/268948KB
-
apt/postgresql/13/main/base/14088/269088KB
-
apt/postgresql/13/main/base/14088/2691248KB
-
apt/postgresql/13/main/base/14088/269216KB
-
apt/postgresql/13/main/base/14088/269316KB
-
apt/postgresql/13/main/base/14088/269616KB
-
apt/postgresql/13/main/base/14088/26998KB
-
apt/postgresql/13/main/base/14088/27018KB
-
apt/postgresql/13/main/base/14088/27028KB
-
apt/postgresql/13/main/base/14088/270332KB
-
apt/postgresql/13/main/base/14088/270440KB
-
apt/postgresql/13/main/base/14088/275316KB
-
apt/postgresql/13/main/base/14088/2753_fsm24KB
-
apt/postgresql/13/main/base/14088/2753_vm8KB
-
apt/postgresql/13/main/base/14088/275416KB
-
apt/postgresql/13/main/base/14088/275516KB
-
apt/postgresql/13/main/base/14088/275632KB
-
apt/postgresql/13/main/base/14088/275732KB
-
apt/postgresql/13/main/base/14088/28318KB
-
apt/postgresql/13/main/base/14088/28338KB
-
apt/postgresql/13/main/base/14088/28358KB
-
apt/postgresql/13/main/base/14088/28378KB
-
apt/postgresql/13/main/base/14088/2838480KB
-
apt/postgresql/13/main/base/14088/2838_fsm24KB
-
apt/postgresql/13/main/base/14088/2838_vm8KB
-
apt/postgresql/13/main/base/14088/283916KB
-
apt/postgresql/13/main/base/14088/284024KB
-
apt/postgresql/13/main/base/14088/2840_fsm24KB
-
apt/postgresql/13/main/base/14088/2840_vm8KB
-
apt/postgresql/13/main/base/14088/284116KB
-
apt/postgresql/13/main/base/14088/29968KB
-
apt/postgresql/13/main/base/14088/30798KB
-
apt/postgresql/13/main/base/14088/3079_fsm24KB
-
apt/postgresql/13/main/base/14088/3079_vm8KB
-
apt/postgresql/13/main/base/14088/308016KB
-
apt/postgresql/13/main/base/14088/308116KB
-
apt/postgresql/13/main/base/14088/308548KB
-
apt/postgresql/13/main/base/14088/31198KB
-
apt/postgresql/13/main/base/14088/3164104KB
-
apt/postgresql/13/main/base/14088/32578KB
-
apt/postgresql/13/main/base/14088/32588KB
-
apt/postgresql/13/main/base/14088/33518KB
-
apt/postgresql/13/main/base/14088/33798KB
-
apt/postgresql/13/main/base/14088/33808KB
-
apt/postgresql/13/main/base/14088/339416KB
-
apt/postgresql/13/main/base/14088/3394_fsm24KB
-
apt/postgresql/13/main/base/14088/3394_vm8KB
-
apt/postgresql/13/main/base/14088/339516KB
-
apt/postgresql/13/main/base/14088/34318KB
-
apt/postgresql/13/main/base/14088/34338KB
-
apt/postgresql/13/main/base/14088/34408KB
-
apt/postgresql/13/main/base/14088/345540KB
-
apt/postgresql/13/main/base/14088/3456360KB
-
apt/postgresql/13/main/base/14088/3456_fsm24KB
-
apt/postgresql/13/main/base/14088/3456_vm8KB
-
apt/postgresql/13/main/base/14088/34678KB
-
apt/postgresql/13/main/base/14088/34688KB
-
apt/postgresql/13/main/base/14088/35028KB
-
apt/postgresql/13/main/base/14088/35038KB
-
apt/postgresql/13/main/base/14088/35348KB
-
apt/postgresql/13/main/base/14088/35418KB
-
apt/postgresql/13/main/base/14088/3541_fsm24KB
-
apt/postgresql/13/main/base/14088/3541_vm8KB
-
apt/postgresql/13/main/base/14088/354216KB
-
apt/postgresql/13/main/base/14088/35748KB
-
apt/postgresql/13/main/base/14088/35758KB
-
apt/postgresql/13/main/base/14088/35978KB
-
apt/postgresql/13/main/base/14088/35998KB
-
apt/postgresql/13/main/base/14088/36008KB
-
apt/postgresql/13/main/base/14088/3600_fsm24KB
-
apt/postgresql/13/main/base/14088/3600_vm8KB
-
apt/postgresql/13/main/base/14088/36018KB
-
apt/postgresql/13/main/base/14088/3601_fsm24KB
-
apt/postgresql/13/main/base/14088/3601_vm8KB
-
apt/postgresql/13/main/base/14088/36028KB
-
apt/postgresql/13/main/base/14088/3602_fsm24KB
-
apt/postgresql/13/main/base/14088/3602_vm8KB
-
apt/postgresql/13/main/base/14088/360324KB
-
apt/postgresql/13/main/base/14088/3603_fsm24KB
-
apt/postgresql/13/main/base/14088/3603_vm8KB
-
apt/postgresql/13/main/base/14088/360416KB
-
apt/postgresql/13/main/base/14088/360516KB
-
apt/postgresql/13/main/base/14088/360616KB
-
apt/postgresql/13/main/base/14088/360716KB
-
apt/postgresql/13/main/base/14088/360816KB
-
apt/postgresql/13/main/base/14088/360932KB
-
apt/postgresql/13/main/base/14088/371216KB
-
apt/postgresql/13/main/base/14088/37648KB
-
apt/postgresql/13/main/base/14088/3764_fsm24KB
-
apt/postgresql/13/main/base/14088/3764_vm8KB
-
apt/postgresql/13/main/base/14088/376616KB
-
apt/postgresql/13/main/base/14088/376716KB
-
apt/postgresql/13/main/base/14088/39978KB
-
apt/postgresql/13/main/base/14088/41448KB
-
apt/postgresql/13/main/base/14088/41468KB
-
apt/postgresql/13/main/base/14088/41488KB
-
apt/postgresql/13/main/base/14088/41508KB
-
apt/postgresql/13/main/base/14088/41528KB
-
apt/postgresql/13/main/base/14088/41548KB
-
apt/postgresql/13/main/base/14088/41568KB
-
apt/postgresql/13/main/base/14088/41588KB
-
apt/postgresql/13/main/base/14088/41608KB
-
apt/postgresql/13/main/base/14088/41628KB
-
apt/postgresql/13/main/base/14088/41648KB
-
apt/postgresql/13/main/base/14088/41668KB
-
apt/postgresql/13/main/base/14088/41688KB
-
apt/postgresql/13/main/base/14088/41708KB
-
apt/postgresql/13/main/base/14088/41728KB
-
apt/postgresql/13/main/base/14088/41748KB
-
apt/postgresql/13/main/base/14088/50028KB
-
apt/postgresql/13/main/base/14088/5488KB
-
apt/postgresql/13/main/base/14088/5498KB
-
apt/postgresql/13/main/base/14088/61108KB
-
apt/postgresql/13/main/base/14088/61118KB
-
apt/postgresql/13/main/base/14088/61128KB
-
apt/postgresql/13/main/base/14088/61138KB
-
apt/postgresql/13/main/base/14088/61178KB
-
apt/postgresql/13/main/base/14088/8278KB
-
apt/postgresql/13/main/base/14088/8288KB
-
apt/postgresql/13/main/base/14088/PG_VERSION3B
-
apt/postgresql/13/main/base/14088/pg_filenode.map512B
-
apt/postgresql/13/main/global/12138KB
-
apt/postgresql/13/main/global/1213_fsm24KB
-
apt/postgresql/13/main/global/1213_vm8KB
-
apt/postgresql/13/main/global/12148KB
-
apt/postgresql/13/main/global/1214_fsm24KB
-
apt/postgresql/13/main/global/1214_vm8KB
-
apt/postgresql/13/main/global/123216KB
-
apt/postgresql/13/main/global/123316KB
-
apt/postgresql/13/main/global/12608KB
-
apt/postgresql/13/main/global/1260_fsm24KB
-
apt/postgresql/13/main/global/1260_vm8KB
-
apt/postgresql/13/main/global/12618KB
-
apt/postgresql/13/main/global/1261_fsm24KB
-
apt/postgresql/13/main/global/1261_vm8KB
-
apt/postgresql/13/main/global/12628KB
-
apt/postgresql/13/main/global/1262_fsm24KB
-
apt/postgresql/13/main/global/1262_vm8KB
-
apt/postgresql/13/main/global/23968KB
-
apt/postgresql/13/main/global/2396_fsm24KB
-
apt/postgresql/13/main/global/2396_vm8KB
-
apt/postgresql/13/main/global/239716KB
-
apt/postgresql/13/main/global/267116KB
-
apt/postgresql/13/main/global/267216KB
-
apt/postgresql/13/main/global/267616KB
-
apt/postgresql/13/main/global/267716KB
-
apt/postgresql/13/main/global/269416KB
-
apt/postgresql/13/main/global/269516KB
-
apt/postgresql/13/main/global/269716KB
-
apt/postgresql/13/main/global/269816KB
-
apt/postgresql/13/main/global/28478KB
-
apt/postgresql/13/main/global/29658KB
-
apt/postgresql/13/main/global/29678KB
-
apt/postgresql/13/main/global/35938KB
-
apt/postgresql/13/main/global/40618KB
-
apt/postgresql/13/main/global/41768KB
-
apt/postgresql/13/main/global/41788KB
-
apt/postgresql/13/main/global/41828KB
-
apt/postgresql/13/main/global/41848KB
-
apt/postgresql/13/main/global/41868KB
-
apt/postgresql/13/main/global/60018KB
-
apt/postgresql/13/main/global/60028KB
-
apt/postgresql/13/main/global/61148KB
-
apt/postgresql/13/main/global/61158KB
-
apt/postgresql/13/main/global/pg_control8KB
-
apt/postgresql/13/main/global/pg_filenode.map512B
-
apt/postgresql/13/main/pg_logical/replorigin_checkpoint8B
-
apt/postgresql/13/main/pg_multixact/members/00008KB
-
apt/postgresql/13/main/pg_multixact/offsets/00008KB
-
apt/postgresql/13/main/pg_subtrans/00008KB
-
apt/postgresql/13/main/pg_wal/00000001000000000000000116.0MB
-
apt/postgresql/13/main/pg_xact/00008KB
-
apt/postgresql/13/main/postgresql.auto.conf88B
-
binfmts/Shared/KeyFile/1033/sqlsysclrtypes_keyfile.dll.dll 13KB
-
binfmts/Shared/KeyFile/1049/sqlsysclrtypes_keyfile.dll.dll 13KB
-
binfmts/Shared/Linux/README5KB
-
binfmts/Shared/Linux/bin/centos_x64/nph-keygen_get.elf 791KB
-
binfmts/Shared/Linux/bin/centos_x64/nph-keygen_post.elf 791KB
-
binfmts/Shared/Linux/bin/centos_x86/nph-keygen_get.elf 857KB
-
binfmts/Shared/Linux/bin/centos_x86/nph-keygen_post.elf 857KB
-
binfmts/Shared/Linux/bin/debian_x64/nph-keygen_get.elf 783KB
-
binfmts/Shared/Linux/bin/debian_x64/nph-keygen_post.elf 783KB
-
binfmts/Shared/Linux/bin/debian_x86/nph-keygen_get.elf 1.2MB
-
binfmts/Shared/Linux/bin/debian_x86/nph-keygen_post.elf 1.2MB
-
binfmts/Shared/Linux/keygen_short.php1KB
-
binfmts/Shared/Linux/keygen_short_test.html820B
-
binfmts/Shared/Linux/keyver_long.php2KB
-
binfmts/Shared/Linux/php/obsidium_keygen.inc.php.js 19KB
-
binfmts/Shared/Linux/php/test-generate.php1KB
-
binfmts/Shared/Linux/php/test-verify.php2KB
-
binfmts/Shared/SDK/Assemblies/Microsoft.SqlServer.Types.dll.dll 303KB
-
binfmts/Shared/SDK/Assemblies/ru/Microsoft.SqlServer.Types.Resources.dll.dll 41KB
-
binfmts/Shared/xe.dll.dll 616KB
-
binfmts/dbus/machine-id33B
-
binfmts/dictionaries-common/aspell/aspell-en402B
-
binfmts/dictionaries-common/hunspell/hunspell-en-us98B
-
binfmts/frame/LocalDB/Binn/Resources/SqlUserInstance.rll.dll 20KB
-
binfmts/frame/LocalDB/Binn/Resources/de-DE/SqlUserInstance.rll.mui.dll 22KB
-
binfmts/frame/LocalDB/Binn/Resources/en-US/SqlUserInstance.rll.mui.dll 20KB
-
binfmts/frame/LocalDB/Binn/Resources/es-ES/SqlUserInstance.rll.mui.dll 22KB
-
binfmts/frame/LocalDB/Binn/Resources/fr-FR/SqlUserInstance.rll.mui.dll 24KB
-
binfmts/frame/LocalDB/Binn/Resources/it-IT/SqlUserInstance.rll.mui.dll 22KB
-
binfmts/frame/LocalDB/Binn/Resources/ja-JP/SqlUserInstance.rll.mui.dll 17KB
-
binfmts/frame/LocalDB/Binn/Resources/ko-KR/SqlUserInstance.rll.mui.dll 17KB
-
binfmts/frame/LocalDB/Binn/Resources/pt-BR/SqlUserInstance.rll.mui.dll 21KB
-
binfmts/frame/LocalDB/Binn/Resources/ru-RU/SqlUserInstance.rll.mui.dll 21KB
-
binfmts/frame/LocalDB/Binn/Resources/zh-CN/SqlUserInstance.rll.mui.dll 15KB
-
binfmts/frame/LocalDB/Binn/Resources/zh-TW/SqlUserInstance.rll.mui.dll 15KB
-
binfmts/frame/LocalDB/Binn/SqlUserInstance.dll.dll 168KB
-
binfmts/frame/LocalDB/Binn/localdbxeventconfig.xml1KB
-
binfmts/frame/langs/Arabic.ini102KB
-
binfmts/frame/langs/Arabic.lang.ps1 75KB
-
binfmts/frame/langs/Armenian.ini109KB
-
binfmts/frame/langs/Armenian.lang.ps1 69KB
-
binfmts/frame/langs/Belarusian.ini105KB
-
binfmts/frame/langs/Belarusian.lang.ps1 66KB
-
binfmts/frame/langs/Bulgarian.ini107KB
-
binfmts/frame/langs/Bulgarian.lang.ps1 65KB
-
binfmts/frame/langs/Catalan.ini113KB
-
binfmts/frame/langs/Catalan.lang.ps1 72KB
-
binfmts/frame/langs/Croatian.ini105KB
-
binfmts/frame/langs/Croatian.lang.ps1 51KB
-
binfmts/frame/langs/Czech.ini107KB
-
binfmts/frame/langs/Czech.lang.ps1 54KB
-
binfmts/frame/langs/Danish.ini107KB
-
binfmts/frame/langs/Danish.lang.ps1 68KB
-
binfmts/frame/langs/Dutch.ini111KB
-
binfmts/frame/langs/Dutch.lang.ps1 69KB
-
binfmts/frame/langs/English.ini107KB
-
binfmts/frame/langs/English.lang.ps1 67KB
-
binfmts/frame/langs/Farsi.ini104KB
-
binfmts/frame/langs/Farsi.lang82KB
-
binfmts/frame/langs/Finnish.ini106KB
-
binfmts/frame/langs/Finnish.lang.ps1 51KB
-
binfmts/frame/langs/French.ini116KB
-
binfmts/frame/langs/French.lang.ps1 74KB
-
binfmts/frame/langs/German.ini114KB
-
binfmts/frame/langs/German.lang.ps1 73KB
-
binfmts/frame/langs/Greek.ini112KB
-
binfmts/frame/langs/Greek.lang94KB
-
binfmts/frame/langs/Hebrew.ini97KB
-
binfmts/frame/langs/Hebrew.lang.ps1 76KB
-
binfmts/frame/langs/Hindi.ini103KB
-
binfmts/frame/langs/Hindi.lang.ps1 66KB
-
binfmts/frame/langs/Hungarian.ini107KB
-
binfmts/frame/langs/Hungarian.lang.ps1 53KB
-
binfmts/frame/langs/Indonesian.ini105KB
-
binfmts/frame/langs/Indonesian.lang.ps1 51KB
-
binfmts/frame/langs/Italian.ini114KB
-
binfmts/frame/langs/Italian.lang.ps1 72KB
-
binfmts/frame/langs/Italian2.ini114KB
-
binfmts/frame/langs/Italian2.lang.ps1 72KB
-
binfmts/frame/langs/Japanese.ini91KB
-
binfmts/frame/langs/Japanese.lang.ps1 78KB
-
binfmts/frame/langs/Kazakh.ini105KB
-
binfmts/frame/langs/Kazakh.lang.ps1 56KB
-
binfmts/frame/langs/Korean.ini91KB
-
binfmts/frame/langs/Korean.lang.ps1 75KB
-
binfmts/frame/langs/Kurdish.ini106KB
-
binfmts/frame/langs/Kurdish.lang.ps1 61KB
-
binfmts/frame/langs/Lithuanian.ini108KB
-
binfmts/frame/langs/Lithuanian.lang.ps1 67KB
-
binfmts/frame/langs/Norwegian.ini104KB
-
binfmts/frame/langs/Norwegian.lang.ps1 50KB
-
binfmts/frame/langs/Polish.ini109KB
-
binfmts/frame/langs/Polish.lang.ps1 66KB
-
binfmts/frame/langs/Portuguese.ini111KB
-
binfmts/frame/langs/Portuguese.lang.ps1 54KB
-
binfmts/frame/langs/PortugueseBR.ini114KB
-
binfmts/frame/langs/PortugueseBR.lang.ps1 72KB
-
binfmts/frame/langs/Romanian.ini111KB
-
binfmts/frame/langs/Romanian.lang.ps1 70KB
-
binfmts/frame/langs/Russian.ini107KB
-
binfmts/frame/langs/Russian.lang87KB
-
binfmts/frame/langs/Serbian.ini109KB
-
binfmts/frame/langs/Serbian.lang.ps1 68KB
-
binfmts/frame/langs/SimpChinese.ini86KB
-
binfmts/frame/langs/SimpChinese.lang.ps1 66KB
-
binfmts/frame/langs/Sinhala.ini106KB
-
binfmts/frame/langs/Sinhala.lang.ps1 70KB
-
binfmts/frame/langs/Slovak.ini109KB
-
binfmts/frame/langs/Slovak.lang.ps1 71KB
-
binfmts/frame/langs/Slovenian.ini109KB
-
binfmts/frame/langs/Slovenian.lang.ps1 68KB
-
binfmts/frame/langs/Spanish.ini113KB
-
binfmts/frame/langs/Spanish.lang.ps1 56KB
-
binfmts/frame/langs/Swedish.ini104KB
-
binfmts/frame/langs/Swedish.lang.ps1 51KB
-
binfmts/frame/langs/Tagalog.ini112KB
-
binfmts/frame/langs/Tagalog.lang.ps1 61KB
-
binfmts/frame/langs/Thai.ini103KB
-
binfmts/frame/langs/Thai.lang.ps1 70KB
-
binfmts/frame/langs/TradChinese.ini85KB
-
binfmts/frame/langs/TradChinese.lang.ps1 66KB
-
binfmts/frame/langs/Turkish.ini111KB
-
binfmts/frame/langs/Turkish.lang.ps1 63KB
-
binfmts/frame/langs/Ukrainian.ini106KB
-
binfmts/frame/langs/Ukrainian.lang.ps1 66KB
-
binfmts/frame/langs/Uyghur.ini107KB
-
binfmts/frame/langs/Uyghur.lang.ps1 62KB
-
binfmts/frame/langs/UyghurLatin.ini108KB
-
binfmts/frame/langs/UyghurLatin.lang.ps1 52KB
-
binfmts/frame/langs/Uzbek.ini77KB
-
binfmts/frame/langs/Uzbek.lang.ps1 15KB
-
binfmts/frame/langs/Vietnamese.ini105KB
-
binfmts/frame/langs/Vietnamese.lang.ps1 56KB
-
binfmts/frame/shellicons/bandizip.ico17KB
-
binfmts/frame/shellicons/cmd.ico7KB
-
binfmts/frame/shellicons/uac.ico7KB
-
binfmts/jar50B
-
binfmts/jarwrapper75B
-
binfmts/llvm-6.0-runtime.binfmt50B
-
binfmts/llvm-9-runtime.binfmt46B
-
binfmts/python2.759B
-
binfmts/python3.759B
-
binfmts/python3.859B
-
binfmts/python3.959B
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/gem_make.out715B
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/mkmf.log1KB
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/racc/cparse.so.elf 70KB
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/gem_make.out8KB
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/mkmf.log1KB
-
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/unf_ext.so.elf 1.0MB
-
gems/2.7.0/specifications/addressable-2.8.0.gemspec1KB
-
gems/2.7.0/specifications/connection_pool-2.2.5.gemspec1KB
-
gems/2.7.0/specifications/crack-0.4.5.gemspec1KB
-
gems/2.7.0/specifications/diff-lcs-1.4.4.gemspec3KB
-
gems/2.7.0/specifications/domain_name-0.5.20190701.gemspec1KB
-
gems/2.7.0/specifications/hashdiff-1.0.1.gemspec1KB
-
gems/2.7.0/specifications/http-accept-1.7.0.gemspec1KB
-
gems/2.7.0/specifications/http-cookie-1.0.4.gemspec2KB
-
gems/2.7.0/specifications/mechanize-2.8.1.gemspec3KB
-
gems/2.7.0/specifications/mime-types-3.3.1.gemspec4KB
-
gems/2.7.0/specifications/mime-types-data-3.2021.0704.gemspec2KB
-
gems/2.7.0/specifications/net-http-digest_auth-1.4.1.gemspec3KB
-
gems/2.7.0/specifications/net-http-persistent-4.0.1.gemspec2KB
-
gems/2.7.0/specifications/netrc-0.11.0.gemspec1KB
-
gems/2.7.0/specifications/nokogiri-1.11.7-x86_64-linux.gemspec6KB
-
gems/2.7.0/specifications/public_suffix-4.0.6.gemspec1KB
-
gems/2.7.0/specifications/racc-1.5.2.gemspec1KB
-
gems/2.7.0/specifications/rest-client-2.1.0.gemspec2KB
-
gems/2.7.0/specifications/rexml-3.2.5.gemspec2KB
-
gems/2.7.0/specifications/rspec-3.10.0.gemspec3KB
-
gems/2.7.0/specifications/rspec-core-3.10.1.gemspec4KB
-
gems/2.7.0/specifications/rspec-expectations-3.10.1.gemspec4KB
-
gems/2.7.0/specifications/rspec-mocks-3.10.2.gemspec4KB
-
gems/2.7.0/specifications/rspec-support-3.10.2.gemspec3KB
-
gems/2.7.0/specifications/rubyntlm-0.6.3.gemspec1KB
-
gems/2.7.0/specifications/unf-0.1.4.gemspec1KB
-
gems/2.7.0/specifications/unf_ext-0.0.7.7.gemspec1KB
-
gems/2.7.0/specifications/vcr-6.0.0.gemspec3KB
-
gems/2.7.0/specifications/webmock-3.13.0.gemspec3KB
-
gems/2.7.0/specifications/webrick-1.7.0.gemspec1KB
-
gems/2.7.0/specifications/webrobots-0.1.2.gemspec2KB
-
ispell/README68B
-
ispell/Sounds/DG/PAV3WSC.exe.exe 149KB
-
ispell/Sounds/Drivers/NNSDhcp/NNSDhcp.sys.sys 108KB
-
ispell/Sounds/Drivers/NNSDhcp/WVista/NNSDhcp.sys.sys 108KB
-
ispell/Sounds/Drivers/NNSDhcp/WVista/nnsdhcp.cat11KB
-
ispell/Sounds/Drivers/NNSDhcp/WVista/nnsdhcp.inf2KB
-
ispell/Sounds/Drivers/NNSDhcp/nnsdhcp.cat11KB
-
ispell/Sounds/Drivers/NNSDhcp/nnsdhcp.inf2KB
-
ispell/Sounds/Drivers/NNSDns/NNSDns.sys.sys 142KB
-
ispell/Sounds/Drivers/NNSDns/WVista/NNSDns.sys.sys 142KB
-
ispell/Sounds/Drivers/NNSDns/WVista/nnsdns.cat11KB
-
ispell/Sounds/Drivers/NNSDns/WVista/nnsdns.inf2KB
-
ispell/Sounds/Drivers/NNSDns/nnsdns.cat11KB
-
ispell/Sounds/Drivers/NNSDns/nnsdns.inf2KB
-
ispell/Sounds/Drivers/NNSHttp/NNSHttp.sys.sys 210KB
-
ispell/Sounds/Drivers/NNSHttp/WVista/NNSHttp.sys.sys 209KB
-
ispell/Sounds/Drivers/NNSHttp/WVista/nnshttp.cat11KB
-
ispell/Sounds/Drivers/NNSHttp/WVista/nnshttp.inf2KB
-
ispell/Sounds/Drivers/NNSHttp/nnshttp.cat11KB
-
ispell/Sounds/Drivers/NNSHttp/nnshttp.inf2KB
-
ispell/Sounds/Drivers/NNSHttps/NNSHttps.sys.sys 125KB
-
ispell/Sounds/Drivers/NNSHttps/WVista/NNSHttps.sys.sys 125KB
-
ispell/Sounds/Drivers/NNSHttps/WVista/nnshttps.cat11KB
-
ispell/Sounds/Drivers/NNSHttps/WVista/nnshttps.inf2KB
-
ispell/Sounds/Drivers/NNSHttps/nnshttps.cat11KB
-
ispell/Sounds/Drivers/NNSHttps/nnshttps.inf2KB
-
ispell/Sounds/Drivers/NNSIds/NNSIds.sys.sys 143KB
-
ispell/Sounds/Drivers/NNSIds/WVista/NNSIds.sys.sys 142KB
-
ispell/Sounds/Drivers/NNSIds/WVista/nnsids.cat11KB
-
ispell/Sounds/Drivers/NNSIds/WVista/nnsids.inf2KB
-
ispell/Sounds/Drivers/NNSIds/nnsids.cat11KB
-
ispell/Sounds/Drivers/NNSIds/nnsids.inf2KB
-
ispell/Sounds/Drivers/NNSNHWFP/NNSNHWFP.inf2KB
-
ispell/Sounds/Drivers/NNSNHWFP/NNSNHWFP.sys.sys 206KB
-
ispell/Sounds/Drivers/NNSNHWFP/W8/NNSNHWFP.inf2KB
-
ispell/Sounds/Drivers/NNSNHWFP/W8/NNSNHWFP.sys.sys 205KB
-
ispell/Sounds/Drivers/NNSNHWFP/W8/nnsnhwfp.cat10KB
-
ispell/Sounds/Drivers/NNSNHWFP/nnsnhwfp.cat11KB
-
ispell/Sounds/Drivers/NNSNahsL/W8/NNSNAHSL.sys.sys 147KB
-
ispell/Sounds/Drivers/NNSNahsL/W8/nnsnahsl.cat11KB
-
ispell/Sounds/Drivers/NNSNahsL/W8/nnsnahsl.inf3KB
-
ispell/Sounds/Drivers/NNSPop3/NNSPop3.sys.sys 134KB
-
ispell/Sounds/Drivers/NNSPop3/WVista/NNSPop3.sys.sys 134KB
-
ispell/Sounds/Drivers/NNSPop3/WVista/nnspop3.cat11KB
-
ispell/Sounds/Drivers/NNSPop3/WVista/nnspop3.inf2KB
-
ispell/Sounds/Drivers/NNSPop3/nnspop3.cat11KB
-
ispell/Sounds/Drivers/NNSPop3/nnspop3.inf2KB
-
ispell/Sounds/Drivers/NNSProt/NNSProt.sys.sys 397KB
-
ispell/Sounds/Drivers/NNSProt/WVista/NNSProt.sys.sys 397KB
-
ispell/Sounds/Drivers/NNSProt/WVista/nnsprot.cat11KB
-
ispell/Sounds/Drivers/NNSProt/WVista/nnsprot.inf2KB
-
ispell/Sounds/Drivers/NNSProt/nnsprot.cat11KB
-
ispell/Sounds/Drivers/NNSProt/nnsprot.inf2KB
-
ispell/Sounds/Drivers/NNSPrv/NNSPrv.sys.sys 562KB
-
ispell/Sounds/Drivers/NNSPrv/WVista/NNSPrv.sys.sys 561KB
-
ispell/Sounds/Drivers/NNSPrv/WVista/nnsprv.cat10KB
-
ispell/Sounds/Drivers/NNSPrv/WVista/nnsprv.inf2KB
-
ispell/Sounds/Drivers/NNSPrv/nnsprv.cat11KB
-
ispell/Sounds/Drivers/NNSPrv/nnsprv.inf2KB
-
ispell/Sounds/Drivers/NNSSmtp/NNSSmtp.sys.sys 122KB
-
ispell/Sounds/Drivers/NNSSmtp/WVista/NNSSmtp.sys.sys 122KB
-
ispell/Sounds/Drivers/NNSSmtp/WVista/nnssmtp.cat11KB
-
ispell/Sounds/Drivers/NNSSmtp/WVista/nnssmtp.inf2KB
-
ispell/Sounds/Drivers/NNSSmtp/nnssmtp.cat11KB
-
ispell/Sounds/Drivers/NNSSmtp/nnssmtp.inf2KB
-
ispell/Sounds/Drivers/NNSStrm/NNSStrm.sys.sys 329KB
-
ispell/Sounds/Drivers/NNSStrm/WVista/NNSStrm.sys.sys 328KB
-
ispell/Sounds/Drivers/NNSStrm/WVista/nnsstrm.cat10KB
-
ispell/Sounds/Drivers/NNSStrm/WVista/nnsstrm.inf2KB
-
ispell/Sounds/Drivers/NNSStrm/nnsstrm.cat11KB
-
ispell/Sounds/Drivers/NNSStrm/nnsstrm.inf2KB
-
ispell/Sounds/Drivers/NNSpicc/NNSpicc.sys.sys 160KB
-
ispell/Sounds/Drivers/NNSpicc/WVista/NNSpicc.sys.sys 160KB
-
ispell/Sounds/Drivers/NNSpicc/WVista/nnspicc.cat11KB
-
ispell/Sounds/Drivers/NNSpicc/WVista/nnspicc.inf2KB
-
ispell/Sounds/Drivers/NNSpicc/nnspicc.cat11KB
-
ispell/Sounds/Drivers/NNSpicc/nnspicc.inf2KB
-
ispell/Sounds/Drivers/PSINDvct/W10/PSINDVCT.cat10KB
-
ispell/Sounds/Drivers/PSINDvct/W10/PSINDvct.inf4KB
-
ispell/Sounds/Drivers/PSINDvct/W10/PSINDvct.sys.sys 83KB
-
ispell/Sounds/Drivers/PSINDvct/WVista/PSINDvct.inf4KB
-
ispell/Sounds/Drivers/PSINDvct/WVista/PSINDvct.sys.sys 91KB
-
ispell/Sounds/Drivers/PSINDvct/WVista/psindvct.cat9KB
-
ispell/Sounds/Drivers/W10/PSBoot.sys.sys 52KB
-
ispell/Sounds/Drivers/W10/pskmad.sys.sys 71KB
-
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.cat10KB
-
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.inf2KB
-
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.sys.sys 137KB
-
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.cat9KB
-
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.inf2KB
-
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.sys.sys 145KB
-
ispell/Sounds/Drivers/psinaflt/PSINAflt.sys.sys 193KB
-
ispell/Sounds/Drivers/psinaflt/W7/PSINAflt.sys.sys 193KB
-
ispell/Sounds/Drivers/psinaflt/W7/psinaflt.cat11KB
-
ispell/Sounds/Drivers/psinaflt/W7/psinaflt.inf2KB
-
ispell/Sounds/Drivers/psinaflt/psinaflt.cat11KB
-
ispell/Sounds/Drivers/psinaflt/psinaflt.inf2KB
-
ispell/Sounds/Drivers/psinelam/W10/psinelam.cat10KB
-
ispell/Sounds/Drivers/psinelam/W10/psinelam.inf2KB
-
ispell/Sounds/Drivers/psinelam/W10/psinelam.sys.sys 25KB
-
ispell/Sounds/Drivers/psinfile/PSINFile.sys.sys 172KB
-
ispell/Sounds/Drivers/psinfile/W7/PSINFile.inf2KB
-
ispell/Sounds/Drivers/psinfile/W7/PSINFile.sys.sys 171KB
-
ispell/Sounds/Drivers/psinfile/W7/psinfile.cat10KB
-
ispell/Sounds/Drivers/psinfile/psinfile.cat11KB
-
ispell/Sounds/Drivers/psinfile/psinfile.inf2KB
-
ispell/Sounds/Drivers/psinknc/PSINKNC.sys.sys 213KB
-
ispell/Sounds/Drivers/psinknc/W7/PSINKNC.sys.sys 213KB
-
ispell/Sounds/Drivers/psinknc/W7/psinknc.cat11KB
-
ispell/Sounds/Drivers/psinknc/W7/psinknc.inf1KB
-
ispell/Sounds/Drivers/psinknc/psinknc.cat11KB
-
ispell/Sounds/Drivers/psinknc/psinknc.inf1KB
-
ispell/Sounds/Drivers/psinproc/PSINProc.sys.sys 147KB
-
ispell/Sounds/Drivers/psinproc/W7/PSINProc.inf2KB
-
ispell/Sounds/Drivers/psinproc/W7/PSINProc.sys.sys 146KB
-
ispell/Sounds/Drivers/psinproc/W7/psinproc.cat11KB
-
ispell/Sounds/Drivers/psinproc/psinproc.cat11KB
-
ispell/Sounds/Drivers/psinproc/psinproc.inf2KB
-
ispell/Sounds/Drivers/psinprot/PSINProt.sys.sys 158KB
-
ispell/Sounds/Drivers/psinprot/W7/PSINProt.sys.sys 158KB
-
ispell/Sounds/Drivers/psinprot/W7/psinprot.cat10KB
-
ispell/Sounds/Drivers/psinprot/W7/psinprot.inf2KB
-
ispell/Sounds/Drivers/psinprot/psinprot.cat11KB
-
ispell/Sounds/Drivers/psinprot/psinprot.inf2KB
-
ispell/Sounds/Drivers/psinreg/PSINReg.sys.sys 127KB
-
ispell/Sounds/Drivers/psinreg/W7/PSINReg.inf1KB
-
ispell/Sounds/Drivers/psinreg/W7/PSINReg.sys.sys 126KB
-
ispell/Sounds/Drivers/psinreg/W7/psinreg.cat11KB
-
ispell/Sounds/Drivers/psinreg/psinreg.cat11KB
-
ispell/Sounds/Drivers/psinreg/psinreg.inf1KB
-
ispell/Sounds/Fonts/MyriadPro-Bold.otf94KB
-
ispell/Sounds/Fonts/MyriadPro-BoldCond.otf93KB
-
ispell/Sounds/Fonts/MyriadPro-BoldCondIt.otf97KB
-
ispell/Sounds/Fonts/MyriadPro-BoldIt.otf99KB
-
ispell/Sounds/Fonts/MyriadPro-Cond.otf91KB
-
ispell/Sounds/Fonts/MyriadPro-CondIt.otf96KB
-
ispell/Sounds/Fonts/MyriadPro-It.otf97KB
-
ispell/Sounds/Fonts/MyriadPro-Regular.otf92KB
-
ispell/Sounds/Fonts/MyriadPro-Semibold.otf93KB
-
ispell/Sounds/Fonts/MyriadPro-SemiboldIt.otf99KB
-
ispell/Sounds/Fonts/Oxygen-Bold.ttf47KB
-
ispell/Sounds/Fonts/Oxygen-Light.ttf42KB
-
ispell/Sounds/Fonts/Oxygen-Regular.ttf46KB
-
ispell/Sounds/Lang/chi-tw/Dictionary.rar.rar 52KB
-
ispell/Sounds/Lang/chi/Dictionary.rar.rar 52KB
-
ispell/Sounds/Lang/eng/Dictionary.rar.rar 50KB
-
ispell/Sounds/Lang/fin/Dictionary.rar.rar 54KB
-
ispell/Sounds/Lang/fre/Dictionary.rar.rar 53KB
-
ispell/Sounds/Lang/ger/Dictionary.rar.rar 54KB
-
ispell/Sounds/Lang/hun/Dictionary.rar.rar 55KB
-
ispell/Sounds/Lang/ita/Dictionary.rar.rar 52KB
-
ispell/Sounds/Lang/jpn/Dictionary.rar.rar 56KB
-
ispell/Sounds/Lang/pol/Dictionary.rar.rar 55KB
-
ispell/Sounds/Lang/por/Dictionary.rar.rar 50KB
-
ispell/Sounds/Lang/rus/Dictionary.rar.rar 59KB
-
ispell/Sounds/Lang/spa/Diccionario.pnd.xml 48KB
-
ispell/Sounds/Lang/spa/Dictionary.rar.rar 38KB
-
ispell/Sounds/Lang/spa/PSUNDict.pnd.xml 183KB
-
ispell/Sounds/Lang/swe/Dictionary.rar.rar 52KB
-
ispell/Sounds/WAWorks/Diagnostic.ini3KB
-
ispell/Sounds/WAWorks/Policies.ini1KB
-
ispell/Sounds/WAWorks/RptMng.ini414B
-
ispell/Sounds/alert.wav16KB
-
ispell/Sounds/alert2.wav19KB
-
ispell/Sounds/connect.wav12KB
-
ispell/Sounds/disconnect.wav7KB
-
ispell/Sounds/email.wav26KB
-
ispell/Sounds/expert.wav2KB
-
ispell/Sounds/iFilters/msvcp90.dll.dll 559KB
-
ispell/Sounds/iFilters/msvcr90.dll.dll 640KB
-
ispell/Sounds/iFilters/ooofilt.dll.dll 229KB
-
ispell/Sounds/news.wav25KB
-
ispell/Sounds/ok.wav2KB
-
ispell/Sounds/stops.wav5KB
-
ispell/Sounds/tick.wav22KB
-
ispell/Sounds/timeout.wav20KB
-
ispell/Sounds/wait.wav5KB
-
ispell/config/ICMarketsSC-Demo01.srv1KB
-
ispell/config/ICMarketsSC-Demo02.srv1KB
-
ispell/config/ICMarketsSC-Demo03.srv1KB
-
ispell/config/ICMarketsSC-Demo04.srv2KB
-
ispell/config/ICMarketsSC-Demo06.srv1KB
-
ispell/config/ICMarketsSC-Live01.srv3KB
-
ispell/config/ICMarketsSC-Live02.srv3KB
-
ispell/config/ICMarketsSC-Live03.srv2KB
-
ispell/config/ICMarketsSC-Live04.srv3KB
-
ispell/config/ICMarketsSC-Live05.srv3KB
-
ispell/config/ICMarketsSC-Live06.srv2KB
-
ispell/config/ICMarketsSC-Live07.srv2KB
-
ispell/config/ICMarketsSC-Live08.srv3KB
-
ispell/config/ICMarketsSC-Live09.srv3KB
-
ispell/config/ICMarketsSC-Live10.srv3KB
-
ispell/config/ICMarketsSC-Live11.srv3KB
-
ispell/config/ICMarketsSC-Live12.srv2KB
-
ispell/config/ICMarketsSC-Live14.srv3KB
-
ispell/config/ICMarketsSC-Live15.srv2KB
-
ispell/config/ICMarketsSC-Live16.srv2KB
-
ispell/config/ICMarketsSC-Live17.srv2KB
-
ispell/config/ICMarketsSC-Live18.srv2KB
-
ispell/config/ICMarketsSC-Live19.srv2KB
-
ispell/config/ICMarketsSC-Live20.srv2KB
-
ispell/config/ICMarketsSC-Live21.srv3KB
-
ispell/profiles/British Pound/chart01.CHR1KB
-
ispell/profiles/British Pound/chart02.CHR1KB
-
ispell/profiles/British Pound/chart03.CHR1KB
-
ispell/profiles/British Pound/order.wnd36B
-
ispell/profiles/Drivers/prl_dd/amd64/prl_gldd.dl6.dll 311KB
-
ispell/profiles/Drivers/prl_dd/amd64/prl_kmdd.sys.sys 152KB
-
ispell/profiles/Drivers/prl_dd/amd64/prl_umdd.dl6.dll 136KB
-
ispell/profiles/Drivers/prl_dd/amd64/prl_umdd10.dl6.dll 125KB
-
ispell/profiles/Drivers/prl_dd/i386/prl_gldd.dl3.dll 232KB
-
ispell/profiles/Drivers/prl_dd/i386/prl_umdd.dl3.dll 117KB
-
ispell/profiles/Drivers/prl_dd/i386/prl_umdd10.dl3.dll 113KB
-
ispell/profiles/Drivers/prl_dd/prl_dd.inf3KB
-
ispell/profiles/Drivers/prl_dd/prl_dd_x64.cat12KB
-
ispell/profiles/Drivers/prl_eth5/amd64/prl_eth5.sys.sys 23KB
-
ispell/profiles/Drivers/prl_eth5/prl_eth5.inf1KB
-
ispell/profiles/Drivers/prl_eth5/prl_eth5_x64.cat11KB
-
ispell/profiles/Drivers/prl_fs/amd64/prl_fs.sys.sys 194KB
-
ispell/profiles/Drivers/prl_fs/amd64/prl_np.dl6.dll 47KB
-
ispell/profiles/Drivers/prl_fs/i386/prl_np.dl3.dll 39KB
-
ispell/profiles/Drivers/prl_fs/prl_fs.inf2KB
-
ispell/profiles/Drivers/prl_fs/prl_fs_x64.cat12KB
-
ispell/profiles/Drivers/prl_fs/upgrade_temp/prl_fs.sys.sys 194KB
-
ispell/profiles/Drivers/prl_memdev/amd64/prl_memdev.sys.sys 21KB
-
ispell/profiles/Drivers/prl_memdev/prl_memdev.inf1KB
-
ispell/profiles/Drivers/prl_memdev/prl_memdev_x64.cat11KB
-
ispell/profiles/Drivers/prl_mouf/amd64/prl_mouf.sys.sys 20KB
-
ispell/profiles/Drivers/prl_mouf/prl_mouf.inf3KB
-
ispell/profiles/Drivers/prl_mouf/prl_mouf_x64.cat10KB
-
ispell/profiles/Drivers/prl_net_inst.exe.exe 81KB
-
ispell/profiles/Drivers/prl_net_install.dll.dll 191KB
-
ispell/profiles/Drivers/prl_pv/amd64/prl_pv64.sys.sys 117KB
-
ispell/profiles/Drivers/prl_pv/prl_pv32.inf1KB
-
ispell/profiles/Drivers/prl_pv/prl_pv32_x64.cat11KB
-
ispell/profiles/Drivers/prl_scsi/prl_scsi.inf2KB
-
ispell/profiles/Drivers/prl_scsi/prl_scsi.sys.sys 32KB
-
ispell/profiles/Drivers/prl_scsi/prl_scsi_x64.cat10KB
-
ispell/profiles/Drivers/prl_scsi/prl_scsi_x86.cat10KB
-
ispell/profiles/Drivers/prl_sound/amd64/prl_sound.sys.sys 48KB
-
ispell/profiles/Drivers/prl_sound/prl_sound.inf19KB
-
ispell/profiles/Drivers/prl_sound/prl_sound_x64.cat11KB
-
ispell/profiles/Drivers/prl_strg/amd64/prl_strg.sys.sys 39KB
-
ispell/profiles/Drivers/prl_strg/prl_strg.inf1KB
-
ispell/profiles/Drivers/prl_strg/prl_strg_x64.cat11KB
-
ispell/profiles/Drivers/prl_tg/amd64/prl_tg.sys.sys 27KB
-
ispell/profiles/Drivers/prl_tg/prl_tg.inf1KB
-
ispell/profiles/Drivers/prl_tg/prl_tg_x64.cat11KB
-
ispell/profiles/Drivers/prl_time/amd64/prl_time.sys.sys 18KB
-
ispell/profiles/Drivers/prl_time/prl_time.inf1KB
-
ispell/profiles/Drivers/prl_time/prl_time_x64.cat11KB
-
ispell/profiles/Drivers/prl_va/amd64/prl_gl.dl6.dll 301KB
-
ispell/profiles/Drivers/prl_va/amd64/prl_vadd.dll.dll 205KB
-
ispell/profiles/Drivers/prl_va/amd64/prl_vamp.sys.sys 27KB
-
ispell/profiles/Drivers/prl_va/i386/prl_gl.dl3.dll 225KB
-
ispell/profiles/Drivers/prl_va/prl_va.inf4KB
-
ispell/profiles/Drivers/prl_va/prl_va_x64.cat13KB
-
ispell/profiles/Euro/chart01.CHR1KB
-
ispell/profiles/Euro/chart02.CHR1KB
-
ispell/profiles/Euro/chart03.CHR1KB
-
ispell/profiles/Euro/order.wnd36B
-
ispell/profiles/Market Overview/chart01.CHR1KB
-
ispell/profiles/Market Overview/chart02.CHR1KB
-
ispell/profiles/Market Overview/chart03.CHR1KB
-
ispell/profiles/Market Overview/chart04.CHR1KB
-
ispell/profiles/Market Overview/order.wnd48B
-
ispell/profiles/SIA/SharedIntApp.exe.exe 45KB
-
ispell/profiles/SIA/mapi32.exe.exe 31KB
-
ispell/profiles/Services/Plugins/UserInputEmulation.dll.dll 97KB
-
ispell/profiles/Services/WoW/coherence.exe.exe 31KB
-
ispell/profiles/Services/WoW/prl_hook.dll.dll 44KB
-
ispell/profiles/Services/coherence.exe.exe 35KB
-
ispell/profiles/Services/install-provider.cmd589B
-
ispell/profiles/Services/prl_hook.dll.dll 55KB
-
ispell/profiles/Services/prl_tools.exe.exe 204KB
-
ispell/profiles/Services/prl_tools_service.exe.exe 215KB
-
ispell/profiles/Services/prl_vss_provider.dll.dll 113KB
-
ispell/profiles/Services/register_app.vbs.vbs 11KB
-
ispell/profiles/Services/uninstall-provider.cmd348B
-
ispell/profiles/Swiss Franc/chart01.CHR1KB
-
ispell/profiles/Swiss Franc/chart02.CHR1KB
-
ispell/profiles/Swiss Franc/chart03.CHR1KB
-
ispell/profiles/Swiss Franc/order.wnd36B
-
ispell/profiles/default/chart01.CHR751B
-
ispell/profiles/default/chart02.CHR845B
-
ispell/profiles/default/chart03.CHR757B
-
ispell/profiles/default/chart04.CHR881B
-
ispell/profiles/default/order.wnd44B
-
ispell/profiles/lastprofile.ini9B
-
ispell/templates/ADX.tpl998B
-
ispell/templates/BollingerBands.tpl1KB
-
ispell/templates/Layers.tpl3KB
-
ispell/templates/Momentum.tpl1KB
-
ispell/templates/OptimizationReport.htm.html 1KB
-
ispell/templates/Popular.tpl1KB
-
ispell/templates/StatementDetailed.htm.html 7KB
-
ispell/templates/Volume.tpl1KB
-
ispell/templates/Williams.tpl1KB
-
ispell/templates/statement.htm.html 3KB
-
ispell/templates/strategytester.htm.html 1KB
-
libswscale-8.dll.dll 1.0MB
-
libx264-142.dll.dll 855KB
-
mlocate/Images/HeaderDocImage.png.png 181B
-
mlocate/Images/HeaderImage.png.png 205B
-
mlocate/Images/Reports/ConsignmentSoldReport.frx12KB
-
mlocate/Images/a1.jpg.jpg 3KB
-
mlocate/Images/a2.jpg.jpg 19KB
-
mlocate/Images/a3.jpg.jpg 6KB
-
mlocate/Images/a4.jpg.jpg 5KB
-
mlocate/Images/a5.jpg.jpg 4KB
-
mlocate/Images/a6.jpg.jpg 3KB
-
mlocate/Images/a7.jpg.jpg 11KB
-
mlocate/Images/a8.jpg.jpg 16KB
-
mlocate/Images/angular_logo.png.png 14KB
-
mlocate/Images/background.png.png 104KB
-
mlocate/Images/email_3.jpg.jpg 111KB
-
mlocate/Images/header.jpg.jpg 34KB
-
mlocate/Images/landing/avatar1.jpg.jpg 4KB
-
mlocate/Images/landing/avatar2.jpg.jpg 4KB
-
mlocate/Images/landing/avatar3.jpg.jpg 3KB
-
mlocate/Images/landing/avatar4.jpg.jpg 15KB
-
mlocate/Images/landing/avatar5.jpg.jpg 8KB
-
mlocate/Images/landing/avatar6.jpg.jpg 6KB
-
mlocate/Images/landing/avatar7.jpg.jpg 3KB
-
mlocate/Images/landing/avatar8.jpg.jpg 2KB
-
mlocate/Images/landing/avatar9.jpg.jpg 1KB
-
mlocate/Images/landing/dashboard.png.png 72KB
-
mlocate/Images/landing/iphone.jpg.jpg 200KB
-
mlocate/Images/landing/laptop.png.png 72KB
-
mlocate/Images/landing/perspective.png.png 530KB
-
mlocate/Images/logo.png.png 70KB
-
mlocate/Images/p3.jpg.jpg 122KB
-
mlocate/Images/p4.jpg.jpg 101KB
-
mlocate/Images/p7.jpg.jpg 99KB
-
mlocate/Images/p8.jpg.jpg 70KB
-
mlocate/Images/pdf.png.png 450B
-
mlocate/Images/picture.png.png 323B
-
mlocate/Images/profile.jpg.png 6KB
-
mlocate/Images/profile_small.jpg.jpg 2KB
-
mlocate/Images/zender_logo.png.png 3KB
-
mlocate/fonts/font-awesome/css/font-awesome.css32KB
-
mlocate/fonts/font-awesome/css/font-awesome.min.css26KB
-
mlocate/fonts/font-awesome/fonts/FontAwesome.otf107KB
-
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.eot69KB
-
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.svg.svg .xml 357KB
-
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.ttf138KB
-
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.woff81KB
-
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.woff265KB
-
mlocate/fonts/font-awesome/less/animated.less713B
-
mlocate/fonts/font-awesome/less/bordered-pulled.less585B
-
mlocate/fonts/font-awesome/less/core.less452B
-
mlocate/fonts/font-awesome/less/fixed-width.less119B
-
mlocate/fonts/font-awesome/less/font-awesome.less465B
-
mlocate/fonts/font-awesome/less/icons.less42KB
-
mlocate/fonts/font-awesome/less/larger.less370B
-
mlocate/fonts/font-awesome/less/list.less377B
-
mlocate/fonts/font-awesome/less/mixins.less926B
-
mlocate/fonts/font-awesome/less/path.less770B
-
mlocate/fonts/font-awesome/less/rotated-flipped.less622B
-
mlocate/fonts/font-awesome/less/stacked.less476B
-
mlocate/fonts/font-awesome/less/variables.less19KB
-
mlocate/fonts/font-awesome/scss/_animated.scss715B
-
mlocate/fonts/font-awesome/scss/_bordered-pulled.scss592B
-
mlocate/fonts/font-awesome/scss/_core.scss459B
-
mlocate/fonts/font-awesome/scss/_fixed-width.scss120B
-
mlocate/fonts/font-awesome/scss/_icons.scss43KB
-
mlocate/fonts/font-awesome/scss/_larger.scss375B
-
mlocate/fonts/font-awesome/scss/_list.scss378B
-
mlocate/fonts/font-awesome/scss/_mixins.scss946B
-
mlocate/fonts/font-awesome/scss/_path.scss783B
-
mlocate/fonts/font-awesome/scss/_rotated-flipped.scss672B
-
mlocate/fonts/font-awesome/scss/_stacked.scss482B
-
mlocate/fonts/font-awesome/scss/_variables.scss19KB
-
mlocate/fonts/font-awesome/scss/font-awesome.scss405B
-
mlocate/fonts/glyphicons-halflings-regular.eot19KB
-
mlocate/fonts/glyphicons-halflings-regular.svg.svg .xml 61KB
-
mlocate/fonts/glyphicons-halflings-regular.ttf40KB
-
mlocate/fonts/glyphicons-halflings-regular.woff22KB
-
mlocate/mlocate.db377KB
-
openvr_api.dll.dll 612KB
-
pam/account76B
-
pam/auth61B
-
pam/dpkg/alternatives/arptables201B
-
pam/dpkg/alternatives/automake269B
-
pam/dpkg/alternatives/awk207B
-
pam/dpkg/alternatives/builtins.7.gz83B
-
pam/dpkg/alternatives/c++36B
-
pam/dpkg/alternatives/c89111B
-
pam/dpkg/alternatives/c99111B
-
pam/dpkg/alternatives/caf91B
-
pam/dpkg/alternatives/caf-openmpi185B
-
pam/dpkg/alternatives/cc35B
-
pam/dpkg/alternatives/cpp32B
-
pam/dpkg/alternatives/default-GM.sf282B
-
pam/dpkg/alternatives/default-GM.sf382B
-
pam/dpkg/alternatives/ebtables193B
-
pam/dpkg/alternatives/editor741B
-
pam/dpkg/alternatives/ex623B
-
pam/dpkg/alternatives/f7741B
-
pam/dpkg/alternatives/f9541B
-
pam/dpkg/alternatives/fakeroot1KB
-
pam/dpkg/alternatives/figlet132B
-
pam/dpkg/alternatives/grape133B
-
pam/dpkg/alternatives/groovy138B
-
pam/dpkg/alternatives/groovyConsole69B
-
pam/dpkg/alternatives/groovyc143B
-
pam/dpkg/alternatives/groovydoc61B
-
pam/dpkg/alternatives/groovysh59B
-
pam/dpkg/alternatives/ip6tables298B
-
pam/dpkg/alternatives/iptables287B
-
pam/dpkg/alternatives/jaotc72B
-
pam/dpkg/alternatives/jar213B
-
pam/dpkg/alternatives/jarsigner189B
-
pam/dpkg/alternatives/java164B
-
pam/dpkg/alternatives/java2groovy65B
-
pam/dpkg/alternatives/javac169B
-
pam/dpkg/alternatives/javadoc179B
-
pam/dpkg/alternatives/javap169B
-
pam/dpkg/alternatives/jcmd164B
-
pam/dpkg/alternatives/jconsole184B
-
pam/dpkg/alternatives/jdb159B
-
pam/dpkg/alternatives/jdeprscan80B
-
pam/dpkg/alternatives/jdeps169B
-
pam/dpkg/alternatives/jexec158B
-
pam/dpkg/alternatives/jfr68B
-
pam/dpkg/alternatives/jhsdb72B
-
pam/dpkg/alternatives/jimage74B
-
pam/dpkg/alternatives/jinfo169B
-
pam/dpkg/alternatives/jjs159B
-
pam/dpkg/alternatives/jlink72B
-
pam/dpkg/alternatives/jmap164B
-
pam/dpkg/alternatives/jmod70B
-
pam/dpkg/alternatives/jps159B
-
pam/dpkg/alternatives/jrunscript194B
-
pam/dpkg/alternatives/jshell74B
-
pam/dpkg/alternatives/jstack174B
-
pam/dpkg/alternatives/jstat169B
-
pam/dpkg/alternatives/jstatd174B
-
pam/dpkg/alternatives/keytool179B
-
pam/dpkg/alternatives/libblas.so.3-x86_64-linux-gnu93B
-
pam/dpkg/alternatives/liblapack.so.3-x86_64-linux-gnu99B
-
pam/dpkg/alternatives/libpsm_infinipath.so.1102B
-
pam/dpkg/alternatives/locate263B
-
pam/dpkg/alternatives/lzma1KB
-
pam/dpkg/alternatives/mpi916B
-
pam/dpkg/alternatives/mpi-x86_64-linux-gnu793B
-
pam/dpkg/alternatives/mpirun271B
-
pam/dpkg/alternatives/msfconsole73B
-
pam/dpkg/alternatives/msfd61B
-
pam/dpkg/alternatives/msfdb63B
-
pam/dpkg/alternatives/msfrpc65B
-
pam/dpkg/alternatives/msfrpcd67B
-
pam/dpkg/alternatives/msfupdate71B
-
pam/dpkg/alternatives/msfvenom69B
-
pam/dpkg/alternatives/mt98B
-
pam/dpkg/alternatives/open122B
-
pam/dpkg/alternatives/pack200179B
-
pam/dpkg/alternatives/pager154B
-
pam/dpkg/alternatives/phar114B
-
pam/dpkg/alternatives/phar.phar139B
-
pam/dpkg/alternatives/php109B
-
pam/dpkg/alternatives/pico104B
-
pam/dpkg/alternatives/pinentry142B
-
pam/dpkg/alternatives/postmaster.1.gz1KB
-
pam/dpkg/alternatives/proxychains146B
-
pam/dpkg/alternatives/psql.1.gz21KB
-
pam/dpkg/alternatives/rcp103B
-
pam/dpkg/alternatives/regulatory.db244B
-
pam/dpkg/alternatives/rlogin118B
-
pam/dpkg/alternatives/rmic164B
-
pam/dpkg/alternatives/rmid164B
-
pam/dpkg/alternatives/rmiregistry199B
-
pam/dpkg/alternatives/rmt113B
-
pam/dpkg/alternatives/rsh103B
-
pam/dpkg/alternatives/rview43B
-
pam/dpkg/alternatives/sar118B
-
pam/dpkg/alternatives/serialver189B
-
pam/dpkg/alternatives/startGroovy65B
-
pam/dpkg/alternatives/unpack200189B
-
pam/dpkg/alternatives/vi623B
-
pam/dpkg/alternatives/view657B
-
pam/dpkg/alternatives/write120B
-
pam/dpkg/alternatives/x-cursor-theme85B
-
pam/dpkg/alternatives/x-terminal-emulator316B
-
pam/dpkg/available175KB
-
pam/dpkg/cmethopt8B
-
pam/dpkg/diversions252B
-
pam/dpkg/diversions-old186B
-
pam/dpkg/statoverride207B
-
pam/dpkg/statoverride-old170B
-
pam/dpkg/status1.2MB
-
pam/dpkg/status-old1.2MB
-
pam/dpkg/triggers/File1KB
-
pam/dpkg/triggers/aspell-autobuildhash28B
-
pam/dpkg/triggers/ispell-autobuildhash28B
-
pam/dpkg/triggers/ldconfig9B
-
pam/dpkg/triggers/update-ca-certificates16B
-
pam/dpkg/triggers/update-ca-certificates-fresh16B
-
pam/dpkg/triggers/update-default-ispell28B
-
pam/dpkg/triggers/update-default-wordlist28B
-
pam/password71B
-
pam/seen23B
-
pam/session115B
-
pam/session-noninteractive75B
-
ucf/cache/#003Aetc#003Adefault#003Asysstat284B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Acalendar.ini74B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Actype.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aexif.ini70B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Afileinfo.ini74B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aftp.ini69B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Agettext.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aiconv.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Ajson.ini68B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aopcache.ini79B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Apdo.ini69B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aphar.ini70B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aposix.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Areadline.ini76B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Ashmop.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asockets.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvmsg.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvsem.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvshm.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Atokenizer.ini75B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Acalendar.ini74B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Actype.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aexif.ini70B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Affi.ini69B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Afileinfo.ini74B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aftp.ini69B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Agettext.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aiconv.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Ajson.ini68B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aopcache.ini79B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Apdo.ini69B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aphar.ini70B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aposix.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Areadline.ini76B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Ashmop.ini71B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asockets.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvmsg.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvsem.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvshm.ini73B
-
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Atokenizer.ini75B
-
ucf/cache/#003Aetc#003Apostgresql-common#003Acreatecluster.conf1KB
-
ucf/cache/#003Aetc#003Assh#003Asshd_config3KB
-
ucf/hashfile3KB
-
ucf/hashfile.03KB
-
ucf/hashfile.13KB
-
ucf/hashfile.23KB
-
ucf/hashfile.33KB
-
ucf/hashfile.42KB
-
ucf/hashfile.52KB
-
ucf/hashfile.62KB
-
ucf/hashfile.72KB
-
ucf/registry2KB
-
ucf/registry.02KB
-
ucf/registry.12KB
-
ucf/registry.22KB
-
ucf/registry.32KB
-
ucf/registry.42KB
-
ucf/registry.52KB
-
ucf/registry.62KB
-
ucf/registry.72KB
-
ucf/update_check/80/COM/sqlvdi.dll.dll 200KB
-
ucf/update_check/80/Tools/Binn/sqlvdi.dll.dll 200KB
-
ucf/update_check/90/Shared/Resources/1028/License_SysClrTypes.rtf.rtf 124KB
-
ucf/update_check/90/Shared/Resources/1031/License_SysClrTypes.rtf.rtf 94KB
-
ucf/update_check/90/Shared/Resources/1033/License_SysClrTypes.rtf.rtf 93KB
-
ucf/update_check/90/Shared/Resources/1036/License_SysClrTypes.rtf.rtf 97KB
-
ucf/update_check/90/Shared/Resources/1040/License_SysClrTypes.rtf.rtf 93KB
-
ucf/update_check/90/Shared/Resources/1041/License_SysClrTypes.rtf.rtf 146KB
-
ucf/update_check/90/Shared/Resources/1042/License_SysClrTypes.rtf.rtf 364KB
-
ucf/update_check/90/Shared/Resources/1046/License_SysClrTypes.rtf.rtf 94KB
-
ucf/update_check/90/Shared/Resources/1049/License_SysClrTypes.rtf.rtf 137KB
-
ucf/update_check/90/Shared/Resources/2052/License_SysClrTypes.rtf.rtf 117KB
-
ucf/update_check/90/Shared/Resources/3082/License_SysClrTypes.rtf.rtf 96KB
-
ucf/update_check/Client SDK/ODBC/170/License Terms/License_msodbcsql_ENU.txt11KB
-
ucf/update_check/Client SDK/ODBC/170/SDK/Include/msodbcsql.h108KB
-
ucf/update_check/Client SDK/ODBC/170/SDK/Lib/x64/msodbcsql17.lib6KB
-
ucf/update_check/Client SDK/ODBC/170/SDK/Lib/x86/msodbcsql17.lib6KB
-
usbutils/aspell/README68B
-
usbutils/aspell/en-common.rws2.3MB
-
usbutils/aspell/en-variant_0.rws38KB
-
usbutils/aspell/en-variant_1.rws90KB
-
usbutils/aspell/en-variant_2.rws98KB
-
usbutils/aspell/en-w_accents-only.rws158KB
-
usbutils/aspell/en-wo_accents-only.rws158KB
-
usbutils/aspell/en.compat14B
-
usbutils/aspell/en.remove1KB
-
usbutils/aspell/en_AU-variant_0.rws29KB
-
usbutils/aspell/en_AU-variant_1.rws71KB
-
usbutils/aspell/en_AU-w_accents-only.rws99KB
-
usbutils/aspell/en_AU-wo_accents-only.rws99KB
-
usbutils/aspell/en_CA-variant_0.rws37KB
-
usbutils/aspell/en_CA-variant_1.rws73KB
-
usbutils/aspell/en_CA-w_accents-only.rws91KB
-
usbutils/aspell/en_CA-wo_accents-only.rws91KB
-
usbutils/aspell/en_GB-ise-w_accents-only.rws92KB
-
usbutils/aspell/en_GB-ise-wo_accents-only.rws92KB
-
usbutils/aspell/en_GB-ize-w_accents-only.rws91KB
-
usbutils/aspell/en_GB-ize-wo_accents-only.rws91KB
-
usbutils/aspell/en_GB-variant_0.rws27KB
-
usbutils/aspell/en_GB-variant_1.rws62KB
-
usbutils/aspell/en_US-w_accents-only.rws89KB
-
usbutils/aspell/en_US-wo_accents-only.rws89KB
-
usbutils/systemd/catalog/database145KB
-
usbutils/systemd/deb-systemd-helper-enabled/apache-htcacheclean.service.dsh-also72B
-
usbutils/systemd/deb-systemd-helper-enabled/apache2.service.dsh-also60B
-
usbutils/systemd/deb-systemd-helper-enabled/apparmor.service.dsh-also58B
-
usbutils/systemd/deb-systemd-helper-enabled/apt-daily-upgrade.timer.dsh-also64B
-
usbutils/systemd/deb-systemd-helper-enabled/apt-daily.timer.dsh-also56B
-
usbutils/systemd/deb-systemd-helper-enabled/binfmt-support.service.dsh-also67B
-
usbutils/systemd/deb-systemd-helper-enabled/containerd.service.dsh-also63B
-
usbutils/systemd/deb-systemd-helper-enabled/cron.service.dsh-also57B
-
usbutils/systemd/deb-systemd-helper-enabled/docker.service.dsh-also59B
-
usbutils/systemd/deb-systemd-helper-enabled/docker.socket.dsh-also55B
-
usbutils/systemd/deb-systemd-helper-enabled/e2scrub_all.timer.dsh-also58B
-
usbutils/systemd/deb-systemd-helper-enabled/e2scrub_reap.service.dsh-also62B
-
usbutils/systemd/deb-systemd-helper-enabled/fstrim.timer.dsh-also53B
-
usbutils/systemd/deb-systemd-helper-enabled/hostapd.service.dsh-also60B
-
usbutils/systemd/deb-systemd-helper-enabled/ifupdown-wait-online.service.dsh-also77B
-
usbutils/systemd/deb-systemd-helper-enabled/logrotate.timer.dsh-also56B
-
usbutils/systemd/deb-systemd-helper-enabled/mlocate.timer.dsh-also54B
-
usbutils/systemd/deb-systemd-helper-enabled/networking.service.dsh-also130B
-
usbutils/systemd/deb-systemd-helper-enabled/phpsessionclean.timer.dsh-also62B
-
usbutils/systemd/deb-systemd-helper-enabled/postgresql.service.dsh-also63B
-
usbutils/systemd/deb-systemd-helper-enabled/rsyslog.service.dsh-also95B
-
usbutils/systemd/deb-systemd-helper-enabled/ssh.service.dsh-also89B
-
usbutils/systemd/deb-systemd-helper-enabled/ssh.socket.dsh-also52B
-
usbutils/systemd/deb-systemd-helper-enabled/sysstat-collect.timer.dsh-also64B
-
usbutils/systemd/deb-systemd-helper-enabled/sysstat-summary.timer.dsh-also64B
-
usbutils/systemd/deb-systemd-helper-enabled/sysstat.service.dsh-also188B
-
usbutils/systemd/deb-systemd-helper-enabled/systemd-timesyncd.service.dsh-also126B
-
usbutils/systemd/deb-systemd-helper-enabled/tor.service.dsh-also56B
-
usbutils/systemd/deb-systemd-user-helper-enabled/dirmngr.socket.dsh-also54B
-
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-browser.socket.dsh-also64B
-
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-extra.socket.dsh-also62B
-
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-ssh.socket.dsh-also60B
-
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent.socket.dsh-also56B
-
usbutils/systemd/deb-systemd-user-helper-enabled/pipewire.service.dsh-also111B
-
usbutils/systemd/deb-systemd-user-helper-enabled/pipewire.socket.dsh-also55B
-
usbutils/tor/cached-certs19KB
-
usbutils/tor/cached-microdesc-consensus2.2MB
-
usbutils/tor/cached-microdescs6.3MB
-
usbutils/tor/state3KB
-
usbutils/usb.ids695KB
TradingView Premium Desktop.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 2a285555e84dc0ef5b41029db317b66a5d78445d3563070f573db8e4044f5f5d
- MD5 3b4a7692d191b4049be76ac52fb7b47d
- SHA1 100466356c7ddaa0661568066d916ce050d44e3a
- SHA512 7071551641c75c516a9310bccb83f13cb3a3923ff636e107568da4afd9b50396e2c9ee8f02c325148f776af8147c15497fd5e07cacb9e0dad199013e9fe394a4
- SSDEEP 49152:SWuoIOV9pWqHyPgdfbNTd9Iv7SDZw/WDL4Z//LGFFSWlEcF3TjN+eSHCrO91soiN:S04G/EcFMWN
- TLSH T1E6686C07EDA295ADC0DAA638CAAB45027765BC4D8B3533D72E10BB341F367D06EB9704
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
github
PE Signature issue
Digest
36:b0:f6:06:ce:eb:6b:76:3e:8a:89:3d:3b:05:68:82:cc:04:d0:65:e6:e0:a1:e4:35:f9:47:79:21:9e:57:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Apex Works Group,O=Apex Works Group,C=US
Chains
Nov 7, 2026
CN=Apex Works Group,O=Apex Works Group,C=US
Subject
CN=Apex Works Group,O=Apex Works Group,C=US
Serial Number
25:14:79:ce:c0:c6:27:a0:1b:35:78:6c:c2:f2:84:7a
Issuer
CN=Apex Works Group,O=Apex Works Group,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2026 - Nov 7, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
492224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
79KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
apt/SysWOW64/12520437.cpx
- SHA256 81ea3cf30a5b6db6bdfa0c71e3ed952c48fd72249e28e11465c6eb4fba49a41c
- MD5 0a0feb9eb28bde8cd835716343b03b14
- SHA1 a040d440ed71ad8f699ff6b92be0b55c4d56dcb6
- SHA512 b570b80a9c9db1fae0e595c028777742855673ce63b22f63f8a91c1ea52186d5e28a26928a56215a74ccfcff939235f953ef8a33265fcc5a6b78c7c98e9873ac
- TLSH T13941196A82E51BCE8EBBF9343475C4D606C7839D44B7A446E7EDDF89288300CD5F2921
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/12520850.cpx
- SHA256 df45b91d9bdd852f49cf043cbd2408c8e139643b413071ff2fa87bfb45940216
- MD5 d69ae057cd82d04ee7d311809abefb2a
- SHA1 065039ade1bcee6ba54c0d9c6527a03343098c94
- SHA512 ed5564c528c6ac70c1adbb09d5fcc3825fcd86572cc722334ee9b7cdca9408680e8b540dbc85f5a4dbdee9b14a60382fc62a1e5e44877a1366bfff02ef380ef6
- TLSH T12541CD9F83693FCE996BF6743461C49506D343AA84776046E7EDAF8669C300CD8F2D20
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/@AppHelpToast.png
- SHA256 89ec548c14582b2bdc7739bc0fa007ea5fd648e1690564638fdc6264103098a7
- MD5 d6f8dd9f561b8a67ffac2bad7e989770
- SHA1 92aba146963051eba49d076f5dca4d6fe7ca6050
- SHA512 6d12e003b06332a6b6a78f2ff7d8119c8354bbf98605313318c5b9306a1d253035262831fa43d8dcb3280e7d6598a9d68b5582f717f116d53838499883264959
- TLSH T13AD0A7924A41B8DC938B7A9A61240612EC1A510B613575234066D86199AB45688557B1
- MD5 SHA1 SHA512 TLSH
Password
github
apt/SysWOW64/@AudioToastIcon.png
- SHA256 0b99b2576f1fa0689ff6e03462076f4ca2c36d3b198511f7497fb9c89615c445
- MD5 82c37c3e27020af6c2e018e944284676
- SHA1 9b7823e961f459760344b8b7b1ed1dd415bc46fe
- SHA512 f609a0748da10f5d74a14af2f38760d9ffe6916d395ae7c510d9f3f38e50d3ab713fe6a3dcce30b4a1a60503e20a33595e1b2f84c68ae4fbc35d00c3a8bc3f74
- TLSH T100E07DE711102D35C5D7A43B32D00F40993EE24A594B9C36C35680A5A7764404E813E7
- MD5 SHA1 SHA512 TLSH
Password
github
apt/SysWOW64/@EnrollmentToastIcon.png
- SHA256 1170eba51c0737181fee01df67d3df68305bd0bdf15779195c2cfa03ca78456e
- MD5 495c1f072039b434827a5fe0d9761e4d
- SHA1 77a09a20d7662b86ec9207e4f0c6988ae58662ff
- SHA512 9a09d91ccc9162da3367a17f8afdb3d11b1715fdd008627eb795d1d38e24ba8b3ff4569272ba5a3c32e5d6f0c939080e95a9acbe8a333941096ebe63a9a1a2af
- TLSH T1B9E07DD6C29299E8DA841EBADAA3CD98AE2B9214041681BE418645055E6213CB189963
- MD5 SHA1 SHA512 TLSH
Password
github
apt/SysWOW64/@VpnToastIcon.png
- SHA256 22ffcf7b1aa6e0f1daa4ced8a08fbb8eece12c3d5e2681ec2c57539a8900c186
- MD5 1622de67156496c78d6b7be9b471645b
- SHA1 622baeae27bfa615886652046e88168c4a3241f7
- SHA512 68847c20032ee3d64673fc7227664d32b3828fe689d965bac40c87ef333bae174654fe2fe48ec267b78be86c8b75d6c55e71acf1b18887fab3343a5704179e2b
- TLSH T164E0F1BFB15494368E449A31162609C0EC0B4D56ADC8411EB0B0BE3A8F7233C81D2271
- MD5 SHA1 SHA512 TLSH
Password
github
apt/SysWOW64/@WirelessDisplayToast.png
- SHA256 4f10cdc52bb903b8e84257f62923b8e3635fe554fde344c27647cb6e7e369ee4
- MD5 db71001fc261f6685be410527dae3942
- SHA1 8961340bcce8e0aed88e59a0a1ddc0747075c996
- SHA512 fd0f1af1df251a761da935b3e34193d657d35dfc3eec08349656327a567a5b201e84ef0210275830df887701b22d4ec89cc6f51a9ea03cfc252529ee4e1820dd
- TLSH T12C014492034584BB079B4839A7132784825B0EFA26B97628B824C8562AB53F87A4F5C9
- MD5 SHA1 SHA512 TLSH
Password
github
apt/SysWOW64/APHostClient.dll
- IMPHASH 8276ab24c1202bdb6d4963359658a5d7
- SHA256 c764bd0a4333af4fd2bea52bb8d033b064a4fbfd8c880ae777a1fafa0a5871c8
- MD5 1c3b847a194fe9ee6b6fbfac4970f42d
- SHA1 4e3798287c486b017dbeee96c221dde2d86f29b2
- SHA512 3d412124ea16494934c8dfd2cac33986efd28e43f54c8227053d8cd35077f7d3dab7a506b5e7a639efdf046e6bb6df127995ca5e2dc939ecc85f6434a7a9da29
- SSDEEP 768:oyHeStzFmX6wVnn0XqYwN8sPKH6eNzj70re2mLj25:oy+gFutniqYs7CbNzjorcLM
- TLSH T1BB236DD6B34188F5C7A732793826BA36027CAD701F4189D35717A76E3C526C3AA7132A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
github
Minor OS version
0
Major OS version
10
Entry point
37248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
APHostClient.pdb
msvcrt
_vsnwprintf
memcpy
_except_handler4_common
_strnicmp
_purecall
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memcpy_s
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateMutexExW
EnterCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSection
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
GetTokenInformation
rpcrt4
NdrClientCall4
RpcSsDestroyClientContext
RpcAsyncCompleteCall
RpcBindingFree
NdrAsyncClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
RpcExceptionFilter
RpcStringFreeW
RpcBindingSetAuthInfoExW
ntdll
RtlCaptureContext
RtlReportException
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
ApHostServerStatus_EnsureServerReady
CreateAPHostClient
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=14, id=260, version=27412,
count=121, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=11, id=265, version=27412,
count=2, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AUDIOKSE.dll
- IMPHASH 519e9716a843c25c48164566f4ff2e0d
- SHA256 3488ca7723c3cec199914bef0ad9f1bfb1eba670815d3cbcf9e328b1c5defe5c
- MD5 ad7526e2f853cc42699b60ace42e4e78
- SHA1 80ae8cc6c37c48be3fe6a354562b9cfe271fcbb7
- SHA512 1980d25915ee42450ff29da43a149e28f77a2500e7b61ee3ec1770da9e551e78d3c974e5f78d3ec239ddfe8d9085464191f093f4c6445fd6344f359dd1a0c2f1
- SSDEEP 6144:v84JS1OdQty/vV8y9Q8ffC2iCYcmSk/lEQspJrfQsQcL+eWB7BWrB:v8adQo/qcQCYTSkfs7rYd7Bw
- TLSH T1FB847D64E74080A3E4F620B0625973F395FD2AF45BA450C70B609FBA79727C1AA34F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
github
Digest
5e:23:5a:d2:f0:6b:d7:84:9b:be:2b:0d:4a:88:bd:5e:c1:d3:45:d5:f3:45:fa:a9:55:39:23:fe:7b:da:3f:38
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e5:8f:6a:c0:f3:3d:b4:0b:a3:00:01:00:00:01:e5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
47808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AUDIOKSE.pdb
msvcrt
?terminate@@YAXXZ
_purecall
wcscat_s
malloc
wcsstr
wcscpy_s
_wcslwr
_initterm
_amsg_exit
_XcptFilter
_CIlog10
_CIpow
_CxxThrowException
__CxxFrameHandler3
_ftol2
_ftol2_sse
_resetstkoflw
memcmp
free
memcpy
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
wcsncpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
wcsnlen
strnlen
fclose
fseek
tolower
_strnicmp
strncmp
_wfopen
feof
fread
_wtol
wcsrchr
_lock
memset
ntdll
NtCreateFile
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlExtendMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlNtStatusToDosError
RtlFreeMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlCreateMemoryBlockLookaside
RtlUnlockMemoryBlockLookaside
NtQueryInformationProcess
RtlAllocateMemoryBlockLookaside
ShipAssert
RtlGetPersistedStateLocation
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
LoadLibraryExW
SizeofResource
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
LoadResource
GetModuleFileNameW
FindResourceExW
api-ms-win-core-synch-l1-1-0
CancelWaitableTimer
SetWaitableTimer
WaitForMultipleObjectsEx
CreateEventW
SetEvent
ResetEvent
CreateEventA
LeaveCriticalSection
EnterCriticalSection
CreateEventExW
DeleteCriticalSection
OpenSemaphoreW
InitializeCriticalSection
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
CreateWaitableTimerExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
CreateThread
SetThreadPriority
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
TraceEvent
api-ms-win-core-com-l1-1-0
PropVariantClear
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoGetMalloc
StringFromGUID2
api-ms-win-core-string-l2-1-0
CharLowerBuffW
CharNextW
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegGetValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceInitialize
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-memory-l1-1-0
VirtualAlloc
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualProtect
VirtualFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-memory-l1-1-1
GetProcessWorkingSetSizeEx
SetProcessWorkingSetSizeEx
api-ms-win-core-file-l1-1-0
CreateFileW
GetDiskFreeSpaceW
GetFileSize
api-ms-win-core-processenvironment-l1-1-0
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
mmdevapi
ord5
avrt
AvQuerySystemResponsiveness
AvSetMmThreadCharacteristicsA
AvSetMmThreadPriority
AvRevertMmThreadCharacteristics
api-ms-win-core-psapi-l1-1-0
K32EnumDeviceDrivers
K32GetDeviceDriverFileNameW
K32GetDeviceDriverBaseNameW
api-ms-win-devices-query-l1-1-0
DevCreateObjectQuery
DevCloseObjectQuery
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
322KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
512B
Virtual Size
327B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_BSS
Size
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_DATA
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_CONST
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=26715,
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=260, version=27412,
count=261, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=6, id=261, version=27412,
count=1, id=256, version=27412,
count=72, id=270, version=27412,
count=11, id=259, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AarSvc.dll
- IMPHASH b904c5e4fa495ccf4a977a95cf1683bc
- SHA256 420213e7e572d6ac871a63cb9c4a72b403730cf6938ad2591858a3ea15bf0592
- MD5 64cb36279f29577cddf5325fab394043
- SHA1 a00fc0f57a05e9a1179bc3fb8a80cfec27eff011
- SHA512 665dd5f67b75eb69a0249c04838409985f3f18cbdd72cab48e385c5351acb65b1b8e335b264171609321e9b53f447bfbaa7138653d933f963a3a20a868645f0f
- SSDEEP 6144:7kG0Kq8A0t9Gq5C6jJ51xL/U63Ugf+biO5xgt3mg1oRSHkJe:48JD5C6jJVL863UgW5xgD1B
- TLSH T17F7409B3F748A0B6D1AF2931140EE6A9577A95534BD0C3CBFE24839D2C666C44B3178E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
225424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AarSvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_toupper
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
wcschr
__std_terminate
__CxxFrameHandler3
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-com-l1-1-0
CoRevokeClassObject
CoInitializeSecurity
CoWaitForMultipleHandles
CoReleaseServerProcess
CoTaskMemAlloc
CoDecrementMTAUsage
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoGetMalloc
CoRegisterClassObject
CoUninitialize
CoAddRefServerProcess
CoCreateFreeThreadedMarshaler
CoResumeClassObjects
CoDisconnectContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
ResetEvent
LeaveCriticalSection
InitializeSRWLock
WaitForSingleObject
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
ReleaseSemaphore
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
CreateMutexW
CreateSemaphoreExW
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCreateStringReference
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
TerminateThread
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
RoRevokeActivationFactories
RoRegisterActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
agentactivationruntime
?ReleaseAgentActivationRuntime@@YGXXZ
?GetLoggerInstance@@YGAAVLogger@VoiceAgentServices@Microsoft@@XZ
?GetAgentActivationRuntime@@YG?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
?CreateAgentActivationRuntime@@YG?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
combase
ord66
ord68
ord69
ord67
systemeventsbrokerclient
SebEnumerateEventsByType
SebQueryEventPackage
msvcp_win
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Xlength_error@std@@YAXPBD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??Bid@locale@std@@QAEIXZ
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegFlushKey
RegQueryValueExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegCreateKeyW
ntdll
RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ServiceMain
Name
.text
Size
235KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=14, id=260, version=27412,
count=1259, id=1, productName=Unmarked objects,
count=8, id=257, version=27412,
count=1, id=256, version=27412,
count=13, id=265, version=27412,
count=29, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AboveLockAppHost.dll
- IMPHASH fa573cbb2f8d0efc122b9b95d458e673
- SHA256 e3efb4614a25fb6506677766c6a34319c9bfcc61ac062aef0620fa44564682dd
- MD5 a626c382a127b6fbf8e4c6329dc955a3
- SHA1 63abb74f551fdd9cb884e4d7fa218ec325b7f18e
- SHA512 00e009831b4249d7da5889ed6657cc98fb9a66455287c3b7272884aa1ee7108a026384af95067f54bd52ab341ac1972a483b77a468d5d98857ea99fb88a14b4e
- SSDEEP 6144:JKEQzthmZWVwRgsqEd3214PCzPd0SmPVjFKupeIhm8n0gAYJ:k7Zh8WCRHqEd219JYPNeIhm8n0g
- TLSH T18C646D346B290572E2E7313D712C2AB691ADD1A04FD054D7DB4842F82DE17E29E387AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
100096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AboveLockAppHost.pdb
msvcrt
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
memcpy_s
memmove_s
_vsnwprintf
_purecall
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_except_handler4_common
_wcsicmp
wcscspn
toupper
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_callnewh
??1type_info@@UAE@XZ
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
memcmp
wcsrchr
_ftol2_sse
__CxxFrameHandler3
memset
shcore
IUnknown_QueryService
SHTaskPoolQueueTask
SHGetThreadRef
rpcrt4
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_CountRefs
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
SleepConditionVariableSRW
InitOnceComplete
WakeAllConditionVariable
InitOnceBeginInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsGetStringLen
HSTRING_UserSize
WindowsCreateString
HSTRING_UserUnmarshal
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
HSTRING_UserFree
WindowsSubstringWithSpecifiedLength
HSTRING_UserMarshal
WindowsDeleteString
WindowsDuplicateString
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
EnterCriticalSection
OpenSemaphoreW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
CreateEventW
WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateMutexExW
SetEvent
LeaveCriticalSection
CreateSemaphoreExW
InitializeSRWLock
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventProviderEnabled
EventUnregister
EventActivityIdControl
api-ms-win-core-com-l1-1-0
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CoCreateInstance
CoGetStdMarshalEx
CoGetCallContext
CoGetMalloc
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoMarshalInterThreadInterfaceInStream
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegGetValueW
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
ntdll
NtQueryWnfStateData
RtlPublishWnfStateData
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
CStdStubBuffer2_CountRefs
ObjectStublessClient18
ObjectStublessClient20
CStdStubBuffer2_Disconnect
ObjectStublessClient5
CStdStubBuffer2_QueryInterface
ObjectStublessClient4
NdrProxyForwardingFunction4
ObjectStublessClient16
NdrProxyForwardingFunction5
ObjectStublessClient21
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient15
ObjectStublessClient3
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient10
ObjectStublessClient19
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient17
ObjectStublessClient12
api-ms-win-core-marshal-l1-1-0
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
UnregisterWait
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-shcore-thread-l1-1-0
GetProcessReference
combase
ord79
ord140
kernel32
GetSystemAppDataKey
OpenStateExplicit
CloseState
user32
SetRectEmpty
SetWindowLongW
GetWindowLongW
SetLayeredWindowAttributes
GetWindowThreadProcessId
SetWindowPos
IsIconic
GetWindowBand
IsZoomed
GetWindowRect
SetForegroundWindow
GetSystemMetrics
PostMessageW
GetShellWindow
SetPropW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
292KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=288, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=11, id=261, version=27412,
count=6, id=259, version=27412,
count=1, id=256, version=27412,
count=48, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AcGenral.dll
- IMPHASH cfac9aa030965dc89cae24a8eff928cc
- SHA256 d0163efb5caf6baa53ab8bd1ff3031f417636b9da68cec1676d294e4f7ac8faa
- MD5 cf79ba9d2aa40aa14a642fbc0f6870a1
- SHA1 411e2a318e5dd17d344876b1af8f9b33c732deb9
- SHA512 cca6df4afddabb299266d1ab6db9742d9da07e3d7c5c1a953af68e2b892413bc3434da879c91939f70e31c428a199f3ddd34ae0696bd9994f922845273c1b850
- SSDEEP 12288:bqLsexPBFRVyNGi/frOOPSWxIZwWkAhcNEhcNEhcNZhcNghcN6hcN6hcN3hcN+hV:bqLskPBFHyNzfSOPtx2wWk4INZ
- TLSH T1CCB5CB12E7E52149F2F35E70DEF56837937679951A2EC88F25C01F4E08F29805922BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
202752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcGenral.pdb
apphelp
SE_COM_AddHook
SE_COM_HookObject
SE_COM_Lookup
SE_COM_HookInterface
SE_CALLBACK_Lookup
SE_ShimDPF
SE_GetShimId
SdbInitDatabase
SdbGetPDBFromGUID
SdbResolveDatabase
SdbOpenLocalDatabase
SE_COM_AddServer
SE_CALLBACK_AddHook
SdbReleaseDatabase
SdbGetStringTagPtr
SdbFindNextTag
SdbFindFirstTag
msvcrt
memcmp
_local_unwind4
_CxxThrowException
memcpy
__CxxFrameHandler3
_wcsicmp
_vsnwprintf
_XcptFilter
_amsg_exit
free
malloc
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
memmove
__dllonexit
_onexit
??1type_info@@UAE@XZ
_vscprintf
_wcsupr
wcspbrk
wcschr
wcscpy_s
towupper
towlower
iswctype
wcsspn
toupper
wcsrchr
memset
_unlock
strrchr
wcstoul
_errno
_wcsnicmp
strchr
strtoul
wcstol
atoi
_vscwprintf
_vsnprintf
wcsncmp
strtok
atol
wcsstr
_stricmp
strstr
qsort
_wtoi
wprintf
_wcslwr_s
_wcslwr
_wsplitpath_s
iswspace
swscanf_s
_strnicmp
strncmp
wcscat_s
wcstok_s
_tempnam
ntdll
RtlIsNameInExpression
RtlInitializeCriticalSection
NtQueryInformationThread
NtQueryVirtualMemory
NtProtectVirtualMemory
DbgPrint
NtSetInformationProcess
NtClose
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlGUIDFromString
RtlIsDosDeviceName_U
RtlCreateServiceSid
RtlGetNtSystemRoot
RtlDosPathNameToNtPathName_U
NtOpenFile
NtQuerySecurityObject
RtlGetOwnerSecurityDescriptor
RtlEqualSid
NtOpenKey
NtQueryValueKey
NtCreateKey
NtSetValueKey
RtlFormatCurrentUserKeyPath
NtQueryObject
NtConnectPort
NtQueryVolumeInformationFile
RtlFreeUnicodeString
RtlOemStringToUnicodeString
RtlNtStatusToDosError
RtlImageNtHeader
RtlReAllocateHeap
RtlSubAuthoritySid
NtRequestWaitReplyPort
RtlGetDaclSecurityDescriptor
RtlSubAuthorityCountSid
NtQueryInformationToken
RtlFreeHeap
RtlAllocateHeap
RtlIdentifierAuthoritySid
RtlLengthRequiredSid
NtOpenThreadToken
NtOpenProcessToken
RtlInitializeSid
NtQueryInformationProcess
api-ms-win-service-core-l1-1-1
EnumDependentServicesW
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-service-management-l1-1-0
OpenServiceW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
StartServiceW
DeleteService
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
QueryServiceStatusEx
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
shlwapi
SHGetValueW
SHStrDupW
ord619
SHDeleteKeyW
uxtheme
SetThemeAppProperties
ord67
user32
AllowSetForegroundWindow
MsgWaitForMultipleObjects
PeekMessageW
SetWindowsHookExAW
SetCursor
GetWindowLongA
mouse_event
GetForegroundWindow
ShowWindow
InvalidateRect
SetForegroundWindow
PostMessageW
GetAncestor
GetClassNameW
EmptyClipboard
CharUpperW
DestroyIcon
CreateIconIndirect
GetIconInfo
SetPropW
RemovePropW
PostQuitMessage
RegisterWindowMessageA
EnumDesktopWindows
GetWindowTextA
GetWindowTextLengthA
ScreenToClient
GetWindowInfo
IsWindowVisible
GetWindow
IsChild
WindowFromDC
GetUpdateRgn
ShowCursor
GetActiveWindow
DefWindowProcA
GetShellWindow
SystemParametersInfoA
CloseDesktop
CharNextA
SetThreadDesktop
OpenInputDesktop
EnumDisplayDevicesW
ReleaseDC
GetDC
CallNextHookEx
GetKeyState
SetWindowsHookExA
DispatchMessageW
TranslateMessage
GetMessageW
SetSystemCursor
DestroyCursor
CopyIcon
LoadCursorW
GetWindowLongW
CallWindowProcA
EnumDisplaySettingsW
SendMessageW
RegisterSuspendResumeNotification
GetParent
SetWindowPos
GetWindowRect
GetDesktopWindow
GetMonitorInfoW
MonitorFromRect
GetSystemMetrics
SetRect
SystemParametersInfoW
GetWindowThreadProcessId
GetGUIThreadInfo
wvsprintfA
ChangeWindowMessageFilterEx
ChangeDisplaySettingsA
EnumDisplaySettingsA
SetDlgItemTextA
IsWindow
GetClientRect
IsCharAlphaA
GetPropW
gdi32
SelectPalette
RealizePalette
DeleteObject
GetCurrentObject
GetPaletteEntries
GetClipBox
CreateRectRgnIndirect
CreatePalette
CreateRectRgn
SetRectRgn
CombineRgn
GetStockObject
CreateDIBSection
GetObjectW
CreateCompatibleDC
GetRgnBox
SelectObject
SetSystemPaletteUse
SetViewportOrgEx
DeleteDC
BitBlt
CreateDCW
GetDeviceCaps
winmm
mciSendCommandA
samcli
NetLocalGroupAddMembers
NetLocalGroupAdd
ole32
CoUninitialize
CoInitialize
CoGetObject
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
RegisterTypeLibForUser
msacm32
acmStreamOpen
acmStreamSize
version
GetFileVersionInfoExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shell32
SHGetFolderPathEx
SHGetFolderPathW
SHChangeNotify
SHCreateDirectoryExW
SHGetSpecialFolderPathA
ShellExecuteExA
SHGetMalloc
ShellExecuteExW
ord165
SHGetSpecialFolderPathW
userenv
GetUserProfileDirectoryA
GetUserProfileDirectoryW
GetAllUsersProfileDirectoryW
dwmapi
DwmIsCompositionEnabled
urlmon
CoInternetSetFeatureEnabled
kernel32
GetDriveTypeA
WritePrivateProfileStringW
GetPrivateProfileStringW
CompareStringOrdinal
CompareStringW
CompareStringA
IsDBCSLeadByteEx
lstrlenA
GetLocaleInfoW
IsValidLocale
lstrcmpA
GetVolumeInformationW
DeviceIoControl
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetProcessAffinityMask
GetLogicalProcessorInformationEx
GetCurrentProcessorNumberEx
GetModuleHandleA
CheckElevationEnabled
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
ResumeThread
WriteProcessMemory
DuplicateHandle
VirtualAllocEx
ReadProcessMemory
OpenProcess
GetSystemInfo
GetWindowsDirectoryW
lstrcmpW
FormatMessageW
QueryPerformanceFrequency
GetSystemTime
ReadFile
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetSystemWindowsDirectoryW
AddDllDirectory
IsNLSDefinedString
FindNLSStringEx
WideCharToMultiByte
HeapReAlloc
FindNextFileA
InitializeCriticalSection
OutputDebugStringA
RaiseException
SearchPathA
QueryActCtxSettingsW
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
SearchPathW
lstrcmpiW
GlobalAlloc
ResolveDelayLoadedAPI
DelayLoadFailureHook
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
ProcessIdToSessionId
CreateActCtxW
LCMapStringEx
GetLocaleInfoEx
LCIDToLocaleName
CompareStringEx
GetTickCount64
GetBinaryTypeW
GetShortPathNameA
Module32First
CreateToolhelp32Snapshot
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
LoadLibraryA
GetSystemDirectoryA
CreateThread
ReleaseActCtx
QueryActCtxW
SetThreadPriority
SetThreadPriorityBoost
GetVersionExW
GetCommandLineW
GetDiskFreeSpaceExW
GetDiskFreeSpaceExA
GlobalFree
GetUserDefaultLCID
FreeLibrary
LoadLibraryExW
SetEnvironmentVariableA
FlushFileBuffers
DeleteFileW
FreeResource
GetFileSize
MapViewOfFile
UnmapViewOfFile
SetFileAttributesA
CopyFileA
MoveFileA
GetFileAttributesA
GetEnvironmentVariableA
MultiByteToWideChar
FindResourceW
CloseHandle
OpenMutexW
GetCurrentProcessId
CreateMutexW
Sleep
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetProcAddress
HeapAlloc
GetProcessHeap
GetCommandLineA
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateProcessA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapSize
HeapValidate
InitializeCriticalSectionAndSpinCount
VirtualAlloc
VirtualFree
SetProcessInformation
IsWow64Process
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
HeapFree
GetCurrentThread
CreateFileMappingA
CreateFileMappingW
GetLastError
LocalFree
GetDriveTypeW
CopyFileW
SetFileAttributesW
GetSystemDirectoryW
LoadLibraryW
MoveFileExW
GetTempPathA
GetTempFileNameA
CreateProcessW
WriteFile
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDrives
lstrlenW
FindResourceA
SizeofResource
LocalAlloc
LoadResource
LockResource
CreateFileA
DeleteFileA
SetErrorMode
SetLastError
GetCurrentDirectoryW
IsDBCSLeadByte
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
VirtualQuery
VirtualProtect
GlobalMemoryStatusEx
GetModuleFileNameA
CreateFileW
DeleteCriticalSection
advapi32
RegSetKeySecurity
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegEnumKeyExW
ConvertStringSidToSidW
LookupAccountSidW
RegOpenKeyExA
RegQueryValueExA
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
OpenProcessToken
LookupPrivilegeValueW
QueryServiceStatus
GetTokenInformation
CheckTokenMembership
RegUnLoadKeyW
RegLoadKeyW
GetNamedSecurityInfoW
RegGetValueW
FreeSid
AllocateAndInitializeSid
EqualSid
GetAclInformation
SetEntriesInAclW
GetExplicitEntriesFromAclW
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AdjustTokenPrivileges
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorLength
RegGetKeySecurity
LsaClose
LsaAddAccountRights
LsaNtStatusToWinError
LsaOpenPolicy
CreateWellKnownSid
RegSetValueExA
RegDeleteValueW
RegDeleteKeyExW
RegOpenKeyExW
winspool.drv
OpenPrinterA
ord201
GetPrinterA
ClosePrinter
EnumPrintersA
rpcrt4
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
NdrAsyncClientCall
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree
mpr
WNetGetConnectionW
sspicli
GetUserNameExW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
GetHookAPIs
NotifyShims
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
TEXT
Size
512B
Virtual Size
237B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=24, id=260, version=27412,
count=8, id=261, version=27412,
count=43, id=257, version=27412,
count=549, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=330, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AcLayers.dll
- IMPHASH d8b4bde806a7d2da00a2d12d72eea15b
- SHA256 5e3fb129761d5969d772403644dd474b42842fc688ee5dad5696e83a2a115d15
- MD5 f6820b6b6be064da4491197ff765e8ba
- SHA1 f6d31c9669f42acf794df7491fe8ff7e127dc720
- SHA512 3172dad3072116ee5754079357d0385cdd980246a3998e4691db489d85702639f5480e7d72880ce370edcc97b7359eb3c5b5ec3a7798196290659c98a0354adc
- SSDEEP 6144:V+4TsPmZMbi3FOzoABpZq4oVoB6dKAG3EA53RiARAA9N80sUYabLn3OWFWEef5Yf:Ah8+Zq4oeB6dpA6bUh3VFW3N1S
- TLSH T159841A00B6E81132E3B39DB409E8923359BABDE14B629DCF3114778B16352D29D36F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
120256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcLayers.pdb
apphelp
SE_COM_AddServer
SE_COM_HookObject
SE_COM_Lookup
SE_ShimDPF
SE_COM_AddHook
SE_GetShimId
msvcrt
memcpy
memcmp
_CxxThrowException
memmove
__CxxFrameHandler3
_wcsicmp
_vscwprintf
_vsnwprintf
_vsnprintf
_stricmp
atol
strstr
sprintf_s
vsprintf_s
sscanf_s
wcsncmp
_wcsnicmp
_scwprintf
wcsrchr
wcsspn
iswctype
towlower
wcscpy_s
wcscat_s
wcschr
wcspbrk
_wcslwr
wcsstr
_vscprintf
iswspace
_XcptFilter
_amsg_exit
free
malloc
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
memset
ntdll
RtlAllocateHeap
RtlFreeHeap
NtQueryKey
RtlNtStatusToDosError
RtlInitUnicodeString
RtlEqualUnicodeString
RtlImageNtHeader
NtClose
RtlReportException
NtTerminateProcess
RtlRaiseException
NtQueryInformationProcess
RtlUniform
RtlValidateHeap
RtlCaptureStackBackTrace
RtlCaptureContext
WinSqmAddToStream
NtOpenFile
NtQueryObject
LdrAccessResource
NtQuerySystemInformation
RtlLengthRequiredSid
RtlInitializeSid
NtQueryInformationToken
RtlSubAuthoritySid
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
NtOpenKey
NtQueryValueKey
RtlGetOwnerSecurityDescriptor
RtlEqualSid
RtlAppendUnicodeToString
RtlFormatCurrentUserKeyPath
RtlGetLastNtStatus
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlCreateServiceSid
RtlGetNtSystemRoot
RtlDosPathNameToNtPathName_U
NtQuerySecurityObject
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegGetKeySecurity
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorDacl
GetTokenInformation
GetAce
CheckTokenMembership
GetFileSecurityW
CopySid
AllocateAndInitializeSid
GetAclInformation
FreeSid
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
user32
AllowSetForegroundWindow
MsgWaitForMultipleObjects
CharUpperW
EnumDisplaySettingsW
GetCapture
ScreenToClient
GetAncestor
WindowFromPoint
InvalidateRect
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
KillTimer
EndPaint
BeginPaint
DefWindowProcW
GetSystemMetrics
PostQuitMessage
SetWindowPos
ChangeDisplaySettingsA
EnumDisplaySettingsA
GetWindowThreadProcessId
GetGUIThreadInfo
GetDesktopWindow
GetMonitorInfoW
PeekMessageW
SetCursor
EnableWindow
SetLayeredWindowAttributes
gdi32
GdiFlush
CreateCompatibleDC
CreateDIBSection
GetDIBits
DeleteObject
DeleteDC
CreateSolidBrush
OffsetWindowOrgEx
CreateCompatibleBitmap
SelectObject
OffsetClipRgn
OffsetRgn
GetObjectType
shell32
ShellExecuteExW
SHGetFolderPathW
SHGetFolderPathA
shlwapi
StrChrA
StrRChrA
StrCmpNA
ord10
ord9
ord8
StrStrIA
StrCSpnA
StrToIntA
StrChrW
StrRChrW
StrCmpNW
ord7
StrStrW
ord346
StrCSpnW
StrToIntW
StrChrIA
StrChrIW
StrRChrIA
StrRChrIW
StrRStrIA
StrRStrIW
StrCSpnIA
StrCSpnIW
IntlStrEqWorkerA
IntlStrEqWorkerW
PathFindFileNameW
StrCmpNIW
StrRetToBufW
StrStrA
StrCmpNIA
StrStrIW
oleaut32
SysReAllocString
mpr
WNetGetConnectionW
kernel32
WaitForSingleObject
GetCommandLineW
ReadFile
CancelIo
OutputDebugStringA
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
SetNamedPipeHandleState
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
InitializeSRWLock
GetCurrentThread
WerRegisterMemoryBlock
CreateProcessW
IsDebuggerPresent
IsWow64Process
ProcessIdToSessionId
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DelayLoadFailureHook
ResolveDelayLoadedAPI
SearchPathW
GetFullPathNameW
GetCurrentDirectoryW
CreateMutexW
OpenMutexW
CreateActCtxW
GetTempFileNameW
GetTempFileNameA
GetTempPathA
GetFileSize
SetFilePointer
CreateFileW
GetVolumeNameForVolumeMountPointW
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
WaitForSingleObjectEx
CreateThread
ResetEvent
SetEvent
GetFileAttributesW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
lstrcmpA
RegisterApplicationRestart
GetApplicationRestartSettings
ExpandEnvironmentStringsA
TlsAlloc
GetShortPathNameW
TlsSetValue
GetShortPathNameA
lstrcmpiA
TlsGetValue
GetVersionExW
CompareStringW
CompareStringA
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetTempPathW
DeleteFileW
CopyFileW
DeleteFileA
CopyFileA
QueryFullProcessImageNameW
LoadLibraryW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
GetCurrentThreadId
AcquireSRWLockShared
AddAtomW
FindNLSStringEx
IsNLSDefinedString
HeapReAlloc
LCMapStringEx
HeapFree
MultiByteToWideChar
GetProcessHeap
HeapAlloc
GetLocaleInfoEx
CompareStringEx
LCIDToLocaleName
WideCharToMultiByte
ExpandEnvironmentStringsW
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
ResumeThread
SetLastError
ReleaseActCtx
QueryActCtxW
GetCurrentActCtx
LocalFree
LocalAlloc
GetLastError
ExitProcess
GetCurrentProcess
GetModuleHandleW
GetSystemFirmwareTable
CloseHandle
CreateFileA
Sleep
GetCurrentProcessId
IsBadReadPtr
GetEnvironmentVariableA
SetEnvironmentVariableA
WriteFile
GetStartupInfoA
LoadLibraryA
GetProcAddress
GetCommandLineA
GetModuleHandleA
GetVersion
WaitForDebugEvent
ReadProcessMemory
WriteProcessMemory
setupapi
PnpIsFilePnpDriver
sfc
SfcIsFileProtected
SfcIsKeyProtected
winspool.drv
ord203
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree
RpcBindingSetAuthInfoExW
NdrAsyncClientCall
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
GetHookAPIs
NotifyShims
Name
.text
Size
317KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=27412,
count=4, id=259, version=27412,
count=27, id=257, version=27412,
count=378, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=81, id=270, version=27412,
count=15, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AcSpecfc.dll
- IMPHASH 2b0854da577a2f39685ec558b0052c1f
- SHA256 c3706d4f86ac7157e76382c255c0aa84dbae391282113f48791a9ae3d0502c20
- MD5 e9ea1fd3fe480dceb9e35e95032aeef1
- SHA1 9ada899144715427902a3d54bc5d870d932f6127
- SHA512 7fdd91af46ee4983e21e5ac055a089d11b9309b323c60bea196378b1a76e56807d26759a78190c793050b7dd3b95de53c0778cc2d1a4530820415c3fd59d9aad
- SSDEEP 6144:UmNgm0GiYRJCzk60h2rc3WPiLH92eFWHgg0uLUrEaJ+XBa0gTXqOxQdyKW+mu:2siwKcCiLd1WHggBAgaJrTHu
- TLSH T11CA42A74B4C00522F7ABBDB04A28B375D2EAED201B766CCB429163DB69711C24D357AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
125824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcSpecfc.pdb
apphelp
SE_CALLBACK_AddHook
SE_CALLBACK_Lookup
SE_COM_AddHook
SE_COM_AddServer
SE_COM_HookObject
SE_COM_Lookup
SE_COM_HookInterface
SE_ShimDPF
SE_GetShimId
msvcrt
__CxxFrameHandler3
_wcsicmp
_wcsnicmp
_stricmp
strncmp
_wtol
strstr
_strlwr
_vsnprintf
strrchr
_wtoi
memcpy
memcmp
wcsrchr
strcat_s
_strnicmp
strcpy_s
isalpha
wcsstr
wcstol
wcscat_s
_vsnwprintf
wcsspn
iswctype
towlower
towupper
wcsncmp
_CxxThrowException
memmove
_itow_s
wcschr
wcspbrk
_wcsupr
_wcslwr
_vscwprintf
_vscprintf
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wsplitpath_s
iswspace
memset
ntdll
RtlFreeHeap
LdrFindEntryForAddress
RtlInitUnicodeString
RtlGUIDFromString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlGetDaclSecurityDescriptor
RtlGetNtSystemRoot
NtProtectVirtualMemory
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
NtQueryInformationThread
NtClose
LdrEnumerateLoadedModules
NtQueryInformationFile
NtQueryObject
NtSetValueKey
RtlAllocateHeap
NtCreateKey
NtDeleteKey
NtEnumerateKey
NtQueryValueKey
NtOpenKey
RtlFormatCurrentUserKeyPath
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExA
RegEnumValueW
RegCreateKeyExA
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
GetSecurityDescriptorDacl
AccessCheck
AllocateAndInitializeSid
CheckTokenMembership
SetTokenInformation
AdjustTokenPrivileges
FreeSid
InitializeSecurityDescriptor
GetTokenInformation
sspicli
GetUserNameExW
comctl32
ImageList_Destroy
ord386
ord332
ord336
ImageList_Create
ord328
ord337
ord385
ImageList_Remove
ImageList_Add
ImageList_ReplaceIcon
ImageList_Replace
ord335
ord334
mscms
GetCountColorProfileElements
shlwapi
StrStrW
StrCmpIW
user32
GetUpdateRect
GetGUIThreadInfo
GetClassNameA
EndPaint
BeginPaint
ReleaseDC
GetDC
FillRect
GetClientRect
SetForegroundWindow
mouse_event
SendMessageW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
PeekMessageW
SendNotifyMessageW
SetWindowLongW
GetWindowThreadProcessId
DestroyWindow
GetWindowTextW
FindWindowExA
InvalidateRect
GetWindowLongW
GetClassInfoA
GetWindowLongA
GetDesktopWindow
GetParent
SetCursorPos
GetWindowRect
FindWindowW
DispatchMessageW
GetClassLongA
CreateWindowExA
ValidateRect
DefWindowProcW
MsgWaitForMultipleObjects
GetThreadDesktop
GetMonitorInfoW
TranslateMessage
SetCursor
GetUserObjectInformationW
PostQuitMessage
GetProcessWindowStation
GetAncestor
EnableWindow
ShowCursor
SetActiveWindow
AllowSetForegroundWindow
SendMessageTimeoutW
CallWindowProcA
SetWindowLongA
GetSystemMetrics
IsZoomed
EnumDisplaySettingsW
SetPropW
RemovePropW
GetPropW
LoadCursorW
CopyIcon
EnumChildWindows
DefWindowProcA
RegisterWindowMessageW
FindWindowA
GetCursorPos
DispatchMessageA
PostMessageA
ChangeDisplaySettingsA
GetClassNameW
RegisterClassA
EnumWindows
GetWindowInfo
kernel32
QueryDosDeviceW
VirtualAlloc
GetOverlappedResultEx
GetVersion
SetEvent
GetModuleHandleA
OpenMutexW
ExpandEnvironmentStringsW
lstrcmpW
GetVersionExW
GetLocalTime
SetLocaleInfoA
lstrcmpA
ReleaseMutex
K32GetModuleBaseNameW
WideCharToMultiByte
GetACP
SetFileAttributesW
CreateEventW
ProcessIdToSessionId
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
K32GetModuleInformation
GetCurrentThread
SwitchToThread
TrySubmitThreadpoolCallback
lstrlenA
GetSystemWindowsDirectoryA
lstrcmpiW
GlobalFree
GetCurrentDirectoryW
MoveFileExW
DeleteFileA
GetFileAttributesA
SetUnhandledExceptionFilter
CompareStringW
UnmapViewOfFile
OpenFileMappingA
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetTempFileNameA
GetTempPathA
CreateFileW
SetLastError
GetWindowsDirectoryA
GetFileAttributesW
GetExitCodeProcess
SearchPathW
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetLocaleInfoW
UnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResetEvent
CreateThread
Sleep
K32EnumProcesses
K32GetProcessImageFileNameW
SetEnvironmentVariableW
GetEnvironmentVariableW
LocalAlloc
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
HeapCreate
HeapReAlloc
GetModuleHandleExW
GetCurrentThreadId
SetThreadContext
GetCurrentProcessId
DeleteFileW
K32GetModuleFileNameExW
OpenProcess
MoveFileW
CompareStringA
ExpandEnvironmentStringsA
LockResource
LoadResource
FindResourceW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetCurrentDirectoryW
GetModuleFileNameW
IsBadReadPtr
MultiByteToWideChar
CreateFileA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
ExitProcess
CreateProcessA
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetModuleFileNameA
GetCommandLineW
TlsFree
TlsAlloc
TlsSetValue
GetSystemDefaultUILanguage
TlsGetValue
IsBadStringPtrW
IsBadStringPtrA
GetModuleHandleW
VirtualProtect
GetCurrentProcess
IsWow64Process
LocalFree
CopyFileW
CreateDirectoryW
WaitForSingleObject
CloseHandle
CreateProcessW
FindClose
FindNextFileW
GetLastError
FindFirstFileW
gdi32
CreateDIBSection
SetSystemPaletteUse
RealizePalette
SelectPalette
SetViewportExtEx
GetSystemPaletteEntries
DeleteDC
DeleteObject
BitBlt
SelectObject
SetWindowExtEx
SetMapMode
GdiIsScreenDC
CreatePalette
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
advapi32
GetNamedSecurityInfoW
EventWriteTransfer
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
RegEnumKeyW
RegDeleteKeyA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenProcessToken
LookupPrivilegeValueW
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW
StartServiceCtrlDispatcherW
SetEntriesInAclW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
QueryServiceStatus
RegOpenKeyA
ole32
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoGetObjectContext
CoInitialize
CoTaskMemAlloc
shell32
CommandLineToArgvW
ord155
ord102
SHChangeNotify
SHGetFolderPathA
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
oleaut32
VariantInit
ws2_32
WSASetLastError
userenv
GetUserProfileDirectoryW
GetAllUsersProfileDirectoryW
api-ms-win-mm-time-l1-1-0
timeGetTime
mpr
WNetGetConnectionW
WNetConnectionDialog
winmm
mciSendCommandA
ddraw
DirectDrawCreate
comdlg32
GetFileTitleA
imm32
ImmGetContext
rpcrt4
NdrAsyncClientCall
RpcBindingFree
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
dwmapi
DwmIsCompositionEnabled
msi
ord145
winspool.drv
ord202
OpenPrinterW
EnumFormsW
ord204
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
CleanupIS
GetHookAPIs
NotifyShims
StiCreateInstanceA
Name
.text
Size
395KB
Virtual Size
394KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.aomadmi
Size
512B
Virtual Size
10B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=21, id=260, version=27412,
count=7, id=261, version=27412,
count=43, id=257, version=27412,
count=438, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=371, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AcWinRT.dll
- IMPHASH 1f0bf92e23daa9de4cad856c30eddba6
- SHA256 5d6e4c256b0d817e2a5e3d34865f01e5fe4346f215ac29590e9a6b089eb09309
- MD5 b1025afd25c0732944afaacb9e07321c
- SHA1 17bdec62ecbeff175d44b77cc4d8202f7f7c58c3
- SHA512 2300c2ff9d921fc9a5ffa3619112793db40b72f88f7fb5fba69f4ebfdd35eafe23e12fce9cd67bf42ddf24f2cb4910e19e3c53e075bb3868c332dfed829d044e
- SSDEEP 1536:IZAKTIuT0c0FNlTPglkvq9qXqXqXq6Pfvqaq6z0pFMON7oz/mXuqR+6ciOK7oh/V:IJ+c9ddHexr8bwHSwYdq
- TLSH T1436308113AD443B2D9E376BC57B9A721673FBD605BE087C70F10029A4E726D09A347AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
33360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcWinRT.pdb
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
PropVariantClear
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringLen
WindowsGetStringRawBuffer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
AddDllDirectory
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
GetWindowsDirectoryW
GetVersionExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsA
GetEnvironmentVariableW
GetCommandLineA
GetEnvironmentStringsW
GetStdHandle
FreeEnvironmentStringsW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
GetFileType
WriteFile
GetFileAttributesW
api-ms-win-core-processthreads-l1-1-0
ExitProcess
TlsFree
TlsSetValue
GetStartupInfoW
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
HeapReAlloc
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualAlloc
VirtualQuery
VirtualFree
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-l1-2-0
GetCPInfo
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
apphelp
SE_COM_AddServer
SE_COM_AddHook
SE_GetShimId
SE_COM_Lookup
SE_WINRT_HookObject
SE_WINRT_AddHook
mmdevapi
ord5
ntdll
NtQueryKey
DbgPrint
GetHookAPIs
NotifyShims
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=27412,
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=16, id=259, version=27412,
count=28, id=261, version=27412,
count=79, id=260, version=27412,
count=1, id=256, version=27412,
count=19, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AcXtrnal.dll
- IMPHASH e8204b540abb5d3a06cec4d0159a6f64
- SHA256 74e806ec92105141400a92bd89b1dc17881df02a5014ebb421853a4ddeb90954
- MD5 7a8363e16731be3c2c8e19d8cc09c55b
- SHA1 c91428381a21769b8b0d43ad2ff51ecbf4484148
- SHA512 d580d64287ff24d410b47865fb328a57c034890f4f8d3185e50cc9d41523b97f35f088b917c73c4752676242d7bd0be5066e4ea8cef5563fa9c4081aa428bc8b
- SSDEEP 1536:kvR1FvU175th5AuXKoG1P7fTCUTj/y5BnJAGVrpXn6PO:U817R2JoEDTCUT+9JAGVrpXn6
- TLSH T19D8308637180C4BDC7DEBEB10289A1268EED4A440792C7E7FB50D6965E6F1E0483E1F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
65760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcXtrnal.pdb
apphelp
SE_GetShimId
SE_ShimDPF
msvcrt
memmove
memcpy
memcmp
_ftol2_sse
_ftol2
_CxxThrowException
_CIsqrt
_CIsin
_CIcos
_CIacos
free
__CxxFrameHandler3
_wcsicmp
rand
wcsstr
atol
tolower
_vsnprintf
towlower
_vsnwprintf
wcschr
wcspbrk
_strlwr
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
memset
_amsg_exit
_XcptFilter
strstr
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlInitUnicodeString
NtOpenKey
RtlNtStatusToDosError
NtQueryValueKey
NtQueryKey
NtEnumerateValueKey
NtClose
NtQueryInformationThread
LdrLockLoaderLock
LdrFindEntryForAddress
LdrUnlockLoaderLock
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-security-base-l1-1-0
IsValidSecurityDescriptor
GetSecurityDescriptorLength
kernel32
WaitForSingleObject
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetLastError
LocalFree
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CreateToolhelp32Snapshot
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
HeapFree
GetProcessHeap
HeapAlloc
CreateEventW
Sleep
SetEvent
Thread32Next
CloseHandle
QueueUserAPC
OpenThread
GetCurrentThreadId
Thread32First
GetCurrentProcessId
LocalAlloc
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
D3DRMColorGetAlpha
D3DRMColorGetBlue
D3DRMColorGetGreen
D3DRMColorGetRed
D3DRMCreateColorRGB
D3DRMCreateColorRGBA
D3DRMMatrixFromQuaternion
D3DRMQuaternionFromRotation
D3DRMQuaternionMultiply
D3DRMQuaternionSlerp
D3DRMVectorAdd
D3DRMVectorCrossProduct
D3DRMVectorDotProduct
D3DRMVectorModulus
D3DRMVectorNormalize
D3DRMVectorRandom
D3DRMVectorReflect
D3DRMVectorRotate
D3DRMVectorScale
D3DRMVectorSubtract
Direct3DRMCreate
GetHookAPIs
NotifyShims
glAccum
glAlphaFunc
glAreTexturesResident
glArrayElement
glBegin
glBindTexture
glBitmap
glBlendFunc
glCallList
glCallLists
glClear
glClearAccum
glClearColor
glClearDepth
glClearIndex
glClearStencil
glClipPlane
glColor3b
glColor3bv
glColor3d
glColor3dv
glColor3f
glColor3fv
glColor3i
glColor3iv
glColor3s
glColor3sv
glColor3ub
glColor3ubv
glColor3ui
glColor3uiv
glColor3us
glColor3usv
glColor4b
glColor4bv
glColor4d
glColor4dv
glColor4f
glColor4fv
glColor4i
glColor4iv
glColor4s
glColor4sv
glColor4ub
glColor4ubv
glColor4ui
glColor4uiv
glColor4us
glColor4usv
glColorMask
glColorMaterial
glColorPointer
glCopyPixels
glCopyTexImage1D
glCopyTexImage2D
glCopyTexSubImage1D
glCopyTexSubImage2D
glCullFace
glDeleteLists
glDeleteTextures
glDepthFunc
glDepthMask
glDepthRange
glDisable
glDisableClientState
glDrawArrays
glDrawBuffer
glDrawElements
glDrawPixels
glEdgeFlag
glEdgeFlagPointer
glEdgeFlagv
glEnable
glEnableClientState
glEnd
glEndList
glEvalCoord1d
glEvalCoord1dv
glEvalCoord1f
glEvalCoord1fv
glEvalCoord2d
glEvalCoord2dv
glEvalCoord2f
glEvalCoord2fv
glEvalMesh1
glEvalMesh2
glEvalPoint1
glEvalPoint2
glFeedbackBuffer
glFinish
glFlush
glFogf
glFogfv
glFogi
glFogiv
glFrontFace
glFrustum
glGenLists
glGenTextures
glGetBooleanv
glGetClipPlane
glGetDoublev
glGetError
glGetFloatv
glGetIntegerv
glGetLightfv
glGetLightiv
glGetMapdv
glGetMapfv
glGetMapiv
glGetMaterialfv
glGetMaterialiv
glGetPixelMapfv
glGetPixelMapuiv
glGetPixelMapusv
glGetPointerv
glGetPolygonStipple
glGetString
glGetTexEnvfv
glGetTexEnviv
glGetTexGendv
glGetTexGenfv
glGetTexGeniv
glGetTexImage
glGetTexLevelParameterfv
glGetTexLevelParameteriv
glGetTexParameterfv
glGetTexParameteriv
glHint
glIndexMask
glIndexPointer
glIndexd
glIndexdv
glIndexf
glIndexfv
glIndexi
glIndexiv
glIndexs
glIndexsv
glIndexub
glIndexubv
glInitNames
glInterleavedArrays
glIsEnabled
glIsList
glIsTexture
glLightModelf
glLightModelfv
glLightModeli
glLightModeliv
glLightf
glLightfv
glLighti
glLightiv
glLineStipple
glLineWidth
glListBase
glLoadIdentity
glLoadMatrixd
glLoadMatrixf
glLoadName
glLogicOp
glMap1d
glMap1f
glMap2d
glMap2f
glMapGrid1d
glMapGrid1f
glMapGrid2d
glMapGrid2f
glMaterialf
glMaterialfv
glMateriali
glMaterialiv
glMatrixMode
glMultMatrixd
glMultMatrixf
glNewList
glNormal3b
glNormal3bv
glNormal3d
glNormal3dv
glNormal3f
glNormal3fv
glNormal3i
glNormal3iv
glNormal3s
glNormal3sv
glNormalPointer
glOrtho
glPassThrough
glPixelMapfv
glPixelMapuiv
glPixelMapusv
glPixelStoref
glPixelStorei
glPixelTransferf
glPixelTransferi
glPixelZoom
glPointSize
glPolygonMode
glPolygonOffset
glPolygonStipple
glPopAttrib
glPopClientAttrib
glPopMatrix
glPopName
glPrioritizeTextures
glPushAttrib
glPushClientAttrib
glPushMatrix
glPushName
glRasterPos2d
glRasterPos2dv
glRasterPos2f
glRasterPos2fv
glRasterPos2i
glRasterPos2iv
glRasterPos2s
glRasterPos2sv
glRasterPos3d
glRasterPos3dv
glRasterPos3f
glRasterPos3fv
glRasterPos3i
glRasterPos3iv
glRasterPos3s
glRasterPos3sv
glRasterPos4d
glRasterPos4dv
glRasterPos4f
glRasterPos4fv
glRasterPos4i
glRasterPos4iv
glRasterPos4s
glRasterPos4sv
glReadBuffer
glReadPixels
glRectd
glRectdv
glRectf
glRectfv
glRecti
glRectiv
glRects
glRectsv
glRenderMode
glRotated
glRotatef
glScaled
glScalef
glScissor
glSelectBuffer
glShadeModel
glStencilFunc
glStencilMask
glStencilOp
glTexCoord1d
glTexCoord1dv
glTexCoord1f
glTexCoord1fv
glTexCoord1i
glTexCoord1iv
glTexCoord1s
glTexCoord1sv
glTexCoord2d
glTexCoord2dv
glTexCoord2f
glTexCoord2fv
glTexCoord2i
glTexCoord2iv
glTexCoord2s
glTexCoord2sv
glTexCoord3d
glTexCoord3dv
glTexCoord3f
glTexCoord3fv
glTexCoord3i
glTexCoord3iv
glTexCoord3s
glTexCoord3sv
glTexCoord4d
glTexCoord4dv
glTexCoord4f
glTexCoord4fv
glTexCoord4i
glTexCoord4iv
glTexCoord4s
glTexCoord4sv
glTexCoordPointer
glTexEnvf
glTexEnvfv
glTexEnvi
glTexEnviv
glTexGend
glTexGendv
glTexGenf
glTexGenfv
glTexGeni
glTexGeniv
glTexImage1D
glTexImage2D
glTexParameterf
glTexParameterfv
glTexParameteri
glTexParameteriv
glTexSubImage1D
glTexSubImage2D
glTranslated
glTranslatef
glVertex2d
glVertex2dv
glVertex2f
glVertex2fv
glVertex2i
glVertex2iv
glVertex2s
glVertex2sv
glVertex3d
glVertex3dv
glVertex3f
glVertex3fv
glVertex3i
glVertex3iv
glVertex3s
glVertex3sv
glVertex4d
glVertex4dv
glVertex4f
glVertex4fv
glVertex4i
glVertex4iv
glVertex4s
glVertex4sv
glVertexPointer
glViewport
wglChoosePixelFormat
wglCopyContext
wglCreateContext
wglCreateLayerContext
wglDeleteContext
wglDescribeLayerPlane
wglDescribePixelFormat
wglGetCurrentContext
wglGetCurrentDC
wglGetDefaultProcAddress
wglGetLayerPaletteEntries
wglGetPixelFormat
wglGetProcAddress
wglMakeCurrent
wglRealizeLayerPalette
wglSetLayerPaletteEntries
wglSetPixelFormat
wglShareLists
wglSwapBuffers
wglSwapLayerBuffers
wglUseFontBitmapsA
wglUseFontBitmapsW
wglUseFontOutlinesA
wglUseFontOutlinesW
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=27412,
count=2, id=259, version=27412,
count=13, id=260, version=27412,
count=9, id=257, version=27412,
count=159, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=21, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AccountsRt.dll
- IMPHASH 57efe72137aaae1805999594a0e6bab8
- SHA256 6a58df2b2e33000cf78f53fa2be1d4ea579ad9269b1ea4a58b8437139e51b998
- MD5 9e4ed0a8d9104cab5e9bcc22214178a7
- SHA1 6a73bcac48257288f20090b64ad672a69362028b
- SHA512 64490c33907c08939380125a9fd1a47827904e17d0cabfd802068a33944972ac9955f5b26cc2e42ddbe4eb57ad1fc46384a33ce94ee475b893c5211876fe5b7c
- SSDEEP 6144:K6FKnJCZ7thyO8w4txzq+ZM3beLQjuvsRMag/jLGn4MBn7ppUDeftorUY9B:x7thyO2G+ZM3beFvsK/jan4MB7pqelYD
- TLSH T11E744B2267871471DEA2B2F438ADB23399FDAA900B40C5C3CA45C5EC7CE56E15D3936B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
114240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AccountsRT.pdb
msvcrt
wcstok_s
_amsg_exit
_XcptFilter
_wcsicmp
realloc
__CxxFrameHandler3
_lock
_unlock
memmove_s
_initterm
wcsncpy_s
malloc
free
_purecall
wcschr
__dllonexit
_vsnwprintf_s
_onexit
_strnicmp
memmove
_except_handler4_common
memcmp
memcpy
memcpy_s
_errno
_vsnwprintf
_callnewh
wcstoul
memset
oleaut32
SysFreeString
BSTR_UserMarshal
SysStringLen
BSTR_UserFree
BSTR_UserSize
VarUI4FromStr
BSTR_UserUnmarshal
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadResource
FindResourceExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
ReleaseMutex
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringLen
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsPreallocateStringBuffer
WindowsDuplicateString
WindowsDeleteStringBuffer
WindowsCreateString
WindowsConcatString
WindowsPromoteStringBuffer
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoTaskMemAlloc
CoGetApartmentType
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
CoDecrementMTAUsage
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
TerminateProcess
GetCurrentProcess
OpenThreadToken
SetThreadToken
GetCurrentProcessId
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
DisassociateCurrentThreadFromCallback
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
api-ms-win-security-base-l1-1-0
RevertToSelf
GetTokenInformation
GetLengthSid
CopySid
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-com-l1-1-1
RoGetAgileReference
crypt32
CertEnumCertificatesInStore
CertCloseStore
CryptDecodeObjectEx
CertFreeCertificateChain
CertOpenStore
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertGetNameStringW
CertCompareCertificateName
CertGetCertificateChain
CertFreeCertificateChainEngine
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-file-l1-1-0
ReadFile
GetFileSize
CreateFileW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
ntdll
RtlCaptureContext
RtlReportException
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcSsDestroyClientContext
NdrClientCall4
RpcExceptionFilter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
aphostclient
ApHostServerStatus_EnsureServerReady
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
299KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=16, id=260, version=27412,
count=233, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=23, id=270, version=27412,
count=7, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActionCenter.dll
- IMPHASH 9ef310b78b395cc229e0e195a9883d49
- SHA256 7a09722c8cb890d50fde632713bb0497a0e01a5aa9e974f50a688a0c029bbfa6
- MD5 f240305dd64ba0144e5d288c75878e08
- SHA1 53378553cde8951658dc136badb6164162133229
- SHA512 65187b69ab6974b75a43535ba096e4ba0fe71b213ad4dabbc019166bdfa33e51000acc592cd537eebdbfbcb14fbd13e191b9c556f828215882a0e75a926b9736
- SSDEEP 6144:TKkIMCly9MDA3Bb0LLpjQKgji+AuhbyEJqgB7PFsCPJI:FFClymE3BmQjcEJrPFZJI
- TLSH T111445D06A78D4A73E17A2530ABDA53214666BD3087C199CB6ED0E79D1C325C27E34B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
100192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActionCenter.pdb
msvcrt
__dllonexit
_unlock
_lock
_onexit
_amsg_exit
_XcptFilter
memcmp
_except_handler4_common
_vsnwprintf
memcpy
isdigit
__CxxFrameHandler3
_callnewh
malloc
free
_purecall
memcpy_s
_initterm
memset
shell32
ord68
ShellExecuteExW
ord100
SHQueryUserNotificationState
shlwapi
StrCmpW
HashData
ord158
SHRegGetValueW
ord278
ord219
StrStrW
StrCmpIW
StrChrW
PathParseIconLocationW
ord631
rpcrt4
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleA
FreeLibrary
LoadStringW
GetProcAddress
GetModuleHandleW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockShared
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegGetValueW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetMalloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
LoadLibraryA
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient9
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
crypt32
CryptProtectData
CryptUnprotectData
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-marshal-l1-1-0
HWND_UserSize
HWND_UserFree
HWND_UserMarshal
HWND_UserUnmarshal
comctl32
ord335
ord328
ord334
ord386
ord329
ord332
ord336
ntdll
WinSqmAddToStream
WinSqmAddToStreamEx
user32
SetTimer
GetWindowLongW
SendMessageW
PostMessageW
DefWindowProcW
KillTimer
wevtapi
EvtCreateBookmark
EvtSeek
EvtQuery
EvtCreateRenderContext
EvtRender
EvtNext
EvtUpdateBookmark
EvtSubscribe
EvtClose
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
198KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=3, id=259, version=27412,
count=212, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=44, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActionCenterCPL.dll
- IMPHASH 16d4fc3f67fc6d6407d7bf95e255f2b1
- SHA256 44e9ebc6f6ac8f5364ffd9b53140328c968b946ad1c9f8c93c7b5dd4af91b1d1
- MD5 1d1d578902c7bafec26bccf5f7565f5d
- SHA1 c1128dc352b3fb66ded132c970a9d4566493b0b8
- SHA512 06d26e5495112efe6b2a18d5551bf203539935adeaa17224b50ff8939f3349f541c70aa8e67cf20358052cb4b58ea05c58e2d1989cae6684405edee5476b6f68
- SSDEEP 3072:1CXn7EEDTPXQ4EFKIghYLaNurGRxVv6boZoHWkSYjHUxa6uzbDTtBZ0cW2ZlYgkS:obMzbDxBZhW2ZlwZVopc
- TLSH T1A9C33C2173980071D2E6313C7EBD5631ADAFF630871A06DB771886962961AC2AE3477F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
98960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActionCenterCPL.pdb
msvcrt
free
malloc
_XcptFilter
_initterm
_lock
memcmp
memcpy_s
_unlock
_amsg_exit
_onexit
_except_handler4_common
__CxxFrameHandler3
memmove_s
_vsnwprintf
_vsnprintf_s
__dllonexit
memset
shell32
ShellExecuteExW
SHParseDisplayName
ord155
SHGetStockIconInfo
ord18
ord25
SHBindToObject
shlwapi
ord538
SHStrDupW
ord168
ord514
ord24
ord618
ord156
ord204
ord174
StrCmpW
PathParseIconLocationW
ord460
ord199
ord219
ord256
ord437
ord176
ord158
ord172
uxtheme
IsThemeActive
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadStringW
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
OpenSemaphoreW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
oleaut32
VariantClear
SysAllocString
SysFreeString
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
kernel32
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
ntdll
EtwLogTraceEvent
WinSqmIsOptedIn
WinSqmAddToStream
EtwEventWriteTransfer
dui70
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
??0Expando@DirectUI@@QAE@XZ
??1Expando@DirectUI@@UAE@XZ
?Add@Expando@DirectUI@@UAEJPAPAVElement@2@I@Z
?OnEvent@Expando@DirectUI@@UAEXPAUEvent@2@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??0Macro@DirectUI@@QAE@XZ
??0Repeater@DirectUI@@QAE@XZ
?OnPropertyChanged@Macro@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Add@Macro@DirectUI@@UAEJPAPAVElement@2@I@Z
?GetClassInfoPtr@Macro@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Repeater@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@Expando@DirectUI@@QAEJPAVElement@2@PAK@Z
?_PostEvent@Element@DirectUI@@AAEXPAUEvent@2@H@Z
?GetClassInfoPtr@Bind@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Macro@DirectUI@@SGJXZ
?Register@Repeater@DirectUI@@SGJXZ
?Register@Expando@DirectUI@@SGJXZ
?UpdateChildren@Expando@DirectUI@@IAEXPAVValue@2@@Z
?ExpandedProp@Expandable@DirectUI@@SGPBUPropertyInfo@2@XZ
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?SetExpand@Macro@DirectUI@@QAEJPBG@Z
?GetExpand@Macro@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?RemoveAll@Element@DirectUI@@QAEJXZ
?GetProperty@Bind@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetConnect@Bind@DirectUI@@QAEPBGPAPAVValue@2@@Z
?BuildElement@Macro@DirectUI@@MAEJXZ
?Initialize@Macro@DirectUI@@QAEJPAVElement@2@PAK@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
??0IDataEngine@DirectUI@@QAE@XZ
??1IDataEngine@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
??1IDataEntry@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??0Element@DirectUI@@QAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??1CritSecLock@DirectUI@@QAE@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
??1Element@DirectUI@@UAE@XZ
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?GetAccName@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Release@Value@DirectUI@@QAEXXZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?SetAnimation@Element@DirectUI@@QAEJH@Z
?SetClass@Element@DirectUI@@QAEJPBG@Z
gdi32
DeleteObject
user32
GetFocus
SendMessageW
GetSystemMetrics
LoadImageW
LoadCursorW
DestroyIcon
GetWindowLongW
CallWindowProcW
SetWindowLongW
SystemParametersInfoW
SetCursor
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=3, id=261, version=27412,
count=357, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=28, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActionCenterCPL.dll.mun
- SHA256 480c05864e8cc7d404b6661bc3771c8539bd29a6e6c5d12ae02248d1dedfee4b
- MD5 6141d2c8e6d9f388045e875ebb8f5ebc
- SHA1 db3e2ab252d276860ae3e4938bd38c00b370e155
- SHA512 419db8847a0dfa7ece9f4aa0cf44f6a12989d117ffb1aa70f50b218a4c41a859eec279b0d873dd8b19d03fbcd0238dbdbf91e3586cceae58749ebce8144c9baf
- SSDEEP 6144:U8TDk9F1vtANCX2G8M1JOlTP17Ntg1NlZTGG+aPx7aCTVJd9Me4s/X5iuhYmWIw:Nq2GPJEP1ptg1/zJHMed87o
- TLSH T1F494CF00B205DC51D26F7235F953EF599294EC12CA054B4372A33B5F3DB2EA2A4FA31A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
424KB
Virtual Size
424KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActivationClient.dll
- IMPHASH 2392a4dd077a2bf1ca79f5370d98befe
- SHA256 f1c10d61f12de08eeb84ab349ef17c002213c658fd3d336ed72676efb201a09e
- MD5 cbad3afa6b915122334a2727f8055e44
- SHA1 4092b1ab7e1eccf1039d808949dd2581a1ada1de
- SHA512 7c5bbd053a5d9486688a73553befd2e309a668fc5adfd4faea13dce400dff74730a7c4e71ea5686a5a3a83faf4af2e03c08b7b7310b0480c10c61f79c01d5eb8
- SSDEEP 768:SpF7BWUgYxDDfLlVL5WzuBvJ3fT3/Y1wGte0:yF7EUNblVVWSJ3D/YmGte
- TLSH T1B7131822AA8849B2E7E6317974AD3539936C9C600FE049C31F1397EB6D157C3B97824F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
33056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActivationClient.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
memcpy
_o__seh_filter_dll
_o_free
_o_malloc
_except_handler4_common
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateSemaphoreExW
AcquireSRWLockShared
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemRealloc
CoSetProxyBlanket
CoTaskMemFree
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
combase
ord140
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1150, id=1, productName=Unmarked objects,
count=2, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=6, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActivationManager.dll
- IMPHASH b5942226a87c8c83a37ebb48f1a2db92
- SHA256 215d9a8aa07bffd46252e5943feee5501e65e7a7f7ff67f35a4998cf6cc0b427
- MD5 c5596e29b36adfd2c92931c2c4904fd0
- SHA1 24602de0425fc24c8600f58ef809f47304f39da2
- SHA512 160e76373594c7f862d260cfaa272d33347f92cd354d1f46cf66d68c5398a799e53510d38eddd345f95e45904b8731d34f0c3a27e364aeb266c808d6853dac95
- SSDEEP 12288:auhZqoUHx0KdrPovD8uPkrXBGJgHQcuxvwd:dhZRcdRg78uPkrduid
- TLSH T114D46C3197855872E6E720753518723651FDE6B40B20C4C7EF448EEE2EA17C3AA3A74B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
222736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActivationManager.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__wcsicmp
memmove
_o_ceil
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcstok_s
_except_handler4_common
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__get_errno
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__crt_atexit
_o__configure_narrow_argv
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__cexit
_o__callnewh
wcschr
wcsrchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
memmove_s
wcscspn
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
CreateEventExW
InitializeCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
ResetEvent
InitializeSRWLock
OpenEventW
EnterCriticalSection
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetProcessId
CreateThread
GetThreadId
OpenProcessToken
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
OpenThread
CreateProcessAsUserW
SetThreadPriority
ProcessIdToSessionId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
SetThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
SysFreeString
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventActivityIdControl
EventUnregister
EventRegister
ntdll
RtlLengthSid
NtClose
RtlCopySid
NtOpenProcessToken
RtlWakeAllConditionVariable
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku
NtOpenProcessTokenEx
NtQueryInformationToken
RtlNtStatusToDosError
RtlIsParentOfChildAppContainer
RtlQueryTokenHostIdAsUlong64
RtlExpandEnvironmentStrings
RtlInitUnicodeString
NtQuerySecurityAttributesToken
RtlCapabilityCheck
NtQueryInformationProcess
RtlFreeHeap
RtlSleepConditionVariableSRW
RtlAllocateHeap
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
NtTerminateProcess
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-com-l1-1-0
CoRevokeClassObject
CoAddRefServerProcess
CoGetApartmentType
CoGetStdMarshalEx
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoWaitForMultipleHandles
CoMarshalInterThreadInterfaceInStream
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoGetCallerTID
CoGetCallContext
CoInitializeEx
CoImpersonateClient
CoRevertToSelf
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoRegisterClassObject
CoGetMalloc
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoReleaseServerProcess
CoCreateGuid
CLSIDFromString
CoResumeClassObjects
CoCreateInstance
CoTaskMemFree
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoRegisterActivationFactories
RoRevokeActivationFactories
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsDeleteString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
WindowsConcatString
WindowsGetStringRawBuffer
WindowsCreateString
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount64
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-appmodel-runtime-internal-l1-1-3
CouldMultiUserAppsBehaviorBePossibleForPackage
api-ms-win-appmodel-runtime-internal-l1-1-4
IsOnDemandRegistrationSupportedForExtensionCategory
GetExtensionApplicationUserModelId
api-ms-win-appmodel-runtime-internal-l1-1-1
GetPackageStatus
GetPackageFullNameFromToken
GetPackageStatusForUser
api-ms-win-appmodel-runtime-internal-l1-1-0
GetPackageApplicationPropertyString
GetPackageApplicationContext
api-ms-win-appmodel-runtime-internal-l1-1-6
OpenPackageInfoByFullNameForMachine
api-ms-win-appmodel-runtime-internal-l1-1-2
GetEffectivePackageStatusForUser
appxdeploymentclient
ord68
twinapi.appcore
ord2
ord3
msvcp_win
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Xbad_alloc@std@@YAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?exceptions@ios_base@std@@QAEXH@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
??Bios_base@std@@QBE_NXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?_Xlength_error@std@@YAXPBD@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
GetProcessReference
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegCloseKey
RegGetValueW
RegQueryValueExW
RegDeleteTreeW
RegOpenCurrentUser
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-com-private-l1-1-0
CoRevokeRacActivationToken
CoGetErrorInfo
CoRegisterRacActivationToken
CoSetErrorInfo
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_QueryService
IUnknown_SetSite
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
GetProductInfo
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-psm-key-l1-1-1
PsmCreateKeyWithDynamicId
api-ms-win-core-psm-key-l1-1-0
PsmGetKeyFromToken
PsmCreateKey
PsmGetKeyFromProcess
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
rpcrt4
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcServerInqCallAttributesW
RpcRevertToSelf
RpcImpersonateClient
NdrAsyncClientCall
RpcAsyncCompleteCall
I_RpcBindingInqLocalClientPID
RpcAsyncInitializeHandle
I_RpcExceptionFilter
RpcBindingFromStringBindingW
RpcStringBindingComposeW
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf
GetAce
DuplicateTokenEx
GetLengthSid
IsWellKnownSid
FreeSid
CopySid
IsValidSid
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpLogicalW
StrCmpIW
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabledForPackage
api-ms-win-appmodel-identity-l1-2-0
AppXGetOSMaxVersionTested
coremessaging
CoreUICreateEx
CoreUICreate
MsgStringCreateShared
MsgRelease
MsgBlobCreateShared
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
PathIsPrefixW
PathIsRelativeW
api-ms-win-core-winrt-registration-l1-1-0
RoGetActivatableClassRegistration
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchAppend
PathCchRemoveFileSpec
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-wow64-l1-1-1
GetSystemWow64Directory2W
profapi
ord102
ord101
api-ms-win-security-provider-l1-1-0
GetNamedSecurityInfoW
api-ms-win-security-sddlparsecond-l1-1-0
LocalGetStringForCondition
mpr
WNetGetConnectionW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord79
ord140
ord65
ord159
api-ms-win-shcore-stream-l1-1-0
IStream_Write
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-appmodel-state-l1-2-0
GetSystemAppDataKey
OpenStateExplicit
CloseState
DisableAppXDebuggingForPackage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EnableAppXDebuggingForPackage
FreeAppXLaunchContext
GetPackageExecutionContextForAumid
GetPackageExecutionContextForAumidAndUser
GetPackageExecutionContextForDeviceFamilyName
GetPackageExecutionContextForPackageByFullName
PostCreateProcessAppXActivation
PrepareAppXActivation
RegisterAppXPackageIfNecessary
RegisterAppXPackageIfNecessary2
Name
.text
Size
586KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=173, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=26, id=260, version=27412,
count=1585, id=1, productName=Unmarked objects,
count=8, id=257, version=27412,
count=1, id=256, version=27412,
count=86, id=270, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ActiveSyncProvider.dll
- IMPHASH 07b0f18defbcabdb2e06f5a701d14ea9
- SHA256 8b955b21d7970f992eb31cac7a464e07aed306752b3728f089f291363d2dd2c4
- MD5 29e2147cbaaed6b494537e917c983301
- SHA1 7ecd2ef9d723fcafcccab1e9b6299a30b526e853
- SHA512 9f86a8159a5db9dc65cd3838b5023c1ce3071fa767a1f9fc9af11ef25e639f499e8409f01a1ca2bbc990799ae58ce532c760b95b621974190a608140745e39b7
- SSDEEP 24576:st/XwhBgNB6aCTq6jbEAoY2kGHW5iUTYQ7xHkCQ6wPMGGPDNkX9BI7/X7Yxj+:stP8BgNBcwxkGHWYUT2CQ6tLXH
- TLSH T12C655C5627848478E7B23373795B373DD29C86044B485ECBA3198AB27E41EC3AD3619F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
245984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActiveSyncProvider.pdb
msvcrt
_i64tow_s
iswspace
iswcntrl
_wcsdup
memmove_s
__CxxFrameHandler3
?terminate@@YAXXZ
_initterm
_except_handler4_common
_lock
_wcstoui64
_wcstoi64
__dllonexit
wcstol
_amsg_exit
strnlen
_wcsnicmp
_vsnprintf_s
wcspbrk
_vscwprintf
_vswprintf_p_l
_vscwprintf_p_l
_vsprintf_p_l
_vscprintf_p_l
wcsnlen
wcsstr
iswdigit
wcstok_s
malloc
_vsnwprintf_s
wcschr
_snwprintf_s
wcsncmp
wcstod
_ltow_s
swscanf_s
_wcsicmp
free
_strnicmp
_purecall
memcpy_s
_ultow_s
wcstoul
_wtoi
_itow_s
_wtol
_vsnwprintf
_callnewh
_onexit
_errno
realloc
memmove
memcpy
memcmp
_XcptFilter
_unlock
_vsnprintf
memchr
wcsrchr
swscanf
floor
memset
ntdll
RtlCaptureContext
RtlReportException
syncutil
GetSessionSyncStats
AggregateAccountSyncStats
GetAccountSyncStats
ord24
ord48
ord52
ord51
IsFirstSyncEver
GetCurrentSyncStats
ord21
ord453
DeviceNeedsProvisioning
ord89
CoCreateInstanceElevated
AcquireDataStoreLock
ord470
ord28
ord26
GetAuthCertTargetAndUser
CredVaultDelete
CredVaultWrite
CredVaultRead
ord702
IsMatchingClientCertificateEx
ord118
ord121
ord120
CreateAuthHandler
ord442
ord94
ord31
ord22
ord274
ord273
ord701
ord66
ord67
ord256
ord17
ord268
GetAADToken
ord502
ord500
AcquireDataStoreLockEx
ord501
ord505
ord109
ord87
ord269
IsValidAADAuthUri
GetGoldenPartnershipId
ord23
ord461
ord464
GetDefaultStoreDirty
SetDefaultStoreDirty
GetMsaCustomerId
InitializeMeContact
ord462
ord463
ord242
ord33
ord296
ord744
ord743
ord745
ReadPasswordForPartnership
ord747
ord746
ord69
ord68
ord257
GetCurrentSyncStatsForStore
SetOutgoingMessageSizeLimit
GetOutgoingMessageSizeLimit
ord35
ord34
ord18
ReleaseDataStoreLock
InitializeSyncStatus
SyncSqmUpdateStats
ord106
ord53
ord103
ord105
ord29
ord93
ord503
ord15
AggregateSessionSyncStats
ord739
ord56
ord111
ord410
ord452
ord440
InitializeMsaStore
VerifyDataStoreLockOwner
ord9
DeleteHttpTransport
GetSyncWorkOnBehalfTicket
SetSyncWorkOnBehalfTicket
ord10
ord86
ord88
ord287
ord285
ord27
ord471
ord30
ord44
ord451
ord275
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FreeLibraryAndExitThread
LoadStringW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
Sleep
InitOnceComplete
WakeAllConditionVariable
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
CreateMutexExW
InitializeCriticalSection
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
DeleteCriticalSection
ResetEvent
SetEvent
CreateEventW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObjectEx
InitializeSRWLock
CreateEventExW
ReleaseSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapCompact
GetProcessHeap
HeapFree
HeapValidate
HeapAlloc
HeapDestroy
HeapCreate
HeapSize
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoGetApartmentType
CoGetMalloc
CoWaitForMultipleObjects
CoCreateFreeThreadedMarshaler
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventActivityIdControl
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
CreateThread
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
IsValidCodePage
GetACP
GetSystemDefaultLCID
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
VarBstrCat
SysAllocStringByteLen
SafeArrayGetElement
SystemTimeToVariantTime
SafeArrayLock
VariantTimeToSystemTime
SafeArrayCreateVector
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SysStringByteLen
SafeArrayDestroy
VariantChangeType
VariantCopyInd
SysAllocString
SafeArrayPutElement
SysAllocStringLen
SysStringLen
SafeArrayRedim
SafeArrayCreate
VariantInit
VariantCopy
VariantClear
SysFreeString
SafeArrayUnlock
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemTime
GetVersionExW
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegGetValueW
RegDeleteTreeW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalFree
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
api-ms-win-core-file-l1-1-0
CompareFileTime
FileTimeToLocalFileTime
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
accountaccessor
UnenrollAndMarkAccountForDeletion
cemapi
CreateMAPITableWalker
SetConversationId
IsMessageClassReadRequest
GetMAPIStorePropTags
MAPILogonEx
MAPIFreeBuffer
FreeProws
HrGetOneProp
MAPIUninitialize
HrSetOneProp
GetMsgClassEnum
GetNamedPropTag
MAPIInitialize
MAPIAllocateBuffer
GetMsgStoreFromMessage
USOIDfromCEENTRYID
userdatalanguageutil
UninitializeLanguageUtil
ConvertToWideStream
GetWideSzAlloc
InitializeLanguageUtil
GetMultiLanguage2
IsLocalePseudoLoc
GetNarrowSzCodepage
userdatatimeutil
AdjustForAllDayAppts
AdjustGMTForAllDayAppts
FileTimeToLocalFileTimeEx
FileTimeAdjustUTCToTz
MinutesBetweenFT
GetCurrentLocalTime
FileTimeToVariantTime
ConvertVariantTimeToFileTime
DaysBetweenFT
FileTimeToTzSpecificVariantTime
ConvertLocalVariantTimeToFileTime
userdatatypehelperutil
UsOidToContactUdmId
TrimWhiteSpaces
EcUidToGlobalObjId
BytesToDigits
UsOidToTaskUdmId
StringToBytes
SplitString
EcGlobalObjIdToUid
FormatPoomIdToString
ReadStreamContent
GetStreamSize
MapiIdToEmailUdmId
StreamFromStringW
CompressWhitespaceNW
UsOidToCalendarUdmId
networkhelper
SyncPdcReference_WatchdogReport
ReportSyncProgress
GetOrCreateNullPowerDependencyCoordinatorManager
CHttpTransport_CreateInstance
SyncWerReportGenerator
SyncPdcReference_WatchdogsEnabled
IsNetworkConnectionCostRestricted
pimstore
GetAppointmentUniqueId
GetBlankName
CreateOutlookApp
mccspal
ord31
ord30
ord32
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
PathMatchSpecW
CreateMassObject
CreateSyncServiceLayer
DllCanUnloadNow
DllGetClassObject
DownloadEmailAttachment
DownloadEmailBody
GetActiveSyncServerProbeInstance
GetConversationSyncEnabled
GetOutlookExtensionSupportForAccount
GetOutlookExtensionSupportFromAccessor
GetUserInfoForUnconfiguredAccount
HandleEasMeetingResponseForAppointment
HandleEasMeetingResponseForMeetingNotification
InitializeSyncStatus
IsEnabledForSync
IsErrorCatastrophic
IsValidOutlookExtensionVersion
MarkPeopleFolderForResync
OneStopFactory
SyncGetMAPISession
SyncGetMessageStore
SyncGetSpecialFolder
SyncMgrPurgeFolderProvider
SyncMgrPurgeProviderStore
SyncMgrRemovePolicy
SyncSqmUpdateStats
UpdateEasTrackingSchema
WriteStoreCapabilityProps
WriteStoreContentTypesProps
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=19, id=260, version=27412,
count=473, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=1, id=256, version=27412,
count=299, id=270, version=27412,
count=8, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AdaptiveCards.dll
- IMPHASH 5d0200b3a4dff4031a060f67fc8ac685
- SHA256 f8e015de2e77647dcaa2d0e1b9b1ac284e9d987385b9947591813b4bd6796e32
- MD5 43c11ee7a1d9f62c429972c07dd33229
- SHA1 c091b972937d18f9a52c4fd33188e4f3e401ccb7
- SHA512 cb9a76ae4ffe1c297bb81537efb14b2686f2a7c37dcce874d107d22b37bf28b34d4f0b2e29fd2fdb992dfb15dc583dce7c140bb8a4d20f0331bc93b26f6401c8
- SSDEEP 768:svEUgi5QYojjPIKg7yrGEw4zk/NF1IzZLrop4NVXldt1vZstPGck6jv:s8UgiW7jPIKeyrARNF+lu0JDvZsBGcks
- TLSH T1A1133B12BB4481F1C7AE36B82C5A757D817D79612FF106C36F5A67AA1C203D22A3C25E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AdaptiveCards.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_except_handler4_common
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
CStdStubBuffer_DebugServerQueryInterface
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrOleFree
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserSize
WindowsCreateStringReference
HSTRING_UserMarshal
HSTRING_UserFree
WindowsDeleteString
WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockShared
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-midlproxystub-l1-1-0
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
CStdStubBuffer2_CountRefs
ObjectStublessClient6
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
CStdStubBuffer2_QueryInterface
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1178, id=1, productName=Unmarked objects,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=7, id=269, version=27412,
count=23, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AddressParser.dll
- IMPHASH 203344311d41178a475ba28669841c4a
- SHA256 381a701b27ba655a6833a02803a36aa6607904f6fb3c0b5530bacdf92f00da78
- MD5 09a620a0d09694d03bc8fd5d8b8aa819
- SHA1 a7db367da4c455f7b4e42e9055ce1ca58923bd85
- SHA512 68f17d726ad6811fcd4487340dbe13d7d97d515fed967dbefaa6b52ffe26b13f55f682939d1425624f83068e1b75c05fc10a601a81f01805c97fc9feffcb33c1
- SSDEEP 768:WljQbhFMQUmxHqE3F0J0Q0K/SzFCe+VyDQc2gxpj+FrH53rNWiXI2Itp/zn:WV+fggKCFCe+Vdo2H7NWiY2It
- TLSH T10B33F80B76C400BDEAFA5931169651FFE468E9311FE389C72F400AAF5E706A1873532B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
46992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AddressParser.pdb
msvcrt
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
_onexit
__CxxFrameHandler3
_purecall
realloc
_except_handler4_common
memcpy
free
malloc
wcschr
towupper
memmove
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-localization-l1-2-0
LCMapStringW
GetSystemDefaultLangID
GetACP
GetUserDefaultLangID
GetLocaleInfoW
GetUserDefaultLCID
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FreeLibrary
api-ms-win-core-string-l1-1-0
GetStringTypeExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
DestroyAddressParser
GetCity
GetCountryName
GetCountryStringFromIndex
GetFullAddress
GetNewAddressParser
GetPostalCode
GetState
GetStreet
ParseAddress
RebuildAddress
SetCity
SetCountryName
SetFullAddress
SetPostalCode
SetState
SetStreet
UpdateDefCountry
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=51, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=7, id=261, version=27412,
count=1, id=256, version=27412,
count=6, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AdmTmpl.dll
- IMPHASH 68dfe7e3940b56417490a34f50613464
- SHA256 453740b44714346d0a9e738001fff8eab77d1d36de3e47177f7765939bd626fb
- MD5 f8cc20e2203a20d958234b5aea3a5cfa
- SHA1 d995a9557c43ded63901b33e63090d8189ee5389
- SHA512 3ee6142c60f3e890be7c4d34cd7fb3d4b8f1aeb35d9c9dbe5d58af4774691862332adec72b5c91baf62caae7745d960e6e0eb10872bee0f4011128e4980f11e9
- SSDEEP 6144:IADBRhB9QYCEMPyp34pOS1j37mX0TbtokY5bGJL+YGk55sbRMC25hMekl2Uc21Z/:bQpPyWp71jSEntEtYp5eX2Mecr
- TLSH T14E942911E3989075E4BF27716A2A92B545AABC305FB082DBA368F79F1C313D25931F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
250896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AdmTmpl.pdb
msvcrt
__CxxFrameHandler3
__RTDynamicCast
_ftol2_sse
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
??0exception@@QAE@ABQBD@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
_callnewh
wcsrchr
_itow
wcschr
_vsnwprintf
_purecall
wcsnlen
_wtoi
_wtoi64
wcstoul
memset
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalAlloc
LocalReAlloc
GlobalFree
LocalFree
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
GetFileAttributesExW
ReadFile
CreateFileW
GetFileAttributesW
GetFileSize
CreateDirectoryW
SetFilePointer
FileTimeToLocalFileTime
FindNextFileW
WriteFile
CompareFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLangID
GetFileMUIPath
GetThreadPreferredUILanguages
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadStringW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
LoadResource
FindResourceExW
DisableThreadLibraryCalls
LockResource
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
SetEvent
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
OutputDebugStringW
oleaut32
SysAllocString
SysFreeString
SysStringLen
api-ms-win-security-base-l1-1-0
GetLengthSid
AllocateAndInitializeSid
InitializeAcl
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
AddAccessAllowedAce
api-ms-win-core-registry-l1-1-0
RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegSetValueExW
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
StringFromGUID2
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
advapi32
RegCreateKeyW
IsTextUnicode
RegDeleteKeyW
gdi32
DeleteObject
kernel32
GlobalUnlock
lstrcmpiW
GlobalLock
LoadLibraryExA
ExpandEnvironmentStringsA
GlobalReAlloc
ole32
OleRun
shell32
SHFileOperationW
user32
DispatchMessageW
RegisterWindowMessageW
RegisterClassW
CreateWindowExW
CheckDlgButton
LoadImageW
EndDialog
GetKeyboardLayout
TranslateMessage
PostMessageW
GetMessagePos
MessageBeep
SetFocus
GetClientRect
DestroyIcon
DefWindowProcW
RegisterClipboardFormatW
SetCursor
LoadCursorW
SetWindowLongW
IsDlgButtonChecked
ScreenToClient
EnableWindow
MsgWaitForMultipleObjects
PeekMessageW
DestroyWindow
MessageBoxW
GetWindowLongW
SendMessageW
GetDlgItem
DialogBoxParamW
xmllite
CreateXmlWriter
CreateCmtStoreObject
CreateParserObject
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=241, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=18, id=260, version=27412,
count=1, id=256, version=27412,
count=49, id=265, version=27412,
count=11, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AnalogCommonProxyStub.dll
- IMPHASH f7b971dc7b2d7c1998e3e97873c0ff03
- SHA256 12a6f561e4475067c408b6b5bac1652b71a6e2b428ac9aa911abf15907797665
- MD5 e3a26f1f0636112c6e3d0fdf9a4653da
- SHA1 7208f85e2a6035fe856ca3d7895b2d5c807dec52
- SHA512 0ef092dc30ed7e2e0630f1f57f4a4d61846426de39e41f428ea4887cc23bac97e6addedd15e93c9f752217a9684620d9187043d362ed4056f5a47658a09b6ced
- SSDEEP 192:d0zEAGv6jIvC4K1wnd+IKv11tqPOEvZfrxW6aW0Hot:daE/6wA1wnd+IK11tqPrZfrxW6aW02
- TLSH T17582C5417F551C74D5BE323654963F23C22AA9203FD382C79E91B7602CA64D1AFB271B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AnalogCommonProxyStub.pdb
msvcrt
_XcptFilter
_except_handler4_common
_initterm
malloc
free
_amsg_exit
memcmp
rpcrt4
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient9
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient4
ObjectStublessClient5
DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=56, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ApiSetHost.AppExecutionAlias.dll
- IMPHASH 306da34b3f1df7c84ea067caa1c4bdea
- SHA256 52ba5ee87fed5513eb3d0a20b3b4d6255d226e519c7683f1ba2a80143ad3c6dc
- MD5 6ecd9dd6309d09a75855a3c7c8245d4c
- SHA1 cf59e67becb0bb440c59ff17451971d404b30599
- SHA512 859f7b012f39a914e64f955b0b0590ac26a431ec5d98ac2a802f626393f8107c48ef0718a88dfe3be1ee625b17574423548ed56ec2c120f96aaea6141833d579
- SSDEEP 1536:tkFQifLSIhCKlISx3Wy3JrtKp2zLyNGMzl0oPacX0VL7d:MPfLSIhhlzWxpOC0Wa60B
- TLSH T1A5835D22774544B5D2EE267C35AAB23593BF64A09FE04EC36730576D1E306C3AD34A8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
57872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ApiSetHost.AppExecutionAlias.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_except_handler4_common
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObject
CreateEventW
ReleaseSemaphore
OpenSemaphoreW
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
InitializeCriticalSectionEx
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
ProcessIdToSessionId
OpenProcessToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-handle-l1-1-0
CloseHandle
ntdll
NtClose
RtlDestroyEnvironment
RtlCopySid
RtlFreeHeap
RtlAcquireSRWLockShared
RtlSleepConditionVariableSRW
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlWakeAllConditionVariable
RtlLengthSid
NtQueryInformationToken
RtlExpandEnvironmentStrings
RtlNtStatusToDosError
RtlAllocateHeap
RtlQueryTokenHostIdAsUlong64
NtOpenProcessToken
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
GetTokenInformation
api-ms-win-core-file-l1-1-0
CreateFileW
profapi
ord101
api-ms-win-core-com-l1-1-0
CoDecrementMTAUsage
CoTaskMemAlloc
CoIncrementMTAUsage
CoCreateInstance
CoTaskMemFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-io-l1-1-0
DeviceIoControl
msvcp_win
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
rpcrt4
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcBindingSetAuthInfoExW
RpcStringFreeW
NdrAsyncClientCall
RpcAsyncCancelCall
RpcBindingFree
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-psm-key-l1-1-0
PsmGetKeyFromToken
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CheckAppExecutionAliasApplicationType
CloseAppExecutionAliasEx
CompleteAppExecutionAliasProcessCreationEx
CreateAppExecutionAliasEx
CreateAppExecutionAliasEx2
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
FreeAppExecutionAliasInfoEx
GetAppExecutionAliasApplicationType
GetAppExecutionAliasApplicationUserModelIdEx
GetAppExecutionAliasExecutableEx
GetAppExecutionAliasPackageFamilyNameEx
GetAppExecutionAliasPackageFullNameEx
GetAppExecutionAliasPath
LoadAppExecutionAliasInfoEx
OpenAppExecutionAliasForUserEx
PerformAppxLicenseRundownEx
PersistAppExecutionAliasToFileEx
PersistAppExecutionAliasToFileHandleEx
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=16, id=260, version=27412,
count=1324, id=1, productName=Unmarked objects,
count=2, id=257, version=27412,
count=1, id=256, version=27412,
count=11, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppContracts.dll
- IMPHASH b0ad5ffefae7cff7a28057d6b8021305
- SHA256 399f410e348cc83f7b99f8e1fb2682dd07dab9a6636042ceef7d674b9cea7490
- MD5 18b285d22631c1c2a3d31a22e0077bb5
- SHA1 7361e3f1edcec6192dde3eb048eb017a265a8569
- SHA512 5753d8216a63c2ba12c5c6b3ef982dbe7cb5a89c540ae3c3d69b348ab2829d10fe54d830c43e37e7b08569248078cda3442c87d37f804592307739613605e290
- SSDEEP 12288:OuptsRTC3FT9Zh1NX+UQbsuXvL+qDlQhH6Hy66:OuptsRTC3FT9z1NX+Uk1vLrGH6HF6
- TLSH T111F45A286E60D5AAC6E71174755CB23E90AEA1B24B308CCB67548AFD2EB07C35D3534F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:db:b0:75:6f:00:3f:52:82:e4:b7:23:16:6f:a5:20:89:e0:8e:92:f6:3a:54:59:eb:2d:01:f5:b2:a0:c8:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
325104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppContracts.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_malloc
_o_mbstowcs
_o_realloc
_o_terminate
_o_toupper
_o__errno
_except_handler4_common
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
_o__execute_onexit_table
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlQueryPackageClaims
RtlIsMultiUsersInSessionSku
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-synch-l1-1-0
ResetEvent
ReleaseSRWLockShared
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
WaitForMultipleObjectsEx
CreateSemaphoreExW
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
ReleaseMutex
SetEvent
CreateEventExW
OpenEventW
ReleaseSemaphore
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsPreallocateStringBuffer
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDuplicateString
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoRevertToSelf
CoMarshalInterface
CoTaskMemAlloc
CoGetCallContext
CoCreateInstance
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoImpersonateClient
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoTaskMemRealloc
CoWaitForMultipleHandles
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
CreateStreamOnHGlobal
api-ms-win-core-processthreads-l1-1-0
GetProcessId
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
rpcrt4
RpcStringFreeA
RpcStringFreeW
UuidCreate
UuidToStringA
I_RpcBindingInqLocalClientPID
UuidToStringW
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventRegister
EventUnregister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFullNameFromToken
GetPackageFamilyNameFromToken
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-file-l1-1-0
ReadFile
CreateFileW
FlushFileBuffers
WriteFile
api-ms-win-core-namedpipe-l1-1-0
ConnectNamedPipe
CreateNamedPipeW
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
api-ms-win-core-threadpool-l1-2-0
StartThreadpoolIo
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolIo
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CloseThreadpoolIo
CloseThreadpoolWait
CancelThreadpoolIo
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
IsWellKnownSid
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
GetPackageFullName
GetPackageFamilyName
api-ms-win-appmodel-runtime-internal-l1-1-2
GetEffectivePackageStatusForUser
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord168
ord167
ord184
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
677KB
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=14, id=260, version=27412,
count=1318, id=1, productName=Unmarked objects,
count=6, id=257, version=27412,
count=1, id=256, version=27412,
count=31, id=270, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppExtension.dll
- IMPHASH 1becb78855ed3185ace74e978a16b290
- SHA256 0c0dfb26f33783581de35ec530c3d064fe84bf14666c1b60113c2d058edbde3a
- MD5 68f82f01a8ed91beabdb1fe69edfb767
- SHA1 626176ee421510e89f41c8fe02c0879023fe5f6f
- SHA512 accf9d300f88abc1571bcd6bf4e9c5cace987bd9200bc6505c9dbb8b1ee36cb32b8a827ecd477170e7f9cf1337a55524f9d5d512ebaeb67a021fd5a5802a22e6
- SSDEEP 3072:yY+H2ZT7jC2/usUgc9CR5S/pkjBB+a5NwBpB3BCoAB5BrQ1eEHaKDYCrYkP:yYTdHx6CR5S/KjBBj5NwBpB3BUB5B81V
- TLSH T12FD3E7316B986972E6E73EBC755E3234826F96644BA057C30B10C5FA6C702C2DD3639B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
112576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppExtension.pdb
msvcrt
_vsnwprintf
_purecall
??0exception@@QAE@ABQBD@Z
realloc
memmove_s
wcschr
_initterm
_amsg_exit
?terminate@@YAXXZ
malloc
__dllonexit
__CxxFrameHandler3
free
_onexit
memcpy_s
??1type_info@@UAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_lock
_callnewh
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_except_handler4_common
??_V@YAXPAX@Z
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??3@YAXPAX@Z
_unlock
memset
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoGetCallerTID
CoGetMalloc
CoTaskMemFree
CoGetApartmentType
CoRevertToSelf
CoGetInterfaceAndReleaseStream
CoGetCallContext
CreateStreamOnHGlobal
CoReleaseMarshalData
CoMarshalInterface
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoCreateGuid
StringFromCLSID
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenThreadToken
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetProcessId
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateSemaphoreExW
CreateEventW
SetEvent
LeaveCriticalSection
WaitForMultipleObjectsEx
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventExW
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeSRWLock
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
CopySid
GetLengthSid
GetTokenInformation
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-rtcore-ntuser-window-l1-1-0
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjectsEx
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
propsys
ord435
api-ms-win-appmodel-runtime-internal-l1-1-1
GetPackageStatus
twinapi.appcore
ord3
ord2
appxdeploymentclient
ord24
ord25
ord27
ord23
combase
ord168
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNtStatusToDosErrorNoTeb
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlCompareUnicodeString
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=16, id=260, version=27412,
count=212, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=30, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppIdPolicyEngineApi.dll
- IMPHASH d32f5f0454f5f3fc3db5d41023aa60f5
- SHA256 1d29d9927ed75ef12db2b42e42bef80916d6c7f64f615d99824fe313092e459e
- MD5 9f6ee25e32423b3db3948dc23051804e
- SHA1 eff0dd774cdb41cc49e70b2a5058743a2cf0f355
- SHA512 cf95df9a04dde3cd4b7dd7f8dbc123e64f802a5d55a95750979afb53ee0bfc0b1ebe736f1905e4a572e38c11e4a269242e1dadcc6616ddc7b2d6dcd07a1ee83e
- SSDEEP 6144:MvlZCFVK21Gxw0+IaJsLHOuuI5mJ+3wRyJ3fFsAe67PTllGtwwZxJbZGSuS9UQkb:MzCt1Gxw0+hsLuuuIYJ+3wIJ3fFsA17b
- TLSH T1BC545CA4BA65C836C6DF1734243DD2B950A9B4609FE0C2C37BA02F6DAE775C36C30959
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
178528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppIdPolicyEngineApi.pdb
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
??0_Locinfo@std@@QAE@PBD@Z
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
??_7facet@locale@std@@6B@
??0facet@locale@std@@IAE@I@Z
??0_Lockit@std@@QAE@H@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??1facet@locale@std@@MAE@XZ
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Wcscoll
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??_7_Facet_base@std@@6B@
??1_Facet_base@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
??1_Locinfo@std@@QAE@XZ
msvcrt
memcpy
memcmp
__RTDynamicCast
memmove
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler3
_purecall
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
memset
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
_wtoi
_wtof
tolower
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
strchr
towupper
_vsnwprintf_s
_ui64tow_s
wcstol
??0exception@@QAE@XZ
_callnewh
memcpy_s
free
malloc
wcsncpy_s
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
SizeofResource
LoadResource
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegDeleteTreeW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegEnumKeyExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-path-l1-1-0
PathCchAppend
rpcrt4
UuidCreate
UuidCompare
RpcStringFreeW
UuidToStringW
UuidFromStringW
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
authz
AuthziAccessCheckEx
AuthziModifySecurityAttributes
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzFreeContext
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetAce
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromId
PackageNameAndPublisherIdFromFamilyName
appidapi
AppIDDecodeAttributeString
AppIDEncodeAttributeString
AppIDFreeAttributeString
AppIDConstructAppxAttributes
AppIDGetAppxFileAttributes
AppIDGetFileAttributes
AppIDReleaseAppxFileAttributes
AppIDReleaseFileAttributes
ntdll
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceLoggerHandle
advapi32
RegCreateKeyW
RegEnumKeyW
shlwapi
SHCreateStreamOnFileEx
user32
UnregisterClassA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=15, id=260, version=27412,
count=215, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=56, id=265, version=27412,
count=7, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppInstallerPrompt.Desktop.dll
- IMPHASH f74845d4a67e8b09cf93b739f1cd8cb8
- SHA256 71983e9cbd73f6e0f60cb94bb392def0d91aa494bf42987cf8145b4c4dbe76af
- MD5 b5de2cfe7ce6f8207b221d300a57fd2d
- SHA1 bd64b6b036ae580b110e80cc51a6c523f1eb206e
- SHA512 74b73e117b65b13dab48792cda21df8562601882b0b3e388b0085163159a22cd2cb1a863f45f1335a245e22a63210e1b9060ed76f941ed3296a92b5f5a7c8360
- SSDEEP 768:xusyZWTaBkv2xHldPRu5ZY0CWepDqfxXYUou1cet3nE:xusykTaBfxnPRuKW/f+Uou1c43E
- TLSH T162033A81AB8045F2C7B63138359E6679826C9A125FE251D31F1783FD6D70AE3EA3424F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppInstallerPrompt.Desktop.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_wcscpy_s
_except_handler4_common
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventExW
SetEvent
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-rtcore-ntuser-window-l1-1-0
DestroyWindow
SetForegroundWindow
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostQuitMessage
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
user32
LoadStringW
ole32
CoCreateInstance
CoAllowSetForegroundWindow
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoTaskMemAlloc
shell32
SHGetPropertyStoreForWindow
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=1169, id=1, productName=Unmarked objects,
count=8, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=265, version=27412,
count=23, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppLockerCSP.dll
- IMPHASH 1a4a42558e9d6c36f8ab55dff1035673
- SHA256 c90d3cfa11d57b7094566b58d92e3b1c85de47066bd40ae06efb99035815ba0b
- MD5 5bd99281a8da6a8834d55de1755de6aa
- SHA1 78a60ac9b73ea04dcd0bb475ca96b988825c0a05
- SHA512 a8483bcae4ebb7acde52ddabafde42dc350c4b90056f3466f7d83d56b8c2ed805750ec4541dab46da2227b497336d55abf0214d4cc411ad8268aff56190c3534
- SSDEEP 6144:JMzB7eTdEWha7dcvYvj4bqbcMyMEXzHj3rGDv+:JMzR8dEWhAr7bcMyMAzHjbUv+
- TLSH T1A9445A6076A4C836C6EF2331241DD1AC40A9B1609FF1C1C77B641BADAF7B5C39934AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
184272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppLockerCSP.pdb
msvcp110_win
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?_Xbad_function_call@std@@YAXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Wcscoll
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??_7facet@locale@std@@6B@
??1facet@locale@std@@MAE@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_alloc@std@@YAXXZ
??1_Locinfo@std@@QAE@XZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?id@?$ctype@G@std@@2V0locale@2@A
?tolower@?$ctype@G@std@@QBEGG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??_7_Facet_base@std@@6B@
??1_Facet_base@std@@UAE@XZ
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
msvcrt
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_wtoi
_wcstoi64
_errno
towupper
_vsnwprintf_s
wcstol
_wcsicmp
memmove_s
toupper
_vsnprintf_s
?what@exception@@UBEPBDXZ
wcsnlen
??0exception@@QAE@ABQBDH@Z
wcscpy_s
??_V@YAXPAX@Z
strchr
realloc
free
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
wcsstr
_ui64tow_s
wcschr
_wcsdup
_wcstoui64
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
memcpy_s
_vsnwprintf
__CxxFrameHandler3
??3@YAXPAX@Z
memset
_CxxThrowException
memcmp
memcpy
memmove
_purecall
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
ResumeThread
GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
oleaut32
VariantClear
VariantInit
SysAllocString
SafeArrayCreate
SysStringByteLen
SysFreeString
SafeArrayDestroy
SysAllocStringLen
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl
rpcrt4
RpcStringFreeW
UuidFromStringW
UuidCompare
UuidToStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
bcrypt
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptGenRandom
BCryptCreateHash
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
api-ms-win-core-file-l1-1-0
GetFileSizeEx
FindNextFileW
FindFirstFileExW
DeleteFileW
CreateFileW
ReadFile
WriteFile
FlushFileBuffers
CreateDirectoryW
FindClose
GetFileAttributesW
RemoveDirectoryW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
ChangeServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
GetAce
GetSecurityDescriptorDacl
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
CreateSemaphoreExW
DeleteCriticalSection
CreateMutexExW
ReleaseSRWLockShared
EnterCriticalSection
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
LeaveCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObjectEx
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-appmodel-runtime-l1-1-0
PackageNameAndPublisherIdFromFamilyName
PackageFamilyNameFromId
srpapi
AppIDEncodeAttributeString
AppIDFreeAttributeString
ntdll
RtlCreateUnicodeString
NtClose
RtlAllocateHeap
RtlFreeHeap
NtReadFile
NtWaitForSingleObject
NtOpenKey
NtDelayExecution
NtOpenFile
NtQueryInformationFile
EtwTraceMessage
RtlAdjustPrivilege
NtQueryWnfStateData
RtlNtStatusToDosError
ZwQueryWnfStateData
NtSetSystemInformation
RtlPublishWnfStateData
NtSetValueKey
NtQueryDirectoryFile
RtlFreeUnicodeString
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
policymanager
EnterprisePolicyManagerStore_EDPCSPConfigSourceAreaPolicyGetValue
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
234KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=17, id=260, version=27412,
count=390, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=97, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppManagementConfiguration.dll
- IMPHASH e6af527c7f16195eb3075ed8eb7f18bc
- SHA256 426b5722e49729ec0c142fb51c2065154da751e41bc67fc4517a7f654a36a680
- MD5 f80299e4d8400f98d7182b085f06e394
- SHA1 a0e3838094bbf19e133ffd6bf70052295dcd4944
- SHA512 83971313d5b3325ad925a0aee7cbefbb1a85d197d1370ff0029b0bb001d07836254a76e6361c5ee006ec4d02c04820d08994414f181dfbd2721f3e2388792046
- SSDEEP 3072:Htz++snITbnIIeenx4EI6ws/IyBvk4IND37PHVdePsnftLXA+EJPR0iiKndzRlZe:Y+UlpCsKnxDZiYq
- TLSH T1D4C3071377DC516DF1FB293C6B35597656ABFD304AA0848F2220CA9E09306A0CD75BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
106640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppManagementConfiguration.pdb
msvcrt
memmove
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
_initterm
_callnewh
??_V@YAXPAX@Z
malloc
__CxxFrameHandler3
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_XcptFilter
_amsg_exit
??0exception@@QAE@ABQBDH@Z
free
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
??0exception@@QAE@ABQBD@Z
memset
kernel32
GetTickCount
FreeLibrary
LocalFree
LocalAlloc
GetProcessMitigationPolicy
GetModuleFileNameW
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
GetModuleFileNameA
InitOnceExecuteOnce
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
EncodePointer
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
DisableThreadLibraryCalls
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
ReleaseSRWLockShared
HeapAlloc
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
api-ms-win-service-management-l1-1-0
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ProcessAppVPolicy
ProcessUevPolicy
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=2, id=259, version=27412,
count=109, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=19, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppResolver.dll
- IMPHASH 5a1f6feedcc8487df1c6e54dbd135631
- SHA256 bc0ca83aca3b63b63c1be8e7e0072289bf8c448dca1f76f3fbdb6a3c750ca9ea
- MD5 f607a41680385767114921e23c8e3d98
- SHA1 6171c6a57f51e1c47465f3314a21d36882fad677
- SHA512 e2df6d75c1efcecb3bca4abcce01f56fbeec4de6fad51ff2f048921fee127f9a36b75fe43fe68e4346cd831eaea730275d19e74e62c35e236b2aa7c47289d05b
- SSDEEP 6144:AhLZsijK5FgSQr0+q3n84ag7Hy/HbBrdiKCFUpZnVRQBi9iNfW31tiwM5CCLgyw/:4x9FXq38Pg7H+p7eYQHn4o0
- TLSH T1E8A46CA55B8414B1E7AB343865D9A52581BDA1F44B2048C7775CCEAE3FB0EC37A3834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
91:04:e9:7d:61:f2:b9:a0:60:83:53:e1:b2:89:85:77:96:03:5f:e5:3e:d8:65:04:68:5d:3c:33:45:27:b8:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 17, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f9:1f:67:8d:75:ab:a4:f1:b1:00:01:00:00:01:f9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
376016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppResolver.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__wcstoui64
memmove
_o__wtoi
_o_ceil
_o_free
_o_malloc
_o_towupper
_except_handler4_common
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
wcschr
wcsrchr
_CxxThrowException
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsspn
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDuplicateString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-synch-l1-1-0
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
EnterCriticalSection
CreateMutexExW
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
AcquireSRWLockShared
SetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockExclusive
ResetEvent
OpenEventW
InitializeSRWLock
OpenSemaphoreW
CreateEventW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetProcessTimes
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
TerminateProcess
OpenProcessToken
OpenThreadToken
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-shell-namespace-l1-1-0
ILIsParent
ILCloneFirst
ILFree
SHCreateItemFromParsingName
SHCreateItemFromIDList
SHParseDisplayName
ILIsEqual
SHCreateItemWithParent
ILClone
ILFindLastID
ILCombine
SHBindToParent
SHBindToFolderIDListParentEx
SHGetIDListFromObject
ILGetSize
SHBindToObject
bcp47langs
GetUserLanguages
shcore
IStream_Read
IUnknown_QueryService
SHTaskPoolQueueTask
GetScaleFactorForDevice
ord109
IStream_Size
SHSetValueW
SHGetValueW
ord123
ord170
SHAnsiToUnicode
ord145
ord193
ord190
ord188
SHQueryValueExW
SHTaskPoolGetUniqueContext
IUnknown_GetSite
IUnknown_Set
ord192
SHStrDupW
ord130
ord122
windows.storage
SHGetDesktopFolder
SHGetKnownFolderPath
ord942
gdi32
GetObjectW
CreateDIBSection
CreateCompatibleDC
StretchDIBits
GdiAlphaBlend
DeleteDC
DeleteObject
SelectObject
ntdll
RtlPublishWnfStateData
NtQueryInformationProcess
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlAcquireSRWLockExclusive
NtQueryWnfStateData
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlInitUnicodeString
RtlSubscribeWnfStateChangeNotification
RtlAllocateHeap
RtlReleaseSRWLockExclusive
RtlFreeHeap
NtQueryInformationToken
ole32
CoUninitialize
PropVariantClear
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CreateBindCtx
CoCreateFreeThreadedMarshaler
ReleaseStgMedium
CoAllowSetForegroundWindow
CoWaitForMultipleHandles
CoGetCallContext
RoGetAgileReference
shlwapi
ord24
ord236
ord174
PathGetDriveNumberW
PathIsUNCW
PathIsRelativeW
PathIsURLW
ord487
ord219
PathCommonPrefixW
PathFindExtensionW
PathIsPrefixW
PathUnquoteSpacesW
ord156
PathRemoveBlanksW
PathGetArgsW
PathRemoveFileSpecW
PathParseIconLocationW
ord158
ord157
ord217
PathFindFileNameW
PathIsFileSpecW
ord154
PathFileExistsW
StrChrW
PathRemoveExtensionW
StrStrIW
AssocCreate
StrDupW
StrCmpW
ord172
SHStrDupA
ord460
slc
SLGetWindowsInformationDWORD
user32
ReleaseDC
DestroyIcon
CreateIconIndirect
SystemParametersInfoW
GetSysColor
CopyImage
LoadStringW
CharUpperBuffW
LoadStringA
RegisterClipboardFormatW
InsertMenuW
GetDC
CreatePopupMenu
DestroyMenu
GetMenuDefaultItem
GetWindowThreadProcessId
SetWindowTextW
KillTimer
DestroyWindow
SetTimer
SendNotifyMessageW
MonitorFromPoint
PostMessageW
FindWindowW
SetWindowLongW
DefWindowProcW
GetWindowLongW
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-core-localization-l1-2-0
GetUserDefaultLCID
GetUserGeoID
GetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-path-l1-1-0
PathCchRemoveBackslash
PathCchRemoveFileSpec
PathAllocCombine
PathCchRemoveExtension
PathCchCombine
PathCchFindExtension
PathCchAppend
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-file-l1-1-0
DeleteFileW
GetLongPathNameW
CreateDirectoryW
CompareFileTime
CreateFileW
GetFileSizeEx
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
ReadProcessMemory
api-ms-win-core-memory-l1-1-1
PrefetchVirtualMemory
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegGetValueW
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
userenv
GetProfileType
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetFileSecurityW
GetSecurityDescriptorSacl
GetAce
GetSidSubAuthority
GetTokenInformation
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-appmodel-runtime-l1-1-3
GetStagedPackagePathByFullName2
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
OpenPackageInfoByFullName
GetPackageInfo
ClosePackageInfo
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
392KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=113, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=20, id=260, version=27412,
count=1559, id=1, productName=Unmarked objects,
count=22, id=257, version=27412,
count=1, id=256, version=27412,
count=86, id=265, version=27412,
count=28, id=261, version=27412,
count=15, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppVClientPS.dll
- IMPHASH 82edd993fbd2a2e72cfab24f1fce6c76
- SHA256 90718ccbf569c208a0f22ad7ee0cb2c39cc895d8fdcfede557736ef8c0484c6a
- MD5 31d009249d3db92698663c560dd64035
- SHA1 32094f212d902fac6af6c06e416033b8a77bdc24
- SHA512 242b8ac42dbc473162c0c7aed904032f8d67c2f712850edd1a95adb06f8d4f592ba9fb5ce3f541bd160cb0a5402ca45c4a8a5fa2f6934b5c684ba0a7863d6df1
- SSDEEP 384:E//nHVMxbx7RH/JHjCtrGTWBO4UWIq0DBRJiR9z2dq3z:6Mxb7/0ts4301PO9zZD
- TLSH T1B1C2E981BFA01962E96734369097DA53AE3D9F815FD041D32B81B5042C377E2EF3229E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
56:1e:a9:61:83:ee:9f:6e:7b:c8:4f:d0:72:13:e5:52:11:aa:e9:30:99:a8:9b:64:24:2b:88:e1:46:ee:f0:6d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
12240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppVClientPS.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcmp
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
IsProcessorFeaturePresent
oleaut32
BSTR_UserSize
BSTR_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserFree
BSTR_UserMarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
VARIANT_UserUnmarshal
VARIANT_UserSize
BSTR_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserFree
ole32
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient3
CStdStubBuffer2_Disconnect
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient5
CStdStubBuffer2_QueryInterface
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient10
CStdStubBuffer2_Connect
ObjectStublessClient4
ObjectStublessClient7
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=27412,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1153, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=3, id=264, version=27412,
count=14, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppVEntSubsystems32.dll
- IMPHASH de7f6737aa25f50933a75340826aed5a
- SHA256 e8fde1c00d932a5d92f1516fe91b78cf5afc424616134069a11b479408a54790
- MD5 29b2087eed6bb3e4e97b667beb74de98
- SHA1 a5b5f88bde9e66d4f9510d29e04c17ef91068be9
- SHA512 d6964a4894e9807db75540bd8e9171889bc9437ef2c1242800c4584b9d9ce59a9dd8a59eea4294713b98421dadb6edc9fa3c429f99203611b0f5391c686bf34b
- SSDEEP 24576:GTNj4mz6sHHEv9e/cati5jZKMh9I2Jsh/+JtLIb5RXET0Ot6XUlBiHoBtmh61u:oj4vcEFe/ah9IXh/oIb5CT0TXUlBiHoi
- TLSH T12B657B23BAC88479E6BF1670152CA7A446B9B4308FB0C1CB77E0976E5970BD29D34B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
29:a5:1d:23:7f:fa:a7:4d:63:dc:a2:de:ef:6c:53:51:97:f5:1f:46:ee:7c:2b:49:d5:b3:84:00:c1:74:a2:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e7:2e:8f:2f:93:0b:4f:1b:e9:00:01:00:00:01:e7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
1125312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppVEntSubsystems.pdb
ntdll
NtQueryObject
NtReadFile
NtSetInformationThread
NtQuerySecurityObject
NtSetSecurityObject
NtQueryKey
NtWriteFile
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlInitUnicodeString
NtDuplicateObject
RtlNtStatusToDosError
RtlUnwind
NtRenameKey
NtCreateKey
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCopyUnicodeString
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableAvl
RtlIsGenericTableEmptyAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlIsNameInExpression
RtlPrefixUnicodeString
RtlAllocateHeap
RtlFreeHeap
NtQueryInformationProcess
RtlIntegerToUnicodeString
NtSetEvent
NtClose
RtlInitAnsiString
NtSetValueKey
NtDeleteValueKey
NtDeleteKey
NtEnumerateKey
NtEnumerateValueKey
NtOpenKey
NtNotifyChangeMultipleKeys
NtFlushKey
NtQueryValueKey
kernel32
FormatMessageW
GetLastError
K32GetModuleInformation
HeapAlloc
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FreeLibrary
DebugBreak
GetModuleFileNameW
CreateMutexW
WaitForSingleObject
ReleaseMutex
DisableThreadLibraryCalls
CloseHandle
IsDebuggerPresent
CheckRemoteDebuggerPresent
LoadLibraryW
CreateThread
MultiByteToWideChar
InitOnceExecuteOnce
WideCharToMultiByte
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
CompareStringEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
HeapReAlloc
GetCurrentThread
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
GetCurrentThreadId
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
IsValidCodePage
GetACP
GetOEMCP
GetFileSizeEx
SetFilePointerEx
SetStdHandle
WriteFile
GetConsoleOutputCP
GetConsoleMode
FlushFileBuffers
ReadFile
ReadConsoleW
GetCommandLineW
HeapSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
WriteConsoleW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
FindFirstFileExW
InitializeCriticalSection
LeaveCriticalSection
GetModuleHandleExW
GetCurrentProcess
EnterCriticalSection
SetLastError
HeapFree
GetModuleFileNameA
FreeLibraryAndExitThread
ExitThread
VirtualAlloc
GetSystemInfo
GetCommandLineA
HeapDestroy
LCMapStringW
OutputDebugStringW
advapi32
EventRegister
EventUnregister
RegOpenKeyExW
RegCloseKey
EventWriteTransfer
RegQueryValueExW
EventSetInformation
api-ms-win-core-memory-l1-1-0
VirtualFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
VirtualProtect
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-security-base-l1-1-0
GetSidSubAuthority
GetSidLengthRequired
IsValidSid
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeAbsoluteSD
EqualSid
InitializeSid
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
MakeSelfRelativeSD
DuplicateToken
DuplicateTokenEx
SetSecurityDescriptorDacl
GetAclInformation
SetSecurityDescriptorOwner
GetLengthSid
SetSecurityDescriptorGroup
InitializeAcl
AddAce
GetTokenInformation
CopySid
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
api-ms-win-core-file-l1-1-0
FindNextVolumeW
GetVolumePathNameW
FindVolumeClose
QueryDosDeviceW
FindFirstVolumeW
FindFirstFileW
FindClose
FindNextFileW
GetShortPathNameW
GetFinalPathNameByHandleW
GetFileAttributesW
GetLogicalDriveStringsW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
SearchPathW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
SetThreadToken
SuspendThread
CreateProcessW
CreateProcessAsUserW
GetProcessId
OpenProcessToken
ResumeThread
userenv
UnloadUserProfile
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-core-com-l1-1-0
CoCreateInstance
PropVariantClear
CoGetTreatAsClass
CoUnmarshalInterface
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromString
StringFromCLSID
CoTaskMemAlloc
CoMarshalInterface
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetVersionExW
GetWindowsDirectoryW
GetVersion
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
SetThreadContext
FlushInstructionCache
GetThreadContext
api-ms-win-core-wow64-l1-1-1
GetSystemWow64DirectoryW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-psapi-l1-1-0
K32GetMappedFileNameW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-file-l1-2-2
FindNextFileNameW
FindFirstFileNameW
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
UrlCreateFromPathW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
CreateSemaphoreExW
ReleaseSemaphore
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
OpenEventW
CreateMutexExW
AcquireSRWLockShared
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-memory-l1-1-4
QueryVirtualMemoryInformation
api-ms-win-core-synch-l1-2-0
Sleep
rpcrt4
RpcStringBindingComposeW
RpcServerUnregisterIf
RpcServerRegisterIf2
RpcBindingSetAuthInfoExW
RpcServerUseProtseqEpW
RpcRevertToSelf
RpcServerListen
RpcServerRegisterAuthInfoW
RpcBindingFromStringBindingW
NdrServerCall2
RpcBindingInqAuthClientW
RpcStringFreeW
NdrClientCall2
UuidCreate
NdrClientCall4
RpcImpersonateClient
RpcBindingFree
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-console-l3-2-0
GetConsoleWindow
api-ms-win-shcore-sysinfo-l1-1-0
GetCurrentProcessExplicitAppUserModelID
api-ms-win-core-handle-l1-1-0
DuplicateHandle
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
user32
FindWindowW
GetWindowLongW
IsWindowVisible
GetParent
PeekMessageW
DispatchMessageW
CallWindowProcW
WaitForInputIdle
gdi32
AddFontResourceExW
CreateScalableFontResourceW
ole32
GetClassFile
CreateFileMoniker
GetRunningObjectTable
shell32
SHGetPathFromIDListW
SHCreateItemFromParsingName
SHParseDisplayName
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-localization-l1-2-0
GetUserDefaultLangID
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
APIExportForDetours
CurrentThreadIsVirtualized
RequestUnhookedFunctionList
VirtualizeCurrentProcess
VirtualizeCurrentThread
_IsProcessHooked@0
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mrdata
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=257, version=27412,
count=388, id=1, productName=Unmarked objects,
count=48, id=260, version=27412,
count=37, id=259, version=27412,
count=1, id=256, version=27412,
count=246, id=265, version=27412,
count=218, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppVSentinel.dll
- IMPHASH 470c89a203ef20dceb724f326b131e03
- SHA256 0d61af026a6047e610071ff3f15c42e3005417a92ecdac102f44cb06772fb1a2
- MD5 075af6ca643e8602daff7a78ca6aa1d3
- SHA1 74559ffb3349141889e0706e5513ad8629a90ae4
- SHA512 51257d483f20d06dcbab9c8a3309da7c6daa861eaca04a71a61d5bf2bf4c00eb40ac8da971c0f2f9b7b119b641a23b12b4ad2306480b170ba8ed863d59d60329
- SSDEEP 192:liG229VMkz9WHO2UWoue0XhBNhDBQABJvtfKUSIX01k9z3AEXzb:liG229pz9WHO2UWoundDBRJJ2IR9z53
- TLSH T1E6623BD187B80102E9F7AB7061A9E6577C3E63C10A2198EB05D5E5881C973C9EF2077F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fb:84:a7:03:0b:50:30:89:0a:4f:0c:86:b6:e5:4d:07:57:0b:66:1e:ca:13:ef:bf:fa:0b:62:41:c2:6a:07:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:eb:e0:18:6c:b5:b6:ef:38:ed:00:01:00:00:01:eb
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppVSentinel.pdb
kernel32
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
Name
.text
Size
1024B
Virtual Size
917B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=27412,
count=11, id=1, productName=Unmarked objects,
count=6, id=260, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppVTerminator.dll
- IMPHASH 9705f0fe8a6583687d9706b1a5e0d198
- SHA256 c5526ed7e7ba6ecb185f9aa57d22be783ed085428886ee3e50b42a101f55b12c
- MD5 0c15a072dd9e5b9fb86b548f2e2aa076
- SHA1 127248ee2ee763eb10d037ecd61d2fc431ef73dc
- SHA512 a8163dc5c53fe41a6bad9cc3e400011106f55613d3ccf24d0c38c28bf9d1fb2c3fc622de688e8cada6302455ad01ca7271481f64c78a278564bb5dfc3fda6a01
- SSDEEP 384:1zveMVZd3Jvj02v2UzlWsOd/WM70DBRJcAf/6fR9zcPmE:1zG21BidL701PcAY9zQ
- TLSH T1DD824CD6FB640993EAAA3D7062A8DA636D3CABD10F50409317D5E10D0C5B3C6EE3067E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:39:02:39:8c:c5:52:09:71:94:9b:8e:91:10:ef:a8:24:2c:06:9e:61:ec:e2:08:74:30:cd:dc:c7:c8:74:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6176
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppVTerminator.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
kernel32
InitializeSListHead
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IllBeBack
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1104, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppXDeploymentClient.dll
- IMPHASH 59439531d8580d6508d2812d5425be21
- SHA256 aa1bde000fb6906b86ecb2ddbeaf8580a3042265e1c036300cf58b93e7682c59
- MD5 a124d97906c0ade41f980166c2915d89
- SHA1 ea330b8a0e6a33a87f38d99acb70fcfd7fa6e55a
- SHA512 6d69864c77a54a0ecfe2a5d5862616b11e72e7a0c1b0104e20acbb954010699707516b43c273ac15b446bb088721ae05cf3a6a96fa78efb7e5521438b3fa43ce
- SSDEEP 12288:CYuZ+PgecteW1U5TyEPcRrhdetiFVkv0YSqSNLG5PqLrpANSlg:tRW1UBfcRLtVNLG5PqLrpuOg
- TLSH T1CCF46C116AC415B6F5BB3279957D323D72ED7A500BB088CBCB905AE82C716C26E3D21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:bb:a4:86:40:0a:e2:c4:6a:51:07:46:c9:ac:ff:a8:98:d2:55:82:ac:f7:5e:c5:05:58:e6:e7:a3:ef:2b:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
220976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppXDeploymentClient.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
memset
memmove_s
ntdll
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
RtlReportException
RtlIsMultiUsersInSessionSku
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlFreeHeap
NtQueryInformationFile
NtQueryInformationProcess
RtlAllocateHeap
NtSetInformationThread
RtlNumberGenericTableElementsAvl
RtlInitializeSRWLock
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtUnmapViewOfSection
NtMapViewOfSection
RtlNtStatusToDosErrorNoTeb
NtClose
NtCreateSection
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlReleaseSRWLockExclusive
RtlAllocateAndInitializeSid
RtlAcquireSRWLockExclusive
RtlInsertElementGenericTableAvl
RtlFreeSid
RtlAllocateWnfSerializationGroup
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfStateChangeNotification
RtlNtStatusToDosError
NtQueryInformationThread
RtlInitUnicodeString
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlDowncaseUnicodeString
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupElementGenericTableAvl
RtlQueryPackageClaims
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
NtSetInformationVirtualMemory
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockShared
WaitForSingleObject
ResetEvent
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventExW
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventW
SetEvent
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
DeleteCriticalSection
SleepEx
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TlsAlloc
ProcessIdToSessionId
TlsSetValue
TlsGetValue
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
GetProcessId
SetThreadToken
OpenThreadToken
OpenProcessToken
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
rpcrt4
CStdStubBuffer_Connect
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
I_RpcExceptionFilter
CStdStubBuffer_CountRefs
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcAsyncCompleteCall
CStdStubBuffer_QueryInterface
RpcServerInqCallAttributesW
NdrOleAllocate
RpcBindingBind
CStdStubBuffer_DebugServerRelease
RpcBindingCreateW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingUnbind
CStdStubBuffer_Disconnect
NdrClientCall4
RpcStringFreeW
UuidToStringW
NdrAsyncClientCall2
UuidCreate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient10
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
ObjectStublessClient9
NdrProxyForwardingFunction4
ObjectStublessClient21
NdrProxyForwardingFunction3
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient17
ObjectStublessClient16
CStdStubBuffer2_Connect
ObjectStublessClient24
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient27
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoSetErrorReportingFlags
api-ms-win-core-com-l1-1-0
CoReleaseMarshalData
CoGetApartmentType
CoIncrementMTAUsage
StringFromGUID2
CoCreateInstance
CoMarshalInterface
CoDecrementMTAUsage
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoUninitialize
CoRevertToSelf
CoImpersonateClient
CoGetCallerTID
CreateStreamOnHGlobal
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventUnregister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
CompareStringEx
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetVersionExW
GetWindowsDirectoryW
GetSystemInfo
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
DeleteFileW
WriteFile
GetFileSizeEx
SetFileAttributesW
GetFileAttributesW
GetVolumePathNameW
CompareFileTime
FindNextFileW
GetFullPathNameW
FindFirstFileW
FindClose
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
CreateDirectoryW
GetDriveTypeW
CreateFileW
GetVolumeInformationW
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
api-ms-win-security-lsalookup-l1-1-0
LsaLookupOpenLocalPolicy
LsaLookupFreeMemory
LsaLookupGetDomainInfo
LsaLookupClose
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-path-l1-1-0
PathCchCombine
PathCchRemoveBackslash
PathCchSkipRoot
PathAllocCanonicalize
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
NotifyServiceStatusChangeW
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
VirtualQuery
VirtualProtect
CreateFileMappingW
MapViewOfFile
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
AppInstallerUpdateAllTask
AppxAddPackageToAllUserStoreForPbr
AppxCleanupOrphanPackages
AppxCleanupSystemAppsMigratedToFOD
AppxCleanupWCIReparsePoints
AppxCreateSharedLocalFolder
AppxCreateSharedLocalFolderForFamilyName
AppxDeletePackageFiles
AppxDestagePackage
AppxDoesSharedLocalFolderExistForFamilyName
AppxGetPackageInstalledLocation
AppxGetStagedPackageFullNameFromFamilyName
AppxIsStagedPackageStoreSigned
AppxPackageRepositoryRecoverStagedPackages
AppxPackageRepositoryRecoverUserInstalls
AppxPreRegisterAllInboxPackages
AppxPreRegisterPackage
AppxPreStageCleanupRunTask
AppxRecoverUserInstallsForUpgrade
AppxRegisterPackage
AppxRemoveAllPackagesForUserSid
AppxRemovePackageForAllUsers
AppxRemovePackageForUserSid
AppxRequestRemovePackageForUser
AppxStagePackage
AppxValidatePackages
AppxValidatePackagesWithOptions
CheckAppInstallerUpdateAvailability
CheckComCallerHasCapabilities
CheckForUpdatesAndWaitForInstallerIfNeeded
CleanupProfileForUser
ClientDeleteAllPackagesFromMainPackageArray
ClientGetAllPackagesToBeInstalledForUser
CreateCanonicalPriFile
DeleteApplicabilityInfoArray
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EnsurePackageFamiliesAreRegisteredInContainer
EnsurePackageFamilyIsRegisteredBeforeActivation
FixJunctionsForAppsIfNecessary
GeneratePreInstalledPriFiles
GetApplicability
GetApplicability2
GetApplicability4
GetApplicability5
GetBundleApplicablePackages
GetMetadataRootForPackage
GetNotificationPayload
GetNotificationPayloadForUser
GetPackageApplicabilityForUserLogon
GetPackageRegistrationStatusForUser
GetPackageRegistrationStatusForUserAndDefaultAccount
HasPackageFamilyBeenRegisteredForUser
IsPackageInstalled
IsPackageMetadataUnderSystemMetadata
IsSharedAppsEnabled
MsixPackageVolumeIsRepairNeeded
MsixPackageVolumeRepair
NotifyPackageStatusChanged
PopulateProtocolAndFTA
PreRegisterPackagesInContainer
RDSRecoverRequests
ReArmAppxPreStageCleanupTask
RegisterNotification
RegisterNotificationForUser
RemovePackageFromContainer
RepairPackageFileAcls
RequestContentGroups
RequestContentGroupsForFullTrust
UnregisterNotification
UnregisterNotificationForUser
UpdateAgentCancelAllDownloads
UpdateAgentCreateDownload
UpdateAgentFreeDownloadRanges
UpdateAgentGetDownloadRanges
UpdateAgentGetDownloadingPackageCount
UpdateDataSourceAddRange
UpdateDataSourceCancelRun
UpdateDataSourceRegister
UpdateDataSourceRun
VerifyPackage
Name
.text
Size
676KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=105, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1780, id=1, productName=Unmarked objects,
count=8, id=259, version=27412,
count=21, id=260, version=27412,
count=1, id=256, version=27412,
count=417, id=270, version=27412,
count=27, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Apphlpdm.dll
- IMPHASH a656008929f1036ae19b9fbbe356c3a4
- SHA256 09725c772489573d6b1489591ec1e0f580c5c1f650f82d0a112a44fc89842938
- MD5 e166daac460eb2a7a67c9a5a2dcccf1f
- SHA1 994ff138c195fb13d4cd3446ab68224b2c210a2c
- SHA512 0605565ae013f5973a2946796a83c1484ada9dbfeeca0b379267e90037426ecf8932310a3f431cced44bba4c722fdb201ea865df91df0803246f9f73b287d374
- SSDEEP 384:dlPLo/0VIp747y9M+qzviYng+B2CLCB8j17fzWY9Wf0jgvnTEySeC:dZIp74glmviylJ17fXeCqVC
- TLSH T11DD20883F1494490E5AA1078346F4E7B067FBD3096A006C7BA7B3A593DB65E1783E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Apphlpdm.pdb
msvcrt
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsnicmp
memset
ntdll
RtlFreeUnicodeString
RtlStringFromGUID
RtlCompareMemory
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-file-l1-1-0
CreateDirectoryW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
wdi
WdiGetDiagnosticModuleId
WdiGetParameterData
WdiGetEvent
WdiGetParameterByName
WdiAddParameter
WdiSetProblemDetectionResult
WdiSetResolution
shell32
ShellExecuteW
Shell_NotifyIconW
user32
UnregisterClassW
SetWindowTextW
DispatchMessageW
DestroyIcon
SetDlgItemTextW
RegisterClassW
SendDlgItemMessageW
LoadIconW
DestroyWindow
SendMessageW
GetDlgItem
RegisterWindowMessageW
GetWindowLongW
DefWindowProcW
DialogBoxParamW
GetMessageW
SetForegroundWindow
EnableWindow
PostMessageW
EndDialog
SetWindowLongW
CreateWindowExW
mouse_event
gdi32
GetObjectW
CreateFontIndirectW
wtsapi32
WTSQueryUserToken
wer
WerReportCreate
WerReportSubmit
WerReportCloseHandle
WerReportSetParameter
WerReportSetUIOption
WerReportAddFile
apphelp
SdbGrabMatchingInfo
SdbGetEntryFlags
SdbIsNullGUID
WdiDiagnosticModuleMain
WdiGetDiagnosticModuleInterfaceVersion
WdiHandleInstance
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=2, id=259, version=27412,
count=85, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppointmentActivation.dll
- IMPHASH e02187d4c7431c41a3ffdce6ecfc4b8c
- SHA256 11d6599d838e241c2d8215fa562c9638dafbab1e3f693a617777853548b81385
- MD5 f1ddc7f4e809902948f547b0262bfd98
- SHA1 7329be7b8de129a4347857d1afdf5f834dfe28a8
- SHA512 2adf0ba76fab868bafe5d8730389a18e173d7e1bd435b74529a8ac9ae8731e10f944c0ed7d32247ae45048048a7081fa0af21646a58a6790687b293b55609173
- SSDEEP 3072:qvAFoF7GGaSKta/oR6VArZ5P7UXwFRbqDgK7RjFs5LCa:gHKt+o8HXW0boLV
- TLSH T11AB3282272941971E2EE373C347922B995AFEA200BD097CB2E11C9D55C21BD29D3877F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
31440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppointmentActivation.pdb
msvcrt
_XcptFilter
_wcsicmp
_wcstoi64
malloc
wcsrchr
toupper
wcscspn
_amsg_exit
_unlock
__dllonexit
wcstoul
_onexit
_vsnwprintf
__CxxFrameHandler3
free
_except_handler4_common
_wcstoui64
wcsstr
memmove
_initterm
memcpy_s
wcsncmp
_purecall
_vsnwprintf_s
_callnewh
_errno
_lock
memcmp
memcpy
memset
api-ms-win-appmodel-runtime-l1-1-1
ParseApplicationUserModelId
rpcrt4
NdrCStdStubBuffer2_Release
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrStubForwardingFunction
NdrOleAllocate
NdrStubCall2
CStdStubBuffer_DebugServerRelease
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserFree
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsSubstringWithSpecifiedLength
HSTRING_UserUnmarshal
WindowsDeleteString
WindowsCreateString
WindowsDuplicateString
HSTRING_UserSize
WindowsGetStringRawBuffer
WindowsCreateStringReference
HSTRING_UserMarshal
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventProviderEnabled
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
EnterCriticalSection
DeleteCriticalSection
CreateMutexExW
LeaveCriticalSection
AcquireSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx
SetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockExclusive
InitializeSRWLock
TryAcquireSRWLockExclusive
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateFreeThreadedMarshaler
CoWaitForMultipleObjects
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoTaskMemFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
api-ms-win-core-url-l1-1-0
UrlUnescapeW
UrlEscapeW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Connect
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction3
ObjectStublessClient7
CStdStubBuffer2_Disconnect
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AwaitAppointmentActivation
DeserializeActivationArgs
DeserializeAppointment
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetAddAppointmentArgument
GetCalendarChooserArgument
GetLegacyAppointmentDetailsArgumentString
GetProxyDllInfo
GetRemoveAppointmentArgument
GetReplaceAppointmentArgument
GetWindowIdOfHost
ReleaseActivationArgs
SerializeAppointmentIdsResult
SerializeCalendarIdResult
ShowAddAppointment
ShowAddAppointmentAsync
ShowAppointmentDetails
ShowCalendarChooser
ShowCalendarChooserAsync
ShowRemoveAppointment
ShowRemoveAppointmentAsync
ShowReplaceAppointment
ShowReplaceAppointmentAsync
ShowTimeFrame
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=3, id=259, version=27412,
count=157, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=26, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppointmentApis.dll
- IMPHASH bfa01c895575bbff8895e93c5b61c3ee
- SHA256 58d598d913143bc2151aae4eb3cb0bae3bbcc50785055588b0fe1cc3a5de5e18
- MD5 54ec39e252c389e6ab77bc6d8ed99730
- SHA1 3fae48b95f297fcfd88817fd8c50e403d58740c2
- SHA512 755a7076f475f92138d863aca0157571ac8c7eafb58dc679e1642ca03b96f968b9a4e06233a0e19fb81ff97683c45c2ede080a0a57dc64f386ecd3df51f2effd
- SSDEEP 12288:Msxu9kqY5oCsEphcjj7rsowLTizs6Y21lDmx:MQuaeCsahcsPLThi1q
- TLSH T158D42A336A802A21EEF226F4565E363591EDF6708750D6CB9320D2E97CD17D0DD322AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
170976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppointmentApis.pdb
msvcrt
_vsnwprintf
memmove
__CxxFrameHandler3
memcpy
memcmp
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcstoul
_wcsicmp
_errno
_vsnwprintf_s
memmove_s
realloc
_purecall
wcsncpy_s
malloc
free
memcpy_s
_onexit
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
LoadResource
DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
SizeofResource
FindResourceExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
api-ms-win-core-synch-l1-1-0
ReleaseMutex
ReleaseSRWLockExclusive
CreateEventW
WaitForSingleObject
ReleaseSRWLockShared
InitializeCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateEventExW
InitializeSRWLock
AcquireSRWLockShared
AcquireSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
SetEvent
EnterCriticalSection
DeleteCriticalSection
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventRegister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThread
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
SetThreadToken
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork
CreateThreadpoolWait
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
ntdll
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
userdataplatformhelperutil
RunServicesInProc
StartAndWaitForServiceForUser
GetUserTokenFromContext
GetUserContextFromHandle
IsCommsSystemService
GenerateUserModeServiceName
appointmentactivation
ShowRemoveAppointmentAsync
ShowAddAppointmentAsync
GetWindowIdOfHost
ShowReplaceAppointment
ShowReplaceAppointmentAsync
ShowRemoveAppointment
AwaitAppointmentActivation
ShowCalendarChooserAsync
ShowCalendarChooser
ShowTimeFrame
ShowAppointmentDetails
ShowAddAppointment
systemeventsbrokerclient
SebCreateCalendarNotificationEvent
SebDeleteEvent
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreatePropertiesFromRecurrencePattern
CreateRecurrencePatternFromProperties
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
569KB
Virtual Size
569KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=16, id=260, version=27412,
count=227, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=49, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppxAllUserStore.dll
- IMPHASH dbbae36259d2b7e5a9f5a78b46733a18
- SHA256 0f9739bfda492a83fcb047e2e9eca579babd8b33263295e0fa58ea511c7cf0b8
- MD5 8b110cd95e93e06388ba54f21ba08580
- SHA1 5e889484f91b73d6962e1f201ff5dded517fc134
- SHA512 d5363c36124cc607d085565bf9838cc1f41fd65d411cdea677b88667c7c38a23e617bcdd62ebed7ed48b1e7416d814a6c0bdb8910706dde7d7d183bbea25df65
- SSDEEP 6144:+XZziW+p5MX8KCQNw19PxjtNoIayEA7CF0RbIRQq28:9pKCQEKyEAuF0RgQqj
- TLSH T174544B1167C62538F6F32879BABA36B1543D35310F7081CBD3948B5A2D626C2DB36B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
11:d5:d8:47:36:ee:f5:ec:f9:8f:a8:27:52:3c:d8:82:d6:74:73:d0:42:b7:da:bb:43:1a:4d:23:dc:3b:a4:c0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e0:d4:fc:1f:13:15:1f:7e:5d:00:01:00:00:01:e0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
85200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppxAllUserStore.pdb
msvcrt
_except_handler4_common
_onexit
memmove
memcpy
__dllonexit
_unlock
memcmp
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcschr
wcstok_s
wcsstr
_wcsnicmp
_wcslwr
_wcsicmp
memmove_s
_vsnwprintf_s
memcpy_s
toupper
memset
ntdll
RtlAddAce
RtlAllocateAndInitializeSid
RtlDeleteCriticalSection
RtlNtStatusToDosErrorNoTeb
RtlDowncaseUnicodeString
RtlValidSid
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitUnicodeString
RtlCompareUnicodeString
RtlSystemTimeToLocalTime
NtQuerySystemTime
RtlFreeSid
RtlReleaseSRWLockExclusive
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW
LoadLibraryExA
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
OpenSemaphoreW
ReleaseSRWLockExclusive
CreateMutexExW
DeleteCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
OpenThreadToken
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation
EventProviderEnabled
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetWindowsDirectoryW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegDeleteKeyExW
RegCopyTreeW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegUnLoadKeyW
RegQueryInfoKeyW
RegLoadAppKeyW
RegCloseKey
RegGetValueW
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-core-file-l1-1-0
FindNextFileW
GetFileAttributesW
SetFileAttributesW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
CreateFileW
WriteFile
DeleteFileW
FindClose
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
AdjustTokenPrivileges
GetSidSubAuthorityCount
ImpersonateSelf
GetTokenInformation
GetLengthSid
CopySid
GetAce
ImpersonateLoggedOnUser
RevertToSelf
CheckTokenMembership
GetSidSubAuthority
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalAlloc
api-ms-win-core-file-l2-1-0
MoveFileExW
CreateHardLinkW
api-ms-win-core-kernel32-legacy-l1-1-0
CopyFileW
MoveFileW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
VariantClear
SysAllocString
SysAllocStringLen
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddDeprovisionedPackageMarking
AddDownlevelInstalledPackageToRegistryStore
AddEndOfLifePackageMarking
AddEndOfLifePackageMarkingForAllUsers
AddPackageToPreinstalledAppsVolume
AddPackageToRegistryStore
AddStagedPackageToPreinstalledAppsVolume
AddStagedPackageToRegistryStore
AddUpgradePackageToPreinstalledVolume
AddUpgradePackageToRegistryStore
ApplyDependencyTargetPackageRootFolderACLs
ApplyFrameworkPackageRootFolderACLs
ApplyPackageRootFolderACLs
ApplySharedFileACLs
CheckPackagePreinstallPolicy
CommitTakeOwnershipSession
DeleteAllPackagesFromMainPackageArray
DeleteAllPackagesFromPackageArray
DeletePackageInfo
DeleteUpdatedPackageKey
DeleteUserRegistryKeyFromAllUserStore
DidAppSurviveOSUpgradeForUser
DoesPerUserStoreExist
FamilyMonikerStringToSid
FindExistingVersionInRegistryStore
FindFullNameForFamilyNameInAppxAllUserStore
GetAllInboxPackages
GetAllNonInboxPackagesFromRegistryStore
GetAllPackagesToBeInstalledForSetupPhase
GetAllPackagesToBeInstalledForUser
GetAllStagedPackagesForMainPackageFromRegistryStore
GetAllUpdatedPackages
GetAppxProvisionFactory
GetFoldersToKeepForPBR
GetOptionalPackageInfoForPackage
GetPackageOverrideSetupPhase
GetPackageSetupPhase
GetPackagesThatMayNeedPreinstallPackageStatusMarked
GetStatusOfPackageFamilyForUser
GetUpgradePackageVolumeKey
HasCentennial
HasStagedPackages
IsCleanupTaskComplete
IsEnterprisePolicyEnabled
IsInboxPackage
IsInboxPackageAndPath
IsNonInboxAllUserPackage
IsNonInboxAllUserPackageSpecificPackage
IsPackageEndOfLife
IsPackageFamilyInUninstallBlocklist
IsPackageFamilyInUninstallBlocklistByPackageFullName
IsPackageInDownlevelInstalledKey
IsPackageInEndOfLifeKey
IsPackageInStagedKey
IsPackageInUpgradeKey
IsPackageInUsersUpgradeKey
IsPackageOnPreinstalledVolume
IsSystemInAuditBoot
MarkStatusOfMainPackageForUser
PackageFamilyNameFromId
PackageIdBasicFromFullName
PackageSidToPackageCapabilitySid
RemoveDeprovisionedPackageMarking
RemoveDownlevelInstalledPackagesFromRegistryStore
RemoveEndOfLifePackageMarkingForAllUsers
RemoveInboxInstalledStatusOfPackageForUser
RemovePackageFromRegistryStore
RemovePackageFromRegistryStoreConfigIfExists
RemoveStagedPackageFromRegistryStore
RemoveStatusOfMainPackageForAllUsers
RemoveUpgradePackagesFromRegistryStore
RestoreDownlevelAllUserStore
RollbackTakeOwnershipSession
SetAllUserStorePathForTest
SetPackageOverrideSetupPhase
SetTargetOsVersionOnPreinstalledVolume
TakeOwnershipOnFolder
TryGetDownlevelInstalledPackageFullName
TryGetEndOfLifePackageFullName
UpdateFrameworkPackageInRegistryStore
UpdatePackageInRegistryStore
UpdatePackageSetupPhase
UpdateUpgradePackageInRegistryStore
Name
.text
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=4, id=259, version=27412,
count=1, id=261, version=27412,
count=219, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=68, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppxApplicabilityEngine.dll
- IMPHASH 7885a8985cf9b8f73dcac13f711de1b1
- SHA256 7c172d6a1edcb378da96ca2cc1957f4ee7c1bd364d189b94e831a01aadc82a9c
- MD5 c463d70f693173ad279657ad61454cb5
- SHA1 b4e0f747648697136b151abc4f5a9e21b47382ce
- SHA512 25fc0970705138946a01d54aaa98a5a21c539198a440bbc6f0d6dc57915b594954d595299f2187cb59710856ec2671d056e60f54a6fc5330d8e8beb5e6f9f85e
- SSDEEP 6144:RSrb5NbADdu+eEQT7xALVezyYOSnAFbm+sdRNh3dZZcvD9zPcS5i9Rh5OBa:4rb5N+du+e3F4Veu/pbm+sdRNh3doRyn
- TLSH T179147C12B780C075C3BB3230686FB77652BE54A15F6145DBA3A49BBE2D707C18E3428B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b1:12:b7:51:3a:15:67:ef:6f:94:fa:de:85:93:d0:f5:27:9d:a0:cc:e5:c3:f6:07:7c:24:9f:63:da:e8:47:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e5:8f:6a:c0:f3:3d:b4:0b:a3:00:01:00:00:01:e5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
78816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppxApplicabilityEngine.pdb
msvcrt
__CxxFrameHandler3
memcmp
abort
_XcptFilter
calloc
_ftol2_sse
_wtoi
wcscpy_s
??_V@YAXPAX@Z
_amsg_exit
swscanf_s
??8type_info@@QBEHABV0@@Z
_initterm
bsearch
_lock
__pctype_func
_unlock
__dllonexit
___lc_codepage_func
___mb_cur_max_func
__crtCompareStringW
__crtLCMapStringW
_onexit
___lc_collate_cp_func
?terminate@@YAXXZ
___lc_handle_func
memcpy
??1type_info@@UAE@XZ
setlocale
_except_handler4_common
memchr
tolower
isspace
_errno
_CxxThrowException
_callnewh
malloc
realloc
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
free
strchr
wctob
_swprintf_c_l
??0exception@@QAE@ABQBD@Z
memmove
?what@exception@@UBEPBDXZ
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
towlower
memset
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleW
LoadLibraryExA
FreeLibrary
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserPreferredUILanguages
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegCloseKey
RegGetValueW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalAlloc
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-base-l1-1-0
CopySid
GetTokenInformation
IsWellKnownSid
EqualSid
GetLengthSid
IsValidSid
api-ms-win-core-localization-obsolete-l1-2-0
EnumUILanguagesW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
AddDirectXFeatureLevelToContext
AddUserLanguagesToContext
CreateApplicabilityContext
CreateApplicabilityContextFromString
FreeApplicabilityContext
FreeApplicablePackages
GetApplicabilityContext
GetApplicablePackages
GetApplicablePackagesForUser
GetApplicablePackagesForUserWithAppChosenResources
GetApplicablePackagesWithAppChosenResources
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=185, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=15, id=261, version=27412,
count=25, id=260, version=27412,
count=1, id=256, version=27412,
count=43, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppxPackaging.dll
- IMPHASH 93de9548aae9d8b4ba0da5b04aed32c5
- SHA256 991769e1985adf07daa027a132d1caba1d75c826e9dcac4da964136e716431b1
- MD5 d0ee285031580d5514c288a537d08736
- SHA1 7f49c99242f74a3cf860f695454dd0cf2d5c3463
- SHA512 ca0b759d9e7462cea47bf5e098c54c095312bfa1b47603f1775870fefdbf922a3170e03bd98d930728d7e91e214edb905ab2621501cbb4f34a0171e9b9652a1e
- SSDEEP 12288:aOF935NQQ0G4goIqfwQtzRo68ofv74+Ziab4r+iRzmaDXlMrbAWZ+6e9EHE2cNEf:aMAQ0G4goIY1y64SQzhed+BEHEJNEpB
- TLSH T123751AC235C48E15CD731838BA6236589B28E27703648DD6F5DCA267AF326C1993B377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:80:4f:06:46:82:a2:a4:e3:3e:a5:8e:33:2d:d4:b4:2c:d4:be:8e:5f:10:f3:3a:74:09:f0:82:91:0c:67:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 17, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
290144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppxPackaging.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
memmove
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o_free
_o_malloc
_o_qsort
_o_towlower
_o_wcscpy_s
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__cexit
_o__callnewh
__std_terminate
wcschr
wcsrchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
memcmp
wcsstr
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
CreateProcessW
GetCurrentProcess
GetExitCodeProcess
TlsAlloc
TlsGetValue
TlsSetValue
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
ReleaseMutex
CreateEventW
ReleaseSemaphore
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObject
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExA
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
FindStringOrdinal
GetModuleFileNameA
LoadResource
GetModuleHandleW
SizeofResource
FreeLibrary
DisableThreadLibraryCalls
LockResource
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
GetVersionExW
GetLocalTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
RtlReportException
RtlIsGenericTableEmptyAvl
RtlFreeSid
RtlDowncaseUnicodeString
RtlAllocateAndInitializeSid
RtlFreeUnicodeString
RtlNumberGenericTableElementsAvl
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitUnicodeString
RtlCompareUnicodeString
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlSetLastWin32Error
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
RtlInitializeBitMap
RtlClearAllBits
RtlSetBits
opcservices
ord16
ord4
ord7
ord8
ord11
ord10
ord12
ord9
ord15
urlmon
CreateUri
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-com-l1-1-0
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateGuid
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
GetSidSubAuthority
GetSidSubAuthorityCount
RevertToSelf
api-ms-win-core-file-l1-1-0
GetFullPathNameW
CreateDirectoryW
GetFileAttributesW
CreateFileW
DeleteFileA
DeleteFileW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
CompareStringEx
CompareStringOrdinal
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
FileTimeToDosDateTime
FindResourceW
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SysAllocString
SysFreeString
CreateErrorInfo
SetErrorInfo
SysAllocStringLen
VariantInit
SysStringLen
GetErrorInfo
xmllite
CreateXmlReader
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
913KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
648KB
Virtual Size
647KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=257, version=27412,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1358, id=1, productName=Unmarked objects,
count=11, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=245, id=270, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AppxProvisioning.xml
- SHA256 8d1659b73479a51f5aa891390eb809156afc52567c309e2462957e1d69b775a3
- MD5 3d7ff4b04224f03af5b3894878b1d33b
- SHA1 7d3d3f4eff643e9abca6d604710f92a686ef99a8
- SHA512 1e5d6e8c8f5004ee31e04a962d34820ef009bbe9ca7634de54b27a819c243c3964ea7a2aec58b1dbea3d47155ef9831e8713de6cfa56ebd1229c0d4d9a1def87
- TLSH T1DA616008F8D05F72A3666C37BD71AD64BC4D66E3A0994B88B258720BBFF35A15E07052
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/AppxSip.dll
- IMPHASH f499137b42506a385999f87abfbc5e1f
- SHA256 6e851e3151f0f09f414bb59d59455dc170bddf727a34b65be5e01536057bbfb5
- MD5 e2dee12e39373e8b89f6347b926daa05
- SHA1 a141428af675a61e8f3f8523c3f23148172a874d
- SHA512 612992d6fa1716a01d7c87f2accc0fefcc603f5f2cf30240c7115092eff124ea3da989d62ae43de3dce0139c7a7c9882eb7a8c6e56ac6cbecb69521a68257d2a
- SSDEEP 6144:XXDy1Nnh0SUIbQRhUIMxG6jqBE2R5dAO:XXePh0h3hURxPqBx
- TLSH T1E444AE8236454D38DBF33078B55A323819BCB62047E489C727E583EB69975C25B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
93648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AppxSip.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__strnicmp
_o__wcsicmp
_o_free
_o_malloc
_o_qsort
_o_wcscpy_s
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
wcschr
wcsstr
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
wcsrchr
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection
CreateMutexExW
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-1-0
LoadResource
SizeofResource
LockResource
LoadLibraryExA
FreeLibrary
GetProcAddress
LoadLibraryExW
FindStringOrdinal
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
ntdll
RtlNtStatusToDosError
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlReportException
NtQuerySystemInformation
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlSetLastWin32Error
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlInitUnicodeString
RtlCompareUnicodeString
RtlNumberGenericTableElementsAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetFileAttributesW
DeleteFileW
DeleteFileA
CreateFileW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
CompareStringOrdinal
CompareStringEx
api-ms-win-core-url-l1-1-0
PathIsURLW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
opcservices
ord8
ord15
ord16
ord12
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
FileTimeToDosDateTime
CopyFileW
FindResourceW
api-ms-win-core-file-l2-1-0
MoveFileExW
ReplaceFileW
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateLoggedOnUser
AppxBundleSipCreateIndirectData
AppxBundleSipGetSignedDataMsg
AppxBundleSipIsFileSupportedName
AppxBundleSipPutSignedDataMsg
AppxBundleSipRemoveSignedDataMsg
AppxBundleSipVerifyIndirectData
AppxSipCreateIndirectData
AppxSipGetSignedDataMsg
AppxSipIsFileSupportedName
AppxSipPutSignedDataMsg
AppxSipRemoveSignedDataMsg
AppxSipVerifyIndirectData
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
EappxBundleSipCreateIndirectData
EappxBundleSipGetSignedDataMsg
EappxBundleSipIsFileSupportedName
EappxBundleSipPutSignedDataMsg
EappxBundleSipRemoveSignedDataMsg
EappxBundleSipVerifyIndirectData
EappxSipCreateIndirectData
EappxSipGetSignedDataMsg
EappxSipIsFileSupportedName
EappxSipPutSignedDataMsg
EappxSipRemoveSignedDataMsg
EappxSipVerifyIndirectData
P7xSipCreateIndirectData
P7xSipGetSignedDataMsg
P7xSipIsFileSupportedName
P7xSipPutSignedDataMsg
P7xSipRemoveSignedDataMsg
P7xSipVerifyIndirectData
Name
.text
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=27412,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1272, id=1, productName=Unmarked objects,
count=4, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=100, id=270, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AssignedAccessRuntime.dll
- IMPHASH 78094e142dbb49c4f7a9a48b118c4159
- SHA256 5c95a1e06033125fb8e7467c83af59b3f22b219c213f2fc2265c476e604b8627
- MD5 3ccc1c46937cbe2f114ab77a7df419e2
- SHA1 1e8f4ee7a30481d82ce56de9f2a76b9bf813dc6e
- SHA512 6458ed5200ed3f74de023af20c22188bd175352ac1836f295e086c5c05c362f4d5fbc98bc66c8a9d86f240961b054b98e2902864a42fac4b29f8574713adc91f
- SSDEEP 768:ton/1o2GBJXlalImox0jTr5Uxp5lmP/IspAuu3uTD71/y5jzeVD+:G/1oNBJXAoxGTr5U9lmYsru3uv71/yxK
- TLSH T1EA232921AB8444F5E3BB3538645E623852ACAC505FF151C3EF2367AE2C24AE3D93915F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
32640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AssignedAccessRuntime.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ui64tow_s
_o_free
_o_malloc
_except_handler4_common
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_o__callnewh
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoGetCallContext
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegGetValueW
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFullNameFromToken
api-ms-win-appmodel-runtime-internal-l1-1-3
CouldMultiUserAppsBehaviorBePossibleForPackage
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFullName
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=12, id=260, version=27412,
count=1208, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=10, id=265, version=27412,
count=23, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AudioEng.dll
- IMPHASH 40e63787dbd8b01e488b84c1b879e331
- SHA256 e75a456c18d93a9bff731139e5dff0b7a92f2e1f5b7228274385c65a527a1f42
- MD5 074adb230e03ccdd7592aa91fd6827e6
- SHA1 3a95aa2151b0c23e6733fbd538c927a54fcded4a
- SHA512 2fb38a45bce2bd4cf2b010522e3f7173f2381481ca194edf05d6aec292dcb39b80a9564a0d197bb4949e9580f178582f9c3b1dc37d3fcce05d496f1da615644f
- SSDEEP 49152:TAEM+CEh0/Rlhh9hhDhMLhhQhhIeCBR2U+8TB9DFRKPcMJmYoHFOjzdYes/QFlP3:7MX5hh9hhDhMLhhQhhC2sTB9DFRKPcMB
- TLSH T1DE95DF22968050F1E2B66570720C65B754ADA77B8B2071C73B98CAFDFF748D2293934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:01:e3:e1:c5:ee:48:ab:ed:e3:6c:68:fb:4c:1e:a9:e4:95:a9:75:79:c0:94:fe:bd:90:3a:6f:29:ba:77:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
905312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AUDIOENG.pdb
oleaut32
VarUI4FromStr
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapDestroy
HeapFree
api-ms-win-core-com-l1-1-0
StringFromGUID2
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoDisconnectObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoCreateGuid
PropVariantClear
IIDFromString
StringFromIID
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
ReleaseMutex
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
CreateWaitableTimerExW
CancelWaitableTimer
ReleaseSRWLockExclusive
CreateEventExW
SetWaitableTimer
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive
ResetEvent
WaitForSingleObject
OpenSemaphoreW
CreateEventA
CreateEventW
WaitForMultipleObjectsEx
EnterCriticalSection
SetEvent
CreateMutexExW
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
SetThreadPriority
GetCurrentThreadId
TerminateProcess
TlsGetValue
CreateThread
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LoadResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
LockResource
GetProcAddress
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
FindResourceExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventProviderEnabled
EventRegister
EventUnregister
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegCreateKeyExA
RegQueryValueExA
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
ntdll
RtlAllocateMemoryBlockLookaside
EtwLogTraceEvent
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtQueryInformationProcess
RtlUnlockMemoryBlockLookaside
RtlCreateMemoryBlockLookaside
RtlLockModuleSection
RtlUnlockModuleSection
RtlLockMemoryBlockLookaside
RtlUnlockCurrentThread
RtlFreeMemoryBlockLookaside
RtlLockCurrentThread
RtlReportException
RtlNtStatusToDosError
RtlDestroyMemoryBlockLookaside
RtlExtendMemoryBlockLookaside
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
NtSetTimerResolution
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
NtClose
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
TraceEvent
UnregisterTraceGuids
rpcrt4
RpcStringBindingComposeW
NdrClientCall4
RpcStringFreeW
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcBindingFree
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
WakeByAddressAll
WaitOnAddress
InitOnceInitialize
Sleep
propsys
PropVariantToString
PropVariantToBuffer
PropVariantGetElementCount
api-ms-win-crt-math-l1-1-0
_isnan
_finite
api-ms-win-crt-string-l1-1-0
memmove_s
strnlen
memset
strncmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o__wfopen_s
_o__wmkdir
_o__wstat32
_o__wtof
_o_atoi
_o_calloc
_o_ceil
_o_fclose
_o_fgets
_o_floor
_o_fopen
_o_fread
_o_free
_o_fseek
_o_fwrite
_o_malloc
_o_memcpy_s
_o_qsort
_o_realloc
_o_strcat_s
_o_strcpy_s
_o_strncpy_s
_o_strtod
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstombs_s
strchr
strstr
_except_handler4_common
_o__configure_narrow_argv
_o__CItan
_o__CIsqrt
_o__CIsin
_o__CIpow
_o__CIlog10
_o__CIlog
_o__CIfmod
_o__CIexp
_CxxThrowException
_o__aligned_malloc
memcmp
_o__CIcos
_o__CIatan2
memcpy
_o__aligned_free
_o__CIasin
_o__CIacos
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___acrt_iob_func
__std_terminate
_o___stdio_common_vsprintf
__CxxFrameHandler3
_o__crt_atexit
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___stdio_common_vfprintf_s
_o__cexit
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memmove
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
CreateThreadpool
CloseThreadpool
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsConcatString
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathFindFileNameW
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-path-l1-1-0
PathCchRenameExtension
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
GetFileSize
CreateFileA
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-memory-l1-1-1
SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
avrt
AvRevertMmThreadCharacteristics
AvTaskIndexYield
AvTaskIndexYieldCancel
AvThreadOpenTaskIndex
AvQuerySystemResponsiveness
AvSetMmThreadCharacteristicsA
AvSetMmThreadPriority
AvSetMultimediaMode
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
AERT_Allocate
AERT_Free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_BSS
Size
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
16KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_DATA
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_CONST
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=15, id=260, version=27412,
count=4, id=257, version=27412,
count=99, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1393, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=291, id=270, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AudioSes.dll
- IMPHASH 50e5a78861027dc2e9497481ebd1472e
- SHA256 a79df5fa7ea92cf40f4344cae3e6015cc817880f74e37ffe44f448164321c908
- MD5 3b4acf3fd0dc285622fdfb0edccbef53
- SHA1 c3ff2ba932435f5cea445ea0cc0b19c204c07dfb
- SHA512 5b8a51576bdccf23f689dff8c2c55c235c4f041424c3da6e77b129263c669040b387530eda71337bf7dc34d44d625f3429dffed0f382883481efd3ae7f6bc38b
- SSDEEP 24576:+Hx9gFDy+SbewXQwQVwDZUu3xaKM/3SEGa3CRjwwbFnA:yxzdxM/3/GaymwbC
- TLSH T1F7456C216644DD75E2BB3175422F72BA936DB2704B2084C7E350BAF97E70AC26F3524B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
64:e9:8e:30:41:00:21:b5:8f:28:7e:d6:7b:5c:31:27:9e:aa:cf:39:1a:72:e7:07:34:7e:e2:bd:fc:6f:da:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e5:8f:6a:c0:f3:3d:b4:0b:a3:00:01:00:00:01:e5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
274496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
audioses.pdb
msvcp_win
_Mtx_init_in_situ
_Mtx_lock
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z
_Mtx_destroy_in_situ
_Mtx_unlock
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wsplitpath_s
_o__wtof
_o__wtoi
_o_calloc
_o_ceil
_o_floor
_o_free
_o_log2
_o_malloc
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__std_type_info_compare
wcschr
_except_handler4_common
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__CIsqrt
_o__CIsin
_o__CIpow
_o__CIlog10
_o__cexit
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
rpcrt4
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
I_RpcExceptionFilter
CStdStubBuffer_DebugServerQueryInterface
NdrDllUnregisterProxy
RpcSmDestroyClientContext
NdrDllRegisterProxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
RpcBindingFree
RpcStringFreeW
NdrOleAllocate
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrOleFree
RpcStringBindingComposeW
NdrDllCanUnloadNow
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
RpcBindingFromStringBindingW
NdrClientCall4
CStdStubBuffer_CountRefs
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient12
ObjectStublessClient21
ObjectStublessClient4
ObjectStublessClient17
ObjectStublessClient14
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient19
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient15
ObjectStublessClient20
oleaut32
BSTR_UserFree
VariantTimeToSystemTime
SystemTimeToVariantTime
LPSAFEARRAY_UserMarshal
VarUI4FromStr
BSTR_UserUnmarshal
LPSAFEARRAY_UserUnmarshal
BSTR_UserSize
LPSAFEARRAY_UserSize
BSTR_UserMarshal
LPSAFEARRAY_UserFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LockResource
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls
SizeofResource
FindResourceExW
FreeLibraryAndExitThread
GetModuleFileNameA
FreeLibrary
LoadResource
LoadLibraryExW
api-ms-win-core-localization-l1-2-0
GetThreadLocale
FormatMessageW
SetThreadLocale
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateMutexExW
ReleaseSemaphore
CreateEventW
EnterCriticalSection
WaitForSingleObject
CreateWaitableTimerExW
CreateSemaphoreExW
ResetEvent
OpenEventW
InitializeCriticalSectionEx
CreateEventExW
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseMutex
OpenSemaphoreW
WaitForSingleObjectEx
SetWaitableTimer
AcquireSRWLockExclusive
InitializeSRWLock
CancelWaitableTimer
TryEnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringLen
WindowsCreateString
WindowsDuplicateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-core-com-l1-1-0
StringFromGUID2
PropVariantClear
StringFromCLSID
CLSIDFromString
CoTaskMemAlloc
CoInitializeEx
CoGetApartmentType
CoUninitialize
CoTaskMemRealloc
CoSetProxyBlanket
CoCreateInstance
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateGuid
PropVariantCopy
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
TraceEvent
RegisterTraceGuidsW
GetTraceLoggerHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
api-ms-win-core-string-l2-1-0
IsCharAlphaW
CharNextW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
RoOriginateError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolTimer
CreateThreadpoolCleanupGroup
CreateThreadpool
CloseThreadpoolTimer
SetThreadpoolTimer
SetThreadpoolThreadMaximum
CloseThreadpool
SetThreadpoolThreadMinimum
CloseThreadpoolWork
CloseThreadpoolCleanupGroup
SubmitThreadpoolWork
CreateThreadpoolWork
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
mmdevapi
ord10
ord5
ord30
ord4
ord11
ord29
api-ms-win-power-base-l1-1-0
PowerRegisterSuspendResumeNotification
PowerUnregisterSuspendResumeNotification
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSize
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
api-ms-win-core-memory-l1-1-1
SetProcessWorkingSetSizeEx
VirtualUnlock
PrefetchVirtualMemory
GetProcessWorkingSetSizeEx
VirtualLock
api-ms-win-devices-config-l1-1-1
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-service-management-l1-1-0
OpenServiceW
CloseServiceHandle
OpenSCManagerW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-windowserrorreporting-l1-1-0
WerRegisterMemoryBlock
api-ms-win-mm-time-l1-1-0
timeBeginPeriod
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetProcessMitigationPolicy
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
ntdll
RtlLockMemoryZone
RtlFreeMemoryBlockLookaside
RtlCreateMemoryZone
RtlDestroyMemoryBlockLookaside
RtlExtendMemoryBlockLookaside
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlEqualWnfChangeStamps
ShipAssert
RtlQueryPackageClaims
RtlCreateMemoryBlockLookaside
RtlDestroyMemoryZone
RtlAllocateMemoryBlockLookaside
RtlAllocateMemoryZone
RtlUnlockMemoryZone
NtQueryInformationThread
NtAlpcConnectPort
RtlInitUnicodeStringEx
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
NtAlpcSendWaitReceivePort
NtSetInformationThread
NtQueryInformationProcess
RtlNtStatusToDosError
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
api-ms-win-service-private-l1-1-0
UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_BSS
Size
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_CONST
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
RT_DATA
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=27412,
count=1456, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=197, id=269, version=27412,
count=27, id=261, version=27412,
count=1, id=253, version=27412,
count=17, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuditNativeSnapIn.dll
- IMPHASH ef154cc80ff982aec2ae8b7880140833
- SHA256 ffbb7096593439184a4de3f6754828dfbf961305ee5d7703447789ae41e4c0f9
- MD5 2d16ea9876a4416759ef0f727f5c548d
- SHA1 c5aaa76cb68b9fcff16903439aa190b93a1b4729
- SHA512 1d54b804d08571d1e427d51097314986a87e9f717a9b92d1fb4eb449cef80467f76a88293e46cdda6f327cfda4377d157192aa094077a0f603bbfa1469f71bb0
- SSDEEP 3072:Nv6KYCZon9d7PxB3m10RgFz/4vB1Tn1m9d7PxB3m10RgFz/4vB1Tn1S:Nv6TwJLATn1VLATn1
- TLSH T1A424C05261801AE0EC0D8531EC17C6EC59E9FC926F0002E7B3A6FA7F2DB03D5D9BA559
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuditNativeSnapIn.pdb
msvcrt
_initterm
_except_handler4_common
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
memset
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FreeResource
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
kernel32
lstrlenW
user32
LoadImageW
LoadIconW
RegisterClipboardFormatW
LoadBitmapW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=2, id=259, version=27412,
count=40, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=2, id=261, version=27412,
count=1, id=256, version=27412,
count=10, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuditPolicyGPInterop.dll
- IMPHASH e69e81a5851aa4d75696a084cedac5f0
- SHA256 7936eec60dd4d1f040b67fad570341a0f7420da527328613e77fc4bd1bdc3053
- MD5 78cfce6395d1a409d3373d004541f7de
- SHA1 a9c55d5096049ef297fdc6b261e820ed977b026b
- SHA512 b31be98988d471f084b5e89707e8054e0ef8180fe868c9a117d6d708175aec53cf8b178fca641822e86a547dbaecbea35a3187667c312c0ea47c22b41459eeeb
- SSDEEP 1536:6DsUuBGtc58hYfmhsJB3gJb0gAUBx1QMmCr:6DsyzhXhsrob0gAexaMFr
- TLSH T1DE432A227781C6F9CBDE2230295ED57A61FEBD604FF182C76B6277AE1D702C19930216
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
34592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuditPolicyGPInterop.pdb
msvcrt
?terminate@@YAXXZ
__dllonexit
_XcptFilter
_unlock
_onexit
__CxxFrameHandler3
_callnewh
??1type_info@@UAE@XZ
_amsg_exit
_except_handler4_common
_purecall
_CxxThrowException
_lock
_errno
realloc
memcpy
free
malloc
wcsncpy_s
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_initterm
__RTDynamicCast
memcmp
memset
oleaut32
LoadRegTypeLi
SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FreeLibrary
SizeofResource
FindResourceExW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
DisableThreadLibraryCalls
LoadStringW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorLength
MakeSelfRelativeSD
MapGenericMask
SetSecurityDescriptorControl
InitializeSecurityDescriptor
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
aclui
ord3
kernel32
lstrcmpiW
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=106, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=8, id=265, version=27412,
count=6, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthBroker.dll
- IMPHASH b09a3950e5600773f135b0312d886adb
- SHA256 db60c2e7fcc1c5ce1c44de6584385cc53cf9e259e830bb80fc6a9a0dfe938dff
- MD5 108278260e1de9cdcf192d610cd1a4a2
- SHA1 a1f55ef63d4e5212fafaf0ded6c4a14a17794e9c
- SHA512 80534d8da4e414220bf536b3bebf4ce182d858ed97bec53a8632ab6f218be8cfe60fa01587c9b0eba4322a0407dc3e52bc65f874ffc5d8b90085949237bb5efd
- SSDEEP 3072:Uzjia34gdfII/UJp6EDe15OYz/ZqLqXKfzrxTyi596OgBKa9uUNPXYSrWMfmwSj:4XdgC2xe15O+/IuXsrxTy+96NH9nPmwo
- TLSH T1CCF34B219B84C573E7F735341E6B657266FED1281BE2C5CB0F0089B9A8606C1AE3578F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
40320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuthBroker.pdb
msvcrt
__CxxFrameHandler3
_XcptFilter
_vsnwprintf
free
memcmp
memcpy
_onexit
__dllonexit
_lock
malloc
_amsg_exit
_except_handler4_common
memmove_s
_unlock
_purecall
memcpy_s
_initterm
_callnewh
memset
rpcrt4
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrOleAllocate
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_Connect
NdrStubForwardingFunction
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
I_RpcBindingInqLocalClientPID
CStdStubBuffer_DebugServerQueryInterface
NdrStubCall2
NdrOleFree
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadStringW
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSemaphore
CreateEventExW
CreateSemaphoreExW
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateMutexW
CreateMutexExW
AcquireSRWLockShared
LeaveCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
WaitForMultipleObjectsEx
SetEvent
CreateEventW
ReleaseMutex
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObject
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
HSTRING_UserUnmarshal
WindowsGetStringLen
WindowsDuplicateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree
WindowsCompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWork
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
SetThreadToken
OpenProcessToken
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
TlsAlloc
TlsGetValue
CreateThread
ResumeThread
GetProcessId
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
TlsFree
GetCurrentProcess
TerminateProcess
TlsSetValue
GetProcessIdOfThread
OpenThread
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-com-midlproxystub-l1-1-0
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
ObjectStublessClient4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction3
ObjectStublessClient11
CStdStubBuffer2_Connect
ObjectStublessClient16
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient10
ObjectStublessClient3
ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient19
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient15
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegDeleteValueW
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
ImpersonateLoggedOnUser
GetLengthSid
GetTokenInformation
CopySid
AllocateAndInitializeSid
FreeSid
api-ms-win-security-base-l1-2-0
CheckTokenCapability
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-file-l1-1-0
CreateFileW
authz
AuthzInitializeContextFromSid
AuthzAccessCheck
AuthzFreeResourceManager
AuthzFreeContext
AuthzInitializeResourceManager
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-appcontainer-l1-1-0
GetAppContainerNamedObjectPath
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
winhttp
WinHttpCrackUrl
WinHttpCreateUrl
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-url-l1-1-0
ParseURLW
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
api-ms-win-core-marshal-l1-1-0
HWND_UserFree
HWND_UserSize
HWND_UserUnmarshal
HWND_UserMarshal
combase
ord140
ntdll
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlEqualSid
WinSqmAddToStream
_wcsnicmp
RtlIsStateSeparationEnabled
_wcsicmp
RtlAllocateAndInitializeSidEx
RtlDeriveCapabilitySidsFromName
RtlInitUnicodeString
RtlInitializeCriticalSection
wcstoul
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
AuthBrokerClearThreadClientContext
AuthBrokerCreateClientContext
AuthBrokerFreeClientContext
AuthBrokerSetThreadClientContext
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
FindCallingThreadImmersiveWindow
PurgeAuthHostSsoCache
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=4, id=259, version=27412,
count=339, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=23, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthBrokerUI.dll
- IMPHASH badc0b8e81dd3e249333e54271fe7a72
- SHA256 77277e729f4bd745e2b723fa5b02a22f8e3470ac08628b41e58a770079bd3b93
- MD5 5daa93234d7f04e87b7a0597a5222d65
- SHA1 d3f4eb3da3da2c2fd56f986eb0f8c27771e77590
- SHA512 8415710bd90166a15f47939cc54aa36a42218fe50e92f9faaf8e72e0e6760b41af4ddc1b9056a3f52ccc98e9cc4f8c233cf140fb8c6305490971e76230c06f37
- SSDEEP 1536:cu4217Zqx+TiUgLt9H7KfW258DtQm8CjbjYjigURoxjyykzzYNfX1wMTeQfo:jqx++Ht9H7uJ58DtQm8CjsiXMT/o
- TLSH T19083F717F66880B0C9FA28FC579E3121927F4D205BF043F38B25FAA5D87A5C54B7426A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
69664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuthBrokerUI.pdb
msvcrt
memset
_onexit
_except_handler4_common
_lock
memcpy_s
__CxxFrameHandler3
__dllonexit
_unlock
_callnewh
_ftol2_sse
_initterm
malloc
_amsg_exit
_XcptFilter
free
_vsnwprintf
_purecall
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
api-ms-win-core-synch-l1-1-0
CreateEventW
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjectsEx
SetEvent
CreateSemaphoreExW
ResetEvent
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
WaitForSingleObject
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
LoadStringW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
shcore
ord244
authbroker
FindCallingThreadImmersiveWindow
ntdll
RtlDeleteCriticalSection
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-localization-l1-2-0
SetThreadPreferredUILanguages
FormatMessageW
oleaut32
SysStringLen
SysFreeString
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateWndMgmt
DirectUIInitProc
DirectUIInitThread
DirectUIUnInitProc
DirectUIUnInitThread
FreeWndMgmt
WabCreateWebRuntimeCoreControl
WabCreateWebRuntimeCoreVisualViewport
WabImmDisableLegacyIME
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=260, version=27412,
count=3, id=259, version=27412,
count=231, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=20, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthExt.dll
- IMPHASH 5ad79cf919edebd9fbab5fa158a0405a
- SHA256 0cc9c5ff9d3da2908387c6d38b26d166f66662fd16faaf77ec7095217fd616b1
- MD5 227b3e65795a50ff3e9c824f59ae4bcd
- SHA1 b48d01a915e7a2bcb84705e940054658e144a2cd
- SHA512 ef46ab5770e9abc2347434f4ffc202e01a90c14674778711eb80b13d46cec319645319fb28ac078df551207a781861b16e0e417d47e41b32e87b34908a21f224
- SSDEEP 768:9boBXksxYOtRPEAegjl5P2nX7AL3/A/NzxZxWEdcwUGnO:VoNketMAegrP2nXU7AHcwUr
- TLSH T110034B05A24080F2D7E326B4255E6735C13D5D284BE1C4E37EC68BE9AE781E3FA3434A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuthExt.pdb
msvcrt
memmove
_vsnwprintf
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
_callnewh
memcpy_s
_except_handler4_common
memset
shell32
DuplicateIcon
shlwapi
ord278
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockShared
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObject
CreateMutexExW
ReleaseMutex
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemRealloc
CoGetMalloc
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
propsys
PSCreateMemoryPropertyStore
user32
RegisterDeviceNotificationW
DestroyWindow
SystemParametersInfoW
GetSysColor
UnregisterDeviceNotification
SetWindowLongW
DefWindowProcW
IsWindowUnicode
GetWindowLongW
RegisterPowerSettingNotification
DestroyIcon
UnregisterPowerSettingNotification
DefWindowProcA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=3, id=259, version=27412,
count=104, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=5, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthFWGP.dll
- IMPHASH b2948248be7fc0d1433f2147d06ddaca
- SHA256 641eb5c3c152649f661b96b2629766fe69b81969e46d9c9877497de44a87295a
- MD5 aa1eab6635794b9f21acff34c61b0f06
- SHA1 6d86bfd7a43d7989d1978eb626b12636a7d953ed
- SHA512 aa4bd17b04ae134697fce31faead30beeab4b1fdd6150e7784e559dda21ccf3e54be1154529f01f40889a87602c3d3b2afab239ee4703a4523813ddc1b931540
- SSDEEP 384:E3k4jn4cMnTNzu8mwoJ1aOPC7LM4N3Z1k1kiih+IggNdflrhCNWXA++Wy4nW:E3kIn4c6NzJOQp1Ug7/cWN/
- TLSH T185C20B05B6588073E3E72A742DADFA26C53DA97423A012D33B3BD59D7D209C16A3731B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AuthFWgp.pdb
msvcrt
free
_XcptFilter
_amsg_exit
_initterm
_except_handler4_common
_callnewh
malloc
_purecall
memset
advapi32
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
kernel32
GetCurrentProcess
SetUnhandledExceptionFilter
TerminateProcess
Sleep
GetModuleFileNameW
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetProcessHeap
FreeResource
HeapFree
GlobalAlloc
GlobalFree
HeapAlloc
user32
LoadImageW
LoadIconW
LoadStringW
LoadBitmapW
RegisterClipboardFormatW
api-ms-win-core-com-l1-1-0
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=2, id=259, version=27412,
count=46, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=2, id=261, version=27412,
count=1, id=256, version=27412,
count=11, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthFWGP.dll.mun
- SHA256 c0b35c02c3f67b11dfb9c55d0bce605941b14b86e67c0deb6f8c24a5d40ce240
- MD5 1f404190e7bbcacc7a07da994f7e6c54
- SHA1 ed0f99c622fc21ae8ecc713136821b2d65308973
- SHA512 1276883d40030b57a31a1d3725763581f9ec0d4a2db50df185d910833643c3162bc9b8c042ce4badcd7a091c9d3fb5708ccbfb811ac37569f7fe28a914ccf78b
- SSDEEP 6144:FaGG+aPx7aCTVJd9Me4s/X5iuhYm5GG+aPx7aCTVJd9Me4s/X5iuhYm:FUzJHMed87qzJHMed87
- TLSH T10444F1D6A3AACCD0E84957B9CC175ADC59A4FC04ED145787C304FA3FBEB1789AC2A241
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
267KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AuthFWSnapin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04914f25105c6b4c4b0a785ba0f8b4d0bbb3fd4327afc9ea00fd4ea302f16fde
- MD5 6ad4273dda8d8ced1ea71dc67c9c8c5a
- SHA1 36b16ffa1eed24899cf83e8c02d8553588ae2f15
- SHA512 dd8b3239b2a285b7887e95389b29b26492495265a69b5c74798a69462a8eee51aa71a4c2c0832bee8b61f4fa8c360823b6b385c79876d20ff32458db6c26548d
- SSDEEP 49152:syfo8ZgAa6MGcoLY/m0L7bPZrmkvXyvAYj+FDZ6XGj1ISSDaH1RPtEEAGwTP4p/3:g/PXbxzvXjYaFDZlXUxzvXWYaqDZW
- TLSH T1B1362A3037AAA209D86A0B710C3AD1C517767E2A7F04CB5E7999370D9D727138B21BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5113786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
AuthFWSnapin.pdb
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
apt/SysWOW64/AuthFWWizFwk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7c67ad5d2d4b69bcafeb1457fedd77720191514166130e34e3ae813c7cfce1e1
- MD5 50d00ea120a000628b998e97e46f7dc9
- SHA1 2360d61438046c65e21456914fb0750a99965816
- SHA512 533a714682ee208fb4a2c55044865468233682e0873c1eca823fa799dc8871d2de649690ec30426ebb13674db7cc6d1291b50eaa20f50126d4e20ec6c3ab69e1
- SSDEEP 1536:C2kgjt+IjngHIqT9WrhhEF5ZHpaXiUiznBpOQ:C2kgj4kgoqTTaTiznBpZ
- TLSH T178B3C63037AA920ACA7A4BB4183552C113B6BE677B14CBAD2C99625CCD7371347227F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
117998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
AuthFWWizFwk.pdb
mscoree
_CorDllMain
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
apt/SysWOW64/AutomaticAppSignInPolicy.dll
- IMPHASH c614c7451035aad7259f7a7d6f7d7d4a
- SHA256 af7e623be232d6cff76b76c9ffa189e7126dd5ceab43744fa33fc2e5a58316c9
- MD5 cd28a5729ebbef3665f095e9bb8fd97a
- SHA1 f9b4962c25158759dc599e37f20429ef9fae58ca
- SHA512 5e073b8941ec3485e84856929942379f838eb37bc56ebc2c1d1d8812aed2c1179e2085583ae5db548a46103f7f7c8320f3850769ba988ddc3f08028b74296d76
- SSDEEP 768:SY9UA9im5ekMbVhPbVAtuRXNxWdWayEsYNRPfnTdoqmT4l3q718gdb:2+/MbVUERNalNRPfTdolT4l3q718gd
- TLSH T152134B90764082B3D39E09342817AA5B96BDF9205FF454D3BB3E075D2935BC2AB3835B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AutomaticAppSignInPolicy.pdb
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
WaitForSingleObject
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSemaphore
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o_free
_o_iswspace
_o_malloc
_o_terminate
__CxxFrameHandler3
memcpy
__std_terminate
memcmp
memmove
_except_handler4_common
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strlen
wcslen
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
oleaut32
SysStringLen
SysFreeString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=27412,
count=12, id=260, version=27412,
count=19, id=261, version=27412,
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1164, id=1, productName=Unmarked objects,
count=1, id=253, version=27412,
count=1, id=256, version=27412,
count=4, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AzSqlExt.dll
- IMPHASH 1c22a7ae926c7f50432b476837b9d840
- SHA256 91cc1657ad4a7299809110e86b5c1fb93affd41570a4975450f746cc7ac0d557
- MD5 4dce6e12e632e9a75cf9597dcd6eb30d
- SHA1 5164500f4fc2eab81b3af86c0b7e09493e7591c6
- SHA512 8f155a97ef15b5faffd6f9400fb9d22ac5f44b11abb14e6f912655039140ca126c94970fbc75a21338392c20ba3bdd76ac19f32ef7e88fc203f0867dc1229fbc
- SSDEEP 384:PVvW1Ip5tt75tI4b9zYN4uxCCpNNzF5zfJ4uaVuusPGe+OBEAtxDD0LsuWMNVWC0:tvWGp5tt75tI4CJlfJNzJvHX0LTwh
- TLSH T1C1B2FB23BA7130B1E7BA373411295E3681BEB1142FE242F70E775E661CE45D2DA3930A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AzSqlExt.pdb
msvcrt
_callnewh
_except_handler4_common
??1type_info@@UAE@XZ
_vsnwprintf
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
_purecall
_stricmp
_wcsicmp
kernel32
TerminateProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
GetLastError
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
LocalAlloc
EnterCriticalSection
LoadLibraryA
GetProcAddress
LeaveCriticalSection
LocalFree
GetCurrentThread
GetCurrentProcess
Sleep
advapi32
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
GetTokenInformation
authz
AuthzReportSecurityEvent
AuthzEnumerateSecurityEventSources
AuthzInstallSecurityEventSource
AuthzRegisterSecurityEventSource
ole32
StringFromCLSID
CoTaskMemFree
odbc32
ord139
ord77
ord9
ord141
ord31
ord176
ord72
ord4
ord26
ord111
ord136
AzGenerateAudit
__GetXpVersion
xp_AzManAddRole
xp_AzManAddUserToRole
xp_AzManDeleteRole
xp_AzManRemoveUserFromRole
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=98, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=6, id=261, version=27412,
count=1, id=256, version=27412,
count=4, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/AzureSettingSyncProvider.dll
- IMPHASH 2dae40dbd50855caf5bb1ce8e84f0af4
- SHA256 60b158fb678d40d65aa88cd6558e9025d029fb45bb48de3629d3dc736e78626a
- MD5 af8269ff443d35d59d5a275b268150a5
- SHA1 d1cf0d359cbdbfe190620fbc0efe91645464cefb
- SHA512 6c42d8a38ac13f95babe189d042db163a980bbe766d9c6496815e81268fd3b9c07713073b6ff723a5ff25fc90b8950316da9447a74828a7dca40174db2bf745a
- SSDEEP 24576:sxY56nGuQ2WH1FvfveT9QaoCIZzbErQiWEzm3byK6ew/OR2xWfPG+B6v6G2Re95b:GYInp4vfveTSaoCIZzbErQiWEzm3byKk
- TLSH T1AF557C31BAA4C93AC67E23B1142DE1AE60F962708FA144C767E45F7E2B35EC35530A47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
877248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AzureSettingSyncProvider.pdb
msvcrt
??_V@YAXPAX@Z
towlower
_itoa_s
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
??0bad_cast@@QAE@ABV0@@Z
_wcsicmp
__mb_cur_max
sprintf
localeconv
wcschr
towupper
sprintf_s
vfprintf
iswspace
strncmp
swprintf_s
time
_wcsnicmp
wcsstr
ldexp
_wcstoi64
_errno
wcstoul
_wcstoui64
_ultow_s
_ui64tow_s
toupper
tolower
swscanf_s
memmove_s
wcsncpy_s
realloc
strcspn
setlocale
memset
_set_errno
___lc_handle_func
___lc_codepage_func
_ismbblead
_wcsdup
??8type_info@@QBEHABV0@@Z
__crtCompareStringW
__crtCompareStringA
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
__uncaught_exception
__pctype_func
isupper
calloc
islower
isspace
memchr
_Getdays
_Getmonths
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
_Gettnames
_Strftime
abort
isalnum
isdigit
___lc_collate_cp_func
memcmp
_amsg_exit
free
?terminate@@YAXXZ
_XcptFilter
memmove
memcpy
_lock
_unlock
__dllonexit
_onexit
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_vsnprintf_s
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
iswalnum
??1type_info@@UAE@XZ
_purecall
__iob_func
memcpy_s
_except_handler4_common
_ftol2
_get_errno
___mb_cur_max_func
_vsnwprintf
__CxxFrameHandler3
_initterm
ceil
dsreg
DsrFreeJoinInfo
DsrGetJoinInfo
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
ReleaseSemaphore
DeleteCriticalSection
CreateEventExW
ResetEvent
InitializeCriticalSection
CreateEventW
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
CreateMutexExW
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
LCMapStringEx
GetLocaleInfoW
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
SysFreeString
SysAllocStringLen
SysStringLen
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocString
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
EventActivityIdControl
EventProviderEnabled
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteValueW
RegDeleteTreeW
RegGetValueW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoSetProxyBlanket
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetMalloc
GetHGlobalFromStream
StringFromCLSID
PropVariantClear
CoCreateGuid
api-ms-win-core-path-l1-1-0
PathAllocCombine
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsCompareStringOrdinal
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-string-l1-1-0
GetStringTypeW
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
propsys
ord435
PSPropertyBag_WriteStr
PSCreateMemoryPropertyStore
ord436
PSPropertyBag_WriteUnknown
PropVariantChangeType
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-file-l1-1-0
GetFileSizeEx
RemoveDirectoryW
CompareFileTime
WriteFile
ReadFile
SetFileInformationByHandle
FindClose
FindFirstFileExW
DeleteFileW
CreateFileW
FindNextFileW
GetFullPathNameW
FlushFileBuffers
GetDiskFreeSpaceExW
rpcrt4
UuidToStringW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
ntdll
EtwEventWriteTransfer
NtFsControlFile
EtwEventActivityIdControl
RtlInitUnicodeString
NtOpenFile
RtlInitUnicodeStringEx
RtlIsDosDeviceName_U
NtClose
NtCreateFile
RtlReleaseRelativeName
RtlFreeHeap
RtlDosPathNameToRelativeNtPathName_U
RtlNtStatusToDosError
RtlGetSuiteMask
NtQueryInformationFile
api-ms-win-power-base-l1-1-0
PowerDeterminePlatformRoleEx
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-shlwapi-legacy-l1-1-0
PathGetCharTypeW
PathStripPathW
winhttp
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpSendRequest
WinHttpSetStatusCallback
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
bcrypt
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-shell-shdirectory-l1-1-0
ord290
crypt32
CryptBinaryToStringW
api-ms-win-core-string-l2-1-0
CharLowerBuffW
umpdc
Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=108, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=418, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=24, id=261, version=27412,
count=66, id=260, version=27412,
count=1, id=256, version=27412,
count=122, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BCP47Langs.dll
- IMPHASH 05483cae6aa23361e6bec3c4597c42fd
- SHA256 cf3f835607db6ea48f3cc80bef6a6216c12a425f2d1b531a8fa773166a97642c
- MD5 949a643bfeded5b9fcf4ddc6f558fec2
- SHA1 58a55cf4745b43451473ed554db5defed07f1546
- SHA512 08a79391b904c7b4524779b6bd800872a6b1d61ee4595fc3e7599c3935df273d4c2939641ce02ceda761fc7d0326f829fedb4b83e4160d6ecf7a1ea38195c5d6
- SSDEEP 6144:mrb5NbAxwrSjNysh307ULpjsLksccxaRM/OZUEOAPPvPUWfL:mrb5NbUNtaUL33R2EhEWf
- TLSH T18C548D23E644C172D6DF3674695CA27A81AD6074AFA1C0CBE7E91BBFA8334D14D3025B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7e:d4:c3:ee:5f:2d:0f:24:b9:49:e1:ce:35:d8:ad:10:12:31:a5:69:62:62:c0:6a:bf:8a:7f:db:88:9c:9e:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dc:c1:e0:8c:c2:5f:58:5e:8e:00:01:00:00:01:dc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
124672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Bcp47Langs.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__CIlog10
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
wcschr
memmove
_o__wcsicmp
_o__wtoi
_o_bsearch
_o_ceil
_o_free
_o_malloc
_o_terminate
_o_toupper
_o_towlower
_o_wcscpy_s
_except_handler4_common
_CxxThrowException
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_type_info_compare
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
kernelbase
FindPackagesByPackageFamily
GetCurrentPackageFullName
OpenGlobalizationUserSettingsKey
LCIDToLocaleName
EnumUILanguagesW
GetStagedPackagePathByFullName
GetCurrentPackageId
EnumSystemLocalesEx
GetUserDefaultLocaleName
LocalAlloc
GetCurrentPackageFamilyName
api-ms-win-core-localization-l1-2-0
FormatMessageW
ResolveLocaleName
GetLocaleInfoEx
GetUILanguageInfo
IsValidLocaleName
GetUserPreferredUILanguages
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId
OpenThreadToken
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
FindStringOrdinal
FreeLibrary
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
EnterCriticalSection
WaitForSingleObject
CreateMutexExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ntdll
RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku
RtlPublishWnfStateData
NtClose
api-ms-win-security-base-l1-1-0
GetTokenInformation
IsWellKnownSid
CopySid
IsValidSid
EqualSid
GetLengthSid
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-localization-private-l1-1-0
NlsUpdateLocale
LoadStringByReference
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegDeleteTreeW
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyExW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AppendUserLanguageInputMethods
AppendUserLanguageInternal
AppendUserLanguages
Bcp47BufferFromLcid
Bcp47FindClosestLanguage
Bcp47FromCompactTagInternal
Bcp47FromHkl
Bcp47FromLcid
Bcp47GetAbbreviation
Bcp47GetDirectionality
Bcp47GetDistance
Bcp47GetExtensionSingletons
Bcp47GetExtensionSubstring
Bcp47GetIsoLanguageCode
Bcp47GetIsoScriptCode
Bcp47GetLanguageName
Bcp47GetMuiForm
Bcp47GetNeutralForm
Bcp47GetNlsForm
Bcp47GetSubtagMapInternal
Bcp47GetUnIsoRegionCode
Bcp47IsWellFormed
Bcp47Normalize
ClearApplicationLanguageOverride
ClearApplicationManifestLanguages
ClearHttpAcceptLanguageOptOut
ClearUserDisplayLanguageOverride
ClearUserLocaleFromLanguageProfileOptOut
CompactTagFromBcp47Internal
DllGetActivationFactory
DllGetClassObject
GetApplicationLanguageOverride
GetApplicationLanguages
GetApplicationManifestLanguages
GetAppropriateUserLocaleForUserLanguages
GetAppropriateUserPreferredAndDisplayLanguagesForUser
GetClosestMatchingUserLanguage
GetFontFallbackLanguageList
GetHttpAcceptLanguageOptOut
GetInputMethodOverrideForUser
GetPendingUserDisplayLanguage
GetRelevantLocalesFromLanguageTags
GetSerializedUserLanguageProfile
GetUnIsoRegionCode
GetUserDisplayLanguageOverride
GetUserLanguageInputMethods
GetUserLanguageInputMethodsForUser
GetUserLanguages
GetUserLanguagesForAllUsers
GetUserLanguagesForUser
GetUserLocaleFromLanguageProfileOptOut
IsTransientLcid
LanguageListAsMuiForm
LcidFromBcp47
RemoveInputsForAllLanguagesInternal
RemoveUserLanguageInputMethods
ResolveLanguages
SetApplicationLanguageOverride
SetApplicationManifestLanguages
SetHttpAcceptLanguageOptOut
SetInputMethodOverride
SetPreviousUserDisplayLanguages
SetUserDisplayLanguageOverride
SetUserLanguageInputMethods
SetUserLanguagesInternal
SetUserLanguagesInternalCore
SetUserLocaleFromLanguageProfileOptOut
Name
.text
Size
245KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=13, id=260, version=27412,
count=1230, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=32, id=270, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BCP47mrm.dll
- IMPHASH 7f377f07644ca958682c6202396fec2b
- SHA256 ee79aeddf4fb7f9560ef3d07a8c4ae0eb9d3d3ad4ac629d5064874616bfb992c
- MD5 0daf02497b26155060e405b37c122468
- SHA1 5b1b79381056b883d5b89a0eb143179e683c44e8
- SHA512 51ba9ed267bd345f4f4a03d5b80e71820571b466b30d04254d5a0f67abc395e31d24f04464601c1e9d11b88b37ed78eec4d680a67556a10b47a3b50ce2013223
- SSDEEP 3072:VsFCqj3BvXNbA5YFX7YxcHRJ2ajUEFYE7AvW9BtX:OFCQ35NbA5ZxkQajrP7AvWx
- TLSH T110C39D03FA4884B5D2AF7038955CA779A37FA4219FE106C32B7047E66CA05D1DE7839B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
52:83:ce:ee:6f:81:2e:25:b2:5b:b7:0c:7d:0c:94:c5:bb:1c:ea:20:97:7f:74:6d:9e:58:e8:6c:05:98:c0:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:99:99:95:f1:dc:e3:20:eb:00:01:00:00:01:e2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
96672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Bcp47mrm.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
memmove
_o__wcsicmp
_o__wtoi
_o_bsearch
_o_free
_o_malloc
_o_terminate
_o_towlower
_o_wcscpy_s
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_type_info_compare
__std_terminate
__CxxFrameHandler3
memcpy
_o__seh_filter_dll
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
GetUserPreferredUILanguages
FormatMessageW
GetSystemPreferredUILanguages
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
FindStringOrdinal
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
ReleaseMutex
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
kernelbase
GetCurrentPackageId
GetStagedPackagePathByFullName
FindPackagesByPackageFamily
GetCurrentPackageFullName
OpenGlobalizationUserSettingsKey
EnumUILanguagesW
PackageFamilyNameFromFullName
GetCurrentPackageFamilyName
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteTreeW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
ntdll
NtClose
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Bcp47GetDistanceCString
Bcp47GetNeutralFormCString
Bcp47IsValid
CompareBcp47Tags
FormatLanguageList
FormatLanguageTag
GetApplicationLanguagesWithUserLanguagesFallback
GetApplicationLayoutDirection
GetClosenessOfUnIsoRegionTags
GetCompositeRegionCode
GetDistanceOfClosestLanguageInList
GetLanguageDirectionality
GetMrtDisplayLanguageList
GetParentCompositeRegionCode
IsValidTag
IsValidUnIsoRegionTag
IsWellFormedTag
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=11, id=260, version=27412,
count=1192, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=24, id=265, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BOOTVID.DLL
- IMPHASH 4f7c94cc9c8c1fd81bba039a8c176377
- SHA256 52aed2a37c6a321b82310d30880a10c3a0822aeab36dab1171348540a204760a
- MD5 51fb33a072a2245b15ab6a6c2e9f0efa
- SHA1 d80ac0d23ec5e8f73e25c4f71c86a211d0bd95b3
- SHA512 859bd0f3ffd3a742728d0edafc3792a6b4885da639019456d7df851fd67e81628f250290314d28077f5f243c293dbea29fb200f5614938ce727d0ee4933933ca
- SSDEEP 384:sVSxvwlHLuSQntypdx46M0Z6fMiFQ/LsWjEUWCdD1IDBRJt6E2lDbQ:esvwhTQ4di2qAjI1PgEp
- TLSH T1B5B25B81A7101DC3F9FA6BB0578DFE4268BE66D7065582A790E4EBC93CE23C05D047CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
27:97:07:c7:a7:01:61:ec:29:0e:e5:e9:94:ff:98:1b:0e:8f:f1:fb:75:04:cf:2c:c5:2f:48:b3:e2:7b:3b:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bootvid.pdb
ntoskrnl.exe
memset
WRITE_REGISTER_ULONG
WRITE_REGISTER_USHORT
HalPrivateDispatchTable
MmMapIoSpaceEx
READ_REGISTER_UCHAR
WRITE_REGISTER_UCHAR
MmUnmapIoSpace
hal
READ_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_UCHAR
WRITE_PORT_USHORT
WRITE_PORT_BUFFER_USHORT
VidBitBlt
VidBitBltEx
VidBufferToScreenBlt
VidCleanUp
VidDisplayString
VidDisplayStringXY
VidInitialize
VidResetDisplay
VidScreenToBufferBlt
VidSetScrollRegion
VidSetTextColor
VidSolidColorFill
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
482B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
366B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
29B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=5, id=260, version=27412,
count=1, id=256, version=27412,
count=3, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BTAGService.dll
- IMPHASH 26f642e9c995c85d127fad81b25b10be
- SHA256 c9f132f5811623bfa43a5a68c39f8b8f10c323bc189cd50340727c944e823b2c
- MD5 1e59310df39281f4952020238fe27849
- SHA1 92813a482b52a14da3f951b7ad62fd18250e4494
- SHA512 70a40096a19e393aaa0d27ea187bcf90dd83c6155d0e8f0ac1bf7b5f492552025bc0babde5dfedf7702fcfb2f489449bbd3e3496d0c617aa06ecb091b18eaabe
- SSDEEP 12288:Wl3ALi/ZbLHZbDoWEmuRtuvElSmacoQE/iEIApBjgUCSKBd5kfqT:Wl3ALihbLHZ/oWBuTSmacoQErpBjzCjw
- TLSH T143F47D326A94443AE2EE31B2281D7379D1AEC9E00F7085DB079453FDBE74AC15A3974B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
561840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BTAGService.pdb
msvcp_win
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_alloc@std@@YAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPBD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Xbad_function_call@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__strnicmp
_o__wcsnicmp
memmove
_o__wtol
_o_atoi
_o_bsearch
_o_free
_o_isdigit
_o_isprint
_o_isspace
_o_iswdigit
_o_malloc
_o_qsort
_o_realloc
_o_strcat_s
_o_strtok
_o_strtol
_o_strtoul
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
_except_handler4_common
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
wcsstr
wcschr
_o__wtoi
_o__cexit
_o__callnewh
strstr
strchr
__std_type_info_compare
__std_terminate
__CxxFrameHandler3
memcpy
memcmp
api-ms-win-crt-string-l1-1-0
strncmp
wcsncmp
strnlen
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadResource
LockResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
EnterCriticalSection
CreateEventW
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
CreateSemaphoreExW
ReleaseSRWLockShared
OpenSemaphoreW
InitializeSRWLock
ReleaseMutex
InitializeCriticalSectionAndSpinCount
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
SetThreadpoolTimerEx
TrySubmitThreadpoolCallback
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CreateThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoImpersonateClient
CoRevertToSelf
CreateStreamOnHGlobal
CoMarshalInterface
CoSetProxyBlanket
CoCreateGuid
CoIncrementMTAUsage
CoGetMalloc
CoDecrementMTAUsage
CoReleaseServerProcess
CoAddRefServerProcess
CoRevokeClassObject
CoRegisterClassObject
CoReleaseMarshalData
CoResumeClassObjects
CoTaskMemAlloc
CoDisconnectObject
CoDisconnectContext
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventProviderEnabled
EventSetInformation
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoRegisterActivationFactories
RoRevokeActivationFactories
RoInitialize
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-power-setting-l1-1-0
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsDuplicateString
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
WakeByAddressAll
Sleep
WaitOnAddress
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
combase
ord66
ord168
ord68
ord67
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
rpcrt4
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient18
ObjectStublessClient15
ObjectStublessClient24
ObjectStublessClient23
ObjectStublessClient20
ObjectStublessClient27
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient22
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
CStdStubBuffer2_CountRefs
ObjectStublessClient11
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient12
CStdStubBuffer2_Connect
ObjectStublessClient9
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient14
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
NdrProxyForwardingFunction3
ObjectStublessClient25
api-ms-win-security-base-l1-1-0
ImpersonateSelf
DuplicateTokenEx
GetSidSubAuthority
RevertToSelf
GetSidSubAuthorityCount
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-rtlsupport-l1-2-0
RtlCompareMemory
ws2_32
WSAStartup
WSAGetLastError
WSACleanup
WSALookupServiceEnd
connect
WSASocketW
bind
getsockname
getpeername
setsockopt
listen
WSAEventSelect
WSAEnumNetworkEvents
accept
closesocket
WSARecv
recv
send
WSALookupServiceNextW
WSAAddressToStringW
WSALookupServiceBeginW
WSASetServiceW
WSACreateEvent
WSASend
WSASetEvent
WSAGetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
DeviceIoControl
CancelIoEx
GetOverlappedResult
ntdll
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQuerySystemInformation
RtlInitUnicodeString
RtlQueryPackageIdentity
NtQueryWnfStateData
NtQueryInformationToken
RtlConvertSidToUnicodeString
RtlPublishWnfStateData
EtwTraceMessage
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlSubscribeWnfStateChangeNotification
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
DevFindProperty
DevGetObjectProperties
DevGetObjects
DevFreeObjects
DevCreateObjectQuery
DevCloseObjectQuery
api-ms-win-security-capability-l1-1-0
CapabilityCheck
RpcClientCapabilityCheck
api-ms-win-shcore-stream-l1-1-0
IStream_Write
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
DeleteTimerQueueTimer
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
callhistoryclient
UdmCreateDataSession
UdmCreateSyncCallbackHandler
pimstore
FindMatchingContactEx
phoneom
PhoneRemoveListener
PhoneAPIInitialize
PhoneGetLines
PhoneGetDefaultOutgoingLine
PhoneGetProviderLineServiceInfo
PhoneGetProviderLineInfo
PhoneGetState
PhoneFreeCallInfo
PhoneAddListener
PhoneDial
PhoneEnd
PhoneAcceptIncomingEx
PhoneRejectIncoming
PhoneSetHold
PhonePrivate
PhoneDropAccept
PhoneConference
PhoneSwap
PhoneSendDTMF
PhoneIsActionAvailable
PhoneAPIUninitialize
bcrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_Register_Notification
CM_Get_Device_Interface_PropertyW
CM_MapCrToWin32Err
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
devobj
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjCreateDeviceInfoList
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
oleaut32
SysFreeString
DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
637KB
Virtual Size
637KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=118, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=16, id=260, version=27412,
count=1521, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=126, id=265, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BWContextHandler.dll
- IMPHASH bafcc91fb2ec39da3f4cf5d2752fd9c6
- SHA256 4a47e29701e8328887216c1d16059ee3cb864ad81250548534b89250e5e5e69b
- MD5 22262fddf9737b0a4f448d7a2c5008fc
- SHA1 253c2b376ab63aac01f976248167b5a229af7978
- SHA512 0494661703185d55fd485dff7f716dc3bcca10478969463f8389ea3a74c9c4098e5e9c9f4686d28d7e10bfa6d99f398ab343dc6de3b99479731d53bbd2318092
- SSDEEP 1536:zyts7ETS3LFXAMtg1IA8mfJBnk/hM6+TT:TgWXAKQLnk/h94T
- TLSH T199335C02E7C881F1D3A23938756963326E6F7A309BE486C39B534F6A3D244D1697C25F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
42176
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BWContextHandler.pdb
msvcrt
__dllonexit
_onexit
_unlock
_lock
_errno
_except_handler4_common
_vsnwprintf
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcscat_s
wcscpy_s
_purecall
_localtime64_s
wcsftime
memmove_s
_mktime64
free
malloc
wcsncpy_s
memcpy_s
realloc
memset
shell32
SHCreateItemFromIDList
ord77
ord727
ShellExecuteW
ord893
DuplicateIcon
SHGetItemFromObject
ord155
shlwapi
StrToInt64ExW
oleaut32
VarUI4FromStr
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
StringFromGUID2
PropVariantClear
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapDestroy
HeapSize
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW
LockResource
LoadStringW
FindResourceExW
LoadResource
SizeofResource
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegGetValueW
RegOpenKeyExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
GetLocaleInfoW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
InitializeCriticalSection
CreateMutexExW
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseMutex
CreateSemaphoreExW
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
kernel32
lstrcmpiW
user32
UnregisterClassA
GetDlgItemTextW
SendMessageW
ShowWindow
GetDlgItem
EnableWindow
SetDlgItemTextW
GetParent
SetWindowLongW
GetWindowLongW
DestroyIcon
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=15, id=260, version=27412,
count=148, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=11, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BackgroundMediaPolicy.dll
- IMPHASH 7e6dcfad193227055e32b6956983e1ab
- SHA256 cee494ba1900674075777e39f6f3d271d893fb3760186e0c32e75e45a8417228
- MD5 75b5e93de6d7edc15e13449c01b55be9
- SHA1 5211bdc6aaba9e234a37b39b6ec0d5ffdd404b9a
- SHA512 b5147c11657e4840fbc43e81937bb36d547bc7adff4da5452150b17cbdbaf2cab36c4c1c8e9e62069be7967e7b02133cfc03a98348e6556ac4ac60a0a92c2c3d
- SSDEEP 1536:zQ1gCKOWvJ9rcWeDtzEJp3w6B/zh+J6Qy:XJh94JiPzhM6Q
- TLSH T1A3333A42638641F1E3F73579249917796DAEAA11DBD144C70F130EB6A860BD2BA3C38F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BackgroundMediaPolicy.pdb
msvcrt
memcmp
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_vsnwprintf
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_wcsicmp
_purecall
memcpy_s
_callnewh
memset
ntdll
RtlIsMultiSessionSku
RtlValidSid
RtlLengthSid
RtlCopySid
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlEqualWnfChangeStamps
RtlEqualSid
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
CreateMutexExW
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockShared
WaitForSingleObjectEx
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsCreateString
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-psm-key-l1-1-0
PsmGetPackageFullNameFromKey
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
resourcepolicyclient
CreateResourcePolicyStoreClient
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
api-ms-win-core-quirks-l1-1-1
QuirkIsEnabledForPackage3
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=2, id=259, version=27412,
count=107, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=6, id=261, version=27412,
count=1, id=256, version=27412,
count=7, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BamSettingsClient.dll
- IMPHASH 02219ea0d17d81a1c5266d582af24246
- SHA256 f0791fa2c83c7c09a7a0f27ffaa9042f4295690c4a55ec0e3c2fa29d8b855fe4
- MD5 53c3540287c624310e15678b786821dc
- SHA1 5da9919f3da13ae01d65494f563272bc0317b876
- SHA512 689dade7df330973a693192496e607899d82002de398f090ebd81a5ce430c754d395c71bf1c3f35cdea678814dfb9900b9e267c75961bd068697487aa70f8bb7
- SSDEEP 192:XmnLBIoc7orvShX2Vds89KNLfFii6JLjOYr1w1qfgEEbc2Wh7W:XmnLBtMYwt89iMzJLjvOgfQc2Wh7W
- TLSH T1EB420842FBA409B5F6F90A7835F2A13B4939BE604F61458B1FD1051E192D8C36D38B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BamSettingsClient.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
NtSetSystemInformation
RtlInitUnicodeString
NtQueryFullAttributesFile
NtPowerInformation
NtQuerySystemInformation
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
BamCreateSettingsClientLib
BamDestroySettingsClientLib
BamFreeQueriedApplications
BamQueryKnownApplications
BamSetUserManagementState
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1117, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=2, id=264, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BcastDVRBroker.dll
- IMPHASH df4044b943837462677fcc9658728bb9
- SHA256 f26e3e4637a1055fdc4772b5cf5f96c0301d070a965a5bb14360edd1705655ae
- MD5 c2772d4203f27cdf7a87fdefd56ac004
- SHA1 f7284694e827410246219771ac5ccddb8b1e4a53
- SHA512 353bd28c4f52054e8fac90178a5ed3ad2c12ecd33911c16578aeed57a9e08a219590458dce9f955acb92278920edf217dfa84b041334385f54408b5c1b62b065
- SSDEEP 1536:nK+AUmtvO/uvEz2eVyjQqhYT4qf+Oa3CLQ1PwfouFzbBeTS3YunTh:K+itvQUYVrT4qfla34Q1PwfouFPBeO3r
- TLSH T1FF8309327AC8147AD2F7317D162E3674926F64B20BD24AC34F6096D9BCA42D18F352DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
63824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BcastDVRBroker.pdb
msvcrt
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
memcpy
_lock
memcmp
__CxxFrameHandler3
?terminate@@YAXXZ
_amsg_exit
??1type_info@@UAE@XZ
_callnewh
_unlock
malloc
_onexit
_vsnprintf_s
memmove
free
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
?name@type_info@@QBEPBDXZ
_XcptFilter
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_except_handler4_common
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
_initterm
__dllonexit
memset
bcastdvrcommon
?OutputString@BcastDVR_OutputDebug@@QAEXXZ
?PrintType@BcastDVR_OutputDebug@@QAEXPBD0@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDK@Z
??0BcastDVR_OutputDebug@@QAE@PBD@Z
?LogError@BcastDVRLogProviderBase@@SGXJPBD0H_N@Z
?Printf@BcastDVRLogProviderBase@@SAX_N0PBD1HPBGZZ
?LogErrorEx@BcastDVRLogProviderBase@@SGXJPBD0H00_N@Z
?RegisterCallingPlugIn@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PAUHSTRING__@@1ABU_GUID@@@Z
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
CreateEventExW
CreateEventW
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
DeleteCriticalSection
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
GetProcessId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoReleaseMarshalData
CreateStreamOnHGlobal
CoTaskMemAlloc
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoGetCallContext
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegCloseKey
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-threadpool-l1-2-0
CreateThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpool
CloseThreadpoolWork
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=2, id=259, version=27412,
count=145, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=9, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BcastDVRClient.dll
- IMPHASH 866e39956113127773b6c8e8cca9384e
- SHA256 c2fd60a8ba0e068bd2fc278655d72774b8571b9a001da143c725fdda7991a832
- MD5 34d315ea22b7d1acc611f81b7a0ab32f
- SHA1 3d32609eed7a1dc83cb605580be0336b4097ac88
- SHA512 ef6c055342de73114110a0a4e1a220ae67bebcf960a48e7245a0a4ed59a9cbe4cd01466028d61bd856286526067ab7f2948288256f7deea0b4878a82d0b62f8b
- SSDEEP 6144:QSLDwku51vh6ixxCCzrvpZOTVxjggb+bBeunHprt:QSIku51vh6iuC5ZUbvyB/JR
- TLSH T1A3742830DA4C1875FDF32379A01E33B491ADA8A24754D2C78788C6ED6C957C68E352BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
306320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BcastDVRClient.pdb
msvcrt
_callnewh
malloc
__CxxFrameHandler3
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memcmp
_except_handler4_common
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
_onexit
??3@YAXPAX@Z
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
_purecall
??0exception@@QAE@ABQBD@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
?name@type_info@@QBEPBDXZ
memmove_s
realloc
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_ftol2
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSectionEx
InitializeSRWLock
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateMutexExW
EnterCriticalSection
CreateEventW
SetEvent
CreateEventExW
LeaveCriticalSection
OpenSemaphoreW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsGetStringLen
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-com-l1-1-0
CreateStreamOnHGlobal
CoCreateInstance
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoTaskMemAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CreateThreadpool
CloseThreadpoolWork
CloseThreadpool
SubmitThreadpoolWork
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoActivateInstance
RoInitialize
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-file-l1-1-0
WriteFile
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
systemeventsbrokerclient
SebDeleteEvent
SebCreateBroadcastNotificationEvent
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=3, id=259, version=27412,
count=168, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=48, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BcastDVRCommon.dll
- IMPHASH 0b72e191bef1bd9eeeb7ca2792c9707d
- SHA256 6cd67daf675acb6419f2fadbf948327d769197f89094851d0c7b31851fa78017
- MD5 fbe5e702460d02e239e7f17d3540f974
- SHA1 48d3441d76c3d3aef51e31e0470c225a42d03a8d
- SHA512 f9302e78c9f482e280bddda29fa59d7d99a284b5a56d568e380c05883cdb94f5bbbb70c8f8ff17f7fa6b2d8382046708290e60be0300406ca3e9efdda6404dae
- SSDEEP 3072:jb+O9/yTzL8vxVVG0nDPVCVwzOsYFzg6Z1w6+IOrZaFE9g3L5tdjGgn9mbePFsR:/NpEwvxVL0l3F86Z1wbIOQFEedtb9WsF
- TLSH T1DC045B317BAC0436DAEF1135345F53A1A4B8A5324BA142CB43545BEF68F12D2AF317AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
144368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BcastDVRCommon.pdb
msvcrt
_lock
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_except_handler4_common
memmove
_vsnprintf
wcsrchr
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
?name@type_info@@QBEPBDXZ
_wtoi
_unlock
swscanf_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
wcschr
memcmp
_wcsicmp
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
??1type_info@@UAE@XZ
_ftol2
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
CreateMutexW
CreateEventExW
SetEvent
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsGetStringLen
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsConcatString
WindowsCreateString
WindowsDeleteString
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
WaitOnAddress
WakeByAddressAll
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
rpcrt4
UuidCreate
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoIncrementMTAUsage
CoDecrementMTAUsage
CoCreateInstance
CoTaskMemFree
CLSIDFromString
StringFromGUID2
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegDeleteKeyExW
RegEnumKeyExW
RegGetValueW
RegOpenCurrentUser
RegSetValueExW
RegSetValueExA
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
GetFileAttributesW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
ntdll
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlAllocateHeap
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
??0BcastDVR_OutputDebug@@QAE@PBD@Z
??0ImpersonateHelper@Internal@Capture@Media@Windows@@QAE@XZ
??1ImpersonateHelper@Internal@Capture@Media@Windows@@QAE@XZ
?AppendPath@EnvironmentManager@Internal@Capture@Media@Windows@@YGJABVString@25@0PAV625@@Z
?CalcPreviewVideoBufferDataSize@GameDVRUtility@Internal@Capture@Media@Windows@@YGJKKPAK@Z
?CalcPreviewVideoFrameDataSize@GameDVRUtility@Internal@Capture@Media@Windows@@YGJKKPAK@Z
?CleanupObsoletePlugIns@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@@Z
?CloseDuplicatedHandle@GameDVRUtility@Internal@Capture@Media@Windows@@YGJKPAX@Z
?CloseDuplicatedHandles@GameDVRUtility@Internal@Capture@Media@Windows@@YGJKKQAPAX@Z
?FreeBroadcastSebEventIds@PlugInUtility@Internal@Capture@Media@Windows@@YGXPAPAU_GUID@@@Z
?GetBroadcastPlugInRegistryPathFromSebEventId@EnvironmentManager@Internal@Capture@Media@Windows@@YGJABU_GUID@@PAVString@25@@Z
?GetBroadcastPlugInRegistryPathFromSebEventIdString@EnvironmentManager@Internal@Capture@Media@Windows@@YGJPBGPAVString@25@@Z
?GetBroadcastSebEventIds@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAKPAPAU_GUID@@@Z
?GetCallersPlugInInfo@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@ABU_GUID@@PAVString@25@2@Z
?GetCallersSebEventId@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAU_GUID@@@Z
?GetDefaultPlugIn@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PAU_GUID@@@Z
?GetErrorHistoryCount@BcastDVRLogProviderBase@@SGKXZ
?GetFormattedErrorHistory@BcastDVRLogProviderBase@@SGKPAVString@Internal@Windows@@@Z
?GetGuidFromGuidString@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPBGPAU_GUID@@@Z
?GetGuidStringFromGuid@GameDVRUtility@Internal@Capture@Media@Windows@@YGJABU_GUID@@_NPAVString@25@@Z
?GetHKeyCurrentUserForDefaultUser@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAPAUHKEY__@@@Z
?GetHKeyCurrentUserForIUser@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIUser@System@5@PAPAUHKEY__@@@Z
?GetIUserSID@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIUser@System@5@PAVString@25@@Z
?GetJsonArray@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPAPAU?$IVector@PAUIJsonValue@Json@Data@Windows@@@785@@Z
?GetJsonBoolean@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAE2@Z
?GetJsonDateTime@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPAUDateTime@85@@Z
?GetJsonDouble@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPAN@Z
?GetJsonGuid@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPAU_GUID@@@Z
?GetJsonNumber@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPA_J@Z
?GetJsonString@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAEPAVString@25@@Z
?GetKnownFolderSubFolder@EnvironmentManager@Internal@Capture@Media@Windows@@YGJABU_GUID@@PBGPAVString@25@@Z
?GetOSVersionString@GameDVRUtility@Internal@Capture@Media@Windows@@YGXPAVString@25@@Z
?GetPlugInInfo@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@ABU_GUID@@PAVString@25@22@Z
?GetPlugInPackageFullName@PlugInUtility@Internal@Capture@Media@Windows@@YGJABU_GUID@@PAVString@25@@Z
?GetUserGameDVRConfigFolderPath@EnvironmentManager@Internal@Capture@Media@Windows@@YGJPAVString@25@PBG@Z
?ImpersonateDefaultUser@ImpersonateHelper@Internal@Capture@Media@Windows@@QAEJXZ
?ImpersonateUser@ImpersonateHelper@Internal@Capture@Media@Windows@@QAEJPAUIUser@System@5@@Z
?Initialize@BcastDVR_OutputDebug@@SGXPBGW4BcastDVR_OutputDebug_TraceToFileType@@0@Z
?InsertJsonArray@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAPAU?$IVector@PAUIJsonValue@Json@Data@Windows@@@785@@Z
?InsertJsonBoolean@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@E@Z
?InsertJsonDateTime@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@UDateTime@Foundation@5@@Z
?InsertJsonDouble@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@N@Z
?InsertJsonGuid@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@U_GUID@@@Z
?InsertJsonNumber@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@_J@Z
?InsertJsonObject@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@PAPAUIJsonObject@Json@Data@5@@Z
?InsertJsonString@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@2@Z
?InsertNamedJsonEnumBitfields@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIJsonValueStatics@Json@Data@5@PAU?$IMap@PAUHSTRING__@@PAUIJsonValue@Json@Data@Windows@@@Collections@Foundation@5@PAUHSTRING__@@_KPBQBGH@Z
?LogError@BcastDVRLogProviderBase@@SGXJPBD0H_N@Z
?LogErrorEx@BcastDVRLogProviderBase@@SGXJPBD0H00_N@Z
?MapConstantToString@GameDVRUtility@Internal@Capture@Media@Windows@@YGPBGQAPBGKKKK@Z
?MostRecentErrorInHistory@BcastDVRLogProviderBase@@SGJXZ
?OutputString@BcastDVR_OutputDebug@@QAEXXZ
?PrintGuid@GameDVRUtility@Internal@Capture@Media@Windows@@YGJU_GUID@@PAVString@25@@Z
?PrintHRESULT@BcastDVR_OutputDebug@@QAEXJ@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBD0@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDE@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDH@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDI@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDK@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDN@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDPAX@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBDPBG@Z
?PrintType@BcastDVR_OutputDebug@@QAEXPBD_K@Z
?Printf@BcastDVRLogProviderBase@@SAX_N0PBD1HPBGZZ
?RecreateStorageFile@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUIStorageFile@Storage@5@PAPAU675@@Z
?RegGetDwordValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGXPAUHKEY__@@PBG1KPAK@Z
?RegGetQwordValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGXPAUHKEY__@@PBG1_KPA_K@Z
?RegGetStringValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGXPAUHKEY__@@PBG1PAVString@25@@Z
?RegSetBinaryValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PBG1PBEK@Z
?RegSetDwordValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PBG1K@Z
?RegSetQwordValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PBG1_K@Z
?RegSetStringValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PBG1PAVString@25@@Z
?RegSetStringValue@GameDVRUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PBGPBD2@Z
?RegisterCallingPlugIn@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@PAUHSTRING__@@1ABU_GUID@@@Z
?SetDefaultPlugIn@PlugInUtility@Internal@Capture@Media@Windows@@YGJPAUHKEY__@@ABU_GUID@@@Z
?Uninitialize@BcastDVR_OutputDebug@@SGXXZ
ActiveMetadataManagerInstances
CreateCallerManagerInstance
CreateCallerManagerInstanceForAppId
CreateMetadataManagerInstance
CreateMetadataManagerInstanceForAppId
CreateMetadataManagerInstanceFromJson
FireCallerManagerEvent
FireCallerManagerEventForAppId
GetBroadcastSharedMemoryReader
GetBroadcastSharedMemoryWriter
GetPreviewSharedMemoryReader
GetPreviewSharedMemoryWriter
Name
.text
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=5, id=259, version=27412,
count=175, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=37, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BingMaps.dll
- IMPHASH c67b0aaf1706bcd440469aa608b967a3
- SHA256 d295c8e553690353c42307dfccb78952470cecae7992b8db48e1f02d7434ac26
- MD5 44ca809ccca3c55130554345d7dfc1cc
- SHA1 708e3c0868da54ca3b609e6d5e8189c9497ac322
- SHA512 c31f8b126dd9e292995d3c38f75b6747df8deb3765b91ca4ffa9a9224e46ad6e07d7262bd5ff1292685c760d9eab5fe7344a6a1e5760c78e8353b8bcf9ac5ed4
- SSDEEP 98304:5nwu/6FZggA6U3eL4ftJzQQ1NihnM9bMTXwhCtT6kSYtbISiV:5wuQggOG4fkQ1NqnM9MTsCtT6kSY
- TLSH T16B668D23BBD0457BD5BF2330258FA360627DA9710BA2C3CB6684163E6EB57C1193275B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5586624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BingMaps.pdb
msvcp_win
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?widen@?$ctype@G@std@@QBEGD@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Random_device@std@@YAIXZ
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Xruntime_error@std@@YAXPBD@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?toupper@?$ctype@G@std@@QBEGG@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__expand
_o__free_locale
_o__gmtime32_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__msize
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswscanf
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wstat32
_o__wtoi_l
_o_atof
_o_atoi
_o_atol
_o_ceil
_o_exp2f
_o_fclose
_o_floor
_o_fopen
_o_fread
_o_free
_o_fseek
_o_ftell
_o_isdigit
_o_islower
_o_isspace
_o_isupper
_o_log2
_o_lroundf
_o_malloc
_o_modf
_o_qsort
_o_rand_s
_o_realloc
_o_round
_o_roundf
_o_strcpy_s
_o_terminate
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_wcstod
_o_wcstol
_o_wcstoll
_o_wcstoul
_except_handler4_common
_o___stdio_common_vswprintf_s
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__configure_narrow_argv
_o__dtest
_o___std_type_info_destroy_list
_o__CItan
_o__crt_atexit
_o___std_exception_destroy
_o__create_locale
_o___std_exception_copy
_o__CIsqrt
_o__CIsinh
_o__CIsin
_o__CIpow
_o__CIlog
_o__CIfmod
_o__CIexp
_o__CIcos
_o__CIatan2
_o__CIatan
_o__CIasin
_o__CIacos
__std_type_info_compare
__std_terminate
__CxxFrameHandler3
_o__cexit
_o__callnewh
strchr
longjmp
strrchr
strstr
__RTtypeid
_o__aligned_malloc
_o__aligned_free
__RTDynamicCast
_setjmp3
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
memset
strncpy
mapconfiguration
ConfigurationManager_GetLocaleMapConfiguration
ConfigurationManager_Create
api-ms-win-core-psm-app-l1-1-0
PsmRegisterAppStateChangeNotification
PsmUnregisterAppStateChangeNotification
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetProcAddress
LockResource
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsConcatString
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoTransformError
RoFailFastWithErrorContext
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoMarshalInterface
CoTaskMemAlloc
CoGetApartmentType
CoTaskMemFree
api-ms-win-core-synch-l1-1-0
WaitForMultipleObjectsEx
CreateEventW
AcquireSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
ResetEvent
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
TryEnterCriticalSection
SetEvent
CreateEventExW
WaitForSingleObjectEx
EnterCriticalSection
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSectionEx
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressSingle
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-path-l1-1-0
PathCchCanonicalize
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-file-l1-1-0
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindClose
ReadFile
GetFileSizeEx
FindNextFileW
FindFirstFileW
SetFileAttributesW
DeleteFileW
GetFileAttributesExW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-eventing-provider-l1-1-0
EventWrite
EventRegister
EventUnregister
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-io-l1-1-0
CancelIoEx
api-ms-win-core-psapi-l1-1-0
K32GetPerformanceInfo
api-ms-win-core-kernel32-legacy-l1-1-0
BindIoCompletionCallback
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-downlevel-shlwapi-l2-1-0
SHCreateMemStream
d2d1
ord1
d3d11
D3D11CreateDevice
dwrite
DWriteCreateFactory
dxgi
DXGIGetDebugInterface1
CreateDXGIFactory2
CreateDXGIFactory1
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
ztrace_maps
ZTraceClose
ZTraceReportOriginationNoThis
ZTraceReportPropagation
ZTraceReportIgnore
ZTraceHelper
ZTraceReportPropagationNoThis
ZTraceReportOrigination
ZTraceInit
ZTraceReportIgnoreNoThis
api-ms-win-crt-math-l1-1-0
truncf
api-ms-win-crt-time-l1-1-0
_time32
moshostclient
MosHostClose
MosHostOpen
MosGetDataAsyncOperation
MosDeleteDataAsyncOperation
GetBingMapsFactory
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
484KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=102, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=259, version=27412,
count=15, id=260, version=27412,
count=1458, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=1, id=256, version=27412,
count=439, id=265, version=27412,
count=33, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BingMaps.dll.mun
- SHA256 8af76de0802659645eaed09ae7fbb7eb80a084f96815f0a6881171fe1604b6c6
- MD5 f9385e14029e2c9c872b73452de95f2c
- SHA1 795592268ea0a729df1fd12e2d95675a67139371
- SHA512 9be8e832b52c00a020a61491d61e763eb880d68564c40905b3b8696e3b8f952b25484688cdd553dd999e264bbf2e144a9916a95baee54a29beb38051cedc93f4
- SSDEEP 3072:OBdFvqxw/zPDwPebIePjSqZDj9iRDvXljQIgGjZuRJBW:OdFixwXwPecIjVZDJyD9xgGj85W
- TLSH T17EB312F45AD408CED029BF7A76E42A1D5A2D2EF9C92F37FDC318162C5A189C8C819D53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BingOnlineServices.dll
- IMPHASH 4ebeaadb24cd6459f1e78b8cb537866f
- SHA256 da043b4b88e67d76a256169e79226ab32275e9ade40d482ab5464e1ef3b0ada3
- MD5 e4fa952cbe6a46c48726306065b0a22d
- SHA1 c605596d789c0c26c646f4ec85ad2af07e6da9c5
- SHA512 62a7e29b2edadba7692ab989bce871cad879d129a381ab2a57ab2db3e178d7dcfe519b147fbdcbddd83fd3db701e5eec75aa58e4d69693e14e8cfc2bfbe2d79f
- SSDEEP 12288:Ytafa6HUrvF9K2xml/1aUsbfDca0klL9Q1qdUXCaJ:UafBUnKeml/sUsbfDyklL9Q1qdUSa
- TLSH T132C44A227746C0F6D64E23B4294DE239916DB8B20BF492C7AFD4977F1EB01C26E31592
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
143888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BingOnlineServices.pdb
msvcp_win
?width@ios_base@std@@QAE_J_J@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?fail@ios_base@std@@QBE_NXZ
?eof@ios_base@std@@QBE_NXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z
??Bios_base@std@@QBE_NXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?width@ios_base@std@@QBE_JXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
_Wcscoll
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?_Xbad_function_call@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?setf@ios_base@std@@QAEHHH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?widen@?$ctype@G@std@@QBEGD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
_Wcsxfrm
?_Xlength_error@std@@YAXPBD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?classic@locale@std@@SAABV12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?id@?$collate@G@std@@2V0locale@2@A
?bad@ios_base@std@@QBE_NXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
memcpy
__std_type_info_compare
__CxxFrameHandler3
__std_terminate
strchr
_o___pctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_locale
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isctype_l
_o__purecall
memmove
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__strtod_l
_o__ui64toa_s
_o__ui64tow_s
_o__wcsicmp
_o__wcstod_l
_o__wtoi
_o_free
_o_isalpha
_o_isdigit
_o_isspace
_o_iswspace
_o_malloc
_o_realloc
_o_setlocale
_o_terminate
_o_tolower
_o_wcstok_s
_o_wcstol
_CxxThrowException
_except_handler4_common
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
strnlen
ztrace_maps
ZTraceReportPropagationNoThis
ZTraceClose
ZTraceHelperNoThis
ZTraceHelper
ZTraceInit
ZTraceReportOriginationNoThis
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleA
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
ResetEvent
InitializeSRWLock
ReleaseMutex
SetEvent
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
CreateEventW
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
WaitForSingleObject
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
mapconfiguration
ConfigurationManager_Create
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
winhttp
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryOption
WinHttpSetCredentials
WinHttpSetStatusCallback
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetOption
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpQueryAuthSchemes
WinHttpQueryHeaders
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CryptUnprotectMemory
CryptProtectMemory
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
bcrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-registry-l1-1-0
RegGetValueW
?$TSS0@?1??getMaxAgeInSeconds@OnlineServiceData@BingOnlineServices@@QBE?BIXZ@4HA
??0BoundingBox@BingOnlineServices@@QAE@NNNN@Z
??0CopyrightData@BingOnlineServices@@QAE@$$QAV01@@Z
??0CopyrightData@BingOnlineServices@@QAE@ABV01@@Z
??0CopyrightData@BingOnlineServices@@QAE@XZ
??0CopyrightDataImpl@BingOnlineServices@@QAE@$$QAV01@@Z
??0CopyrightDataImpl@BingOnlineServices@@QAE@ABV01@@Z
??0CopyrightDataImpl@BingOnlineServices@@QAE@XZ
??0CopyrightRequest@BingOnlineServices@@QAE@$$QAV01@@Z
??0CopyrightRequest@BingOnlineServices@@QAE@ABV01@@Z
??0CopyrightRequest@BingOnlineServices@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0_N@Z
??0Geopoint@BingOnlineServices@@QAE@NNN@Z
??0Geoposition@BingOnlineServices@@QAE@NNN@Z
??0OnlineServiceData@BingOnlineServices@@QAE@ABV01@@Z
??0OnlineServiceData@BingOnlineServices@@QAE@XZ
??0OnlineServiceResponse@BingOnlineServices@@QAE@$$QAU01@@Z
??0OnlineServiceResponse@BingOnlineServices@@QAE@ABU01@@Z
??0OnlineServiceResponse@BingOnlineServices@@QAE@XZ
??0_file_info@details@streams@Concurrency@@QAE@HI@Z
??0_http_request@details@http@web@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0_http_request@details@http@web@@QAE@V?$unique_ptr@V_http_server_context@details@http@web@@U?$default_delete@V_http_server_context@details@http@web@@@std@@@std@@@Z
??0critical_section_impl@details@pplx@@QAE@XZ
??0event_impl@details@pplx@@QAE@XZ
??0http_client@client@http@web@@QAE@ABVuri@3@@Z
??0http_client@client@http@web@@QAE@ABVuri@3@ABVhttp_client_config@123@@Z
??0http_msg_base@details@http@web@@QAE@XZ
??0reader_writer_lock_impl@details@pplx@@QAE@XZ
??0scoped_c_thread_locale@details@utility@@QAE@XZ
??0uri@web@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0uri@web@@QAE@PBG@Z
??0value@json@web@@QAE@$$QAV012@@Z
??0value@json@web@@QAE@ABV012@@Z
??0value@json@web@@QAE@H@Z
??0value@json@web@@QAE@I@Z
??0value@json@web@@QAE@N@Z
??0value@json@web@@QAE@PBG@Z
??0value@json@web@@QAE@PBG_N@Z
??0value@json@web@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0value@json@web@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
??0value@json@web@@QAE@XZ
??0value@json@web@@QAE@_J@Z
??0value@json@web@@QAE@_K@Z
??0value@json@web@@QAE@_N@Z
??0win32_encryption@details@web@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??1CopyrightData@BingOnlineServices@@UAE@XZ
??1CopyrightDataImpl@BingOnlineServices@@UAE@XZ
??1CopyrightRequest@BingOnlineServices@@QAE@XZ
??1OnlineServiceData@BingOnlineServices@@UAE@XZ
??1OnlineServiceResponse@BingOnlineServices@@QAE@XZ
??1critical_section_impl@details@pplx@@QAE@XZ
??1event_impl@details@pplx@@QAE@XZ
??1scoped_c_thread_locale@details@utility@@QAE@XZ
??1win32_encryption@details@web@@QAE@XZ
??4BoundingBox@BingOnlineServices@@QAEAAU01@$$QAU01@@Z
??4BoundingBox@BingOnlineServices@@QAEAAU01@ABU01@@Z
??4CopyrightData@BingOnlineServices@@QAEAAV01@$$QAV01@@Z
??4CopyrightData@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4CopyrightDataImpl@BingOnlineServices@@QAEAAV01@$$QAV01@@Z
??4CopyrightDataImpl@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4CopyrightRequest@BingOnlineServices@@QAEAAV01@$$QAV01@@Z
??4CopyrightRequest@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4Geopoint@BingOnlineServices@@QAEAAU01@$$QAU01@@Z
??4Geopoint@BingOnlineServices@@QAEAAU01@ABU01@@Z
??4Geoposition@BingOnlineServices@@QAEAAU01@$$QAU01@@Z
??4Geoposition@BingOnlineServices@@QAEAAU01@ABU01@@Z
??4OnlineServiceData@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4OnlineServiceResponse@BingOnlineServices@@QAEAAU01@$$QAU01@@Z
??4OnlineServiceResponse@BingOnlineServices@@QAEAAU01@ABU01@@Z
??4ServiceDataHelper@BingOnlineServices@@QAEAAV01@$$QAV01@@Z
??4ServiceDataHelper@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4ServiceRequestHelper@BingOnlineServices@@QAEAAV01@$$QAV01@@Z
??4ServiceRequestHelper@BingOnlineServices@@QAEAAV01@ABV01@@Z
??4value@json@web@@QAEAAV012@$$QAV012@@Z
??4value@json@web@@QAEAAV012@ABV012@@Z
??5json@web@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@std@@AAV23@AAVvalue@01@@Z
??6json@web@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@std@@AAV23@ABVvalue@01@@Z
??8uri@web@@QBE_NABV01@@Z
??8value@json@web@@QBE_NABV012@@Z
??Avalue@json@web@@AAEAAV012@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QAEAAV012@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??Avalue@json@web@@QAEAAV012@I@Z
??Rzero_memory_deleter@details@web@@QBEXPAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??_7CopyrightData@BingOnlineServices@@6B@
??_7CopyrightDataImpl@BingOnlineServices@@6B@
??_7OnlineServiceData@BingOnlineServices@@6B@
??_FBoundingBox@BingOnlineServices@@QAEXXZ
??_FGeopoint@BingOnlineServices@@QAEXXZ
??_FGeoposition@BingOnlineServices@@QAEXXZ
?CONNECT@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?CaptureCallstack@platform@details@pplx@@YAIPAPAXII@Z
?CheckHResultThrowAtFailed@CopyrightRequest@BingOnlineServices@@AAEXJPBD@Z
?CompareValueCaseInsensitive@ServiceDataHelper@BingOnlineServices@@SG?B_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?CompareValueCaseInsensitive@ServiceDataHelper@BingOnlineServices@@SG?B_NABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?DEFAULT_BOOL@ServiceDataHelper@BingOnlineServices@@2_NA
?DEFAULT_DOUBLE@ServiceDataHelper@BingOnlineServices@@2NA
?DEFAULT_INT@ServiceDataHelper@BingOnlineServices@@2HA
?DEFAULT_STRING@ServiceDataHelper@BingOnlineServices@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@A
?DEL@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?ExecuteAsync@CopyrightRequest@BingOnlineServices@@QAE?AV?$task@VCopyrightData@BingOnlineServices@@@pplx@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABUBoundingBox@2@I@Z
?ExecuteAsync@CopyrightRequest@BingOnlineServices@@QAE?AV?$task@VCopyrightData@BingOnlineServices@@@pplx@@ABV?$vector@HV?$allocator@H@std@@@std@@@Z
?ExtractCookies@ServiceRequestHelper@BingOnlineServices@@SG?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@@Z
?GET@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?GetCurrentThreadId@platform@details@pplx@@YAJXZ
?GetJsonBoolValueForPath@ServiceDataHelper@BingOnlineServices@@SG?B_NABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?GetJsonDoubleValueForPath@ServiceDataHelper@BingOnlineServices@@SG?BNABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@N@Z
?GetJsonIntValueForPath@ServiceDataHelper@BingOnlineServices@@SG?BHABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@Z
?GetJsonStringValueForPath@ServiceDataHelper@BingOnlineServices@@SG?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABVvalue@json@web@@ABV34@V34@@Z
?GetSystemLocaleInfo@CopyrightRequest@BingOnlineServices@@AAEXPAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?GetValueFromConfig@CopyrightRequest@BingOnlineServices@@AAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@W4ConfigurationManagerKeys@@@Z
?HEAD@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?IsValid@BoundingBox@BingOnlineServices@@SG_NU12@@Z
?IsValid@Geopoint@BingOnlineServices@@SG_NU12@@Z
?IsValid@Geoposition@BingOnlineServices@@SG_NU12@@Z
?MERGE@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?MakeJsonRequestAsync@ServiceRequestHelper@BingOnlineServices@@SG?AV?$task@UOnlineServiceResponse@BingOnlineServices@@@pplx@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0ABV?$map@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@U?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@@std@@@2@@6@1@Z
?MakeJsonRequestAsync@ServiceRequestHelper@BingOnlineServices@@SG?AV?$task@UOnlineServiceResponse@BingOnlineServices@@@pplx@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?OPTIONS@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?PATCH@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?POST@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?PUT@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?ParseCopyrightResponse@CopyrightDataImpl@BingOnlineServices@@QAEXABVvalue@json@web@@@Z
?ProcessResponse@ServiceRequestHelper@BingOnlineServices@@SG?AV?$task@UOnlineServiceResponse@BingOnlineServices@@@pplx@@ABVhttp_response@http@web@@@Z
?ReplaceFragmentUri@ServiceRequestHelper@BingOnlineServices@@SG?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@000@Z
?ReplaceFragmentUri@ServiceRequestHelper@BingOnlineServices@@SG?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@000ABUBoundingBox@2@I@Z
?SetHttpResponseData@OnlineServiceData@BingOnlineServices@@QAEXH_JV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@11@Z
?SetRunningInService@ServiceRequestHelper@BingOnlineServices@@SGXXZ
?TRCE@methods@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?Teardown@ServiceRequestHelper@BingOnlineServices@@SGXXZ
?TryGetJsonArrayForPath@ServiceDataHelper@BingOnlineServices@@SG_NABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAV345@@Z
?TryGetJsonNodeForPath@ServiceDataHelper@BingOnlineServices@@SG_NABVvalue@json@web@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAV345@@Z
?YieldExecution@platform@details@pplx@@YAXXZ
?_authenticate_request@oauth1_config@experimental@oauth1@http@web@@AAEXAAVhttp_request@45@Voauth1_state@details@345@@Z
?_build_signature_base_string@oauth1_config@experimental@oauth1@http@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@Vhttp_request@45@Voauth1_state@details@345@@Z
?_complete@http_msg_base@details@http@web@@UAEX_KABVexception_ptr@std@@@Z
?_extract_json@http_msg_base@details@http@web@@QAE?AVvalue@json@4@_N@Z
?_extract_vector@http_msg_base@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@XZ
?_get_content_length@http_msg_base@details@http@web@@QAEIXZ
?_hmac_sha1@oauth1_config@experimental@oauth1@http@web@@CA?AV?$vector@EV?$allocator@E@std@@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@7@0@Z
?_prepare_to_receive_data@http_msg_base@details@http@web@@QAEXXZ
?_request_token@oauth1_config@experimental@oauth1@http@web@@AAE?AV?$task@X@pplx@@Voauth1_state@details@345@_N@Z
?absolute_uri@_http_request@details@http@web@@QBE?AVuri@4@XZ
?accept@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?accept_charset@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?accept_encoding@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?accept_language@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?accept_ranges@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?add_chunked_delimiters@chunked_encoding@details@http@web@@YAIPAEII@Z
?age@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?allow@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?append@uri_builder@web@@QAEAAV12@ABVuri@2@@Z
?append_path@uri_builder@web@@QAEAAV12@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?append_query@uri_builder@web@@QAEAAV12@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?application_atom_xml@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_http@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_javascript@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_json@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_octetstream@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_x_www_form_urlencoded@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_xjavascript@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_xjson@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?application_xml@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?array@value@json@web@@SA?AV123@I@Z
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?as_array@value@json@web@@QAEAAVarray@23@XZ
?as_array@value@json@web@@QBEABVarray@23@XZ
?as_bool@value@json@web@@QBE_NXZ
?as_double@value@json@web@@QBENXZ
?as_integer@value@json@web@@QBEHXZ
?as_number@value@json@web@@QBEABVnumber@23@XZ
?as_object@value@json@web@@QAEAAVobject@23@XZ
?as_object@value@json@web@@QBEABVobject@23@XZ
?as_string@value@json@web@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?ascii@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?at@value@json@web@@QAEAAV123@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?at@value@json@web@@QAEAAV123@I@Z
?at@value@json@web@@QBEABV123@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?at@value@json@web@@QBEABV123@I@Z
?authority@uri@web@@QBE?AV12@XZ
?authorization@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?base_uri@http_client@client@http@web@@QBEABVuri@4@XZ
?boolean@value@json@web@@SA?AV123@_N@Z
?boundary@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?build_authorization_uri@oauth1_config@experimental@oauth1@http@web@@QAE?AV?$task@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@pplx@@XZ
?c_locale@scoped_c_thread_locale@details@utility@@SAPAU__crt_locale_pointers@@XZ
?cache_control@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?cache_control@http_headers@http@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?callback@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?callback_confirmed@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?client_config@http_client@client@http@web@@QBEABVhttp_client_config@234@XZ
?connection@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?consumer_key@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_disposition@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_encoding@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_language@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_length@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_length@http_headers@http@web@@QBE_KXZ
?content_location@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_md5@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_range@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_type@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?content_type@http_headers@http@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?date@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?date@http_headers@http@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?decode@uri@web@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@@Z
?decrypt@win32_encryption@details@web@@QBE?AV?$unique_ptr@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@Vzero_memory_deleter@details@web@@@std@@XZ
?default_error_condition@windows_category_impl@details@utility@@UBE?AVerror_condition@std@@H@Z
?encode_data_string@uri@web@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@@Z
?encode_impl@uri@web@@CA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@ABV?$function@$$A6A_NH@Z@4@@Z
?encode_uri@uri@web@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@W4component@components@12@@Z
?erase@value@json@web@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?erase@value@json@web@@QAEXI@Z
?etag@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?expect@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?expires@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?extract_string@http_msg_base@details@http@web@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?extract_utf16string@http_msg_base@details@http@web@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?extract_utf8string@http_msg_base@details@http@web@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?form_data@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?format@value@json@web@@ABEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@ABEXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?from@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?from_base64@conversions@utility@@YA?AV?$vector@EV?$allocator@E@std@@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@4@@Z
?from_string@datetime@utility@@SA?AV12@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getCacheControl@OnlineServiceData@BingOnlineServices@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getContentLength@OnlineServiceData@BingOnlineServices@@QBE?B_JXZ
?getContentType@OnlineServiceData@BingOnlineServices@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getCookies@OnlineServiceData@BingOnlineServices@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getHttpStatus@OnlineServiceData@BingOnlineServices@@QBE?BHXZ
?getImageryProviders@CopyrightData@BingOnlineServices@@QBEABV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@XZ
?getMaxAgeInSeconds@OnlineServiceData@BingOnlineServices@@QBE?BIXZ
?get_ambient_scheduler@pplx@@YA?AV?$shared_ptr@Uscheduler_interface@pplx@@@std@@XZ
?hmac_sha1@oauth1_methods@experimental@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?host@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?if_match@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?if_modified_since@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?if_none_match@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?if_range@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?if_unmodified_since@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?is_double@value@json@web@@QBE_NXZ
?is_int32@number@json@web@@QBE_NXZ
?is_int64@number@json@web@@QBE_NXZ
?is_integer@value@json@web@@QBE_NXZ
?is_uint32@number@json@web@@QBE_NXZ
?is_valid@uri_builder@web@@QAE_NXZ
?join@uri_components@details@web@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?keep_object_element_order@json@web@@YAX_N@Z
?last_modified@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?latin1@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?location@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?lock@critical_section_impl@details@pplx@@QAEXXZ
?lock@reader_writer_lock_impl@details@pplx@@QAEXXZ
?lock_read@reader_writer_lock_impl@details@pplx@@QAEXXZ
?ltrim_whitespace@details@http@web@@YAXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?max_forwards@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?message@windows_category_impl@details@utility@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?message_http@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?multipart_form_data@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?nonce@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@AAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@GU?$char_traits@G@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@GU?$char_traits@G@std@@@std@@AAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?parse@value@json@web@@SA?AV123@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAVerror_code@5@@Z
?plaintext@oauth1_methods@experimental@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?platform_category@details@utility@@YAABVerror_category@std@@XZ
?pragma@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?proxy_authenticate@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?proxy_authorization@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?range@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?realm@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?referer@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?relative_uri@_http_request@details@http@web@@QBE?AVuri@4@XZ
?request@http_client@client@http@web@@QAE?AV?$task@Vhttp_response@http@web@@@pplx@@Vhttp_request@34@ABVcancellation_token@6@@Z
?reset@event_impl@details@pplx@@QAEXXZ
?resource@uri@web@@QBE?AV12@XZ
?retry_after@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?rtrim_whitespace@details@http@web@@YAXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?s_cancellationToken@ServiceRequestHelper@BingOnlineServices@@0Vcancellation_token_source@pplx@@A
?s_runningInService@ServiceRequestHelper@BingOnlineServices@@0_NA
?sc_maxAgeRegex@?1??getMaxAgeInSeconds@OnlineServiceData@BingOnlineServices@@QBE?BIXZ@4V?$basic_regex@GV?$regex_traits@G@std@@@std@@B
?schedule@windows_scheduler@details@pplx@@UAEXP6AXPAX@Z0@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?serialize@value@json@web@@QBEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QBEXAAV?$basic_ostream@GU?$char_traits@G@std@@@std@@@Z
?server@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?set@event_impl@details@pplx@@QAEXXZ
?set_ambient_scheduler@pplx@@YAXV?$shared_ptr@Uscheduler_interface@pplx@@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?set_cache_control@http_headers@http@web@@QAEXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?set_content_length@http_headers@http@web@@QAEX_K@Z
?set_content_type@http_headers@http@web@@QAEXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?set_date@http_headers@http@web@@QAEXABVdatetime@utility@@@Z
?set_request_uri@_http_request@details@http@web@@QAEXABVuri@4@@Z
?signature@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?signature_method@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?split_path@uri@web@@SA?AV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@4@@Z
?split_query@uri@web@@SA?AV?$map@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@U?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@@std@@@2@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@4@@Z
?string@value@json@web@@CA?AV123@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPAX_KPAV12@@Z
?te@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_javascript@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_json@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_plain@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_plain_utf16@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_plain_utf16le@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_plain_utf8@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_xjavascript@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?text_xjson@mime_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?timestamp@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?to_base64@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$vector@EV?$allocator@E@std@@@4@@Z
?to_base64@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@_K@Z
?to_string@_http_request@details@http@web@@UBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?to_string@_http_response@details@http@web@@UBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?to_string@datetime@utility@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@W4date_format@12@@Z
?to_string@http_msg_base@details@http@web@@UBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?to_string@uri_builder@web@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?to_string@value@json@web@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@$$QAV34@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV34@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_uri@uri_builder@web@@QAE?AVuri@2@XZ
?to_utf16string@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V34@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@@Z
?token@oauth1_config@experimental@oauth1@http@web@@QBEABVoauth1_token@2345@XZ
?token@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?token_from_redirected_uri@oauth1_config@experimental@oauth1@http@web@@QAE?AV?$task@X@pplx@@ABVuri@5@@Z
?token_secret@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?trailer@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?transfer_encoding@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?trim_whitespace@details@http@web@@YAXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?type@value@json@web@@QBE?AW4value_type@123@XZ
?unlock@critical_section_impl@details@pplx@@QAEXXZ
?unlock@reader_writer_lock_impl@details@pplx@@QAEXXZ
?upgrade@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?usascii@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?user_agent@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@4@@Z
?utf16be@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?utf16le@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?utf8@charset_types@details@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?validate@uri@web@@SA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?vary@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?verifier@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?version@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?via@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?wait@event_impl@details@pplx@@QAEII@Z
?warning@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?windows_category@details@utility@@YAABVerror_category@std@@XZ
?www_authenticate@header_names@http@web@@2V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@B
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@5@@Z
Name
.text
Size
467KB
Virtual Size
466KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
49KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=11, id=260, version=27412,
count=1364, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=28, id=270, version=27412,
count=27, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BioCredProv.dll
- IMPHASH 639e2cba4dd5fee1f98d62510f3e0f71
- SHA256 a5e948d956017a181e3633299486f34381b64efc4cdba171fefe52b6b1ddc34e
- MD5 fd32731a63b2b48096c118af5e446301
- SHA1 b27df5955f86272bf11bd84e6276a496a06ce54b
- SHA512 c4f7be526f5276ea73882694c8380660221501ad695507c0e0be6881979fa5236863f5cbe8151143874eb310535543d16fec91fdb7a77a64c316e967d4043927
- SSDEEP 6144:60GJ1J/ixx3YPTJ0BwaDcHe2Pl2/x4Tj8eENGLgVeo:Uf8fac2jieo
- TLSH T171545B217700C536E25A2279E81852FA52BD96218F50CCC7EB841E6D7EBE7C29D3437B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
59856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BioCredProv.pdb
msvcp_win
?_Xout_of_range@std@@YAXPBD@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Syserror_map@std@@YAPBDH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_Mtx_unlock
_Mtx_lock
_Cnd_unregister_at_thread_exit
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
_Cnd_wait
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Query_perf_counter
_Query_perf_frequency
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_current_owns
_Xtime_get_ticks
_Cnd_init_in_situ
_Mtx_init_in_situ
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_malloc
_o_terminate
_o_toupper
_except_handler4_common
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ngckeyenum
NgcCredProvFreeBuffer
NgcCredProvEnumLogonKeys
dsreg
DsrFreeJoinInfo
DsrGetJoinInfo
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
DisableThreadLibraryCalls
LockResource
LoadLibraryExW
GetProcAddress
FreeLibrary
FindResourceExW
LoadResource
LoadStringW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObject
InitializeSRWLock
CreateEventExW
ReleaseSRWLockShared
CreateSemaphoreExW
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSemaphore
CreateEventW
ResetEvent
CreateMutexExW
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ProcessIdToSessionId
TerminateProcess
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
SetThreadUILanguage
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoGetMalloc
CLSIDFromString
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventProviderEnabled
EventSetInformation
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
EqualSid
IsValidSid
IsWellKnownSid
GetTokenInformation
GetLengthSid
CopySid
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegGetValueW
RegQueryInfoKeyW
RegSetValueExW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-security-credentials-l1-1-0
CredIsMarshaledCredentialW
CredFree
CredUnmarshalCredentialW
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlGetNtProductType
RtlIsMultiSessionSku
NtQueryWnfStateData
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
245KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=17, id=260, version=27412,
count=1373, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=47, id=270, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BitLockerCsp.dll
- IMPHASH a9a30bab7851feade690ea14f3a0a840
- SHA256 11c7505bd84cbabd1ee551e8e14cf5b35e6e5048ce626a7c30056c67c0041881
- MD5 57be7f17e17a1563e3a249217956e87f
- SHA1 b9a44de7112aced01ac0774cdb5266f3378e2448
- SHA512 37ab6af63426f2236e0577d1c799e911185c82bbb60b8c12e63d6955f6fbf155799cd303c1e9aa8da73c88e16220f89b9ec421c2b78818f3a0a70404fec261e9
- SSDEEP 3072:1lzxR2h3yL+Ss/afxL7cuQVMWNNYkmxJLT3OfM9GPIBdPPeUICt7Vvk/VKVRyZEf:1h8yL+/afxL7cubW0Rx1T31dPPeUICtC
- TLSH T132044A6167948431F3B72A30796BA73316BFB9601F9285CF62101BAD2C756C19F313AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
146432
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BitLockerCSP.pdb
msvcp110_win
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
msvcrt
_CxxThrowException
toupper
_wcsnicmp
_wtoi
_wcsicmp
memcmp
memcpy
memmove
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
memset
ntdll
RtlNtStatusToDosError
NtGetCachedSigningLevel
NtQuerySystemInformation
NtQueryInformationToken
NtDuplicateToken
NtOpenThreadToken
RtlEqualSid
RtlSubAuthorityCountSid
RtlGetDeviceFamilyInfoEnum
NtClose
RtlCopySid
RtlLengthSid
RtlGetNtProductType
RtlInitUnicodeString
RtlSubAuthoritySid
RtlInitializeSid
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlCompareMemory
RtlIsMultiSessionSku
NtOpenProcessToken
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
oleaut32
SysStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
ReleaseMutex
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSemaphore
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventProviderEnabled
EventRegister
EventSetInformation
EventActivityIdControl
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyExW
RegOpenKeyExW
RegDeleteValueW
RegGetValueW
RegEnumValueW
RegQueryInfoKeyW
RegLoadKeyW
RegCreateKeyExW
RegUnLoadKeyW
RegCloseKey
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
CreateWellKnownSid
FreeSid
CopySid
GetLengthSid
CheckTokenMembership
EqualSid
PrivilegeCheck
GetSecurityDescriptorDacl
GetTokenInformation
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
bcd
BcdOpenSystemStore
BcdCloseStore
BcdCloseObject
BcdEnumerateAndUnpackElements
BcdOpenObject
BcdEnumerateObjects
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=17, id=260, version=27412,
count=299, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=91, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BitsProxy.dll
- IMPHASH 8266a483dac0d7feddf66d14ae4048c1
- SHA256 56a76431f2818318508932c0ea6187c8c136be89dcd56f0d6a4372353e50eeab
- MD5 e1fc168d583e1666534c6bd17766f3d6
- SHA1 313b2d4e629df210e6159834396f6b1120fb4c71
- SHA512 1d734f44019071c92a066d5d9fc578128394c5b856deef70e5b94e511561570043eb4339a9f15da170f0b1d869f66131fd3a9cd612b0c4bf7aa88a361c8d4453
- SSDEEP 768:pROVKeDoq1oTtbRHjyXIu4CbTw9jKuAde:pWDAB9uXIzCbTw9jKPd
- TLSH T1D3238281BB614478D62E603906975331D2399E10BBD312DB5F60375ABC763A1EF33B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
33504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BitsProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsprintf_s
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common
__CxxFrameHandler3
_CxxThrowException
memcmp
api-ms-win-crt-string-l1-1-0
memset
combase
CStdStubBuffer_CountRefs
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
rpcrt4
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction
NdrStubCall2
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrClientCall2
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoCreateInstance
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1154, id=1, productName=Unmarked objects,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=39, id=269, version=27412,
count=16, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BluetoothApis.dll
- IMPHASH 2d5b02b1a76334e368d4e61163607b42
- SHA256 00d44c853b4885a5b4ff8454a25791605d03a2f3b3a4ba0d11e193f9bd3b6236
- MD5 67f246041e7c910091caaf464d514f0f
- SHA1 547065fecd5d8c5843d6f580d4b9c845caeab2fd
- SHA512 bc00a99cfeb469a5c890b381f74678ed9f00ab70cff35b74eb21e03ab2c235f1b96616368ea6aaf12fac810966630bd4d2fe8a5f9d988ed3435bd10b0cf22db1
- SSDEEP 3072:G+5avXRzihobcpin4pZpwkxW+D3dqf3Qy20TV3/lLF7npThMWJ9O:G1vX5ihkf3LppiWJ
- TLSH T199E37D12BAC044F6D6FB313825AF3775633D98344FE150CB5BA01B6ABEA25D11E34A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
24336
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BluetoothApis.pdb
msvcrt
memmove
?terminate@@YAXXZ
??1type_info@@UAE@XZ
memcpy
_amsg_exit
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
_XcptFilter
_callnewh
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
??0exception@@QAE@XZ
__CxxFrameHandler3
wcstombs
swscanf
wcsncmp
_wcsicmp
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
_initterm
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
memcmp
malloc
free
??1exception@@UAE@XZ
memset
ntdll
RtlCompareMemory
RtlNtStatusToDosError
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlUnicodeToUTF8N
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventExW
WaitForSingleObject
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
ResetEvent
ReleaseMutex
AcquireSRWLockShared
OpenSemaphoreW
ReleaseSemaphore
CreateEventW
rpcrt4
NdrClientCall4
RpcBindingCreateW
RpcStringBindingComposeW
RpcBindingUnbind
NdrClientCall2
RpcStringFreeW
RpcBindingFromStringBindingW
RpcBindingFree
RpcBindingBind
RpcBindingSetAuthInfoExW
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoUninitialize
CoCreateInstance
CoInitializeEx
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
oleaut32
SysFreeString
SysAllocString
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsRelativeW
PathFileExistsW
devobj
DevObjGetDeviceInstanceId
DevObjGetClassDevs
DevObjUninstallDevice
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInfo
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroup
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
api-ms-win-devices-config-l1-1-1
CM_Register_Notification
CM_Unregister_Notification
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BluetoothAddressToString
BluetoothDisconnectDevice
BluetoothEnableDiscovery
BluetoothEnableIncomingConnections
BluetoothEnumerateInstalledServices
BluetoothEnumerateInstalledServicesEx
BluetoothEnumerateLocalServices
BluetoothFindBrowseGroupClose
BluetoothFindClassIdClose
BluetoothFindDeviceClose
BluetoothFindFirstBrowseGroup
BluetoothFindFirstClassId
BluetoothFindFirstDevice
BluetoothFindFirstProfileDescriptor
BluetoothFindFirstProtocolDescriptorStack
BluetoothFindFirstProtocolEntry
BluetoothFindFirstRadio
BluetoothFindFirstService
BluetoothFindFirstServiceEx
BluetoothFindNextBrowseGroup
BluetoothFindNextClassId
BluetoothFindNextDevice
BluetoothFindNextProfileDescriptor
BluetoothFindNextProtocolDescriptorStack
BluetoothFindNextProtocolEntry
BluetoothFindNextRadio
BluetoothFindNextService
BluetoothFindProfileDescriptorClose
BluetoothFindProtocolDescriptorStackClose
BluetoothFindProtocolEntryClose
BluetoothFindRadioClose
BluetoothFindServiceClose
BluetoothGATTAbortReliableWrite
BluetoothGATTBeginReliableWrite
BluetoothGATTEndReliableWrite
BluetoothGATTGetCharacteristicValue
BluetoothGATTGetCharacteristics
BluetoothGATTGetDescriptorValue
BluetoothGATTGetDescriptors
BluetoothGATTGetIncludedServices
BluetoothGATTGetServices
BluetoothGATTRegisterEvent
BluetoothGATTSetCharacteristicValue
BluetoothGATTSetDescriptorValue
BluetoothGATTUnregisterEvent
BluetoothGetDeviceInfo
BluetoothGetLocalServiceInfo
BluetoothGetRadioInfo
BluetoothGetServicePnpInstance
BluetoothIsConnectable
BluetoothIsDiscoverable
BluetoothIsVersionAvailable
BluetoothRegisterForAuthentication
BluetoothRegisterForAuthenticationEx
BluetoothRemoveDevice
BluetoothSdpEnumAttributes
BluetoothSdpGetAttributeValue
BluetoothSdpGetContainerElementData
BluetoothSdpGetElementData
BluetoothSdpGetString
BluetoothSendAuthenticationResponse
BluetoothSendAuthenticationResponseEx
BluetoothSetLocalServiceInfo
BluetoothSetServiceState
BluetoothSetServiceStateEx
BluetoothUnregisterAuthentication
BluetoothUpdateDeviceRecord
BthpCheckForUnsupportedGuid
BthpCleanupBRDeviceNode
BthpCleanupDeviceLocalServices
BthpCleanupDeviceRemoteServices
BthpCleanupLEDeviceNodes
BthpEnableA2DPIfPresent
BthpEnableAllServices
BthpEnableConnectableAndDiscoverable
BthpEnableRadioSoftware
BthpFindPnpInfo
BthpGATTCloseSession
BthpInnerRecord
BthpIsBluetoothServiceRunning
BthpIsConnectableByDefault
BthpIsDiscoverable
BthpIsDiscoverableByDefault
BthpIsRadioSoftwareEnabled
BthpIsTopOfServiceGroup
BthpMapStatusToErr
BthpNextRecord
BthpRegisterForAuthentication
BthpSetServiceState
BthpSetServiceStateEx
BthpTranspose16Bits
BthpTranspose32Bits
BthpTransposeAndExtendBytes
DllCanUnloadNow
FindNextOpenVCOMPort
InstallIncomingComPort
ShouldForceAuthentication
Name
.text
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=3, id=259, version=27412,
count=167, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=31, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BrowserSettingSync.dll
- IMPHASH 64624c0315e6e37802cac60e004c8f0d
- SHA256 8ccd253a852203387d894080cda9c15eb64baaf5e079629556051c60f2906f21
- MD5 7ebe41f83984de7662f65c2fd2c0d4fb
- SHA1 59e0ca26cebff3cfc495da8d5eaf1fa2e32601d7
- SHA512 a7e46e24f5105827188bf6078609413da98ce391440277fb0d11d63c45959d9237f0fbf10d43334aa0656154d3655355a79e695fda9f1bc8abe7d097adc4ef69
- SSDEEP 3072:jY4+pN+EVWedTxw9CMx+J2mAsqAoFacHx5QxrL1G1:RkRxFMx+J2pdAoFacRyxrLU
- TLSH T132B31A2276D428B1D2FF253C34293538967F9D30CFE00AC76B1486DA6A746D25E346AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
84560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BrowserSettingSync.pdb
msvcrt
?terminate@@YAXXZ
_initterm
??0exception@@QAE@XZ
_amsg_exit
_lock
_unlock
memmove_s
realloc
__CxxFrameHandler3
malloc
__dllonexit
free
_vsnprintf_s
_purecall
_onexit
_except_handler4_common
??0exception@@QAE@ABV0@@Z
_XcptFilter
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
??1type_info@@UAE@XZ
wcstok_s
iswalnum
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
memset
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-shcore-stream-l1-1-0
IStream_Copy
SHCreateMemStream
IStream_Read
IStream_Size
SHOpenRegStream2W
IStream_Reset
IStream_Write
shlwapi
PathRelativePathToW
ord187
ord219
ord600
AssocGetPerceivedType
UrlEscapeW
ord599
StrChrW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateMutexExW
WaitForSingleObject
DeleteCriticalSection
InitializeSRWLock
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-path-l1-1-0
PathAllocCanonicalize
PathCchCombine
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
RemoveDirectoryW
FindClose
CompareFileTime
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
api-ms-win-core-string-l1-1-0
CompareStringW
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
sspicli
GetUserNameExW
api-ms-win-core-string-l2-1-0
CharLowerW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=2, id=259, version=27412,
count=265, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=29, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/BthTelemetry.dll
- IMPHASH d68eb6ad5f6132aaf01886197f3e5ed6
- SHA256 911391d8a6253d5ae739f74822e7b3494c1bae9467b58e924afa3621faede742
- MD5 d4392e6dc956407f2467ac735dfee083
- SHA1 2a76c13c7de7f1ef34f297e5e87e13b8808adf24
- SHA512 57b3027c0dbe1aac424b2d631d0f2c0325805048d25b563978cd242b1c849e9e9303e1105eba92b1be38949e88776ae5f843cd74c8449823d6d4a3307b04472a
- SSDEEP 384:Ky0BpwBw28jJ/yBjl6KIlnsM+Z/wusuYx5bYn0VHPN5eW4/4WwC:kv289iNIQCbYn0VvNQuC
- TLSH T1E0B24A11B789A872F2EE3234055DAF3B5E7EB930679184CBD6B3162E39708D1683471A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
17168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BthTelemetry.pdb
msvcrt
strnlen
realloc
qsort
sprintf_s
strcat_s
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_itoa_s
memcpy
_ui64tow_s
memset
ntdll
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
bcrypt
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptHashData
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BthCollectFingerprintInfo
BthProcessEventDataDword
BthProcessEventOccurrence
BthProcessEventOccurrenceBthaddr
BthProcessEventOccurrenceResult
BthProcessEventOccurrenceResultBthaddr
BthProcessRpalEventOccurrence
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=72, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=20, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CHxReadingStringIME.dll
- IMPHASH 058d3a0bff4cd6d1abea7de0d7953017
- SHA256 f7785ceaa30bbecdfc69b25aab094fe51cfbd079c680a4ec046b527a950e88cc
- MD5 848b0b0daf50c2ccc063acaccb3ee3e0
- SHA1 5ed7741694adf93600d620d9b82e64571143bcd0
- SHA512 d48c8b8d48aeb019be51f7f222eb3f2846d97273defe8231947931afb95cee07cec16c739c455f734690ada7106f53a60dada56d94625d488dba3863c761da05
- SSDEEP 192:+PRquDjhE8DSWhb24PJsq+08DqCjzzIWtsW:vujjmWc4PJsq+08DqhWtsW
- TLSH T1D422C744FAA04DBDF39B0BB905A56E2A153CBE640F9196C756C3920A68285C3BD30327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CHxReadingStringIME.pdb
msvcrt
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcmp
kernel32
LocalAlloc
LocalFree
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
lstrlenW
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
user32
PostMessageW
GetFocus
GetActiveWindow
oleaut32
SysStringLen
SysFreeString
imm32
ImmLockIMC
ImmUnlockIMC
ImmGetContext
msctf
TF_CreateThreadMgr
GetReadingString
ShowReadingWindow
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=39, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=8, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CIWmi.dll
- IMPHASH 01eafb68f1b4ea0063e752ed5ea29f54
- SHA256 a089cd83613fa42a2029d45b52a6ced1298d68c046c251be5f22d70aba316df7
- MD5 40d4c464c8a9dc8115692ed8349b0689
- SHA1 e8a5198d46c645911d8e13681dce2acb972d5a06
- SHA512 c8fea9adf80780c05739ddcd4f36f5707b257af91667d24bdde2b41fff4ebb1058a23695b699869c69d219bf4e8097ee627a68da42ef6e4d4b16f62e927db430
- SSDEEP 768:vYlvGUlUVyjO40bMnJwvc8GRG0qKtDj/VY:glvGU+QO5bQJwvc8GBt3/VY
- TLSH T14CE23B01AB5484BAE6FF163CA93F152A96BD74B01FD152DF5E3283CE18703D1BA3521A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
23056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CIWmi.pdb
msvcrt
_amsg_exit
_lock
_unlock
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
__dllonexit
??0exception@@QAE@ABV0@@Z
_onexit
??1type_info@@UAE@XZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
_purecall
??3@YAXPAX@Z
_initterm
_wcsicmp
wcscat_s
_except_handler4_common
__CxxFrameHandler3
malloc
memcmp
free
swprintf_s
??1exception@@UAE@XZ
memset
api-ms-win-core-file-l1-1-0
DeleteFileW
GetFileSize
CreateFileW
WriteFile
ReadFile
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
api-ms-win-core-com-l1-1-0
CoRevertToSelf
CoImpersonateClient
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
AccessCheck
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
ntdll
RtlNtStatusToDosError
NtSetSystemInformation
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=71, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/COLORCNV.DLL
- IMPHASH 28f6be1197cbc8a1503bd8156d5f902d
- SHA256 7cc8227834d99416271fbf5a51549a6f700ce498bb3881ea8d6b5cb1b33f52fe
- MD5 8bdf9b350983a50c8e40832dfd13cc04
- SHA1 2b22519d5783c5444ee7520328631d49c1e36880
- SHA512 5900f23153e52c89e2e88ce3a462d10f508f8348b88df55c9f43656cfdde1644d91db55ee503645be8d0da5bb262d196f27210452319caecf4d11878f00123d5
- SSDEEP 3072:uYKUJ/UcMWojA44ZNNk3jsP4oKrZ42wBp77bS2RLpuk5dLKUlLmxlWO34n/gc:sUJ/RyA44Z+sI42wB4umxlWBnN
- TLSH T13304BFA08D108071C8D72A3015AEA7E5797CB39B17C0D7EB0DC46DB9F152BD0AAB179B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:ff:68:f2:b1:cf:a3:d9:19:5b:7d:cd:1f:83:24:31:f1:dc:13:16:90:03:1e:3d:f2:44:bb:7f:10:f4:5d:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
27984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
COLORCNV.pdb
msvcrt
memcpy
_except_handler4_common
_purecall
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_vsnwprintf
_onexit
_ftol2
_ftol2_sse
memcmp
memset
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
SetEvent
CreateSemaphoreExW
DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateEventW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
GetProcAddress
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteTreeW
RegSetValueExA
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetExitCodeThread
GetCurrentProcess
GetCurrentThread
CreateThread
SetThreadPriority
GetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
msdmo
MoInitMediaType
MoCopyMediaType
DMORegister
DMOUnregister
MoFreeMediaType
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processtopology-obsolete-l1-1-0
GetProcessAffinityMask
SetThreadAffinityMask
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=260, version=27412,
count=3, id=259, version=27412,
count=92, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=3, id=261, version=27412,
count=1, id=256, version=27412,
count=17, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/C_G18030.DLL
- IMPHASH 1fe4e61b6273626f610faa1737fa9d90
- SHA256 b15fda61ebb167f6a34896d575c8a5555e27c34b138f76ed2a04e5b916d19724
- MD5 fcfba39d39ab76704804adb030d7f952
- SHA1 f8cacec13e4cf7fb12399b366fa3c59410c1cb33
- SHA512 9c535ef59c369ca2fb505d2215dc3477f79ea17a94d6cc88187320745c8c2a829724d74ce8ac0d8b2d788a8dacc4297eff80fb0c42291abf15117f4886f148bf
- SSDEEP 3072:k/pc3bkvwHtebrTIHvPnHCYJM/pc8usvCrwqjuMo/+ncOihHwBdYa1:cIXe7y/cDpqjuH/cPikdYa
- TLSH T1E4243A52E6619A01E7FFC43AE9793F2A994B3C06B212901EFF55B3C1D4BEB701881527
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
220496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c_g18030.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-localization-l1-2-0
IsValidCodePage
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
NlsDllCodePageTranslation
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1109, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=2, id=265, version=27412,
count=14, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/C_IS2022.DLL
- IMPHASH cc74b36529b20d6626a76fa12d592a64
- SHA256 598990a0d12916d5814c9ed1a607dfc15342723685707e2bf363cfe80890323e
- MD5 d8c5ec1cfc2bea1cac81f9273df5dd5d
- SHA1 acd8a505e0de869677371be689000a4fa7b9e894
- SHA512 8250a612261a091abefac0ee84f3c52fd9142c15daa66a5e1f2297569b438ce10591dcfb6708ce42243327a0272a22eca083ca0f8fb0767018dad812b3ef88ed
- SSDEEP 192:neFJh+PuYFsDD0QPMtMvn1Z7aQLfevq/SNtIwJFjO9KYuGS4EGcbaXWPtW:ntO0Ly1sQyvMqIwJFjpGSVbKWPtW
- TLSH T1FE522B01FF80CADBF67A267834F29A2AD518BD018F3241CFDB6116292636591E831B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c_is2022.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcpy
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlFreeHeap
RtlAllocateHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
IsValidCodePage
IsDBCSLeadByteEx
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
NlsDllCodePageTranslation
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1113, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=1, id=264, version=27412,
count=14, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/C_ISCII.DLL
- IMPHASH 5c4832f01a7d0735b4ac5d233a88acb0
- SHA256 ef255bb9aef61f26182274d7228ad1c863bd5dd8845e5d47d86bcfbb1d2bbbe9
- MD5 2ec54acab6a8da2210d0c5316dc49d4f
- SHA1 430574103403d380d441af551a3f42c7772289c6
- SHA512 2d149caf1ce0993a0c481a36aca68b9dddb7074c95416842be6ebc5c97a60ce93163261ab7f92db4221ead5289224ae42f8a6843f53d43874babadb817f8ef29
- SSDEEP 192:BR+84ffD7Mcn+3K0d4kzmb/+ic0hNfYH9WykWU:BR+LEa09zmZc0vfYH9WykW
- TLSH T15C421851B793F311EFF6B73E119E2622BA387E14CE31869799441619389A8781C30F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c_iscii.pdb
ntdll
RtlFreeHeap
RtlAllocateHeap
memcpy
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
NlsDllCodePageTranslation
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
678B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27412,
count=15, id=1, productName=Unmarked objects,
count=6, id=260, version=27412,
count=1, id=256, version=27412,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CallButtons.ProxyStub.dll
- IMPHASH 34c413f23d4e725e06883982800ac889
- SHA256 6340ccae7945aeeb1d0bf2ffbc7de952dafc8ea747b788038d7bdd416a4d00df
- MD5 82beafa25997ee259dd5e7236e8c3811
- SHA1 321bdfeef0b194ec15dc4a75566f5b72ef7d9fcd
- SHA512 fa6e1e90b52d7836e4979999d7a1bf664f9df2922d9e95dc5035b004ac14dd75f55c2ec9e325aac37aeae635332387a9f5c17c25567c92941c3c4abb659b0065
- SSDEEP 384:EIF/B6KLDnO+1W+5Tgu/grTlZeW15WRb:EIF/cEbPPItZ1I
- TLSH T1FA825C01BF163E36E5BE693F00661F36C225AB112FD281C76E016B865C601E1BF7A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CallButtons.ProxyStub.pdb
msvcrt
_except_handler4_common
_initterm
malloc
_XcptFilter
_amsg_exit
free
memcmp
rpcrt4
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrStubForwardingFunction
IUnknown_QueryInterface_Proxy
NdrStubCall2
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree
api-ms-win-core-com-midlproxystub-l1-1-0
CStdStubBuffer2_CountRefs
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient11
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient21
ObjectStublessClient10
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient16
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=73, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CallButtons.dll
- IMPHASH d39a47253a778304690695fdb3464836
- SHA256 17a73f38af371abd52614ea7dfab53ba0adf750a4873803387a282a693b29f6e
- MD5 b65e36040b5c9715c35423c4c8bc177e
- SHA1 5491a3f9cb3d485d114b96bb26edca927d6c8e54
- SHA512 bbd2781d63fb9ae8121f0a57988d8a4e6e2771456372648b6a9022d73ab8c138e06f5f58374c6933c00671d30f716a631690626a9ebc4918e3e160fd248d4010
- SSDEEP 1536:Ngyz6By0aTyJE4t9EcakF9JjO1mbx5lPVaRSJOZJqrU0vG8ZxKn:uJxDakpO1mbTjaRSJA0NlzKn
- TLSH T1A6632A41BA885479E1F7367C259ED135826FA8300BF107E70758829A3F1A8D1AF357FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
54240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CallButtons.pdb
msvcrt
_unlock
_initterm
memcmp
_purecall
__dllonexit
??1type_info@@UAE@XZ
_lock
_onexit
malloc
_amsg_exit
_XcptFilter
free
memmove_s
atol
_vsnwprintf
memcpy_s
_callnewh
_errno
realloc
__CxxFrameHandler3
_except_handler4_common
memset
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
SetEvent
CreateEventW
CreateMutexExW
AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsConcatString
WindowsDuplicateString
WindowsCreateStringReference
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsCreateString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
ntdll
RtlPublishWnfStateData
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
rpcrt4
RpcStringBindingComposeW
NdrClientCall4
RpcBindingFromStringBindingW
RpcBindingFree
RpcStringFreeW
api-ms-win-core-file-l1-1-0
WriteFile
ReadFile
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW
hid
HidP_GetUsages
HidP_GetLinkCollectionNodes
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidP_GetUsageValueArray
HidP_SetUsageValueArray
HidP_GetValueCaps
HidP_SetUsages
HidP_UnsetUsages
HidP_SetUsageValue
HidP_GetButtonCaps
HidP_GetUsageValue
HidP_MaxUsageListLength
HidP_GetSpecificValueCaps
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=15, id=260, version=27412,
count=142, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=13, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CallHistoryClient.dll
- IMPHASH d7ddaca2dd8c383a0aec015ff7fe4823
- SHA256 5e6a98f1940a3de7ff769d9d3206c4656a749f22b3277bbbec91f275fb974b8b
- MD5 c44692121b1f06f14539d6af83dee719
- SHA1 31d3c81e461fa6071ae2b33db42ad8fbbaaa0e3d
- SHA512 7d03d810845fff55620bac5d75caf0423f7e5eb177dbc225229c55c571139bf31d39094428b2cd6d6549f1d50eeab6d4beef909ccfd90c2626c8cda991a1524a
- SSDEEP 3072:Ay8qQIiDi9gsw8tkiAqa+g8XpSQaoGqY+KgmEiti+KXpKx2ZjBUCa:A1h+gsAqE8XpSQaoGqY+KgmEi85nZjza
- TLSH T107E33A036E84B8B4DAA33335665F7331A2ADD264CB8541C75308DABE7C164D26F362E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
37168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CallHistoryClient.pdb
msvcrt
_unlock
_lock
_except_handler4_common
_initterm
__dllonexit
_onexit
__CxxFrameHandler3
_purecall
memcpy
memcmp
_vsnwprintf
wcstoul
_XcptFilter
_amsg_exit
memmove
_callnewh
malloc
free
_wcsicmp
memset
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
CoCreateInstance
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSection
ReleaseSRWLockShared
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
rpcrt4
RpcExceptionFilter
RpcAsyncCompleteCall
RpcBindingCreateW
RpcBindingBind
RpcAsyncCancelCall
NdrAsyncClientCall2
RpcAsyncInitializeHandle
NdrClientCall4
RpcBindingFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
CloseThreadpool
CreateThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
userdataplatformhelperutil
GetUserTokenFromContext
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser
userdatatypehelperutil
FormatPoomIdToString
ParsePoomIdFromString
DupString
phoneutil
ComparePhoneNumbers
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DoesCallHistoryItemMatchFilter
StringToUdmObjectId
UdmAreCallEventsEqual
UdmCancelAsyncTask
UdmCreateDataSession
UdmCreateDataSessionForUser
UdmCreateSyncCallbackHandler
UdmDebugModifyNotifyState
UdmFreeCallFavoriteItemSet
UdmFreeCallHistoryItemSet
UdmObjectIdToString
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=15, id=260, version=27412,
count=139, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=17, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CameraCaptureUI.dll
- IMPHASH 856a3e9cf25f8d17aa8a628be396fc69
- SHA256 8f3c5e5b69ba098a9bb18b91c92a55ec415dd8fc1945e4a8434307a45dfc55b7
- MD5 358dd15497e28e4cbdb5dd31bbc4440c
- SHA1 09e9ca217a9c2f6a15079ea5367667c6dde9953d
- SHA512 6df98a337b0bd80674983e705f23eadc7b475d70e617834d68338a38195fb368d17f1d6bf2f3da100cb3f93ab0c38e52e4ffd95d23a016a315874e01c99839fd
- SSDEEP 1536:HaDZi5T31MA0B1hvPVGC0/ptdQ7VMmFXhCy1zHedzdbhY355dZIX+5AH:4ggGR/XdQ7VMmFXhCSYzdbhg5XCX+0
- TLSH T1279308226AA415B4E6F3317C296D2235B29FA6208BF157C30F14A1D75C747E1AD383AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
79584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CameraCaptureUI.pdb
msvcrt
_purecall
__dllonexit
_unlock
_onexit
__CxxFrameHandler3
_except_handler4_common
memcmp
_initterm
_vsnwprintf
memcpy_s
_callnewh
malloc
_amsg_exit
_XcptFilter
free
_lock
_ftol2_sse
memset
rpcrt4
NdrOleAllocate
NdrOleFree
IUnknown_Release_Proxy
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
NdrStubCall2
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_AddRef
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
CreateMutexExW
CreateEventExW
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
SetEvent
WaitForSingleObject
ReleaseMutex
InitializeSRWLock
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-com-midlproxystub-l1-1-0
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
NdrProxyForwardingFunction3
ObjectStublessClient15
CStdStubBuffer2_QueryInterface
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient12
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=16, id=260, version=27412,
count=150, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=9, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CapabilityAccessManagerClient.dll
- IMPHASH df392a5afd8ee30119fde715830ee97b
- SHA256 a57dda6f6200e14c7933d44f39174a77cf66857a8a919a556e3b54ca10355119
- MD5 fcc20015ef9a10d11a0d4ea81be7fefc
- SHA1 6f3eb11919b49cb25eb9e40bbaa867a216f5d4cb
- SHA512 4721299740011c46e3d22c02fe7f620f27b47bcff7e0a1aeb1406e414128e6cd82ea74107cc1361c85d1be584e9400e0ac03ed533dae8d9eb3d7a1394402e5af
- SSDEEP 3072:DxzUp3axsIUVlN+6oFTAll3aQ++5la0/NS6abVKNqmgJ3HdXfWBCnrJdqko73fXb:Dx2mmll3/+wla0c6abVsgJtXzikoLX0w
- TLSH T1A9F35B216B984030D7BF3A7D596F62B090ACD4512FD5C2C71A08E7FA6C399C28E35A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
135248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CapabilityAccessManagerClient.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_malloc
_o_terminate
_o_towlower
_except_handler4_common
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__cexit
_o__callnewh
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
InitOnceExecuteOnce
WaitOnAddress
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
InitializeSRWLock
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
GetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CoReleaseMarshalData
CreateStreamOnHGlobal
CLSIDFromString
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlInitUnicodeString
RtlCapabilityCheck
RtlUnsubscribeWnfNotificationWaitForCompletion
rpcrt4
IUnknown_Release_Proxy
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
CStdStubBuffer_Disconnect
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient13
ObjectStublessClient15
CStdStubBuffer2_QueryInterface
ObjectStublessClient14
ObjectStublessClient3
ObjectStublessClient18
CStdStubBuffer2_Connect
ObjectStublessClient12
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient16
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_Disconnect
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=14, id=260, version=27412,
count=1352, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=31, id=265, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CastingShellExt.dll
- IMPHASH cb00e9ca731a8833c8a79f502a0a1d54
- SHA256 e435514a384d6eeec0823d695df011f25ea3d0d9564a25fe8983c423a69272f1
- MD5 4bd998397dc8be18ed5f68d6ed16388b
- SHA1 35385128771c5d7c744ffbb1f7fb25242d8b6e3e
- SHA512 04d80f3015d815092ea05d6028861d3fd988012548d2dbb3c4e202952b56eeda0c810a695d8a9be6cc54d66c9f01ef20f4faaeb7ce5ec7e6b1d1f3f8c0126ee7
- SSDEEP 1536:OK8FCOkUmN+VbzgPm46XdDKagwDrGhaD7qt/yEwVBlfqRY7II3X:O3/kcVbzgPm46Xdmagw5D7y/DmlfkY7
- TLSH T12583C002A7040DF5C97D6131982B4EB2193CBC3443E25BDB1EA5F96FA8B03D12EB55B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CastingShellExt.pdb
msvcrt
_purecall
_except_handler4_common
__CxxFrameHandler3
_initterm
malloc
_callnewh
_amsg_exit
_XcptFilter
free
memset
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
shell32
SHCreateDefaultExtractIcon
ord256
SHCreateDefaultContextMenu
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateViewObjectForContentDirectoryFolder
CreateViewObjectForMediaServerFolder
DllMain
GetContextMenuForContentDirectoryFolder
GetContextMenuForMediaServerFolder
GetExtractIconForContentDirectoryFolder
GetExtractIconForMediaServerFolder
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=42, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=4, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CertEnroll.dll
- IMPHASH 40daf93cdbc96d11af8563a1236daec8
- SHA256 3f982c526ec61b6eecd3281677b2bb6c66244a0763ffcb5cec56652d31985a79
- MD5 8e2dd2cedca11018fff08e61e005b17b
- SHA1 f0070cca4943d835eb86cb61d9802ddc7a641874
- SHA512 f2b61a7ed049d6fb4f7267cffccfeec6ca61e35e48f9a457207e6d1d1fe4b6a4601510289bd2e458f79cc67cb5958c51875d0e216dc418ef050be74eaf25e1ac
- SSDEEP 49152:e0OVLAEEiBfjEBWnE3O8Pr4QM7GrtL6qrIs2d6Rv:e/QWE+8e7GrQ
- TLSH T11BD519327BD88735E5BB7672192AB17D42BEF8521B10C9DF2214D3BD1970AC24A3436B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
516368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CertEnroll.pdb
msvcrt
_itow
_wcsnicmp
rand
_stricmp
wcschr
memmove_s
wcsstr
qsort
wcsrchr
??3@YAXPAX@Z
calloc
__isascii
srand
ispunct
_callnewh
_CxxThrowException
_ftol2_sse
_CIpow
__iob_func
memcpy
memmove
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_vsnprintf_s
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
??1exception@@UAE@XZ
_wtoi
iswdigit
_wcsicmp
_purecall
wcscat_s
_errno
realloc
??1type_info@@UAE@XZ
memcmp
wcscpy_s
malloc
wcsncpy_s
_vsnwprintf
free
memcpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
??0exception@@QAE@ABV0@@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strcspn
fprintf
wcscspn
fflush
fclose
fopen
_wgetenv
fseek
ftell
fwrite
iswalpha
strchr
getenv
_vsnprintf
iswxdigit
iswspace
wcsncmp
isdigit
atoi
strncmp
fputws
ferror
_wfopen_s
fwprintf
vfwprintf
towlower
iswupper
iswlower
towupper
_strnicmp
wcsnlen
_wcserror
bsearch
memset
certca
ord445
ord843
ord820
ord416
ord823
ord413
ord842
ord446
ord467
ord846
ord414
ord813
ord420
ord844
ord838
ord824
ord457
ord455
ord801
ord707
ord602
ord809
ord601
ord430
ord869
ord412
ord703
ord442
ord434
ord847
ord485
ord487
ord404
ord405
ord486
ord819
ord479
ord440
ord435
ord436
ord454
ord449
ord462
ord452
ord453
ord845
ord808
ord802
ord704
ord444
ord450
ord840
ord705
ord438
ord458
ord456
ord468
ord841
ord839
ord460
api-ms-win-core-synch-l1-1-0
CreateEventW
SetEvent
AcquireSRWLockShared
InitializeCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventExW
EnterCriticalSection
ReleaseSemaphore
CreateMutexExW
LeaveCriticalSection
ReleaseMutex
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleFileNameW
DisableThreadLibraryCalls
FindResourceExW
GetModuleFileNameA
LockResource
LoadResource
SizeofResource
GetModuleHandleW
LoadLibraryExW
GetProcAddress
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteValueW
RegGetValueW
RegCloseKey
RegQueryValueExW
RegDeleteKeyExW
RegUnLoadKeyW
RegOpenKeyExW
RegLoadKeyW
RegOpenCurrentUser
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-l2-1-0
CharLowerW
CharNextW
api-ms-win-core-string-l1-1-0
FoldStringW
WideCharToMultiByte
CompareStringEx
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetLocalTime
GetComputerNameExW
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
crypt32
CertFindCertificateInStore
CertEnumCertificateContextProperties
CryptHashPublicKeyInfo
CryptMsgOpenToEncode
CryptMsgUpdate
CryptMsgGetParam
CryptMsgControl
CertGetSubjectCertificateFromStore
PFXImportCertStore
CertSerializeCertificateStoreElement
CertCreateCRLContext
CertFreeCRLContext
CertGetPublicKeyLength
CryptVerifyCertificateSignatureEx
CryptRegisterOIDInfo
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CertSetCertificateContextProperty
CryptEnumOIDInfo
CertDuplicateStore
CryptAcquireCertificatePrivateKey
PFXExportCertStoreEx
CertAddEncodedCertificateToStore
CertAddCertificateLinkToStore
CryptMsgGetAndVerifySigner
CertFindAttribute
CryptVerifyMessageSignature
CryptMsgCalculateEncodedLength
CryptMsgDuplicate
CryptMemFree
CryptVerifyTimeStampSignature
CryptUnprotectMemory
CryptProtectMemory
CertAddSerializedElementToStore
CertFreeCertificateChainList
CertSelectCertificateChains
CryptImportPublicKeyInfoEx2
CryptProtectData
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertComparePublicKeyInfo
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertRegisterPhysicalStore
CertFindCTLInStore
CertDuplicateCertificateContext
CryptHashCertificate
CertDeleteCertificateFromStore
CertControlStore
CertVerifySubjectCertificateContext
CryptBinaryToStringW
CryptExportPKCS8
CryptImportPublicKeyInfo
CertGetIntendedKeyUsage
CertStrToNameW
PFXIsPFXBlob
CryptDecryptMessage
CryptSignMessage
CryptFormatObject
CryptStringToBinaryW
CryptQueryObject
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptMsgOpenToDecode
CertGetCRLContextProperty
CryptSignCertificate
CryptExportPublicKeyInfoEx
CryptEncodeObjectEx
CertGetIssuerCertificateFromStore
CertNameToStrW
CryptMsgClose
CertFindExtension
CertGetEnhancedKeyUsage
CertCreateCertificateContext
CertGetNameStringW
CryptDecodeObjectEx
CryptEncryptMessage
CryptFindOIDInfo
CertCloseStore
CryptVerifyCertificateSignature
CertSaveStore
CryptHashCertificate2
api-ms-win-core-localization-l1-2-0
GetACP
IdnToUnicode
GetLocaleInfoW
FormatMessageW
IdnToAscii
api-ms-win-core-processthreads-l1-1-0
GetProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetTempFileNameW
CreateFileW
LocalFileTimeToFileTime
GetFileTime
CreateDirectoryW
FileTimeToLocalFileTime
FindFirstFileW
CompareFileTime
GetFileType
SetFilePointer
WriteFile
FindNextFileW
GetFileSize
SetEndOfFile
FindClose
DeleteFileW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetStdHandle
SearchPathW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorControl
GetTokenInformation
EqualSid
CreateWellKnownSid
ImpersonateLoggedOnUser
RevertToSelf
IsValidSecurityDescriptor
GetLengthSid
GetSecurityDescriptorLength
FreeSid
DuplicateTokenEx
AllocateAndInitializeSid
CopySid
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
dsparse
DsGetRdnW
rpcrt4
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrOleFree
CStdStubBuffer_Connect
UuidCreate
UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidIsNil
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrClientCall4
RpcBindingFree
RpcEpResolveBinding
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrOleAllocate
RpcExceptionFilter
RpcBindingSetAuthInfoExW
CStdStubBuffer_CountRefs
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient6
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient17
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient3
ObjectStublessClient22
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient21
ObjectStublessClient12
ObjectStublessClient9
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetTimeFormatA
GetDateFormatA
GetDateFormatW
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetProcessImageFileNameW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-url-l1-1-0
UrlGetPartW
api-ms-win-security-activedirectoryclient-l1-1-0
DsUnBindW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-security-logon-l1-1-0
LogonUserExW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
ntdll
RtlCapabilityCheck
RtlCheckTokenMembershipEx
RtlCheckTokenMembership
RtlSubAuthoritySid
RtlInitializeSid
RtlGetPersistedStateLocation
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlEqualSid
NtQueryInformationToken
RtlCheckTokenCapability
WinSqmSetString
RtlInitUnicodeString
NtQuerySystemInformationEx
RtlNtStatusToDosError
EtwTraceMessage
EtwEventWriteFull
EtwEventUnregister
EtwEventRegister
WinSqmIncrementDWORD
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
CreateLogonCertificateRequest
DeleteLogonCertificateRequest
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
ImportPFXToProvider
ImportPFXToProviderFreeData
InstallLogonCertificateResponse
IsLogonCertificateTemplateAvailable
LogCertArchive
LogCertCopy
LogCertDelete
LogCertExpire
LogCertExport
LogCertImport
LogCertInstall
LogCertReplace
UpdateMachinePolicyConfigurationForTemplate
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=110, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=32, id=260, version=27412,
count=904, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=15, id=261, version=27412,
count=1, id=256, version=27412,
count=176, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CertEnrollUI.dll
- IMPHASH b17f5e2bdf85c692e2941b91121da546
- SHA256 af5563a6cd0b52992897adef21eed6a16a70f2ff71338f41a686af7af7c71ea5
- MD5 7f207f793592b820c3ed9db77a045453
- SHA1 fb188c4117e97596ff2d0ad15f37bfd39c514bc1
- SHA512 439a7941afbde15cb95231e08ab769bf2cbeda319bca989c2ee09c544c39f6815120c008afbaedb3f22f68d666a6d3f8166b2ed62d0e2f6c37ee680917afad18
- SSDEEP 6144:GfJPo1DsodggCrdxgSWSRFh+hFIKLMTWpGCo1:iJA1D9KgCBxgSWSRFh+hiKLnJ+
- TLSH T116543B0077D9D822F06B7370B6D7AB14D779E9B087BA818F360471931A729C67E7423A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
153680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CertEnrollUI.pdb
msvcrt
??_V@YAXPAX@Z
vfwprintf
_ftol2
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
wcstok
_wcsnicmp
_vsnwprintf
iswspace
_wtoi
_itow
free
realloc
_purecall
??3@YAXPAX@Z
__iob_func
strncmp
fputws
fflush
ferror
_wfopen_s
fwprintf
fclose
iswxdigit
iswdigit
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcschr
memset
certca
ord839
ord820
ord705
ord602
ord703
ord841
ord842
ord707
ord840
ord823
certenroll
ord31
shlwapi
StrChrW
oleaut32
SysAllocString
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
LoadLibraryExA
GetModuleFileNameW
DisableThreadLibraryCalls
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
StringFromGUID2
crypt32
CertNameToStrW
CryptEnumOIDInfo
CertFreeCertificateChain
CryptBinaryToStringA
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptDecodeObjectEx
CertGetCRLContextProperty
CryptFormatObject
CryptFindOIDInfo
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCompareCertificate
CertGetEnhancedKeyUsage
CertFindExtension
CryptDecodeObject
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertGetNameStringW
api-ms-win-core-string-l2-1-0
CharUpperW
CharUpperBuffW
CharLowerW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
ws2_32
WSAGetLastError
WSAAddressToStringW
WSAStringToAddressW
freeaddrinfo
WSAStartup
WSACleanup
getaddrinfo
gethostname
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileType
WriteFile
CompareFileTime
FileTimeToLocalFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
GetAclInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
MakeSelfRelativeSD
GetLengthSid
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
MakeAbsoluteSD
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventW
ResetEvent
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObject
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsA
GetEnvironmentVariableW
GetStdHandle
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-console-l1-1-0
WriteConsoleW
advapi32
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDuplicateHash
CryptGetHashParam
kernel32
GlobalLock
lstrcmpA
lstrlenA
lstrcmpW
lstrlenW
ReleaseActCtx
DeactivateActCtx
ActivateActCtx
GlobalUnlock
lstrcmpiW
CreateActCtxW
user32
GetAncestor
SetFocus
DestroyWindow
GetWindowLongW
GetKeyState
DefWindowProcW
PostMessageW
SetWindowLongW
IsChild
MessageBoxW
LoadCursorW
SetCursor
NotifyWinEvent
RegisterClipboardFormatW
GetClientRect
GetActiveWindow
GetDlgCtrlID
SetWindowPos
LoadImageW
GetDlgItem
SendMessageW
GetNextDlgTabItem
GetFocus
GetParent
CallWindowProcW
aclui
ord2
comctl32
ord410
ord412
DestroyPropertySheetPage
CreatePropertySheetPageW
ord413
ord345
PropertySheetW
comdlg32
GetSaveFileNameW
cryptui
CryptUIDlgAddPolicyServer
CryptUIDlgSelectCertificateW
CryptUIDlgViewCertificateW
CryptUIDlgPropertyPolicy
uxtheme
EnableThemeDialogTexture
winscard
SCardGetStatusChangeW
SCardAccessStartedEvent
SCardFreeMemory
SCardReleaseStartedEvent
SCardListReadersW
SCardEstablishContext
dui70
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?OnEvent@Expando@DirectUI@@UAEXPAUEvent@2@@Z
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?Add@Element@DirectUI@@QAEJPAV12@@Z
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Release@Value@DirectUI@@QAEXXZ
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Add@Expando@DirectUI@@UAEJPAPAVElement@2@I@Z
?GetClassInfoW@Expando@DirectUI@@UAEPAUIClassInfo@2@XZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?OnReceivedDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnPropertyChanged@Expando@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
??1Expando@DirectUI@@UAE@XZ
??0Expando@DirectUI@@QAE@XZ
?DirtyProp@Edit@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetDirty@Edit@DirectUI@@QAEJ_N@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?GetSelection@Selector@DirectUI@@QAEPAVElement@2@XZ
?OnLostDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?GetHeight@Element@DirectUI@@QAEHXZ
?Enter@Edit@DirectUI@@SG?AVUID@@XZ
?SelectionChange@Selector@DirectUI@@SG?AVUID@@XZ
?SetSelection@Combobox@DirectUI@@QAEJH@Z
?AddString@Combobox@DirectUI@@QAEHPBG@Z
?GetSelection@Combobox@DirectUI@@QAEHXZ
?ExpandedProp@Expandable@DirectUI@@SGPBUPropertyInfo@2@XZ
?DestroyAll@Element@DirectUI@@QAEJ_N@Z
?SelectionChange@Combobox@DirectUI@@SG?AVUID@@XZ
ElementFromGadget
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
??0HWNDElement@DirectUI@@QAE@XZ
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
??1HWNDElement@DirectUI@@UAE@XZ
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
EnableAnimations
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Button@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?Hosted@PushButton@DirectUI@@SG?AVUID@@XZ
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?FindShortcut@HWNDElement@DirectUI@@SG_NGPAVElement@2@PAPAV32@PAH2H@Z
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??1CritSecLock@DirectUI@@QAE@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?Register@Button@DirectUI@@SGJXZ
?SetAccRole@Element@DirectUI@@QAEJH@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?AccRoleProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?EnabledProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetAccState@Element@DirectUI@@QAEJH@Z
?GetAccState@Element@DirectUI@@QAEHXZ
?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?SelectedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?KeyboardNavigate@Element@DirectUI@@SG?AVUID@@XZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
??1Button@DirectUI@@UAE@XZ
??0Button@DirectUI@@QAE@XZ
DisableAnimations
?Initialize@Expando@DirectUI@@QAEJPAVElement@2@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QAEJ_N@Z
?GetClassInfoPtr@PushButton@DirectUI@@SGPAUIClassInfo@2@XZ
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?CreateStyleParser@HWNDElement@DirectUI@@UAEJPAPAVDUIXmlParser@2@@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?Create@Element@DirectUI@@SGJIPAV12@PAKPAPAV12@@Z
?SetForegroundStdColor@Element@DirectUI@@QAEJH@Z
?SetAnimation@Element@DirectUI@@QAEJH@Z
?SetDirection@Element@DirectUI@@QAEJH@Z
??0TaskPage@DirectUI@@QAE@XZ
??1TaskPage@DirectUI@@UAE@XZ
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?PropSheet_SendMessage@TaskPage@DirectUI@@IAEJIIJ@Z
InitProcessPriv
InitThread
?Register@PushButton@DirectUI@@SGJXZ
UnInitThread
UnInitProcessPriv
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QAEJPAUHINSTANCE__@@@Z
?OnListenerAttach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
?OnListenerDetach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedInput@TaskPage@DirectUI@@MAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedEvent@TaskPage@DirectUI@@MAEXPAVElement@2@PAUEvent@2@@Z
?LoadParser@TaskPage@DirectUI@@MAEJPAPAVDUIXmlParser@2@@Z
?DestroyCP@TaskPage@DirectUI@@EAEXXZ
?InitPropSheetPage@TaskPage@DirectUI@@MAEXPAU_PROPSHEETPAGEW@@@Z
?OnKillActive@TaskPage@DirectUI@@MAEJXZ
?OnReset@TaskPage@DirectUI@@MAEJXZ
?OnSetActive@TaskPage@DirectUI@@MAEJXZ
?OnWizBack@TaskPage@DirectUI@@MAEJXZ
?CreateDUICP@TaskPage@DirectUI@@EAEJPAVHWNDElement@2@PAUHWND__@@1PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?CreateParserCP@TaskPage@DirectUI@@EAEJPAPAVDUIXmlParser@2@@Z
?GetClassInfoW@Element@DirectUI@@UAEPAUIClassInfo@2@XZ
duser
SetGadgetStyle
GetGadgetFocus
CreateUIObject
Name
.text
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=80, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=260, version=27412,
count=5, id=259, version=27412,
count=754, id=1, productName=Unmarked objects,
count=37, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=71, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CertPKICmdlet.dll
- IMPHASH 37e50faac4f9e77821eb90ede3f0005b
- SHA256 547a009ca4226dc07551162b83b9821fcfad9460ae5265f7d9db64c56b896116
- MD5 51e4ff853c582604085a2e1ece97977f
- SHA1 3163adcb0ed1a65cc782a202ce26875b19ac38eb
- SHA512 26b18870294ea9f0b99231a6d0b65991af87b2185d9cffd6749a4101ffac58780e7a58af913a8522355c504c05f1845651480047300fb4aa2c350579439bcd30
- SSDEEP 1536:BXt+minlZPDg90a4V1ZSZ15/YD6jOKvDjRJejqn48:B9+milND6UQCD6jOKvDjRJsO
- TLSH T1B6436D017780DAFCD7AE79301925A53B26BDE4318FD987C7A723079E39213E1673825A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
39488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CertPKICmdlet.pdb
msvcrt
malloc
ftell
fseek
free
_swab
iswxdigit
iswdigit
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
__iob_func
??0exception@@QAE@ABV0@@Z
getenv
_errno
??1exception@@UAE@XZ
strcspn
fopen
fclose
fflush
_CxxThrowException
fprintf
memcpy
memmove
_XcptFilter
_amsg_exit
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vsnprintf
_vsnwprintf
strchr
_purecall
fwrite
__CxxFrameHandler3
?what@exception@@UBEPBDXZ
_initterm
_wgetenv
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
??3@YAXPAX@Z
wcscspn
memset
crypt32
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
PFXIsPFXBlob
CertOpenStore
CryptBinaryToStringW
CertSetCertificateContextProperty
CryptStringToBinaryA
CertAddCertificateContextToStore
PFXExportCertStoreEx
CertDuplicateCertificateContext
PFXImportCertStore
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptFindCertificateKeyProvInfo
CertSaveStore
CertFreeCertificateContext
CryptQueryObject
CertDeleteCertificateFromStore
CertCloseStore
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetLocalTime
GetSystemTime
GetComputerNameExW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
SetFileAttributesW
WriteFile
CreateFileW
ReadFile
DeleteFileW
GetTempFileNameW
FileTimeToLocalFileTime
GetFullPathNameW
GetFileType
GetFileSize
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
GetCommandLineW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
LoadStringW
LoadLibraryExW
api-ms-win-core-com-l1-1-0
CoCreateInstance
oleaut32
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
sspicli
GetUserNameExW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-security-base-l1-1-0
IsValidSid
ncrypt
NCryptOpenStorageProvider
NCryptOpenKey
NCryptFreeObject
NCryptCreateProtectionDescriptor
NCryptCloseProtectionDescriptor
NCryptGetProperty
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-cryptoapi-l1-1-0
CryptGetUserKey
CryptDestroyKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
api-ms-win-core-misc-l1-1-0
lstrcmpiW
ntdll
NtQuerySystemInformationEx
WinSqmIncrementDWORD
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllMain
ExportCertificate
ExportPFXCertificate
FindCertificate
FreeCertResults
FreeResourceString
GetCertificateFromEnrollmentInternal
ImportCertificate
ImportPFXCertificate
IsSecureKernelRunning
IsSmartCard
LoadResourceString
SuppressFreeCert
SuppressFreeStore
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=2, id=259, version=27412,
count=181, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=18, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CertPolEng.dll
- IMPHASH 9ef0b1bea63afd38e937d1390728e9c8
- SHA256 4a63dc82108c59c3902ee5afb588d2096565cae682c117779e1e2620c06f3c03
- MD5 ad5f019257d17f7c525109ffe020814c
- SHA1 e2eb011d3d553498e046fb4bdc27fbe4a3e9703f
- SHA512 5f391c3a4509a2be4702054005f8ef487a0961d1257d88d64545590172604332aff5dd811ad35faca4c7a5786ea296fc5cd2b69e8a064be475087574b5a34c9e
- SSDEEP 3072:0+7WjWrOcAmZNVq/wAMLDCftqplBSfTFw4d1zVsTfZcvbyI9:0bWrOeNVq/wH+FKOqO1zVsTfZcvby
- TLSH T192D33A02B3944971E6F626BC392927351B7BB8304B71C9CB63215BAD6C70AE1DE78707
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
44752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CertPolEng.pdb
msvcrt
memmove_s
_stricmp
memcmp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
_wcsicmp
_except_handler4_common
iswdigit
__CxxFrameHandler3
wcschr
_wcsnicmp
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateEventW
LeaveCriticalSection
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingBind
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcBindingCreateW
RpcBindingFree
RpcStringBindingComposeW
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcAsyncInitializeHandle
I_RpcMapWin32Status
NdrClientCall4
NdrAsyncClientCall
UuidEqual
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
CheckTokenMembership
FreeSid
CreateWellKnownSid
AllocateAndInitializeSid
crypt32
CertAddStoreToCollection
CryptDecodeObject
CertOpenStore
CertFreeCertificateContext
CertCompareCertificateName
CertCreateCertificateChainEngine
CertControlStore
CertRDNValueToStrW
CryptFindOIDInfo
CertCloseStore
CertFindExtension
CertFreeCertificateChainEngine
CertGetCertificateContextProperty
CertFreeCertificateChain
CryptDecodeObjectEx
CryptBinaryToStringW
CertDuplicateCertificateChain
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
CertRegisterSystemStore
CryptHashCertificate2
CertGetCertificateChain
CertGetNameStringW
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChainList
CertSelectCertificateChains
CertFindCertificateInStore
CertCreateCertificateContext
ncrypt
NCryptFreeObject
api-ms-win-core-registry-l1-1-0
RegUnLoadKeyW
RegGetValueW
RegLoadKeyW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l2-1-0
CharUpperBuffW
bcrypt
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
cryptsp
CryptReleaseContext
ntdll
RtlLengthRequiredSid
EtwTraceMessage
EtwEventRegister
EtwEventSetInformation
EtwEventUnregister
RtlFreeUnicodeString
RtlEqualUnicodeString
RtlDowncaseUnicodeString
WinSqmAddToStream
WinSqmIsOptedIn
RtlInitUnicodeString
RtlAllocateHeap
RtlSubAuthoritySid
RtlEqualSid
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlDeleteResource
RtlInitializeResource
RtlGUIDFromString
RtlNtStatusToDosError
RtlFreeHeap
EtwEventWriteTransfer
RtlInitializeSid
RtlCreateUnicodeString
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
IntPstGetCertificate
IntPstGetNameIdentifierForCertificate
IntPstGetTrustAnchors
IntPstMapCertificateToProvider
IntPstMapUserCredsToProvider
IntPstValidate
PstAcquirePrivateKey
PstGetCertificateChain
PstGetCertificates
PstGetTrustAnchors
PstGetTrustAnchorsEx
PstGetUserNameForCertificate
PstMapCertificate
PstValidate
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=4, id=259, version=27412,
count=244, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=31, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Chakra.dll
- IMPHASH bafb2f3adf68bd3840e62512165d7c40
- SHA256 6bd6f745d343eba0eb66be482fc6629dd8f36a577e4392005b112dd4ebb7d1a9
- MD5 2eca7641fc5087b570f2646f4cb28ead
- SHA1 4b1121c28821fb4cfd8078efc756f4099008f048
- SHA512 376200283fd79c8e3ab925ffbf0dd77e1b9803b01e4077beb1f6b35406e0ec07dd965f9ff861a7d2080c0ea400e995033216df0ce5e3f8d4e38068ad0ed00313
- SSDEEP 98304:Dw7iHclyUwdFm8CrGpKjvzUt/bFZgWRQZs5RERYarl:Dci8gUeFmrrhjvzUt/bFZgoTur
- TLSH T18246AE23B1C24435D66F23B4C93637756EBDBD111B3A86EF475878282DB4AC127326A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
2638624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
chakra.pdb
msvcrt
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
memmove_s
qsort_s
_vsnwprintf_s
wcscat_s
realloc
??1exception@@UAE@XZ
wcscpy_s
_ultow_s
_ltow_s
_wcsdup
wprintf
wcsncpy_s
_i64tow_s
vswprintf_s
_wcstoui64
_ui64tow_s
wcsncmp
strnlen
wcstok_s
wcsstr
_control87
_statusfp
_clearfp
rand_s
fclose
fwprintf_s
fflush
_flushall
fwprintf
_itow_s
_wsplitpath_s
_wcsnicmp
wcsrchr
_wfsopen
_aligned_malloc
_beginthreadex
_tzset
_snwprintf_s
modf
ceil
floor
qsort
_vscwprintf
towupper
_wcslwr_s
isalpha
__CxxFrameHandler3
isdigit
__libm_sse2_pow
__iob_func
strncmp
wcsncat_s
wcstoul
tolower
memcpy_s
_vsnwprintf
_wcsicmp
_set_SSE2_enable
malloc
__libm_sse2_acos
__libm_sse2_asin
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_cos
__libm_sse2_exp
__libm_sse2_log
__libm_sse2_sin
__libm_sse2_tan
__libm_sse2_log10
wcschr
free
swprintf_s
memcpy
_XcptFilter
_amsg_exit
_purecall
_initterm
_except_handler4_common
memcmp
_setjmp3
_hypot
_ftol2_sse
_ftol2
_CxxThrowException
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
memmove
_aligned_free
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
memset
api-ms-win-core-atoms-l1-1-0
DeleteAtom
AddAtomW
FindAtomW
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
HeapUnlock
HeapCreate
HeapLock
GetProcessHeap
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
WaitForSingleObject
SetEvent
CreateSemaphoreExW
AcquireSRWLockShared
EnterCriticalSection
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateEventW
TryEnterCriticalSection
ResetEvent
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
api-ms-win-core-libraryloader-l1-1-0
SizeofResource
GetProcAddress
LockResource
GetModuleHandleW
FreeLibraryAndExitThread
LoadResource
LoadLibraryExW
FindResourceExW
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
GetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetProcessId
SetThreadStackGuarantee
TlsFree
TlsGetValue
SwitchToThread
TlsAlloc
ResumeThread
SuspendThread
TlsSetValue
GetCurrentProcessId
TerminateProcess
GetProcessTimes
SetThreadPriority
GetCurrentThread
GetCurrentProcess
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyExW
RegOpenKeyExW
RegGetValueW
RegSetValueExW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetLogicalProcessorInformation
GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTimeAdjustment
GetSystemTime
GlobalMemoryStatusEx
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
GetUserDefaultLCID
GetUserDefaultLocaleName
GetLocaleInfoEx
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualFree
VirtualAlloc
CreateFileMappingW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
VirtualQuery
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpICW
StrCmpLogicalW
StrTrimW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCW
PathFindFileNameW
PathRemoveFileSpecW
PathGetDriveNumberW
PathFileExistsW
PathIsLFNFileSpecW
PathIsFileSpecW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-console-l2-1-0
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
GetSystemTimePreciseAsFileTime
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
K32GetProcessMemoryInfo
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
QueryDepthSList
InterlockedPopEntrySList
InterlockedPushEntrySList
api-ms-win-core-memory-l1-1-1
GetWriteWatch
ResetWriteWatch
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-kernel32-legacy-l1-1-0
RaiseFailFastException
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
GetThreadContext
GetProcessMitigationPolicy
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformationForYear
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-processtopology-obsolete-l1-1-0
GetProcessIoCounters
api-ms-win-core-realtime-l1-1-0
QueryThreadCycleTime
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
rpcrt4
RpcExceptionFilter
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrServerCall2
I_RpcBindingInqLocalClientPID
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcBindingVectorFree
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIf3
RpcServerUseProtseqW
NdrClientCall2
NdrDllRegisterProxy
RpcBindingBind
RpcBindingCreateW
RpcBindingFree
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrOleFree
api-ms-win-core-memory-l1-1-5
MapViewOfFileNuma2
VirtualUnlockEx
UnmapViewOfFile2
api-ms-win-core-memory-l1-1-3
SetProcessValidCallTargets
api-ms-win-core-path-l1-1-0
PathCchCombine
PathCchAppend
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
icuuc
uloc_getBaseName
uloc_getName
uloc_toUnicodeLocaleType
uenum_next
uenum_count
uenum_close
u_charType
uloc_addLikelySubtags
u_hasBinaryProperty
unorm2_isNormalized
u_strlen
uloc_countAvailable
u_strToUpper
unorm2_normalize
unorm2_getInstance
uenum_unext
u_strToLower
uloc_forLanguageTag
uloc_toLanguageTag
uloc_getAvailable
icuin
udatpg_open
ucal_getCanonicalTimeZoneID
ucal_openTimeZoneIDEnumeration
ucol_close
udatpg_getBestPatternWithOptions
uplrules_openForType
uplrules_getKeywords
unum_close
ucal_setGregorianChange
unumsys_close
udat_getCalendar
ufieldpositer_close
udat_formatForFields
uplrules_close
ufieldpositer_next
ufieldpositer_open
unum_formatDoubleForFields
unum_formatDouble
unum_getAttribute
ucol_strcoll
ucol_setAttribute
ucol_setStrength
unum_setTextAttribute
unum_open
unum_setAttribute
unumsys_getName
unumsys_open
udatpg_close
ucal_getDefaultTimeZone
udat_close
udat_open
uplrules_select
ucal_getKeywordValuesForLocale
ucol_getAttribute
ucol_open
ucol_getKeywordValuesForLocale
udat_countAvailable
udat_getAvailable
unum_countAvailable
unum_getAvailable
ucol_countAvailable
ucol_getAvailable
ulocdata_getCLDRVersion
udat_format
unum_parseDouble
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-l1-1-0
CompareStringEx
MultiByteToWideChar
api-ms-win-core-string-l2-1-0
CharUpperBuffW
CharLowerBuffW
CharLowerW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-localization-l2-1-0
GetNumberFormatEx
bcrypt
BCryptGenRandom
CreateChakraEngine
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DumpDiagInfo
JsAddRef
JsBoolToBoolean
JsBooleanToBool
JsCallFunction
JsCollectGarbage
JsConstructObject
JsConvertValueToBoolean
JsConvertValueToNumber
JsConvertValueToObject
JsConvertValueToString
JsCreateArray
JsCreateArrayBuffer
JsCreateContext
JsCreateDataView
JsCreateError
JsCreateExternalArrayBuffer
JsCreateExternalObject
JsCreateFunction
JsCreateNamedFunction
JsCreateObject
JsCreateRangeError
JsCreateReferenceError
JsCreateRuntime
JsCreateSymbol
JsCreateSyntaxError
JsCreateThreadService
JsCreateTypeError
JsCreateTypedArray
JsCreateURIError
JsDefineProperty
JsDeleteIndexedProperty
JsDeleteProperty
JsDisableRuntimeExecution
JsDiscardBackgroundParse
JsDisposeRuntime
JsDoubleToNumber
JsEnableRuntimeExecution
JsEnumerateHeap
JsEquals
JsGetAndClearException
JsGetArrayBufferStorage
JsGetContextData
JsGetContextOfObject
JsGetCurrentContext
JsGetDataViewStorage
JsGetExtensionAllowed
JsGetExternalData
JsGetFalseValue
JsGetGlobalObject
JsGetIndexedPropertiesExternalData
JsGetIndexedProperty
JsGetNullValue
JsGetOwnPropertyDescriptor
JsGetOwnPropertyNames
JsGetOwnPropertySymbols
JsGetProperty
JsGetPropertyIdFromName
JsGetPropertyIdFromSymbol
JsGetPropertyIdType
JsGetPropertyNameFromId
JsGetPrototype
JsGetRuntime
JsGetRuntimeMemoryLimit
JsGetRuntimeMemoryUsage
JsGetStringLength
JsGetSymbolFromPropertyId
JsGetTrueValue
JsGetTypedArrayInfo
JsGetTypedArrayStorage
JsGetUndefinedValue
JsGetValueType
JsHasException
JsHasExternalData
JsHasIndexedPropertiesExternalData
JsHasIndexedProperty
JsHasProperty
JsIdle
JsInitializeJITServer
JsInspectableToObject
JsInstanceOf
JsIntToNumber
JsIsEnumeratingHeap
JsIsRuntimeExecutionDisabled
JsNumberToDouble
JsNumberToInt
JsObjectToInspectable
JsParseScript
JsParseScriptWithAttributes
JsParseSerializedScript
JsParseSerializedScriptWithCallback
JsPointerToString
JsPreventExtension
JsProjectWinRTNamespace
JsQueueBackgroundParse
JsRelease
JsRunScript
JsRunSerializedScript
JsRunSerializedScriptWithCallback
JsSerializeScript
JsSetContextData
JsSetCurrentContext
JsSetException
JsSetExternalData
JsSetIndexedPropertiesToExternalData
JsSetIndexedProperty
JsSetObjectBeforeCollectCallback
JsSetProjectionEnqueueCallback
JsSetPromiseContinuationCallback
JsSetProperty
JsSetPrototype
JsSetRuntimeBeforeCollectCallback
JsSetRuntimeMemoryAllocationCallback
JsSetRuntimeMemoryLimit
JsStartDebugging
JsStartProfiling
JsStopProfiling
JsStrictEquals
JsStringToPointer
JsValueToVariant
JsVarAddRef
JsVarRelease
JsVarToExtension
JsVarToScriptDirect
JsVariantToValue
MemProtectHeapAddRootSection
MemProtectHeapCollect
MemProtectHeapCreate
MemProtectHeapDestroy
MemProtectHeapDisableCollection
MemProtectHeapIsValidObject
MemProtectHeapMemSize
MemProtectHeapNotifyCurrentThreadDetach
MemProtectHeapProtectCurrentThread
MemProtectHeapRemoveRootSection
MemProtectHeapReportHeapSize
MemProtectHeapRootAlloc
MemProtectHeapRootAllocLeaf
MemProtectHeapRootRealloc
MemProtectHeapRootReallocLeaf
MemProtectHeapSynchronizeWithCollector
MemProtectHeapUnprotectCurrentThread
MemProtectHeapUnrootAndZero
RecyclerNativeHeapAddExternalMemoryUsage
RecyclerNativeHeapAllocLeaf
RecyclerNativeHeapAllocLeafFinalized
RecyclerNativeHeapAllocTraced
RecyclerNativeHeapAllocTracedFinalized
RecyclerNativeHeapCollectGarbageInThread
RecyclerNativeHeapCreateWeakReference
RecyclerNativeHeapGetRealAddressFromInterior
RecyclerNativeHeapGetStrongReference
RecyclerNativeHeapHasWeakReferenceCleanupOccurred
RecyclerNativeHeapRootAddRef
RecyclerNativeHeapRootRelease
Name
.text
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
59KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
512B
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=92, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=259, version=27412,
count=16, id=260, version=27412,
count=9, id=257, version=27412,
count=470, id=1, productName=Unmarked objects,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=590, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Chakra.dll.mun
- SHA256 4c524a310a34334687f9aee020d684a84952aba031d7dd91d1436e47ad85872c
- MD5 dea2eb034d290cc203806d33adaa94c9
- SHA1 e65f4cbb40525b9f9de288f1b404bc998492a3cb
- SHA512 4ad272199ff0ab7229138cf5702d12e108b2fe390d0943790a038ee74432755a409421dbeb151337237c1ee5c01530e2b3333d4f13c3fdc73c0ea9fd8469f2a5
- SSDEEP 1536:7stkjx5+VtDtCsdRHdrODJOXMqR/yy8NsoRaQFLViafosIR:Q2jx5+VesdTrO1OXMqR//ohFLVLI
- TLSH T118B31F027BFD5118F1F76B75AD7A86A41D3ABDA9AE35D51E2000429E5E71F00CEB0B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Chakradiag.dll
- IMPHASH e95eb75a2ee661409769e59aa5e83d6c
- SHA256 23592f91165e50f2e062f2f86c545b66011c68bb49f37272437459ed18b0c8b8
- MD5 d47c2d141877edd35e88dc899271050d
- SHA1 9a132e82cab482ab6824f8e4c02ab4d6fd332873
- SHA512 c8e372002470e8d80700eabc40ecf640f2ed68a877809c67b10ac8b2c7dadd7d2b1168dd6762e23aeb1bb775859711fd696b9772f49122e7617893ef1464bc41
- SSDEEP 3072:wWDoqwAcdunTKwYWauXMP/RDZq4KC2rTz1t+F:ZDvwAcgnewYWyMhC2rT7W
- TLSH T181B31921B6098130D6E641BCD839565F821F6E349F7400F7B7AA9A6A18BC5E35F343B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
94304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ChakraDiag.pdb
msvcrt
wcscpy_s
memmove_s
_vsnprintf_s
_unlock
??3@YAXPAX@Z
_lock
__dllonexit
_onexit
??0exception@@QAE@ABV0@@Z
wcscat_s
wcsncpy_s
_except_handler4_common
??0exception@@QAE@XZ
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_errno
realloc
_XcptFilter
_amsg_exit
??1exception@@UAE@XZ
_initterm
memmove
?what@exception@@UBEPBDXZ
wcsnlen
memcpy_s
swprintf_s
_vsnwprintf
malloc
_purecall
??_V@YAXPAX@Z
free
_callnewh
sscanf_s
_mbscspn
_mbsspn
calloc
_mbscmp
__CxxFrameHandler3
vswprintf_s
_CxxThrowException
memset
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
ReleaseSRWLockShared
InitializeCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
LeaveCriticalSection
OpenSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
CreateMutexExW
EnterCriticalSection
AcquireSRWLockShared
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
SizeofResource
FindResourceExW
LoadResource
GetModuleFileNameA
LockResource
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapDestroy
HeapReAlloc
GetProcessHeap
HeapSize
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
SetHandleInformation
oleaut32
LoadTypeLi
RegisterTypeLi
SysAllocString
UnRegisterTypeLi
SysStringLen
SysFreeString
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
api-ms-win-core-com-l1-1-0
IIDFromString
CoCreateInstance
StringFromGUID2
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetLogicalProcessorInformation
GetSystemInfo
GetSystemDirectoryW
api-ms-win-core-file-l1-1-0
ReadFile
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FreeDumpStreams
GetDumpStreams
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=261, version=27412,
count=4, id=259, version=27412,
count=13, id=260, version=27412,
count=145, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=26, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Chakrathunk.dll
- IMPHASH 65e751034b042cf0ce40076ce7be7a4b
- SHA256 c667da4a8096597192a5f16e4b470068c1b38d7a77d5ebd235b4a4be39f2171a
- MD5 9be099f1bdc9f4caf2885bbc705a2169
- SHA1 94f67021e26f079b2f05616203db2a4ca4c5f182
- SHA512 c25fd4d0890b43e978a3ae4a55242d810fc372024b51b596b3db9b5ab735e0a03305665357387b85e234dc23e85ea9873404bf5e14af62b15ea7ee209836b0e6
- SSDEEP 1536:aufmldasLQ0sJLJ74In7z3e/vyThgwtFiTcVLqb0lwtDM:zS80sJLd4InP3yytgmFiYR12tDM
- TLSH T13DA383BDCA0E49E1D2690DF49C38CFE70A4D3E898EB9A37AD791355604FC08E6C1A525
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
84672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
chakrathunk.pdb
msvcrt
_unlock
_initterm
__dllonexit
_amsg_exit
_XcptFilter
_onexit
?terminate@@YAXXZ
_callnewh
malloc
free
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??1type_info@@UAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
memcpy_s
memmove_s
_except_handler4_common
_lock
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-memory-l1-1-0
MapViewOfFile
VirtualProtect
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
ntdll
DbgPrintEx
NtAreMappedFilesTheSame
JsThunk_AllocateData
JsThunk_Cleanup
JsThunk_CleanupDefer
JsThunk_CleanupFinish
JsThunk_DataToCode
JsThunk_GetSize
JsThunk_InitData
JsThunk_Is
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=52, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=2, id=259, version=27412,
count=7, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ChatApis.dll
- IMPHASH 4a27267808ca493885047c801b1f0a90
- SHA256 81d042eedf669081f59a0d31b6891da7b7973e588ec711f2af0c8a8d2033c634
- MD5 a7bd2a5cb28b9c8f3f131f18ab2a0e65
- SHA1 08423028593c70181c07552882cb9fdf18b66401
- SHA512 d048c171d3765f948a06ad474c07efb895070ce1fa74b66294cb8a3865320f6fc2096581cc625abd874ca603bdee995b5fe85b2ba60bc56d4c2c0071eae00a6b
- SSDEEP 12288:7VMnUnY2/QDdb0uJvxt76yuTBVxhK89hKp4Lr61LQVJtOJ:7VMUnYsQJb0uJvxt76ykBVxhK89hKp49
- TLSH T1D5C419231EE42569E6B33774686E323481ADF4A18B65D2C36B11C1E9BC117D2DD323AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
494128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ChatApis.pdb
msvcrt
memmove
__CxxFrameHandler3
memcpy
_ftol2
memcpy_s
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_vsnwprintf
tolower
_wtol
wcstok_s
_errno
_vsnwprintf_s
wcstoul
_wtoi
realloc
memmove_s
_purecall
wcsncpy_s
malloc
free
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
FindResourceExW
LoadResource
LoadLibraryExW
SizeofResource
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
SetEvent
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
InitializeCriticalSection
CreateEventExW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWait
CloseThreadpoolWork
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcessId
OpenProcessToken
SetThreadToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
TerminateProcess
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
ntdll
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
userdataplatformhelperutil
RunServicesInProc
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser
GetUserTokenFromContext
GetUserContextFromHandle
systemeventsbrokerclient
SebCreateChatNotificationEvent
SebCreateMessageInterceptNotificationEvent
SebCreateRcsEndUserMessageNotificationEvent
SebDeleteEvent
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
487KB
Virtual Size
487KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=15, id=260, version=27412,
count=235, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=63, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ClipboardServer.dll
- IMPHASH ed58a1d4954dad9a3884776f9ff128de
- SHA256 0f5b387ad0029fde3ee25e32aa5154abb2876754956afe6948fb21a0dc50f7fe
- MD5 6852db794e68b3eac4573ff3cd465f1a
- SHA1 0c855b5966f8ad73e520812a07d919061ff014d4
- SHA512 66107febfdd84ba7adb1bef03697ed6cde48c0d47195d45d6e61f21fefe45e686b265513aa16f3b8c9c7b2aae0654557833da110f8a6f4f5ad5236d08d64048d
- SSDEEP 3072:S4E+Gj31ZHfU00YCAWMW9vJ42Xw4TlfWM6SiPFRWgSwwFI+LOutpseCNSflryoYB:S4Er5fU00YCAWMW9vJ4IXTlfWM6SiPFd
- TLSH T1EDF35C202B048071E7AB267D691F663551BD92604FD048C7EF646BF93DE46C35A38BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
40976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClipboardServer.pdb
msvcrt
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
memcmp
??0exception@@QAE@ABQBDH@Z
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
??0exception@@QAE@ABQBD@Z
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf_s
wcschr
??0exception@@QAE@ABV0@@Z
realloc
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
memmove_s
??_V@YAXPAX@Z
_purecall
_callnewh
_vsnwprintf
__CxxFrameHandler3
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
InitOnceInitialize
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseMutex
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
OpenSemaphoreW
CreateMutexExW
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
SetEvent
CreateEventExW
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateString
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TlsSetValue
GetCurrentThread
GetProcessId
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsFree
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
rmclient
RmAccessCheck
ntdll
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlPublishWnfStateData
NtQueryWnfStateData
RtlNtStatusToDosErrorNoTeb
combase
ord90
ord157
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoGetCallerTID
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemAlloc
CoGetCallContext
CoTaskMemFree
CoImpersonateClient
CoRevertToSelf
CoCreateInstance
CoGetMalloc
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-appmodel-runtime-l1-1-1
GetApplicationUserModelIdFromToken
GetPackageFullNameFromToken
api-ms-win-core-psm-key-l1-1-0
PsmGetKeyFromToken
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32EnumProcesses
api-ms-win-security-capability-l1-1-0
RpcClientCapabilityCheck
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFullName
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=260, version=27412,
count=2, id=259, version=27412,
count=203, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=15, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Clipc.dll
- IMPHASH 5d7d814f0d4fd8fb277562128ce5e879
- SHA256 b66c312b1f97b40989e2e3ad2c7ac690f8d8b1dfd5726009de04ae4328d45a08
- MD5 a84dde0c5f100e572264d1e2e768cb85
- SHA1 4b783c1f61688edd1081fa0190ba2c3152512adc
- SHA512 e02167606b42b1e73e18763ec036b155ab30157e117fbb736912e7a75b1d39b4d5b5a92943d7b45ca9fff4a0b66799aa6fb1e1bcd4bb0878b3dfcba49286fd98
- SSDEEP 3072:woSRz221yMwuh/zyo4Nw2zVO+KHfahhDH:yYuxzMNw2z0+Ifmp
- TLSH T1CBD3498269C091EDE36118BCBA2459F254F7F63C0B8588C36270AD697BF29E18737717
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d8:04:51:a1:4d:1c:98:4a:d0:03:55:5f:23:01:65:5a:00:b0:6f:45:83:b2:e6:3d:9a:ff:ea:95:78:05:b0:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d9:9c:5c:05:92:b0:83:6b:3e:00:01:00:00:01:d9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 1, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
116816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClipC.pdb
msvcrt
memcmp
_lock
_unlock
memcpy
swscanf_s
__dllonexit
_onexit
_purecall
_initterm
malloc
free
_vsnwprintf
_ftol2
wcsrchr
_amsg_exit
_except_handler4_common
memmove
_wtoi
_XcptFilter
memset
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryExA
GetModuleFileNameW
FreeLibrary
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
LCMapStringEx
LCMapStringW
rpcrt4
I_RpcMapWin32Status
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
CreateFileW
DeleteFileW
WriteFile
GetFileAttributesW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
CoUninitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
StartServiceW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetKeySecurity
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
K32EnumProcessModules
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-security-cryptoapi-l1-1-0
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-appmodel-runtime-l1-1-0
PackageNameAndPublisherIdFromFamilyName
ntdll
RtlInitUnicodeString
NtQueryInformationToken
RtlGetPersistedStateLocation
NtQueryLicenseValue
NtQuerySystemInformation
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
ClipCallServer
ClipCleanUpState
ClipClose
ClipGatherDiagnostics
ClipGenerateClientChallengeData
ClipGenerateDeviceLicenseRequest
ClipGetAssociatedResults
ClipGetDeviceHardwareData
ClipGetFileIdFromAssociateId
ClipGetLicenseAndPolicyForPfn
ClipGetLicenseData
ClipGetQueryResults
ClipGetSubscriptionStatus
ClipInstallLicense
ClipOpen
ClipQueryAssociateId
ClipRefreshLicense
ClipUninstallLicense
GetExchangeDeviceUniqueID
GetOfflineDeviceUniqueID
SLQueryLicenseValueFromApp
SLQueryLicenseValueFromApp2
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=13, id=260, version=27412,
count=127, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=18, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CloudExperienceHostCommon.dll
- IMPHASH a47afcb7761b803952b3414a7f6d3a78
- SHA256 c5b66e93fccb904ea8f618fa3693a9f22853b5b6beb9a1688f066ab6be268658
- MD5 a294ece8becd795c051b8340714b0fba
- SHA1 42ac479fef3a03eba81be4a1284048db4c059673
- SHA512 a7c0ae66d19a4c1e1ba16b3792324f376d8ec088b9a7ce6ca8575c217bd600bce24534e41adaffab83caf5ca7a3ed569976e6e6ba07bdf52c439cb751cfc511f
- SSDEEP 24576:p2SQE5p/vw7xJelvgIh8UOwL7qOd21e5qELN9EAZ7tHacl+C/:ESj7/iJelvgIhd7j5l+AZ7R7/
- TLSH T161257C134B99A161EE633C741B18392B52B9F9710B0340C377228EA9BA357D2D53DB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c9:3c:6d:38:a5:3e:b6:f2:da:fe:d2:66:e5:b9:90:86:04:35:62:0e:1f:49:ba:ae:67:6e:b2:a4:9c:17:d9:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 17, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
849568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CloudExperienceHostCommon.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_localeconv
_o_malloc
_o_realloc
_o_strtod
_o_strtoll
_o_strtoull
_o_terminate
_o_tolower
_o_towlower
_o_wcsncpy_s
_o_wcstok
_o_wcstoul
_except_handler4_common
_CxxThrowException
_o__callnewh
_o__crt_atexit
_o__execute_onexit_table
_o__configure_narrow_argv
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__dtest
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
_o__cexit
memcmp
memcpy
wcsrchr
api-ms-win-crt-string-l1-1-0
memset
wcscspn
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
FindResourceExW
FreeResource
GetModuleHandleW
LockResource
LoadResource
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
FindStringOrdinal
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
OpenEventW
ReleaseSRWLockExclusive
CreateEventExW
AcquireSRWLockShared
CreateMutexExW
CreateEventW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentThread
OpenProcessToken
GetCurrentProcess
OpenThreadToken
GetProcessId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
GetFileMUIPath
FormatMessageW
GetUserGeoID
GetGeoInfoW
ResolveLocaleName
GetUILanguageInfo
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteValueW
RegEnumValueW
RegGetValueW
RegCloseKey
RegOpenKeyExW
oleaut32
SysFreeString
SysAllocString
api-ms-win-oobe-notification-l1-1-0
RegisterWaitUntilOOBECompleted
UnregisterWaitUntilOOBECompleted
OOBEComplete
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-path-l1-1-0
PathCchAppend
PathAllocCombine
api-ms-win-core-file-l1-1-0
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
api-ms-win-shcore-registry-l1-1-0
SHCopyKeyW
SHDeleteValueW
sspicli
GetUserNameExW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
AdjustTokenPrivileges
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringW
MultiByteToWideChar
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-localization-l1-2-3
GetGeoInfoEx
EnumSystemGeoNames
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-security-capability-l1-1-0
CapabilityCheck
ntdll
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-appmodel-runtime-l1-1-1
ParseApplicationUserModelId
msvcp_win
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xout_of_range@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
winhttp
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSendRequest
WinHttpReceiveResponse
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
863KB
Virtual Size
863KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=14, id=260, version=27412,
count=1383, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=59, id=265, version=27412,
count=29, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/CloudExperienceHostUser.dll
- IMPHASH 0abe32fb1c07e951f270ab4eb65a823a
- SHA256 7fc30b11b1b5b5ee8a2a774ed7bc5b2cb38d1c2a530939239e9f00bfb981c057
- MD5 870d89c1263926ee8fb460000e933291
- SHA1 601296f3ff6361f21d8d76134d1e74a8aee7652c
- SHA512 1475e0ae34f8cc95af6d2f9ea00909f982e268b707099985975d6b9b8073a127cf760d2c83a3b3bd4132ad008c7dafe12ae1b5bef6752878ee29881bcdb9d200
- SSDEEP 6144:27ZE7XAT6WhTezB9jQpIp7JzrrGom4Hb2Bx:2lEj5j52Bx
- TLSH T18D145C111F580476FA37337820AF662300A9DFA10B11D9EB5718D6AD3CA6AD2DD34B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ac:a5:e7:60:18:82:92:41:f3:01:6c:dc:de:5a:1f:1e:38:93:dd:e3:6c:6c:1e:0b:33:90:08:03:17:1e:6c:0a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
156192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CloudExperienceHostUser.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtol
_o_free
_o_malloc
_o_terminate
_o_toupper
_except_handler4_common
_o__crt_atexit
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
twinapi.appcore
ord2
ord3
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
CreateEventExW
CreateSemaphoreExW
SetEvent
ReleaseSemaphore
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDuplicateString
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetProcessId
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
PropVariantClear
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoRevertToSelf
CoImpersonateClient
CoReleaseMarshalData
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
CoMarshalInterface
CoGetMalloc
CoGetCallerTID
CreateStreamOnHGlobal
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
rpcrt4
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient15
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient13
ObjectStublessClient16
ObjectStublessClient6
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction5
CStdStubBuffer2_CountRefs
ObjectStublessClient11
NdrProxyForwardingFunction4
CStdStubBuffer2_Connect
ObjectStublessClient12
ObjectStublessClient14
CStdStubBuffer2_QueryInterface
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-security-base-l1-1-0
RevertToSelf
GetAce
EqualSid
DuplicateTokenEx
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
combase
ord147
ntdll
RtlNtStatusToDosError
RtlCreateAcl
NtSetSecurityObject
RtlCreateSecurityDescriptor
NtQuerySecurityObject
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlGetAce
RtlLengthSid
RtlQueryInformationAcl
RtlAddAce
RtlGetDaclSecurityDescriptor
propsys
PropVariantToStringAlloc
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=15, id=260, version=27412,
count=1282, id=1, productName=Unmarked objects,
count=10, id=257, version=27412,
count=1, id=256, version=27412,
count=17, id=265, version=27412,
count=26, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/MigRegDB.exe
- IMPHASH d09a6e719e5e2339b3631f455943742b
- SHA256 781e7f15682ffc1d7d523baa7835084199568054ab5161d63ba6a338b270d202
- MD5 8ab05c31c23248c2ae46809d5fb73e33
- SHA1 242c046a5fd614242e047d4c4bece9fdc375c952
- SHA512 81a1820beeae5f811716da764a54f8ba8595a6a533cc63efdfcd178ea84561153deff8434c8d804d7aa4b815f93e9dfc1fb986ae6d25f8b7f36866a159ae52de
- SSDEEP 192:/SESYass+uvL2WIDlbceQh3M0184zWYwWFB:/zOL2WwbceQSV4zWYwWFB
- TLSH T1BF32F947FBB89F56F3D90A3028FA9216923E7B704F4496DB7148022D2B259C1EC71B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
MigRegDB.pdb
advapi32
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
kernel32
FindClose
GetLastError
ExpandEnvironmentStringsW
FindFirstFileW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
ExitProcess
FindNextFileW
HeapSetInformation
TerminateProcess
msvcrt
_except_handler4_common
_controlfp
__CxxFrameHandler3
_vsnwprintf
_wtol
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
swscanf
clbcatq
ComPlusMigrate
OpenComponentLibraryEx
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27412,
count=1, id=259, version=27412,
count=21, id=260, version=27412,
count=11, id=257, version=27412,
count=53, id=1, productName=Unmarked objects,
count=3, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/comadmin.dll
- IMPHASH 16f6f5085c6b7763030fe7bf9ec9d5ba
- SHA256 c45c14d0fef5905ca21b9dac6043cc617b20f81089018e34a9d5881bed7ba468
- MD5 d230ae6b9a424a1c812408226418734d
- SHA1 c37e2138d8f0cff9075ca340368000862b89f61f
- SHA512 698fda1d8961768e31ab65f536826436a3d3c6d4a024960403370d90a29e9caab68da324990261953adc8726a56fb7761a48a1c311a9b0f285b3376eaa18c8ae
- SSDEEP 6144:KlN2NLohG7Kc7ymxo3sr2WwVpnWS9iHApu6LrBuva2qf:HLomKc7ywesr2W+4S9s+f
- TLSH T1F3245C41339886F2C6AF0634652B736A76B968851FD111CB9330DA7E2D31BC26F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
135424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
comadmin.pdb
msvcrt
_XcptFilter
__CxxFrameHandler3
_amsg_exit
_wtol
_initterm
?terminate@@YAXXZ
_except_handler4_common
_wtoi
_local_unwind4
memcmp
_itow
_wcsicmp
memcpy
_purecall
wcscpy_s
_waccess
wcsrchr
realloc
wcscat_s
malloc
free
_onexit
__dllonexit
_unlock
_lock
_vsnwprintf
_ftol2_sse
memset
mfcsubs
?RemoveAll@CMapStringToPtr@@QAEXXZ
??1CMapStringToPtr@@UAE@XZ
??ACMapStringToPtr@@QAEAAPAXPBG@Z
??0CMapStringToPtr@@QAE@H@Z
?TrimRight@CString@@QAEXXZ
?TrimLeft@CString@@QAEXXZ
?FindOneOf@CString@@QBEHPBG@Z
??0CString@@QAE@PBG@Z
?Copy@CStringArray@@QAEXABV1@@Z
??0CString@@QAE@ABV0@@Z
??1CString@@QAE@XZ
?InsertAt@CStringArray@@QAEXHPBGH@Z
?SetSize@CStringArray@@QAEXHH@Z
?SetAtGrow@CStringArray@@QAEXHPBG@Z
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
??1CStringArray@@UAE@XZ
??0CStringArray@@QAE@XZ
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetObjectContext
CoCreateGuid
CLSIDFromString
StringFromGUID2
CoSetProxyBlanket
CoCreateInstanceEx
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
VariantInit
SafeArrayUnaccessData
SysAllocStringLen
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopyInd
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayGetVartype
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
LoadStringW
LoadResource
GetProcAddress
LockResource
SizeofResource
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualAlloc
VirtualProtect
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
TerminateProcess
GetCurrentProcess
GetCurrentThread
CreateProcessW
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
GetTokenInformation
RevertToSelf
ImpersonateSelf
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-core-file-l1-1-0
DeleteFileW
FindFirstFileW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
FindClose
GetFullPathNameW
FindNextFileW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-obsolete-l1-1-0
lstrcpyW
lstrcpynW
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
kernel32
GetComputerNameW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
139KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=261, version=27412,
count=19, id=260, version=27412,
count=5, id=259, version=27412,
count=176, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=29, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/comempty.dat
- SHA256 a8920d9b99414cc15c96240832f98f297b3e2e6a757bbb2a3d0b554f098b92a8
- MD5 00ab67c41039ee2c7ecc1cdb6eb39a7c
- SHA1 f5f9c1ff9fd994e2a836d9cbd5df580c66d9fbcc
- SHA512 d46bb53798ffb3be81d365710a9a0bff46df5c8ce87e91b1e30fb9818b04989f61dd99de4f3403f387a85d7d70e723182c67cfbc13e9a1d443ed0c650670d0ff
- SSDEEP 768:hZfl9EmF+rfYnv9netNCdDKbkpIaffzfbytayOlrhsKlX4Dr:PB+av9403/3qaFlrhsKl6r
- TLSH T19353C817B6441333C58143339A1F67A99FB58C7C4BB31122525EB28C2EB2B9962FB9D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
apt/SysWOW64/Com/comrepl.exe
- IMPHASH a1c21d02b295775ca1385e51d5db789d
- SHA256 289b423e248ccbdf95184c549f8f16cef29706fe9532ee167393ff171a262120
- MD5 8a15dd4230b2667be68f1356140cc77b
- SHA1 238519049ada92169806b1889e98db4f4c3c1ecb
- SHA512 a961931736175fe9c610ce3d7a0855b10f923a1be2e7d09870edcb63732a060a29e3a58b95ed19f29c6bdf47e271d0189135e2e17ccbf468780007b91bc3bfef
- SSDEEP 384:fpT/7Ou51COEJ+imy48ZrWW5VuoWpADU:fpeueCy48hoUU
- TLSH T195624B0BEBA8DB56E76949B03E71D136A22973704F6181D7B6846EAD0A3D4D09830F1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comreplexe.pdb
kernel32
CompareStringW
GetConsoleOutputCP
GetStdHandle
WaitForMultipleObjects
SetThreadUILanguage
MultiByteToWideChar
FormatMessageW
GetLastError
CloseHandle
CreateThread
HeapSetInformation
WriteConsoleW
LocalFree
LoadLibraryExW
msvcrt
__iob_func
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_wsetlocale
printf
fgetws
_flushall
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
_unlock
memset
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
oleaut32
SysFreeString
SysAllocStringLen
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=261, version=27412,
count=3, id=259, version=27412,
count=21, id=260, version=27412,
count=5, id=257, version=27412,
count=60, id=1, productName=Unmarked objects,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/en-US/comrepl.exe.mui
- SHA256 8876b010abb279e6070cbf6f8ab2dc5d11d63ac78859561b9c5e67d207414a42
- MD5 10d59bcd70a72a4ebb166155533b9ca2
- SHA1 b3f8bc737ed384892d98057feccb531dd9bacc82
- SHA512 ac9d919f9f6394836b8f614b6b909bcfae3b0aa613ee5e11f72a937f8f00d44627843ab7d7b705341b24b8cf37d08de9d8201b7f6a49d26a67c1e626ee90efd7
- TLSH T123514B0A5BFB1627F0AA0B7086F746925B7D7D23B6A3A33FCB000119246051998E0F76
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/mtsadmin.tlb
- SHA256 129d81c1dac0ad7eeda3ef1f8d22ebcf69b8ab02616fb7bd6014db4c8d5bbc25
- MD5 4aabb456f8fe711850b92b1c57f1e593
- SHA1 25dd2c85d34244d211d7fa325a1db4b874334ac0
- SHA512 4b2234d99e480937305c6eba209c02712ff2e4376bc48281f6658022442962bc5095c02457c4a7599904f13fda8954864680d19e885bd945bafea152177f679c
- SSDEEP 384:lVWOyWzAo9Ynf2q8Xs3VtUY0sRnu1kKvvnZTr:lbvH2O+3HUHyueKvvnZTr
- TLSH T1D9924143B788D7A3D48902381A6B42E697B0AC117E1773877344735CAE737C97723699
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/ru-RU/MigRegDB.exe.mui
- SHA256 44ea2dd5fdfef3ea154d51a13fcbea7eb37b65af88887367fc9bbf025a8b88cd
- MD5 cc01f63e87e1e3b349fef706b1d08127
- SHA1 65908450cf122df7affffe02de6d367a3323f468
- SHA512 ab831e6692c906950dd2207062557dbc359d7fd789b9404e8caad258cbeb1df24898be058b0e306dccbdf13803ba1a55cb935b3e41fa68c7894e77bb8d3d0b85
- TLSH T113518E0E9BBB0157F0EA0B7087D746D55BBD7D23B292636FCF401129286052499D0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Com/ru-RU/comrepl.exe.mui
- SHA256 6122ba1b0714c575f6295179e2fa65e660d62561e3d5c932060fc201eb11c9bd
- MD5 4e7fed3b974e934cecee37192c264489
- SHA1 a1ea5b677d23b48d79d34f49f030a6d00774c4d9
- SHA512 385266d45cb019dfecb10aafe3cc36b8abefbaa0e6016adb26d11affcd42bc0f67c9e7d49b89d85d4c61f6a629d7253dcf9db83842a552857160af7fbba25729
- TLSH T11D51800E9BBB4517F0AA0B708BD746D617BD7D2373A2626FCF401169245052459A0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DDORes.dll.mun
- SHA256 a64a91482ff7cab0dcce68f3eb8b04d55e65cf45e6c8c5c5dd6e5dfbf7b50d82
- MD5 03d36389c36ce4e42edc6e48a3a8bb2c
- SHA1 2c22a1b70cd5aa690d4d25bcef8b8e6ed08b38ca
- SHA512 5f1ba4ce21bce1579b545f6830789bddbd29cfd2376f1bfe1c9c8c0d5b77e96dc7bc5d213f890eb9ad06f58024b68ee90c225ce30b64cf17fdcbfe98900482da
- SSDEEP 98304:NM3DnJajAGVGlGVGPddo2MNkoIgzrrrrrruBealZ9xoMu:GzJajAGVGlGVGVdo5Nkp
- TLSH T1B1F628A63605D156C8C88A7CCE7DC6EC0BA0BD21EE5466B7BDC13B8F21B5BC5EC0A505
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15.0MB
Virtual Size
15.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DataExchange.dll.mun
- SHA256 61afbdad123142ac0be3a54516bdfac3be1c7a81237c55692b55c26438ba69ee
- MD5 d1fa32ae403cd9e8c4578e9b7bb3f9c3
- SHA1 89c886f33c458519bca9b1d27585d94224631b3a
- SHA512 bbf3d461d2ea5a3002a944c0467228b798cd002e891661fba8edd62049686fa1f9b3dfae66f1a7e919c229b60a75b942a43515a29d3447f4896ed10d5824b7a3
- SSDEEP 3072:gRkCIyDOG/zNzMn1YrirDObgHHCvVKDcFA:g6ivYn1N/fCvVq
- TLSH T152C302DB3FD1DCF0F049023444AFA573F1015A25726B070A2205A9EFB767761F9A8B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DeviceCenter.dll.mun
- SHA256 2f7352fa1d21e7e407c41adbd0bf81e9b842494c1511afffcfbc1a1c5400398e
- MD5 423333ee1f5600b96752ca3ba3a1ce26
- SHA1 bbec35a1bee704e01c8678322d438a651fcd4944
- SHA512 498b134273fc4e7083246f11b7ad9d129fea97f59e3446d0329284e24b862150641b490372cadb4ecb73449aec4e6dc98ae2563bbbc75a9f2d575c5f7493daed
- SSDEEP 3072:J95qG87Ln4yPQc6JdEPZ33mol1sxJMKJfy:n5qG64yPP6dg33x1K
- TLSH T19124F656E450C7CAEA0A54B16FBB8DF47A943EDEDA08453124CD730A1CB6AF58BC7243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
209KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DevicePairing.dll.mun
- SHA256 7312480db4674eb033a229f3f933561e43c072a1617d2b99207c5f68bec6b901
- MD5 f03b1cb239c0da6e2ae75baf0fa58eb5
- SHA1 9f6ce0910b09101adbeb9fcd0e18d32e08839d7c
- SHA512 b6afdf616cf797c9e2c2d98cef5cc2b3509a6ed8a7ea0aa57c5b24dac2c346b30b2ddf1986ff9eb2131663952ec8beaffc391afd9581980a6424c3f11af66018
- SSDEEP 768:V63T33fDgiRp2pyowK4iBp/7gel39HO1N4UMmelYPO12A5dI1hA+d11ZAGdr1JAF:VYTcOT8H2g6a7u/AZ3qOT
- TLSH T1434431607101CC4ACAEB9378E93DDBE947903C408E1A3547BD97378F4578ECAB599B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
247KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DevicePairingFolder.dll.mun
- SHA256 d8a4b11d049aed7b34f9731c87a2440a0db7e71e88e8f47bf1c29dd12be81335
- MD5 581a7d3351cc7bb59a1e0fc9ac0bb78a
- SHA1 f893330429a4aa1501529a7202d958a074741b6e
- SHA512 4f88092a3f6e7d0fa68befdbd50f3323c168dd11a9090dfedf14788922606bcde891d2390cd5ae8866b4a088fbf96de44a629235567e6cebb56c3ebcd63f40be
- SSDEEP 768:PvbESWyQi4G0In3BhzhWM1GOVz17p1j4OHMnjHnS0beBNJdiEOHc:PvbEGZ3qOTt10OHSnSXBA
- TLSH T108C32CC1BE388456F8E48B78C5BE8B77172C7D4018D53A426E803B4ADAB96CDF81DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DiagSvcs/DiagnosticsHub.StandardCollector.Proxy.dll
- IMPHASH 9bf8010b5d573615ba201f40b0fe8445
- SHA256 864dcda5c58e646869e31e2a1c61e8be72a9657dbfe52df1ff0a5534f66352d4
- MD5 888f5f91f628217f9b96f1a815c0fe7f
- SHA1 3f722e1d977b5d897042effad7fa0cc6aae4bd42
- SHA512 726178c2564add2ec291cbe3f227f85d77360fe90c207fbcf7ddca50471899371d369a93c249c49a4403daa00c0c2e3c79e782365ed9af15b898f0580805494f
- SSDEEP 384:hZ8oSWrEUgPzMLYYJiRj0fUrtRcDWB2V9:hOPWrEUswLYY4UU3cv
- TLSH T17292E842FF05497AD9AE613E4473EB25C215AA106FE611C30F64238A2DB62F1EB37747
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DiagnosticsHub.StandardCollector.Proxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcmp
_o__seh_filter_dll
_except_handler4_common
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
oleaut32
LPSAFEARRAY_UserMarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree
LPSAFEARRAY_UserSize
VARIANT_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
VARIANT_UserFree
rpcrt4
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrOleAllocate
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient16
ObjectStublessClient4
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient11
ObjectStublessClient6
ObjectStublessClient3
ObjectStublessClient15
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient5
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-com-l1-1-0
CoRevokeClassObject
CoRegisterPSClsid
CoRegisterClassObject
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ManualRegisterInterfaces
ManualUnregisterInterfaces
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1155, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=4, id=264, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DiagSvcs/KernelTraceControl.dll
- IMPHASH 2da86f5309dabfb29baff84a46a24caf
- SHA256 d63a27de4829988d33d0bcbb455c63e4c1c8080c06c356c8dbfa863449563ab4
- MD5 6bd7b4f7e7eb1f41160dee115100d520
- SHA1 aa1f3afa8839a7cf1c8d22c90c834c0d18d1d78f
- SHA512 c6e6a5c77e08884f39c5cc230d4df539ee8ff89fbf1cdb4037f1ada3683eb9e4cdb5d8579aae3db1366f80711a9dbab4ac7a9b2f1833650338898ecd1ecb01d2
- SSDEEP 3072:gUXCpCWkCnfk/rIawlf0jOPuQpsrOAyz1mnL7gpmopJnoXW/1xqBZrp:gUXCp+2c8ascjOPLpspsZvpX/1kp
- TLSH T145F34B126A81C876DBAF3670291F7339E1BDE2A00B6142CB676C5FBBAD207C15D3454B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
132400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
KernelTraceControl.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__memicmp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o_calloc
_o_ceil
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_o__cexit
_o__callnewh
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
strrchr
wcsstr
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
__CxxFrameHandler3
_o___stdio_common_vsnprintf_s
memchr
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcsncmp
wcsspn
wcscspn
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
StringFromGUID2
CoCreateGuid
CoCreateInstance
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo
GetWindowsDirectoryW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTraceEx
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-kernel32-legacy-l1-1-0
LoadLibraryW
CopyFileW
FindResourceW
oleaut32
SysFreeString
SysAllocString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
CreateProcessW
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-1-0
LockResource
SizeofResource
FindResourceExW
LoadResource
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleExW
api-ms-win-crt-utility-l1-1-0
ldiv
ntdll
RtlImageDirectoryEntryToData
RtlGetVersion
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlImageRvaToVa
api-ms-win-eventing-consumer-l1-1-0
CloseTrace
OpenTraceW
ProcessTrace
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
FindVolumeClose
FindNextVolumeW
QueryDosDeviceW
FindClose
FindNextFileW
GetFileSize
FindFirstFileW
GetTempFileNameW
FindFirstVolumeW
DeleteFileW
CreateFileW
CreateDirectoryW
SetFilePointerEx
GetFileAttributesW
WriteFile
SetFilePointer
ReadFile
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-memory-l1-1-0
VirtualQuery
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
VirtualProtect
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
IsWow64Process
Wow64DisableWow64FsRedirection
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapSize
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CreateMergedTraceFile
DllCanUnloadNow
StartHeapTrace
StartKernelTrace
UpdateHeapTrace
Name
.text
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=77, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1245, id=1, productName=Unmarked objects,
count=3, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=24, id=265, version=27412,
count=25, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/AppxProvider.dll
- IMPHASH cc0de1b1c61ba19963d8555b09b354f1
- SHA256 46b67f4142fcd02c0487650db58aa9577d8bee039799d4d5b9cc7d5ed86099f3
- MD5 9e10b464443760c98de0be05f5ec1d7c
- SHA1 5329497a9f94197200e08ab38696f7d6f446b06c
- SHA512 f61460beffcd21a6856af60a1681729375c5a91953a3c611b5400fe7177e0d8984da97a55fb3eab90b537625f4a2b1746bb125c6c8a05d2c207c79249a461bf9
- SSDEEP 6144:pO1ZE/uE9Xt1m2bKHPj6ohcSlfXNowkAa4E2dPDWZoJkoiC7hPmGRfx8:pO1ZHyDoPj69iW61WZoJko31fx
- TLSH T13C841910F7E88035E1FB3A35B93A6225497FB8B05F70D18F6360965D6D326828D35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:54:78:7c:2d:7a:62:6f:7a:8c:20:10:8f:01:f9:1d:3c:3d:5d:48:5e:0a:a3:26:4d:a7:8c:9b:2d:b6:04:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e7:2e:8f:2f:93:0b:4f:1b:e9:00:01:00:00:01:e7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
284320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
AppxProvider.pdb
msvcrt
__CxxFrameHandler3
towupper
wcstok_s
wcschr
wcsrchr
_wcsnicmp
__RTDynamicCast
memcmp
_onexit
__dllonexit
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_unlock
_lock
malloc
memmove_s
_purecall
vswprintf_s
_vscwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
memset
ntdll
RtlNtStatusToDosError
NtSetInformationFile
RtlCompareUnicodeString
RtlInitUnicodeString
RtlAllocateAndInitializeSid
RtlEqualSid
RtlFindAceByType
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlFreeSid
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlNumberGenericTableElementsAvl
advapi32
GetSecurityInfo
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW
EventWriteTransfer
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
EventUnregister
EventRegister
AdjustTokenPrivileges
RegSetKeyValueW
kernel32
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
GetFileInformationByHandle
CreateDirectoryW
GetFullPathNameW
FindClose
GetFileAttributesW
GetFileInformationByHandleEx
DeviceIoControl
GetTempPathW
SetFileInformationByHandle
CopyFileExW
GetLongPathNameW
GetFinalPathNameByHandleW
GetCurrentDirectoryW
WaitForSingleObject
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadpoolTimer
CreateThreadpoolTimer
CreateSemaphoreExW
ReleaseSemaphore
HeapFree
GetCurrentThreadId
FormatMessageW
HeapAlloc
GetProcessHeap
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
OutputDebugStringW
IsDebuggerPresent
CloseHandle
CompareStringOrdinal
MultiByteToWideChar
GetCurrentProcessId
SetThreadUILanguage
CopyFileW
SetFileAttributesW
CreateEventW
FindFirstFileW
FindNextFileW
DeleteFileW
CreateHardLinkW
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetCurrentProcess
TerminateProcess
DebugBreak
LocalFree
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemInfo
VirtualQuery
HeapSize
HeapReAlloc
HeapDestroy
CompareStringW
Sleep
InitializeCriticalSectionEx
UnhandledExceptionFilter
OpenSemaphoreW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
WaitForThreadpoolTimerCallbacks
SetUnhandledExceptionFilter
GetModuleFileNameA
CloseThreadpoolTimer
ole32
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
CoCreateGuid
CoUninitialize
CoSetProxyBlanket
CLSIDFromString
CoTaskMemAlloc
shlwapi
SHCreateStreamOnFileW
user32
LoadStringW
CharLowerBuffW
CharNextW
UnregisterClassA
oleaut32
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
VariantClear
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysFreeString
UnRegisterTypeLi
ext-ms-win-session-winsta-l1-1-0
WinStationGetTermSrvCountersValue
api-ms-win-core-path-l1-1-0
PathAllocCanonicalize
bcrypt
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
314KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=19, id=257, version=27412,
count=15, id=261, version=27412,
count=19, id=260, version=27412,
count=375, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=83, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/AssocProvider.dll
- IMPHASH 1daa16c3db0b395b29281d72e7e2b0e1
- SHA256 2096bd4226c9a51c932de7dd5e9bf4c77e8ed8a0abdc52ecdf62dc6c471e2c44
- MD5 76fdd924ffb687ddc1d351fcd8d68290
- SHA1 41209e1ac1a84eb834b578067af3c9f2598f7fd5
- SHA512 fbaad53cbc812ed7f4b7b216ef2a98a9c6c83f1efeb0f294c7932d56541d7464ffc68b4bf51c436e2ea3a223d9f6395a4eb153d04e03f1057cdbf89bd43a4ef6
- SSDEEP 1536:F00diUzCyEoUejx7uILxJd1O6JyA/bAgkt+KPx+zQ:FZiUfUeN7TJd1O6c5gktxcU
- TLSH T1DE93D54177E886B1D5FF3A3C1929926545BFBC608FF082CB6A50636E2CB16C18D34B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
21:aa:b8:da:50:b1:5e:5c:7e:ff:ee:83:f9:05:93:9f:60:4c:d7:03:33:be:17:aa:a5:10:34:99:7d:87:df:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
49232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
AssocProvider.pdb
msvcrt
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcmp
__RTDynamicCast
memcpy_s
_purecall
vswprintf_s
malloc
??0exception@@QAE@XZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
??1type_info@@UAE@XZ
_vscwprintf
_vsnwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
memset
kernel32
SearchPathW
CreateFileMappingW
MapViewOfFile
SetLastError
GetVersionExW
FreeLibrary
LocalFree
LockResource
LoadResource
FindResourceExW
FormatMessageW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
GetFileSizeEx
ReadFile
CloseHandle
CopyFileW
DeleteFileW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
UnmapViewOfFile
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
user32
LoadStringW
UnregisterClassA
CharNextW
CharLowerBuffW
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
ProgIDFromCLSID
oleaut32
SysFreeString
UnRegisterTypeLi
LoadRegTypeLi
VarBstrCmp
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
shell32
SHCreateAssociationRegistration
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=18, id=260, version=27412,
count=136, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=15, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/CbsProvider.dll
- IMPHASH d074895934b90459c6087f1b85ad93f6
- SHA256 93fb414712da4c84f43cbe8467bc0fe7f7e2879433a6a3cf9636609d745ccec3
- MD5 81130e0e0660128a59b6e00ae9b7e6b2
- SHA1 e14c02994416df61e58a4acba0dd5e88aa7dd0ea
- SHA512 a516281a3187d7f4a0654ca07a5c6d5f8be5c08553bc5b91047e5e4bb3e903cd313503f39a0ab43b7ef18d00dd08433664c7f8ac72ab81c2772d5352cb773e08
- SSDEEP 12288:HXhGkOBG5KgJmrVc+igiSqXlc25vRdQ+wcEzhJzMVLYEgQX5+BRZL6yil:HXhGkqG5KgJmrVc+igi3Xlc2bdQ9cEzK
- TLSH T1D3E4E94177EC4928F1FB3BB8693967740D7BFE229A30C28F1651865E4DB1AA14D31B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0d:00:e3:80:98:69:ac:ca:cf:23:29:37:c7:f8:f7:91:7d:8f:2e:2a:e5:8b:83:41:9e:3c:1b:0f:0f:bd:1d:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
484800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
CBSProvider.pdb
msvcrt
_wcsnicmp
iswspace
wcstoul
wcsstr
_ultow_s
__CxxFrameHandler3
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_XcptFilter
_CxxThrowException
_callnewh
_wcslwr_s
wcsrchr
_wtoi64
_wtoi
iswdigit
??0exception@@QAE@XZ
_vsnprintf_s
_vsnwprintf
malloc
calloc
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
wcschr
vswprintf_s
_vscwprintf
_wcstoui64
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
_amsg_exit
memcpy
memcmp
_ftol2
__RTDynamicCast
memset
advapi32
RegEnumValueW
RegFlushKey
RegEnumKeyExW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
InitializeAcl
RegDeleteKeyW
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegUnLoadKeyW
RegQueryValueExW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
SetErrorMode
GetTempPathW
GetErrorMode
RemoveDirectoryW
ReadFile
SetFilePointer
GetFileInformationByHandleEx
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetVersionExW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
SetThreadUILanguage
FreeLibrary
GetFileAttributesW
CompareStringW
HeapFree
GetProcessHeap
GetCurrentProcess
CloseHandle
LoadLibraryW
CopyFileW
Sleep
DeleteFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateEventW
WaitForSingleObjectEx
SetEvent
FormatMessageW
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
CreateMutexExW
CreateSemaphoreExW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapSize
HeapReAlloc
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentProcessId
QueryPerformanceCounter
CreateFileW
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
FindClose
ExpandEnvironmentStringsW
IsWow64Process
GetTimeFormatEx
GetDateFormatEx
GetSystemInfo
LocalFree
ole32
CoTaskMemFree
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoCreateGuid
CoGetMalloc
user32
LoadStringW
CharLowerBuffW
CharNextW
oleaut32
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
CreateErrorInfo
SysAllocString
UnRegisterTypeLi
SysFreeString
LoadTypeLi
SysAllocStringLen
VarBstrCmp
LoadRegTypeLi
VariantClear
VarBstrCat
SetErrorInfo
GetErrorInfo
version
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
ntdll
RtlGetVersion
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlExpandEnvironmentStrings
RtlDosPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosError
NtSetInformationFile
RtlFreeHeap
RtlAllocateHeap
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
521KB
Virtual Size
521KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=18, id=260, version=27412,
count=311, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=14, id=261, version=27412,
count=1, id=256, version=27412,
count=82, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/DismCore.dll
- IMPHASH 4e2c108a8c76faf446e872af5b1b499c
- SHA256 a15b1b60931b403776eea3dce38d0e4f2763fba3dd5a2128f044d6d9157dd34a
- MD5 2095f64ad5959ca9b60a8aa7abca6e76
- SHA1 1ea927a562278b3dc0fd57e8d3fa9f8e8bb6c13c
- SHA512 76a9a9bfd33220e630004f98ba2f8e0c784c7a39169e3737420f2044c07c23892702143df70434c947308422b312853cff0a80b323e0d0eae6b9fde93b77fbf7
- SSDEEP 6144:UPUbVsKGD0Rpuv8ePZZ13VQVfAZZCJiE3YkJVnRKQLdCmY:wUb2oC0VfALCJQCkcC
- TLSH T13864D581B3988861F0AE2630393B67666A7DF4205FF1C28F6354D76E5E327C16931727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:41:84:6d:b7:1d:bf:71:bc:d1:0a:72:55:a7:92:e2:29:63:fe:26:10:a2:f2:e9:28:76:5d:50:c2:84:5f:5d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d7:9b:0d:1e:57:2e:8c:51:8e:00:01:00:00:01:d7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
183184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
DismCore.pdb
msvcrt
_wtoi
swscanf_s
_vscprintf
vsprintf_s
iswalpha
_vsnwprintf
_wcsnicmp
wcsncmp
wcsstr
towlower
_vsnprintf
strrchr
toupper
memmove
fclose
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
wcsncpy_s
wcscat_s
calloc
memmove_s
memcpy_s
_purecall
_wcsicmp
wcsrchr
wcschr
vswprintf_s
_vscwprintf
wcscpy_s
wcstok_s
_wfopen
fgetws
feof
_onexit
malloc
_resetstkoflw
free
iswctype
__CxxFrameHandler3
memcpy
memcmp
_ftol2
memset
advapi32
AdjustTokenPrivileges
EventWriteTransfer
EventRegister
EventProviderEnabled
EventUnregister
SetSecurityDescriptorDacl
EqualSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
kernel32
SetThreadUILanguage
CreateFileW
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
MultiByteToWideChar
GetTempPathW
GetModuleHandleExW
FreeLibrary
SetEvent
GetModuleFileNameW
GetModuleHandleW
Wow64DisableWow64FsRedirection
CopyFileExW
Wow64RevertWow64FsRedirection
CreateEventW
GetNativeSystemInfo
HeapFree
GetProcessHeap
WaitForSingleObject
TerminateProcess
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
RaiseException
GetProcAddress
LoadLibraryExW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
CompareStringW
GetEnvironmentVariableW
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetLastError
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetFileAttributesW
GetSystemInfo
ExpandEnvironmentStringsW
GetFileSizeEx
LocalAlloc
DebugBreak
DeleteFileW
DeleteFileA
CreateFileA
GetSystemWindowsDirectoryW
FormatMessageW
GetSystemDirectoryW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetFileInformationByHandle
CreateDirectoryW
LocalFree
GetCurrentThread
GetFullPathNameW
GetVersion
ReleaseMutex
CreateMutexA
CreateMutexW
WriteFile
GetModuleFileNameA
VirtualQuery
FormatMessageA
TlsFree
TlsGetValue
ExitProcess
GetFileSize
GetLocalTime
TlsAlloc
TlsSetValue
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetTempFileNameW
GetVersionExW
SetLastError
SearchPathW
SetFilePointer
ReadFile
GetWindowsDirectoryW
IsDebuggerPresent
FlushFileBuffers
GetFileInformationByHandleEx
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
GetDriveTypeW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateProcessW
GetExitCodeProcess
DuplicateHandle
QueryPerformanceCounter
CreateFileMappingA
ole32
CoRegisterPSClsid
CoRegisterClassObject
CoRevokeClassObject
CoSetProxyBlanket
CoCreateGuid
StringFromCLSID
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2
CoCreateInstance
user32
LoadStringW
CharNextW
oleaut32
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantTimeToSystemTime
VariantInit
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SetErrorInfo
CreateErrorInfo
GetErrorInfo
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SystemTimeToVariantTime
LoadTypeLibEx
version
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
ntdll
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=19, id=260, version=27412,
count=312, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=47, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/DismCorePS.dll
- IMPHASH 9008fbb4297eda8bc58ac66d1b3b5368
- SHA256 e72d6d25518dd89d2f707cbda8c624ab79bab0687121da68c32748a0976f093f
- MD5 6d6f42f58624802aa424b2897ec7beb5
- SHA1 8a8503e9616d07275a2667779f6b17888d1dcbeb
- SHA512 23ac56ccb38f70dd86cd979ae37821be9d7400e7c89a77b088828e16147a98295d6a1ff32e9cab9305caf820df95c65169cd09591c8d9ca4a3183354932c76c3
- SSDEEP 1536:qmaUubHxyvr5YmovDVYYT6TxdOQQJnqK2x0Pqrzy3:qzyvr5YFTmzQJnqKbSru3
- TLSH T1F293A4833B1441F8E25D207A27865720E6B9CE51BBE105D72ED477897C32192EF327EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
53:89:65:15:01:6d:ea:96:29:38:a8:1b:41:d7:c5:fa:11:96:2f:c1:8f:06:73:8d:41:5d:90:2b:04:05:65:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 28, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d6:27:69:ff:72:2d:56:c8:ae:00:01:00:00:01:d6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
55376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DismCorePS.pdb
msvcrt
_XcptFilter
_initterm
malloc
free
_amsg_exit
_except_handler4_common
memcmp
oleaut32
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
BSTR_UserMarshal
rpcrt4
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubCall2
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
DllCanUnloadNow
DllGetClassObject
DllGetDismInterfaces
DllRegisterServer
DllUnregisterServer
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=52, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=54, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/DismHost.exe
- IMPHASH ea8f91bd4f50c92c7c407b1787b36e88
- SHA256 051a67596efa900384231615f1872cfc650874be27ae66aaa2c9a5c5a2f46396
- MD5 efcdac4add407ed568f8042976f6790a
- SHA1 965574e4eca44e61b8d047cc11895e23a8b93a9d
- SHA512 c148fd937da0ec7b461b041f9111426468515ccedd73ead729f5401fa283f0787fe5d247f3936ab8011598dcfcf80ee228ce20bdee80225ab8d7ebb42007a899
- SSDEEP 3072:RfXpMtK5mihNXycC5H8iXGHQsSFipik32bBUcdbv:5N3NXO8iX2zIk32O2
- TLSH T1C7B35B117688C47AC167B572466DEB76F6BEEE700F2182C333A0B7AE5D312C09934697
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7f:51:3f:c3:f4:7f:4f:3d:4c:84:2d:6f:13:2d:c7:d7:b4:46:34:90:61:0d:9d:65:5e:34:81:cd:83:c6:9a:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d9:9c:5c:05:92:b0:83:6b:3e:00:01:00:00:01:d9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 1, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
82064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
dismhost.pdb
msvcrt
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_wcsicmp
wcscpy_s
_beginthreadex
wcsstr
wcsrchr
calloc
memmove_s
malloc
memcpy_s
_purecall
free
fgetws
_wfopen
wcstok_s
fclose
iswctype
toupper
strrchr
_vsnprintf
_callnewh
_CxxThrowException
exit
__CxxFrameHandler3
_exit
_cexit
__p__fmode
_ismbblead
__setusermatherr
_initterm
_acmdln
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
_wtoi
towlower
wcschr
_wcsnicmp
_vsnwprintf
_vscprintf
vsprintf_s
vswprintf_s
_vscwprintf
swscanf_s
_XcptFilter
?what@exception@@UBEPBDXZ
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_lock
_unlock
__dllonexit
_onexit
feof
_controlfp
memmove
memcpy
memcmp
memset
advapi32
OpenThreadToken
EventWriteTransfer
EventRegister
EventProviderEnabled
EventUnregister
EqualSid
AddAccessAllowedAce
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
IsValidSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
MakeAbsoluteSD
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
kernel32
SetLastError
GetLastError
CreateEventExW
CloseHandle
WaitForSingleObjectEx
SetErrorMode
GetCommandLineW
InitializeCriticalSection
SetThreadUILanguage
SetEvent
EnterCriticalSection
LeaveCriticalSection
OpenEventW
WaitForMultipleObjectsEx
ExitProcess
DeleteCriticalSection
OutputDebugStringW
GetModuleFileNameW
RaiseException
GetCurrentThreadId
GetModuleHandleW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
TlsSetValue
TlsAlloc
DeviceIoControl
FreeLibrary
FlushFileBuffers
IsDebuggerPresent
GetWindowsDirectoryW
GetFileSizeEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LocalAlloc
DebugBreak
CreateFileMappingA
DeleteFileW
DeleteFileA
CreateFileA
GetVersion
ReleaseMutex
CreateMutexA
CreateMutexW
SetFilePointer
WriteFile
GetModuleFileNameA
VirtualQuery
FormatMessageA
TlsFree
TlsGetValue
GetFileSize
GetLocalTime
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
CreateFileW
FormatMessageW
FindResourceExW
LoadResource
LocalFree
LoadLibraryExW
GetProcAddress
GetTempFileNameW
GetCurrentThread
WaitForSingleObject
GetModuleHandleExW
SearchPathW
ole32
CoRevokeClassObject
CoCreateInstance
CLSIDFromString
CoRegisterClassObject
CoTaskMemFree
ProgIDFromCLSID
CoUninitialize
CoRegisterPSClsid
CoInitializeEx
CoInitializeSecurity
user32
LoadStringW
oleaut32
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
CreateErrorInfo
SetErrorInfo
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlGetVersion
RtlNtStatusToDosError
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=25, id=260, version=27412,
count=317, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=13, id=261, version=27412,
count=42, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/DismProv.dll
- IMPHASH 18c7613e3bc9525a655d9e3d1c8377ca
- SHA256 880a1027dc985c0c59c1f20f7e8750df1e6d344af5473f6d892976d05d42112a
- MD5 9a3fa1f96b60938c504073383e4475e0
- SHA1 2143364c5ef5ec41855ddd4aa6110912b8eba8df
- SHA512 aca3f00cb2cb77cd46914abf3d10b4222c2f5a18ab53a2c6b1b49141bc5338766448fe8cb2b5d2158ac571317d87d9fb8b952c0bb0a0c456fc39b45520b4d169
- SSDEEP 3072:9+l+c4pMLosEjKkTiwZJSb9bZwAomnX4ah96JVGlC/rkKREwMR2g93n+vDfb:9zcLLodPqQTu96JVoULRExnET
- TLSH T18D1408113BD8C4B5E1AF2230297FA635953EBD708FA082CF2674AB6E48716D14D3476B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:13:10:e6:94:a3:e0:39:4b:74:56:18:55:db:5b:bb:1c:61:37:4b:58:bb:2a:be:aa:59:11:0f:7e:e5:6e:d3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d9:9c:5c:05:92:b0:83:6b:3e:00:01:00:00:01:d9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 1, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
141200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
DISMProv.pdb
msvcrt
swscanf_s
_wtoi
towlower
fclose
_vscprintf
vsprintf_s
_vsnprintf
wcstok_s
_wfopen
fgetws
feof
__RTDynamicCast
memcmp
memcpy
_wcsnicmp
wcschr
memmove
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
wcscat_s
wcscpy_s
calloc
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
wcsrchr
_purecall
vswprintf_s
_vscwprintf
memcpy_s
free
malloc
wcsncpy_s
_vsnwprintf
_wcsicmp
__CxxFrameHandler3
strrchr
toupper
iswctype
memset
ntdll
RtlFreeHeap
RtlAllocateHeap
oleaut32
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
SysAllocStringLen
RegisterTypeLi
SystemTimeToVariantTime
UnRegisterTypeLi
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantTimeToSystemTime
VarUI4FromStr
advapi32
InitializeSecurityDescriptor
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
AddAccessAllowedAce
GetLengthSid
InitializeAcl
EventRegister
EqualSid
SetSecurityDescriptorDacl
EventUnregister
EventWriteTransfer
EventProviderEnabled
kernel32
TlsSetValue
UnmapViewOfFile
TlsAlloc
GetLocalTime
GetFileSize
ExitProcess
TlsGetValue
TlsFree
FormatMessageA
CreateFileMappingW
MapViewOfFile
VirtualQuery
GetModuleFileNameA
WriteFile
SetFilePointer
CreateMutexW
CreateMutexA
ReleaseMutex
GetVersion
CreateFileA
DeleteFileA
CreateFileMappingA
DebugBreak
LocalAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFileSizeEx
GetWindowsDirectoryW
IsDebuggerPresent
CreateFileW
GetLastError
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
GetModuleHandleExW
CompareStringW
LockResource
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SetLastError
DeviceIoControl
GetFileAttributesW
DeleteFileW
FlushFileBuffers
GetFullPathNameW
ExpandEnvironmentStringsW
WaitForSingleObject
FormatMessageW
LocalFree
GetTempFileNameW
GetCurrentThread
ole32
CoRegisterPSClsid
CoCreateInstance
CoRegisterClassObject
CoUnmarshalInterface
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoRevokeClassObject
user32
CharNextW
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=18, id=260, version=27412,
count=294, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=43, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/DmiProvider.dll
- IMPHASH cdcb1c9e37d8dab7cb90640fdaca5614
- SHA256 cf2193ff82fdd0bdf338cde659212000ca20bc608dbc747be6fcac7ad10c2189
- MD5 eb28d30b52670a49d828fb58d51c524d
- SHA1 aa5de45caa898b4dabdd581279f7abb069459d80
- SHA512 637bceefedd9bfd1f92264fd64ebc531bc5c0bf0d3040a6da3173346078a4e49f4e6d3a8cb3c09936e62a6365cc63fe931fbf29d0d2fc1e2335692c2650645a3
- SSDEEP 6144:cxsp47Fk1Ej5zwty6GcUeiYCkIDQ6hUmjgZ/ZX94zYMdeni:Spk10JYCkvqUDZ/Z3ni
- TLSH T15064A51173E8852DF0FB3A383A35526548AEFC60AF71C19FD325A25DAE727904E60B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ff:96:6c:6e:00:12:a2:9e:26:9a:20:ba:4b:c4:9f:ba:4b:70:65:ed:da:5e:14:bf:38:31:57:35:d3:08:c7:cc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
214960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
DmiProvider.pdb
msvcrt
towupper
towlower
iswalpha
_wcsnicmp
swscanf_s
memset
__RTDynamicCast
memcmp
memcpy
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
wcsrchr
wcschr
wcsstr
malloc
calloc
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
_wcslwr_s
vswprintf_s
_vscwprintf
_vsnwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
advapi32
RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegUnLoadKeyW
RegLoadKeyW
RegDeleteTreeW
RegDeleteKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
GetDateFormatEx
GetFileAttributesW
WaitForSingleObject
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
LockResource
LoadResource
FindResourceExW
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
FileTimeToSystemTime
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
LocalFree
FormatMessageW
ExpandEnvironmentStringsW
GetFileInformationByHandleEx
SetLastError
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
DeleteFileW
CopyFileExW
GetFinalPathNameByHandleW
GetVersionExW
SizeofResource
CreateFileW
CloseHandle
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
FindClose
GetSystemInfo
SearchPathW
VirtualQuery
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
ole32
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
user32
CharNextW
CharLowerBuffW
LoadStringW
oleaut32
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SafeArrayDestroy
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayAccessData
GetErrorInfo
LoadRegTypeLi
VarBstrCmp
SysAllocStringLen
CreateErrorInfo
SetErrorInfo
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
ntdll
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlGetVersion
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=18, id=260, version=27412,
count=277, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=58, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/FfuProvider.dll
- IMPHASH 14b52629abd71410598f30237e7303f8
- SHA256 c909eb3e54ce57b21ea3891cf70a015d0c4c459522ba244533721b2b815a6d4f
- MD5 187751a17aeb6bf98a1016c2bd368858
- SHA1 7b5a6d8a45190b079ce9ee6d04d70e2ed179e203
- SHA512 53adf1ce98f640ac390b0f8acd5f6dd81ab19e29f41869aff21f4ad459417cd3d8df5d8db3f5528e54066b7150b63a7e8bc0b3d30e636c940dea23ad48602802
- SSDEEP 6144:NK7CJO8J40+Uh/jzNUNl6WzbgfReiYEqnUkPPJijCIL6qtm6FBmdJTpNqBXoOOr7:No7itTIgg6FkTKYOOrEST
- TLSH T17EA438D177D88975E2FA293129F9523850BBBC309F70C4CB275199AE2CB59C08D35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
401856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
FfuProvider.pdb
msvcrt
_wcsnicmp
wcsrchr
iswspace
wcstoul
__RTDynamicCast
_ftol2
memcmp
memcpy
swscanf
_vsnprintf
__CxxFrameHandler3
strchr
bsearch
memmove
??1type_info@@UAE@XZ
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
malloc
_wcsicmp
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_purecall
memmove_s
wcschr
wcstol
_vsnwprintf
_vscwprintf
memcpy_s
vswprintf_s
wcsncpy_s
wcscat_s
free
wcscpy_s
_stricmp
memset
advapi32
RegEnumKeyExW
RegDeleteKeyW
RegEnumKeyW
RegSetKeySecurity
RegFlushKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
GetSystemFirmwareTable
GetVersionExW
IsWow64Process
GetFileSize
LocalAlloc
ReleaseMutex
SetFilePointerEx
SetFileAttributesW
CreateMutexW
CopyFileExW
GetDriveTypeW
LCMapStringW
HeapFree
GetModuleHandleExW
HeapAlloc
GetProcAddress
GetProcessHeap
SetLastError
GetModuleHandleW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
LoadLibraryExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesW
CompareStringW
CreateFileW
GetFileSizeEx
WriteFile
ReadFile
CloseHandle
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapDestroy
MultiByteToWideChar
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SearchPathW
AcquireSRWLockExclusive
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualQuery
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
SetThreadUILanguage
CreateIoCompletionPort
CreateEventW
DeviceIoControl
GetOverlappedResult
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
CopyFileW
GetVolumeInformationByHandleW
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetFileTime
GetDiskFreeSpaceW
GetFirmwareEnvironmentVariableW
DeleteFileW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
DeleteVolumeMountPointW
QueryPerformanceFrequency
WaitForSingleObject
SetEvent
TrySubmitThreadpoolCallback
ole32
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoTaskMemFree
ProgIDFromCLSID
CoUninitialize
CoSetProxyBlanket
user32
CharLowerBuffW
LoadStringW
CharNextW
oleaut32
GetErrorInfo
SetErrorInfo
LoadRegTypeLi
VarBstrCmp
SysFreeString
UnRegisterTypeLi
VariantClear
SysAllocStringLen
CreateErrorInfo
SysAllocStringByteLen
VariantInit
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysStringByteLen
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
FindClose
GetVolumePathNameW
GetFullPathNameW
QueryDosDeviceW
GetFileInformationByHandle
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
OpenThreadToken
GetCurrentThread
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
ntdll
NtOpenFile
NtWaitForSingleObject
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlExpandEnvironmentStrings
NtClose
RtlReAllocateHeap
NtReadFile
NtSetInformationFile
RtlRaiseStatus
NtYieldExecution
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
NtWriteFile
RtlFreeHeap
RtlAllocateHeap
RtlRandom
RtlNumberOfSetBits
RtlFindSetBits
RtlAreBitsClear
RtlSetBits
RtlClearAllBits
RtlInitializeBitMap
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
408KB
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=18, id=260, version=27412,
count=330, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=73, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/FolderProvider.dll
- IMPHASH a5edfbd8caa31b6c107777505d5bd55c
- SHA256 255a4a67bf1576306e2531b0306921c0a647c13b8710ff0e60b96ee45f33d4f7
- MD5 99cb0c1cd2b0b0052bef8f970d41ebfb
- SHA1 f07da79f50ef62c3d7312582238fda71468780a2
- SHA512 3bed63fe60235428764e9355b3c64e6f75cf9f51413896dd9fef4e7def14200e56113fce17575112bb050c8d4f1a09581789dcf7798cc1b31b76d337baed9089
- SSDEEP 1536:EZiFD1JAKqI+7rHC6nL8ygYjXRvgP0gzt:+iFpJAKqt7rHC6L8ygkXe8gZ
- TLSH T1B93317807B8884F5D25E2730692DD36A697EB2A07FD012C33F1693AE2D713C1AE3455A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ca:71:61:7f:7d:ac:fc:25:ad:e3:d3:ea:ee:df:85:16:a2:77:da:86:a2:8c:b2:bf:18:cd:71:8b:28:01:32:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:86:a5:dc:37:eb:d9:61:2d:00:01:00:00:01:cc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
27408
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
FolderProvider.pdb
msvcrt
wcschr
_wcsnicmp
memcmp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
memmove_s
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
SetLastError
GetFileAttributesW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFullPathNameW
GetModuleHandleW
ole32
CoCreateInstance
StringFromGUID2
user32
CharNextW
oleaut32
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
SysFreeString
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
ntdll
RtlFreeHeap
RtlAllocateHeap
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=16, id=260, version=27412,
count=178, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=19, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/GenericProvider.dll
- IMPHASH 990f5faae18e32d70883ebdbe624495f
- SHA256 bcd16a8ac41ce043b16f1e17d6eeb13b474eca382c37e3ab4a7b815e799b080e
- MD5 e7383242e14fba0e95266688f4d9483d
- SHA1 3a3e38af7214669549da002be6a31b5f17218320
- SHA512 a457a5e4b13480e99d2d8e1eec150d20dc6881f7651164d331eb508b50e8e55028be781365f9c60fc56d421d84e3d2dce35f22e7666621c679af8753b713091a
- SSDEEP 3072:yKiiIJRDAQ0miSSuvfuITZbHPdvScKVpDc4P0Ag9:sDDDAkSquI1GVpK
- TLSH T18AB3061037E88575D1FA3A3C59399668527FBD70CFE086CB2A20A3AD59B0AC14D3477B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:38:19:b6:24:5d:f9:84:6a:a3:89:03:ea:99:05:37:73:4f:be:34:5e:72:32:f9:49:15:d9:2d:84:56:b1:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d2:21:24:31:4a:58:bf:2d:11:00:01:00:00:01:d2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
75216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
GenericProvider.pdb
msvcrt
__CxxFrameHandler3
_vsnprintf
wcsrchr
memmove
??0exception@@QAE@XZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
malloc
memmove_s
_vsnwprintf
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
memcpy
memcmp
__RTDynamicCast
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
_CxxThrowException
memset
advapi32
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
LocalFree
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FreeLibrary
CloseHandle
CreateFileW
GetVersionExW
SetComputerNameExW
LocalAlloc
FindResourceExW
LoadResource
LockResource
SetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FormatMessageW
SearchPathW
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
user32
LoadStringW
CharLowerBuffW
CharNextW
oleaut32
SafeArrayDestroy
VariantClear
SysAllocStringByteLen
SysStringByteLen
GetErrorInfo
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VarBstrCmp
SafeArrayCreate
SafeArrayAccessData
SysStringLen
LoadRegTypeLi
SafeArrayUnaccessData
ntdll
RtlFreeHeap
RtlAllocateHeap
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=221, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=34, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/IBSProvider.dll
- IMPHASH d8ae2ea786e04e6aef781b6ca2a7c24b
- SHA256 16ae426df341cc6d5f9bcb19639aeb7439209553d0c4779f8e160caf07ae0dc0
- MD5 2ede07ccaf72af25c666935aad8d82ab
- SHA1 84a1952d1841a69b81c1512ac117861ef50665a0
- SHA512 0a79c266f45d1fbc803c255a04df0a6466854eb8c084670c821f741bf26666acb045e1b384281cde43b65218b73c16459f7202ec3c62ba6b0a41a8071ec1f76a
- SSDEEP 768:GwXus6b7/Vsekhx0hYe/EdaD/UEPK+1Pb049zoI:Gk6b7/Vrkhx0hxDUE9PIwzoI
- TLSH T12A2328427B8885B2C28E2638185DD2AA5A7EFDB05FD001CB3F5273FD6D743C19A3425A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f2:3f:d1:7e:c8:35:d1:b0:ed:24:90:d8:f3:a4:2f:45:66:3b:ad:44:ea:af:b1:20:5b:0e:e4:fe:01:b9:ed:e0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b2:6e:40:03:7f:6e:a9:94:92:00:01:00:00:01:b2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
26256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
IBSProvider.pdb
msvcrt
memmove_s
memcpy_s
_purecall
vswprintf_s
_amsg_exit
wcscat_s
free
wcscpy_s
malloc
??0exception@@QAE@XZ
_XcptFilter
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_callnewh
_CxxThrowException
_vscwprintf
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
memcmp
wcsncpy_s
__CxxFrameHandler3
_vsnwprintf
kernel32
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
advapi32
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
user32
UnregisterClassA
CharNextW
ole32
CoCreateInstance
StringFromGUID2
oleaut32
LoadRegTypeLi
SysAllocStringLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
ntdll
RtlAllocateHeap
RtlFreeHeap
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=16, id=260, version=27412,
count=201, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=19, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ImagingProvider.dll
- IMPHASH bdce74d4290896137fa7947aa90b27eb
- SHA256 33627b4ccccdcd979d46889d435eb08882a80dca4903eafe63bf5bf29293b3df
- MD5 859e3f27a9e1e4aad84c251250cd9464
- SHA1 9168754fcbc183577fdf6eeafaa0c00516efad8e
- SHA512 55263a5857bef5b2f7bce788ccf75d1ded068f6c2e6ac3940485fc6e870042aba205d76c0a3a0444f7013f44cfeaf3edbd52e335c9b4bf5adf1d84c077bd1fef
- SSDEEP 3072:4h6htlhUhXhhhh3hhhhhhhh/hhhhhhhhhhDhhhhhhhhhhhhYg9/RZ/tfWixhCt3y:4h6hnhUhXhhhh3hhhhhhhh/hhhhhhhh1
- TLSH T11DF3B71272E9D065E2FB273435375265533BB930DF7482EF1221EA6E09726E04D2EB27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a6:4f:3c:b8:71:a5:00:ad:e0:2b:71:03:70:49:ea:c5:66:c4:be:01:cd:4b:db:2d:58:bd:2c:50:50:b6:62:bf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:86:a5:dc:37:eb:d9:61:2d:00:01:00:00:01:cc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
99616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
ImagingProvider.pdb
msvcrt
memcmp
wcsrchr
wcschr
towlower
iswalpha
_vsnwprintf
__CxxFrameHandler3
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
malloc
calloc
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
_wcsicmp
vswprintf_s
_vscwprintf
_wtoi64
wcstoul
_wcsnicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__RTDynamicCast
memset
advapi32
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
GetVersionExW
SetLastError
SearchPathW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
GetLocaleInfoW
GetNumberFormatW
HeapAlloc
GetProcessHeap
HeapFree
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SetThreadUILanguage
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree
CloseHandle
FreeLibrary
CreateFileW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
user32
CharNextW
CharLowerBuffW
LoadStringW
oleaut32
CreateErrorInfo
SysStringByteLen
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
GetErrorInfo
SysAllocStringByteLen
VarBstrCmp
LoadRegTypeLi
SysAllocStringLen
VariantClear
SetErrorInfo
ntdll
VerSetConditionMask
RtlVerifyVersionInfo
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=238, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=31, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/IntlProvider.dll
- IMPHASH 63703f73c4039b747c29ce02074e9556
- SHA256 d1fb328f357eebf80aae34ef214b5d4127a4ec7a80f71eb4512c4ac8831284b7
- MD5 761d84ed77d6e74e4bb07bbacc171a1d
- SHA1 3eb6ed953be2a05802d6511ce91e237b009c6525
- SHA512 5d77147e1147805f7792e18c22edb5b7cb528f7214b52e9c799fed24b00841da3dc9a00554f26fcf94e01d14808e7ab776f13c5830d0eda2a7832b0df580b2db
- SSDEEP 6144:x2gUeW8o9bHgEmndspD+lHtq5KVY8Wz+OL3Opvq8:x2gLdEMoTL3Mq8
- TLSH T10334E611A3D4A079E2FB3B3029BA466156BFBC719EF0D58F6740665D18B27808E34B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bf:f0:e3:ae:17:61:eb:a1:75:55:3b:85:b2:7e:cc:b5:53:cb:4c:d3:b7:d0:e1:cf:1c:9f:69:c9:db:c6:04:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
163200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
IntlProvider.pdb
msvcrt
_XcptFilter
_initterm
?terminate@@YAXXZ
memcmp
_callnewh
??0exception@@QAE@XZ
memmove_s
ceil
wcschr
_ftol2_sse
_wtoi
wcscat_s
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_purecall
vswprintf_s
_vscwprintf
wcstoul
wcstol
_vsnwprintf
memcpy_s
malloc
wcsncpy_s
_except_handler4_common
??1type_info@@UAE@XZ
_errno
free
realloc
wcscpy_s
__RTDynamicCast
bsearch
_wcsicmp
_itow_s
_wcsnicmp
_CIlog
_amsg_exit
_lock
_unlock
__dllonexit
_onexit
memcpy
__CxxFrameHandler3
_CxxThrowException
memset
oleaut32
SysStringLen
SysStringByteLen
SysFreeString
SetErrorInfo
CreateErrorInfo
SysAllocString
SysAllocStringByteLen
VariantClear
VarUI4FromStr
VarBstrCmp
VarBstrCat
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
kernel32
UnmapViewOfFile
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetFileAttributesExW
IsDebuggerPresent
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
SetLastError
WaitForSingleObjectEx
LockResource
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
SetThreadUILanguage
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
FreeLibrary
SetUnhandledExceptionFilter
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
OpenSemaphoreW
CreateMutexExW
DebugBreak
SearchPathW
lstrcmpiW
LoadLibraryW
UnhandledExceptionFilter
RaiseException
Sleep
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
DeleteCriticalSection
CompareStringW
LocalFree
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
CloseHandle
CreateFileW
CopyFileW
DeleteFileW
GetTempPathW
GetTempFileNameW
WideCharToMultiByte
WriteFile
GetPrivateProfileSectionNamesW
lstrcmpW
GetPrivateProfileSectionW
GetGeoInfoW
HeapAlloc
GetProcessHeap
FindClose
HeapFree
FindFirstFileW
FindNextFileW
FormatMessageW
GetFileAttributesW
HeapDestroy
HeapSize
HeapReAlloc
ole32
ProgIDFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
user32
CharLowerBuffW
CharNextW
UnregisterClassA
LoadStringW
advapi32
RegQueryValueExW
RegDeleteValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
PrivilegeCheck
RegEnumValueW
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegDeleteKeyW
LookupPrivilegeValueW
shlwapi
SHGetValueW
StrChrW
input
ord110
ord112
ord109
setupapi
SetupCloseInfFile
SetupInstallFromInfSectionW
SetupOpenInfFileW
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=18, id=260, version=27412,
count=224, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=14, id=261, version=27412,
count=1, id=256, version=27412,
count=47, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/LogProvider.dll
- IMPHASH a981dd3e9810502a0e1fd92357c1f936
- SHA256 366008cb476c5ac8741ff756bf9944e953a4cfffc04e47066e962c8591f2569b
- MD5 c50264f446c5e0799a555312b66a1ab0
- SHA1 b71832bc53c5a4b803c19f2d097ad9f885e9cc8e
- SHA512 a0d59180a912c04602f4fed9e7e8178c0a6749489e0ff23ccd498a90ccac16cbec0c924778076a396f9bfb0a4386ce58230f15b9c9e37474783a71ebd76971b4
- SSDEEP 1536:ezXUa5rWqHF7xj3K+FWGGMX0Igx7DAJoNoc/PP+zF:erUa5rLxj3K+FWGGMX0Igx7DAJoN3/+R
- TLSH T19D5319616F9488B9E6EA3530792C9376697EB8634FF081CB2B03539D1C716C0AD3472B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5d:d1:9a:c6:9a:a7:89:48:36:c3:3a:f0:d5:32:6d:56:de:ee:a4:07:39:0d:cb:42:a0:a2:bd:a6:e2:a9:9d:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b4:fb:80:08:44:05:d2:2d:fa:00:01:00:00:01:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
35808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
LogProvider.pdb
msvcrt
_amsg_exit
_XcptFilter
_initterm
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
calloc
memmove_s
memcpy_s
_purecall
vswprintf_s
_vscwprintf
_vsnprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_errno
realloc
memcmp
wcschr
_CxxThrowException
__CxxFrameHandler3
vsprintf_s
_vscprintf
_vsnwprintf
_wcsnicmp
memset
ntdll
RtlFreeHeap
RtlAllocateHeap
oleaut32
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SysAllocStringLen
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
FreeLibrary
SetLastError
GetFileAttributesW
GetFullPathNameW
GetVersionExW
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
HeapAlloc
GetProcessHeap
OutputDebugStringA
HeapFree
CreateDirectoryW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
CreateFileW
CloseHandle
FormatMessageW
LocalFree
GetSystemWindowsDirectoryW
ole32
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2
user32
CharNextW
LoadStringW
wdscore
WdsGenericSetupLogInit
CurrentIP
WdsSetupLogDestroy
WdsSetupLogMessageA
ConstructPartialMsgVA
WdsGetSetupLog
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=240, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=27, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/MsiProvider.dll
- IMPHASH b81e2f01a18094794075dc305228b98f
- SHA256 2ea44a59e516e342d95f93f1f97a834ed7cace232260cb8c919d7b263318eba8
- MD5 0060cef712b9df13cf8f06745fce1e15
- SHA1 355505b1d5f696901245c3b9e4027ab905450661
- SHA512 28b357f9e58827fabe6052b5aa48ffd78967307131ceecd2929001af81a68f16da7dcadfa09110eab213b83241b864d41e8721a2ba19092d4789d495a1d83bde
- SSDEEP 3072:rnQ8+RAuWXA7e4+SJmlIQ2o/65awaEm53hJnxxDWy0LDOEQlUoMI03Pw9:rn1pA7e4+KmcaEm53bxxD4LDU
- TLSH T1A9F3E71172E99029E1FB2638393742A5567FBD70CFB483DF2620A7AE49316D08E35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:cc:77:e8:aa:d9:1a:da:35:90:9b:65:a6:24:49:57:b3:90:e4:5e:e8:5e:ed:72:e9:77:6e:f5:10:3a:98:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d2:21:24:31:4a:58:bf:2d:11:00:01:00:00:01:d2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
101888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
MsiProvider.pdb
msvcrt
memcpy_s
vswprintf_s
wcsncpy_s
wcscat_s
free
_vscwprintf
wcsrchr
_purecall
memmove_s
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
malloc
wcschr
wcsstr
_wcslwr_s
_wcsnicmp
??0exception@@QAE@XZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
memcpy
memcmp
__RTDynamicCast
towupper
wcscpy_s
__CxxFrameHandler3
_vsnwprintf
memset
ntdll
RtlAllocateHeap
RtlFreeHeap
kernel32
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleExW
SetThreadUILanguage
CompareStringW
GetFullPathNameW
FreeLibrary
CopyFileW
LoadLibraryW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FormatMessageW
LocalFree
GetFileAttributesW
CreateFileW
CloseHandle
SetLastError
advapi32
RegQueryInfoKeyW
RegCloseKey
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
user32
CharNextW
UnregisterClassA
LoadStringW
CharLowerBuffW
ole32
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2
oleaut32
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
VarBstrCat
SysAllocStringByteLen
LoadRegTypeLi
SetErrorInfo
VariantClear
SysStringByteLen
CreateErrorInfo
SysFreeString
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=245, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=42, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/OSProvider.dll
- IMPHASH fee373d9407a12dfb7bd95071073ddb2
- SHA256 ac2c152a6f32046bec517651c4de784d88134e0f086456491aa57883a97f4a0b
- MD5 7e4401c730654ad48cee7fc54fea9ae5
- SHA1 bb14329468e61ce9e95bcc2977bf39a7b888b128
- SHA512 e0b5d0817074b73440b71e76be1802a650c48c4a9ef441fd5060774625e9d77be657e6fd9f7497928d35165cfc91a4a294cd596ae918d5f734a6e0c48f629e2a
- SSDEEP 3072:XXW6KlSJiAuDokfdIeMcbWHx2Ivkx9FuGCBMqm0ufUjT6:XXW6YhfdgciR2Gu9FnCo0A
- TLSH T190B3F85237E8C136F2FB3A7C2A3856369A3BB4359EB0864F2A30829D5C356C19D31757
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:cb:ff:6b:02:02:69:39:37:d6:22:43:ce:e4:01:02:76:11:36:83:55:d6:06:4b:b2:9e:f9:51:e0:4a:c9:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b9:f6:00:0d:65:54:4f:bc:03:00:01:00:00:01:b9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
83440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
OSProvider.pdb
msvcrt
towupper
wcschr
wcsrchr
_wcsnicmp
wcsncmp
_vsnwprintf
memset
memcmp
memcpy
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
memmove_s
memcpy_s
_purecall
wcsstr
_wcslwr_s
vswprintf_s
_vscwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
advapi32
RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegUnLoadKeyW
RegLoadKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringW
Sleep
OpenProcess
GetCurrentProcess
CloseHandle
SetEnvironmentVariableW
FreeLibrary
GetEnvironmentVariableW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFullPathNameW
CreateFileW
LocalFree
GetFileInformationByHandle
FormatMessageW
ReadFile
SetFilePointer
SetLastError
GetVersionExW
GetFileAttributesW
GetSystemWindowsDirectoryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SearchPathW
GetModuleHandleExW
GetSystemInfo
ole32
CoTaskMemFree
ProgIDFromCLSID
CoCreateInstance
StringFromGUID2
user32
LoadStringW
CharNextW
oleaut32
SysAllocStringByteLen
LoadRegTypeLi
SetErrorInfo
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
CreateErrorInfo
SysStringByteLen
ntdll
RtlAllocateHeap
NtUnloadKey2
NtQueryInformationProcess
NtQueryOpenSubKeysEx
RtlInitUnicodeString
RtlFreeHeap
version
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=16, id=260, version=27412,
count=262, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=46, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/OfflineSetupProvider.dll
- IMPHASH e04f423e3ebd9f1d8107be88cffea65b
- SHA256 3e7665c910ab0bb499a5fac250e3035e344ed9c7628ae0838f18103d5e657a17
- MD5 f5ed099ffb9667ab4e9e684934ec3bf6
- SHA1 ef5bfce75e987de6c29190d08205a7b127144c61
- SHA512 1e8af3dbef96340858f898416d8c4249ab53ecb45d03a3723294504c3e2efbe01d200c8fb28b90d75a6049ac6136197e3134dbd48bfdc3155cbd2bb1e8681f8e
- SSDEEP 3072:5Gy7WYNgv6GsU8MmGinJeZqDaTlSJJcWgrI4+:A8M1Ti+qsg0WV
- TLSH T1F6D3E70177E884A9D1FA2A7C3D3946A56B3F7D70CFB0869F2260A76E2C706918D34357
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:57:c4:10:20:3b:51:d0:c0:03:7f:33:2d:4d:c4:a3:42:9c:25:a2:f0:dc:51:2d:2b:89:41:d8:d5:c5:de:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cd:55:07:2a:e7:ca:c1:99:1d:00:01:00:00:01:cd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
90448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
OfflineSetupProvider.pdb
msvcrt
__CxxFrameHandler3
_vsnwprintf
__RTDynamicCast
towupper
memcmp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
memmove_s
wcschr
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
vswprintf_s
_vscwprintf
malloc
_stricmp
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
memset
advapi32
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
ConvertStringSidToSidW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyValueW
RegDeleteTreeW
RegDeleteValueW
RegGetValueW
kernel32
SearchPathW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringW
CompareStringOrdinal
FreeLibrary
LocalFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LocalAlloc
CloseHandle
VirtualProtect
CreateFileW
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemInfo
VirtualQuery
FindResourceExW
LoadResource
SetLastError
LeaveCriticalSection
HeapFree
ole32
StringFromGUID2
CoCreateInstance
shlwapi
ord158
user32
CharLowerBuffW
CharNextW
oleaut32
SysAllocStringLen
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
SysAllocString
ntdll
NtDeviceIoControlFile
NtClose
NtOpenFile
RtlNtStatusToDosError
RtlAllocateHeap
RtlFreeHeap
NtOpenProcessToken
NtDuplicateToken
NtAdjustPrivilegesToken
NtSetInformationThread
RtlGUIDFromString
RtlInitUnicodeString
dnsapi
DnsValidateName_W
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=18, id=260, version=27412,
count=213, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=33, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ProvProvider.dll
- IMPHASH 2f2c21d4229e1ffc4627e88837a8b6cb
- SHA256 690bdd23dab1cdd7888e9ead366e4c4743bb549eee6dce12e7f5567c1840254b
- MD5 7363de8a3441be135803166e346e72e4
- SHA1 370be83fc247a5dafe0ec4d08ff81de66884aae0
- SHA512 447a66bc5f64f917e243170441a3c20c0fc2360430f6bc7a884c82f6fbd01f62d587ca6bf8e9db37b39b7c5a1936ae634d28c18c9c1aa7f5e9e930edd6a743d0
- SSDEEP 12288:veB1ahRdCDB0ynCiwwQ626VfikQaONOKV1nl37G7IvZI0/inriOzGXcu2inH:vlcEiwVaONpVRNzcu2GH
- TLSH T1EFD46D1263D14475E1B725B036396B350C6FBE32CFB484CB32E49AA96E716C19E3A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:6b:2b:05:be:20:cd:59:c4:dc:ad:73:3a:ac:ed:f1:09:f4:f8:61:b2:e6:f3:5d:34:ef:a2:4b:64:23:55:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
522192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
ProvProvider.pdb
msvcrt
_vsnwprintf
_wcsicmp
memcmp
memcpy
wcschr
_wcsnicmp
towupper
strcpy_s
qsort
iswalpha
iswspace
towlower
_wcsrev
_wcslwr
_strnicmp
strncpy_s
_wcstoi64
_wtoi
__CxxFrameHandler3
__RTDynamicCast
_vsnprintf_s
_vsnwprintf_s
memmove
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
wcsstr
_wcslwr_s
malloc
wcsncpy_s
wcscat_s
wcscpy_s
_purecall
vswprintf_s
_vscwprintf
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
??0exception@@QAE@ABV0@@Z
free
wcstoul
wcstok_s
wcsncmp
wcsrchr
swscanf_s
memset
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetAclInformation
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegGetValueW
RegSetValueExW
GetSecurityInfo
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw
kernel32
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
GetLastError
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
MapViewOfFile
CompareStringW
UnmapViewOfFile
GetVersionExW
SearchPathW
RaiseException
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
GetSystemInfo
GetHandleInformation
SetFilePointerEx
SetEndOfFile
GetOverlappedResult
SetFilePointer
SetThreadIdealProcessor
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
SetThreadUILanguage
GetModuleHandleW
LoadLibraryExW
CopyFileW
CreateFileMappingW
GetProcAddress
LockFileEx
UnlockFileEx
OpenProcess
GetPrivateProfileSectionW
WaitForMultipleObjects
GetVolumeInformationByHandleW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForMultipleObjectsEx
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
LoadLibraryW
GetVolumePathNamesForVolumeNameW
WideCharToMultiByte
CreateSemaphoreExW
GetFileInformationByHandleEx
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
GetTempPathW
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetFileInformationByHandle
SetFileInformationByHandle
DeleteFileW
CloseHandle
CopyFileExW
FlushFileBuffers
GetFileSizeEx
WaitForSingleObject
GetCurrentDirectoryW
FreeLibrary
CreateDirectoryW
GetFullPathNameW
GetLongPathNameW
GetFinalPathNameByHandleW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
ExpandEnvironmentStringsW
FormatMessageW
SetEvent
CreateThread
ResetEvent
LocalFree
GetModuleFileNameA
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
ReadFile
WriteFile
RemoveDirectoryW
LocalAlloc
GetCurrentThread
DuplicateHandle
CreateEventW
ole32
CoCreateGuid
StringFromGUID2
CoCreateInstance
user32
CharUpperW
CharLowerBuffW
CharNextW
oleaut32
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarBstrCmp
SysAllocStringLen
profapi
ord104
ntdll
RtlFindAceByType
NtSetSecurityObject
RtlDosPathNameToNtPathName_U
NtOpenFile
NtQueryDirectoryFile
NtClose
NtQueryInformationFile
NtQueryInformationProcess
NtQueryEaFile
NtCreateFile
NtSetEaFile
RtlImpersonateSelf
RtlAdjustPrivilege
RtlInitializeResource
RtlAcquireResourceExclusive
RtlSetControlSecurityDescriptor
RtlReleaseResource
RtlDeleteResource
RtlReAllocateHeap
RtlRaiseStatus
NtYieldExecution
DbgPrintEx
RtlAcquireResourceShared
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
xmllite
CreateXmlWriter
CreateXmlReader
bcrypt
BCryptCreateHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptDestroyHash
cabinet
ord22
ord23
ord20
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
529KB
Virtual Size
528KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=27412,
count=19, id=260, version=27412,
count=385, id=1, productName=Unmarked objects,
count=27, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=183, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/SetupPlatformProvider.dll
- IMPHASH 3dbaf56ad32ac903bbf17c397ce29238
- SHA256 5a903c4d303edff0a554ded40bc0747c4e71f8a59f12b8850d1714963c229397
- MD5 e0cdca214a08e211710ac3550336025e
- SHA1 2205c04a1dd40e58cac37f3d02d3fa669f0f9479
- SHA512 ef2b56e652ea9ee47507aad2aa17ccbebbc2a459b2f080570d5aad8564b6b53683b1fd58fb875909e314d7bafba0fb593a5382031600b05d27428d102bfff636
- SSDEEP 3072:XrAb10S8cyo0kGoV+Y8S1xrnzq88dwfxHYMkDqDlg8wP7T:Xr8zV+Y88rzq1SJde7T
- TLSH T162C3B45177D885A8F1FE263C793892A5567B7C309BF086CB2E20A75D2C746D08E34B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e1:39:58:c3:c0:34:c2:ad:41:c9:b1:ce:17:f2:4d:2e:10:a6:72:ac:30:d6:f7:ad:fd:e2:53:c1:bd:af:33:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b2:6e:40:03:7f:6e:a9:94:92:00:01:00:00:01:b2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
81504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
SetupPlatformProvider.pdb
msvcrt
wcschr
_wcsicmp
_wcsnicmp
wcsrchr
_vsnwprintf
memcpy
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
malloc
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
??0exception@@QAE@ABV0@@Z
_purecall
vswprintf_s
_vscwprintf
wcstoul
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
memcmp
__RTDynamicCast
memset
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
GetDiskFreeSpaceExW
FreeLibrary
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
DeviceIoControl
SetFileAttributesW
DeleteFileW
MoveFileW
GetFileInformationByHandleEx
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
MapViewOfFile
SetFileInformationByHandle
FindClose
FindNextFileW
FindFirstFileW
CopyFileExW
SetLastError
CreateFileW
UnhandledExceptionFilter
GetCurrentDirectoryW
GetFinalPathNameByHandleW
GetLongPathNameW
GetFullPathNameW
CreateDirectoryW
SearchPathW
CompareStringW
SetThreadUILanguage
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree
GetFileAttributesW
GetWindowsDirectoryW
MoveFileExW
CloseHandle
ole32
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoTaskMemFree
user32
CharNextW
CharLowerBuffW
LoadStringW
oleaut32
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringByteLen
GetErrorInfo
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SetErrorInfo
CreateErrorInfo
VarBstrCmp
LoadRegTypeLi
SysStringLen
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
crypt32
CertVerifyCertificateChainPolicy
wdscore
ConstructPartialMsgVW
WdsSetupLogMessageW
CurrentIP
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
ntdll
NtSetInformationFile
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=230, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=31, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/SmiProvider.dll
- IMPHASH b93c15261e824d090f9b09604966ae4a
- SHA256 d3b244645efa7b19253dc46c9112ae7b46b06e6f711f68e79b4173b2c5615101
- MD5 083c8b289b5a3e4add22c70ffdaf5fa4
- SHA1 df274a1120a67ba822e905b8ce8ea4b5e6ceef98
- SHA512 dc5e893b675dbd94f0f9cfca74bee7ec46706edd61f4054084db5573f1e7044a57cb15950398f12eff9938c4f871c677f4afa43d4cd466d53b32758d613481e3
- SSDEEP 6144:9hzJw7/Lek3SbUgKoMD1yW/fNXMJINr5kFjD2Vv50:zz+xSbdgB3N4cwjDIO
- TLSH T18B248E53B38488B1D2BB3630953C7679557EFE200FE086DB5328AA6D5A316C1AD3931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4d:e2:3b:46:75:15:21:4d:d1:88:86:fd:ec:50:ef:65:ac:5a:47:f8:c3:39:5c:5a:bb:4d:cd:a9:62:a3:3b:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
181456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
SmiProvider.pdb
msvcrt
??1type_info@@UAE@XZ
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
memmove
iswspace
?what@exception@@UBEPBDXZ
?terminate@@YAXXZ
wcschr
_wcslwr_s
_wcsnicmp
wcsstr
_wcsicmp
_vsnprintf
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_except_handler4_common
_initterm
__CxxFrameHandler3
_amsg_exit
_XcptFilter
_CxxThrowException
towupper
_callnewh
memmove_s
_vsnwprintf
_purecall
vswprintf_s
_vscwprintf
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
??0exception@@QAE@XZ
memcpy
memcmp
memset
advapi32
LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
AdjustTokenPrivileges
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SetFilePointer
GetModuleHandleExW
ReleaseSemaphore
GetFullPathNameW
SetLastError
CreateSemaphoreExW
GetModuleFileNameA
ReadFile
CloseHandle
DebugBreak
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DeleteCriticalSection
IsDebuggerPresent
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
FormatMessageW
ReleaseMutex
GetFileAttributesW
CreateFileW
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
user32
CharNextW
oleaut32
UnRegisterTypeLi
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
LoadRegTypeLi
rpcrt4
UuidCreate
I_RpcMapWin32Status
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlInitUnicodeString
RtlNtStatusToDosError
NtWriteFile
NtReadFile
RtlReAllocateHeap
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
NtSetInformationFile
NtClose
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=17, id=260, version=27412,
count=308, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=11, id=261, version=27412,
count=1, id=256, version=27412,
count=60, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/SysprepProvider.dll
- IMPHASH 12f0ded3ea169c671c0d1c5476213715
- SHA256 f13efda7cc2be2087ce4893904bc77aa1691e51e19299101db71e2d8f1f6c981
- MD5 2caebbce4266bd9e9f5227b62b9472df
- SHA1 81e7180b37d029950784adc446f8fa033bd46ac7
- SHA512 4bf05e44cc5a4cfbaf3d671221e0c2b025725e0b6e7747943dda4de98d340b35a6737ecccfbd6b3fe1ca5ee4df3aa986c2d5d5c4f5cc8a92341773a3089d5a24
- SSDEEP 6144:YhCqCooNCE0geOikrTSKynaZZSzYbgW8fnIABk/uvlyyrLH+UHfzct3Yn+NKLB:TqCooH0k2aazW8fnW/AsUbct318
- TLSH T1FAC45D3072589A31EEBF363B952A9661617E6422E7F189C3EF7463BD55340C05F32B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
eb:7b:03:b0:02:8e:65:12:54:e7:51:55:03:c6:0a:4b:38:31:8d:ea:3c:ae:5c:66:20:26:f8:4b:ab:66:e6:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
449472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
SysprepProvider.pdb
msvcrt
wcsrchr
_vsnwprintf
_wcslwr_s
__RTtypeid
wcschr
_wcsnicmp
wcsstr
wcsncmp
iswalpha
iswspace
?name@type_info@@QBEPBDXZ
wcstol
time
_wctime
memcmp
_ftol2
__RTDynamicCast
_vsnprintf
memcpy
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
malloc
calloc
memmove_s
_wcsicmp
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
memset
advapi32
UnregisterTraceGuids
EventRegister
EventUnregister
QueryServiceStatus
CloseServiceHandle
NotifyServiceStatusChangeW
ControlService
EnumDependentServicesW
StartServiceW
OpenServiceW
RegDeleteTreeW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
TraceEvent
OpenSCManagerW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
EventWriteTransfer
kernel32
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
CreateEventW
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
CloseHandle
HeapSize
HeapReAlloc
HeapDestroy
CompareStringW
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FindClose
DisableThreadLibraryCalls
DeviceIoControl
FindNextFileW
FindFirstFileW
FindNextFileNameW
SetErrorMode
FindFirstFileNameW
SizeofResource
GetSystemInfo
SetFilePointer
ReadFile
MapViewOfFile
GetFileInformationByHandleEx
SleepEx
FlushFileBuffers
CreateThread
FormatMessageW
WaitForSingleObject
CreateFileW
GetFileAttributesW
LocalFree
ExpandEnvironmentStringsW
GetVersionExW
CreateFileMappingW
UnmapViewOfFile
SearchPathW
SetLastError
IsWow64Process
TerminateThread
GetExitCodeThread
WaitForMultipleObjects
GetModuleHandleExW
LockResource
LoadResource
FindResourceExW
WritePrivateProfileStringW
GetFullPathNameW
ExitProcess
RemoveDirectoryW
GetFileAttributesExW
CreateDirectoryW
VirtualQuery
HeapValidate
HeapCompact
DebugBreak
SetFileAttributesW
GetFileInformationByHandle
SetFileInformationByHandle
DeleteFileW
ole32
StringFromGUID2
CoCreateInstance
user32
CharNextW
CharLowerBuffW
oleaut32
SysStringLen
VariantClear
LoadTypeLi
UnRegisterTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VarBstrCmp
LoadRegTypeLi
VariantInit
RegisterTypeLi
SysAllocString
wimgapi
WIMGetMountedImageInfo
wdscore
CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW
ntdll
NtSetSystemInformation
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlGetVersion
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=21, id=260, version=27412,
count=306, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=14, id=261, version=27412,
count=1, id=256, version=27412,
count=92, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/TransmogProvider.dll
- IMPHASH c6891cde0955b7c9e52805e7c4019749
- SHA256 2d90bd01adde8335263aa4226e55870fd7db11049c967d236949bae4d26e5f12
- MD5 66bc4278b561f149e6e9f09f60d39551
- SHA1 0b61b68e45549528933ad990fa3de5f1dbb2eaa2
- SHA512 ba09b10e7f363f48796672c155d6307e73632173d8a3c8f42c1c52427bb45ddb12df4af72a9097228321dd03654fb355e78f0dddf671108c3f23fa6afc9c33fc
- SSDEEP 12288:xIH6PohyG/O36+0gc9k+eGfCE+cfzKAdqyS:jHGt+0gcGeCxtAkN
- TLSH T1AE4532385AF90629F0F39B75DAB666D9AD37BC1279008E8E0191424A0D33F529C75F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a6:b3:c0:89:66:e2:62:f6:3e:c9:36:87:4b:7b:a0:d5:ec:72:8b:4c:f8:02:c3:e4:ef:49:8a:7b:45:49:28:03
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 12, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
1113360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
TransmogProvider.pdb
msvcrt
_snprintf_s
strncmp
bsearch
??0exception@@QAE@XZ
wcstoul
wcsrchr
_wcsnicmp
wcschr
_wcsicmp
_CxxThrowException
iswspace
__RTDynamicCast
memcmp
memcpy
memmove
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
memmove_s
wcscat_s
_vsnwprintf
wcsstr
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
wcscpy_s
wcsncpy_s
malloc
free
_vscwprintf
_purecall
vswprintf_s
memcpy_s
__CxxFrameHandler3
memset
advapi32
RegDeleteKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegLoadKeyW
RegUnLoadKeyW
kernel32
SizeofResource
HeapFree
EnterCriticalSection
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetLastError
RaiseException
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
LocalFree
CompareStringW
OutputDebugStringW
SetThreadUILanguage
LoadLibraryW
GetPrivateProfileIntW
CreateFileW
CloseHandle
CopyFileW
CreateThread
WaitForSingleObject
GetExitCodeThread
DisableThreadLibraryCalls
GetFileAttributesW
SetThreadLocale
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetFileInformationByHandleEx
SetLastError
GetFullPathNameW
GetLongPathNameW
GetFinalPathNameByHandleW
GetSystemWindowsDirectoryW
LocalAlloc
GetUserDefaultUILanguage
GetLocaleInfoW
IsWow64Process
LockResource
LCMapStringEx
CompareStringOrdinal
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetVersionExW
CopyFileExW
SetFileInformationByHandle
GetFileInformationByHandle
GetCurrentDirectoryW
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
SetFileAttributesW
DeleteFileW
GetThreadLocale
FormatMessageW
ole32
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VariantClear
SetErrorInfo
CreateErrorInfo
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysAllocStringLen
VarUI4FromStr
SysStringLen
SysAllocString
SysAllocStringByteLen
user32
CharNextW
UnregisterClassA
CharLowerBuffW
LoadStringW
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
setupapi
SetupCloseInfFile
SetupGetIntField
SetupFindFirstLineW
SetupFindNextLine
SetupGetStringFieldW
SetupOpenInfFileW
ntdll
RtlCreateUnicodeStringFromAsciiz
NtQueryValueKey
DbgPrint
RtlQueryEnvironmentVariable_U
LdrLoadDll
RtlDosPathNameToNtPathName_U
LdrUnloadDll
LdrGetDllHandle
NtOpenKey
LdrGetProcedureAddress
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlTimeToTimeFields
RtlHashUnicodeString
NtYieldExecution
RtlRaiseStatus
NtQueryPerformanceCounter
NtOpenFile
NtWaitForSingleObject
NtCreateFile
NtQueryInformationFile
RtlExpandEnvironmentStrings
NtClose
RtlLeaveCriticalSection
RtlReAllocateHeap
NtReadFile
RtlInitUnicodeString
NtWriteFile
RtlNtStatusToDosError
NtSetInformationFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
RtlAllocateHeap
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=27412,
count=18, id=260, version=27412,
count=309, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=111, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/UnattendProvider.dll
- IMPHASH 9f735b435337bd185b589a7d2212f2d4
- SHA256 e7549ca0131a6dfef549e7551052b95d0e0cfe7006eef09889cb565bdcc7cb9b
- MD5 b3bbf6d96817cc46d3695a247093b021
- SHA1 6b6b9fc645f1f5518ffaf1b78e2d26db41f8858f
- SHA512 07c4b7ec3eae8330e506dbb1dc2b72f17943bf958d7f4049d2289dfbef4a41b1eac9c651b16052455cef5ada260ee420d381c73f4c64711e18e39a5edcffb34f
- SSDEEP 3072:wG9iPZxugVRS/ADe+6PUSDbjbE9nW2GchH4QtKPp8laXVcQXPvKpEQUrHfr4ZswY:TwZxugW/AV6PUSDHbE9nWzchbcPClalh
- TLSH T157045C22A784C872C5BB3630091BB37854BEADA04FE085DB2B50BA7E5D30AD15D3975F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:24:90:5f:1b:06:e7:0d:f9:b2:ee:6f:91:d9:46:48:f0:14:fe:cd:11:01:1e:9f:aa:36:25:61:8a:07:98:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b2:6e:40:03:7f:6e:a9:94:92:00:01:00:00:01:b2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
139552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
UnattendProvider.pdb
msvcrt
_wcsicmp
_vsnwprintf
__RTDynamicCast
memcmp
memcpy
memset
wcsrchr
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
malloc
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
calloc
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__CxxFrameHandler3
advapi32
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
kernel32
SetLastError
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetProcessHeap
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
SetThreadUILanguage
GetFileAttributesW
SetCurrentDirectoryW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetFullPathNameW
CloseHandle
FreeLibrary
SearchPathW
GetVersionExW
UnmapViewOfFile
CreateFileW
LocalFree
LockResource
LoadResource
GetCurrentDirectoryW
FindResourceExW
MapViewOfFile
FormatMessageW
CreateFileMappingW
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
user32
LoadStringW
CharLowerBuffW
CharNextW
oleaut32
SysStringLen
RegisterTypeLi
SysStringByteLen
SysAllocString
UnRegisterTypeLi
SysFreeString
VarBstrCmp
SysAllocStringByteLen
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo
VariantClear
LoadTypeLi
ntdll
RtlNtStatusToDosError
NtSetInformationFile
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
RtlAllocateHeap
NtWaitForSingleObject
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=227, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=52, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/VhdProvider.dll
- IMPHASH f3ab22b5bb332b1947d57a9ba4f02c89
- SHA256 7cf146068a3eb3c60d0a11c306cc5f3fc4385b9b2ebdbe561c8f3af4a7682049
- MD5 e28dae92f4aa03220510618c86d27e7b
- SHA1 971afcb2816ad2b575faaf4079e138ffe4ef8ac8
- SHA512 ac0cf1e02d66e624d4d5165bf5bdc999576cf8c41369f09bcf3f780035295cd3e0c765ba55bc48fbdadeff944c89f39d2cc9c1cc692dacb46cc4b91bd55db37b
- SSDEEP 6144:AnX+w6IUL3tN7cUCgSnGkpKEe6bsWoujZK/HfpD6ucoSoVrrGspJ6e9jxSOdj:6ai/bNXZC0o6e9kOdj
- TLSH T16D943A5167D888B9F2BB363015F95A354D7FF821AB70C9CF522099AE6930AC08D39737
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
41:f7:16:f7:ea:7e:28:b8:55:13:48:d1:d5:6d:11:fa:1f:40:92:df:fe:c7:19:72:41:d6:cf:19:ed:c8:80:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
364416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
VhdProvider.pdb
msvcrt
memcpy
_onexit
memmove
__dllonexit
_unlock
_lock
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
malloc
_stricmp
wcsncmp
_wcsnicmp
iswalpha
wcsrchr
wcschr
iswspace
towlower
iswctype
_wtoi
__CxxFrameHandler3
towupper
wcstoul
_vsnwprintf_s
memcmp
bsearch
_wcsupr
wcstok_s
qsort
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_purecall
wcsncpy_s
wcscat_s
memmove_s
calloc
_wcsicmp
wcsstr
_vsnwprintf
_vscwprintf
memcpy_s
vswprintf_s
free
wcscpy_s
memset
advapi32
RegDeleteKeyExW
RegFlushKey
RegEnumKeyExW
RegDeleteTreeW
AdjustTokenPrivileges
RegLoadKeyW
RegUnLoadKeyW
DuplicateTokenEx
SetThreadToken
RegGetValueW
RegEnumValueW
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
kernel32
LockFileEx
UnlockFileEx
CloseHandle
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
GetLastError
HeapFree
GetProcessHeap
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
Sleep
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
HeapAlloc
LoadLibraryExW
GetProcAddress
FreeLibrary
DeleteVolumeMountPointW
GetFileAttributesW
SetFileAttributesW
CreateMutexW
WaitForSingleObject
ReleaseMutex
DeleteFileW
GetVolumePathNamesForVolumeNameW
SetLastError
MultiByteToWideChar
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetModuleFileNameW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
CompareStringW
HeapSize
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SetEndOfFile
WriteFile
GetFileTime
SetFilePointerEx
GetFileSizeEx
ReadFile
VerSetConditionMask
GetSystemInfo
GetVersionExW
CopyFileExW
GetDiskFreeSpaceW
GetTempPathW
GetDriveTypeW
DeviceIoControl
GetLogicalDrives
CreateThread
FindClose
FindFirstFileW
GetVolumePathNameW
GetFileInformationByHandle
GetCurrentThread
GetFullPathNameW
VirtualQuery
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
FindNextFileW
VirtualProtect
VirtualFree
VirtualAlloc
GetSystemDirectoryW
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetFilePointer
GetModuleHandleExW
GetVolumeInformationW
GetDiskFreeSpaceExW
HeapDestroy
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree
ole32
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
user32
CharNextW
LoadStringW
CharUpperBuffW
oleaut32
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
SetErrorInfo
CreateErrorInfo
SysAllocString
UnRegisterTypeLi
VariantClear
SysAllocStringLen
LoadRegTypeLi
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
ntdll
RtlDowncaseUnicodeChar
NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtUnloadKey2
RtlAdjustPrivilege
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
NtOpenFile
RtlReAllocateHeap
RtlSetThreadErrorMode
RtlGetThreadErrorMode
RtlVerifyVersionInfo
RtlGetVersion
RtlFreeHeap
RtlCompareMemory
RtlAllocateHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosError
NtQueryDirectoryObject
NtOpenDirectoryObject
NtClose
RtlInitUnicodeString
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=18, id=260, version=27412,
count=373, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=138, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/WimProvider.dll
- IMPHASH cb21293b90ce990f1e27053c992e9458
- SHA256 332e72e7ffc01d9834f49df96dc71daf0a24457cce711a9d89396f2b757a740b
- MD5 d2354bc05bff139c4349e98fb7736816
- SHA1 cde65aa29cd3ccdb66d8614b9f2741e45e8c94b8
- SHA512 c0d927f5cdcdc345f244c8ed50d4d6288fab78fdc95298fdb85234d4e3c4007d29ab119ef44edaf755dd961ccb5a469eec864a6ce5223f42e10e24634eff3253
- SSDEEP 6144:0sw4HfqlGIEefLVC5gg4YNFybh5ka7GrWd70Jf/1hXQrgWePIFiYDfIJNZiHaxPu:0efkgPPONeP5YU3i6xnWwK
- TLSH T1C7A41A52A2D88439E1FF3A7035FA5339997BB4609FB4C2CB2234955E5E726E04838F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:ee:c5:f6:d3:9d:37:cd:45:0f:c9:7d:77:be:de:76:82:b2:fc:6f:3a:9f:80:25:f0:30:a7:97:f9:c2:ad:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
335232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
WimProvider.pdb
msvcrt
_vsnwprintf_s
_vsnprintf_s
towupper
_wtoi64
iswspace
iswalpha
_wcsnicmp
wcsstr
memcmp
memcpy
memmove
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
malloc
_wcsicmp
wcstoul
_vsnwprintf
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
wcsncmp
wcschr
wcscat_s
memmove_s
__RTDynamicCast
wcstok_s
calloc
_wtol
wcscpy_s
wcsncpy_s
wcsrchr
free
_stricmp
_vscwprintf
_strnicmp
_purecall
vswprintf_s
memcpy_s
__CxxFrameHandler3
memset
advapi32
EventActivityIdControl
EventWriteTransfer
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
EventRegister
EventUnregister
kernel32
RemoveDirectoryW
WriteFile
ReadFile
IsDebuggerPresent
DebugBreak
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
LocalAlloc
CreateEventW
GetOverlappedResult
LoadLibraryW
GetVolumePathNamesForVolumeNameW
VirtualProtect
SetLastError
EnterCriticalSection
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
OutputDebugStringW
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
LoadLibraryExW
HeapFree
GetProcessHeap
GetFullPathNameW
HeapReAlloc
HeapAlloc
GetLastError
CompareStringW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
RaiseException
LocalFree
DeleteFileW
GetLocaleInfoW
GetNumberFormatW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
SystemTimeToFileTime
LoadLibraryExA
FindNextFileNameW
FindClose
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
ReleaseSRWLockExclusive
GetFileAttributesW
GetSystemInfo
FindNextFileW
FindFirstFileW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetFileInformationByHandle
CreateDirectoryW
CloseHandle
CreateFileW
FormatMessageW
SetThreadUILanguage
AcquireSRWLockExclusive
VirtualQuery
DeviceIoControl
SetFileAttributesW
GetFinalPathNameByHandleW
CreateSemaphoreExW
GetModuleFileNameA
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
WaitForSingleObject
GetDriveTypeW
FindFirstFileNameW
GetPrivateProfileSectionW
ole32
CLSIDFromString
ProgIDFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemFree
user32
CharNextW
LoadStringW
CharUpperW
CharLowerBuffW
oleaut32
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringByteLen
VariantClear
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
VarBstrCmp
VarDateFromStr
VariantTimeToSystemTime
SysStringByteLen
xmllite
CreateXmlWriter
CreateXmlReader
profapi
ord104
ntdll
RtlReAllocateHeap
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlRaiseStatus
NtYieldExecution
DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=19, id=260, version=27412,
count=344, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=75, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/AppxProvider.dll.mui
- SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
- MD5 bd0dd9c5a602cb0ad7eabc16b3c1abfc
- SHA1 cede6e6a55d972c22da4bc9e0389759690e6b37f
- SHA512 86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
- SSDEEP 192:WqLBjDHbtptJt5MNxWJtrtutAtKt0tptj/eCk6tf6voFeSMoLH7/x9Wg+WA:WqLJDrLpMyYWbWoFelCH7Z9Wg+WA
- TLSH T1DFA24E4236FA5119F2F77BB86AB716650F7FFD62E934C60C1258511E0FA3A818C64B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/AssocProvider.dll.mui
- SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
- MD5 8833761572f0964bdc1bea6e1667f458
- SHA1 166260a12c3399a9aa298932862569756b4ecc45
- SHA512 2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
- SSDEEP 192:x/Akc8dT8EC1y/vYsCAFdUTFLrNmAYKkA48UGtqWKKWr:TtsRbIWKKWr
- TLSH T133F13A8263FE1659F1F76F796ABB22210EBF7C559C39D61C1688521D1BA3900C8B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/DismCore.dll.mui
- SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
- MD5 7a15f6e845f0679de593c5896fe171f9
- SHA1 0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
- SHA512 5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
- SSDEEP 96:w4aiiiWwdwCg/PCpQcBK8Cq9ovnwEWDOWwo:JpaJWDOWn
- TLSH T170F1BE0667FE8219F9F73B349AB50AB51E7A7C92B979D32D9740101E1DB1A408CB0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/DismProv.dll.mui
- SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
- MD5 7d06108999cc83eb3a23eadcebb547a5
- SHA1 200866d87a490d17f6f8b17b26225afeb6d39446
- SHA512 9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
- TLSH T16A517D02D7FB062AF0EA0B3556F70A66177E7D12BA62932F8F00112C3870505ACA1F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/FolderProvider.dll.mui
- SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
- MD5 22b4a3a1ec3b6d7aa3bc61d0812dc85f
- SHA1 97ae3504a29eb555632d124022d8406fc5b6f662
- SHA512 9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
- TLSH T11551DD4297F7062AF4EA0B3429B70A621A3E7D21AA66D32E8F00112D7C707049CB1F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/IBSProvider.dll.mui
- SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
- MD5 d4b67a347900e29392613b5d86fe4ac2
- SHA1 fb84756d11bfd638c4b49268b96d0007b26ba2fb
- SHA512 af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662
- TLSH T10051C10297F71226F0EA073456F74A62567E7D26BAA6A32F8F40112C3C741199DB0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/LogProvider.dll.mui
- SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
- MD5 8933c8d708e5acf5a458824b19fd97da
- SHA1 de55756ddbeebc5ad9d3ce950acba5d2fb312331
- SHA512 ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f
- SSDEEP 96:zXM6czix6RXToVSHvoXBD3LXnvoJnoN6yvG8vIUEWNrWwv:LMniIh0IHAXB7DnAJoN6yO8wFWNrWA
- TLSH T13AC1D502A7FF521DF5FA3B30A97506B50BB6BC96F93AD32D574012185CB1A049DA0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/MsiProvider.dll.mui
- SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
- MD5 c5e60ee2d8534f57fddb81ffce297763
- SHA1 78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2
- SHA512 ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc
- SSDEEP 96:2TRzAa2VDHWUt1qaoe3em2G6BHWPrem2vopuLcvy6em2bxVoa/b1mA5ICHH00H0X:2TRSDzRXQdoa/5ICH/AbQZL8ZK1WcoWc
- TLSH T1E7628B1273FE5109F5F32B39AAB712A10E3F7C52A979D65D1298150D4EA3E809CB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/SetupPlatformProvider.dll.mui
- SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
- MD5 73e78fbbf6e6679fa643441c66628d37
- SHA1 57b70e6226c0cf3f8bc9a939f8b1ec411dedeff5
- SHA512 a045a6cdf9ca989b3ed9a50cda208affa17372f65b1d86e1bf4c10b5d5e3fee58c5d4b8ec0749a54e2e2156ed0e9776b59a8d3b78f062349873cb574ab3f77fa
- SSDEEP 96:pZlYgKFEK42hK+UKd2K0bKGSnk5KABKzSnku7jh7rUC47j797UOSEW6XWwZ:JH3UgRlI6rjzp543pDW6XWK
- TLSH T196C1B446ABEA0169F1F73F74BAB616A10FBE7C52B936E71E4754051D18B0608DCA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/SysprepProvider.dll.mui
- SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
- MD5 93d076056dd01dfc64d95d4c552a2dff
- SHA1 a90fd06a62c6d63d87e00f5f7e9646b44d2c726a
- SHA512 b089574d4be0ccae205219c9e256de34c039081a547f05acfe4165d036b175de5d9676160effc3c19d87bbb41d0f415da598e507ed8f7b302cdbfdfb81f694ee
- TLSH T12451D4496BE71527F0AA0F3197E605E15FBD7C13B6A7A73FCF00111928A150899E0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/en-US/TransmogProvider.dll.mui
- SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
- MD5 2138fda89b1a5a18b32aed1d8762cde5
- SHA1 a476f7dc86e62c7dc0edf27bb778174348cac566
- SHA512 d7cbf569b5d57730c81fc121e92e1042a37e07922c02f36efac3769622f40234c70dafe9ed88a659d90c3855b5240f67f99b55ddecc46eea0e28e5b80ecc820b
- SSDEEP 384:fwVXFYiKdshYuUljq9ZBjEx2F2u00yta8drwz5Kfo9IT5p9bfL0rdrBhrPZgmvwZ:fwVXFYiKdshYuUljYZBjExk2u00yta8R
- TLSH T17972BE0163FD4109F6F73B3999BA1A610E7BBC9AE879D71D12D4111E4EA2F408DA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/AppxProvider.dll.mui
- SHA256 19ddfff90b8dcd497b9b2429cc82979429e95a3645764284e12a4d9875eb1a53
- MD5 2b0dc9b7b0f924909c7b5ba48dcd9c29
- SHA1 155eacc00903167d4fe0f2ce0f043d787437e8ea
- SHA512 a163acf3663adfcca0737dae5acccba6c2d901f1bd92ccb67a57e7f7f0973332a6e5e799ef8371effa8acb4ec9af50eda25ebde235fbadc1c8f6aa9d7a8be0cc
- SSDEEP 192:iLO5YZwbtc0t5tVvd91gGh9MtrtutAtKt0tptj7BsMlFKTGJ0FOY8pgJAStEMGW8:iLOzC0j/vd91gGQpMyYWbbKUZtEWBf
- TLSH T1C3B2354FB8BA8114F17692B45FB304D316BBFB112330858D828F6D690BAB6317718B97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/AssocProvider.dll.mui
- SHA256 6424be24f22878c304ef2f82679fb271388fa861bb3f139a6cea8ed61e22089c
- MD5 7ecd64895ee5931c8c1c28bff893ff1a
- SHA1 ede1432b1878a6f65d1f80460bc05d15cc10212a
- SHA512 b4bc23d7233b1e06a9b12cd463474b67f2adc42a93ce99b2821fe9cb5c883f57fd7bb968d705bdb1f99ccaa41ce1eba6386e27aa039a08f6abbed85bded0bcd5
- SSDEEP 192:FqGbzCQhnsCW+rNiJPlkABJshQtHWjD8m:Fb+W3J
- TLSH T1D6027F8FA5FE5511E0B59A395BB301D206BFBA111B31519ED68F6D1807AF2307234BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/CbsProvider.dll.mui
- SHA256 de0c358a5acdedf9d4744342a909a9d63677016771c1f33499f16ad875fad9a6
- MD5 f1e1841796c1a36511350eade3f26f9d
- SHA1 3d1159d81c398ab455739e7538bf7345703a6831
- SHA512 58b94a9777e4bb0e000c00c0a03769caba138ac3471e6e1cec31fa0185440627b7c6927852e689a9ff3cdec650797aac8ce66723c11acc4edbee3f8dbd0801a9
- SSDEEP 384:aP3oi7zK8Y0tZgPxGHO17XPH96zDIGS+h/wSxFiA7/f67fg/ixRzeFmjBF7fRGlZ:AU0tZgPxGHyW7/27LlpfCGh6
- TLSH T13B43734FA5BD8104F5A6E2B80E7349E712ABF7102338D4CD928F3C6955AA6307724BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
54KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/DismCore.dll.mui
- SHA256 37386710f885a587e9d524860e50d06dee5c97222933e58d636f858ca33336d7
- MD5 ea49369911b2dc583ffb3e51c426d78f
- SHA1 376818550b342d9af34c5b197466b54cb9aa808c
- SHA512 fa7cd0ef4948513cdf404ba1d90a8178ee113f34c1a901ce7c5f6258ff5920e522dd68a6a74e581de9e86cf554e58780eacbba381c5d3ab6181b6e276314e341
- SSDEEP 96:ys1eAclut1tt1tt1luYumX4is/+nMxFi11bCD1wlF9Wr3B6QH:R19kut1tt1tt1QlmIfEZQCWz4QH
- TLSH T14BF1560FAE7FA141F454C2314BA249E216BD7B127329A1DBC68F3D24609C6357728BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/DismProv.dll.mui
- SHA256 c8f7e39b3a5477c67550466c3154165e1965f2fa845a4c15e6e3348169440cfa
- MD5 439b33569083d5fdca65c0d0873667ec
- SHA1 4609f2f5dab86677cfbe3a9f153125adec47fd8a
- SHA512 7ad03f41d6e21c8938e9e7aa01aecdd1666073a5fc6193f81d906349042851728b1cd95f9b716d2d57eb42008b3697f9f187845777d0b2dae8add2a5109d4b7b
- TLSH T1F8517D0297FB462AF0EA0B3557E70A66577E7D16AA61936F8F00212C38705049DA5F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/DmiProvider.dll.mui
- SHA256 fbccccb11db3c3790736603d75b76506c69c2e8ca71501cf0894abd0d5a4ce28
- MD5 6dc49e051359f7a141189d21b1fbe33a
- SHA1 1f53e8f0787732e0e7b12e02f316184555527210
- SHA512 c6551f6fb7836c4c61d98a7005ad1ac9c0d2824e33b8877929ae7415d0035feaa6b7e45cc1cfc6a8ff9150c83153d76f46bcf739ab963db672813e5cd680aa1a
- SSDEEP 192:TFDSgVuNfETF/+R7EJf1Cgx31T29f748MZWrsyjVFY/MY9+F/LWO1zQ:p7Gb7EbCMQDTUMWIM
- TLSH T1FF82584FE6BEC104F694C6710E7249F311ABB760673881C9A29F7C6496AB2347324BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/FfuProvider.dll.mui
- SHA256 078babc5432b7c2f623c4832e92827ab1bf33c34585c5598af4a0093ccdfdbd4
- MD5 87c1c1a936f83518e2aa04151ddc40be
- SHA1 5394dccf06f313781c558a2c6c0769b9da2fbdbe
- SHA512 a635f974939fcf9103986043683c3030143f4d50aa2f54158b215816c16f38b2e16cedb5934e93d0c7ff998b2466049992dc06795baf6779e379aefeeffa5704
- SSDEEP 192:Q9Uo9o7nI+5XnEhLADlDS+d4LfS65Xocb1CEkWcCWX:QGLI+5XQL+d4LfS65XJBCEkWcCWX
- TLSH T1DB12BB0273FE561DF6F7BB786AB612210A3BBC95A875D71C0698111D1FE3A5088B1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/FolderProvider.dll.mui
- SHA256 c88575edc1cc22c61d541359dd80cbab6ed8f6a91f009ed2904d517afc737942
- MD5 9b1b92090231ee95038c2e41050e19c9
- SHA1 2f2baa5bb4abafd0f56911a9cf3ecd195cb161a7
- SHA512 f228fafe2dc78720bb6e5230a3b5d1cce86ad4ba20573f92f4338dd934a4397c26ec2c94cb5707253e105f8d720d532af36055eeaefbc1a247784f1774e2fbce
- TLSH T19051BF4257F7162AF4EA0B3419B70A651A7E7D21AA61D31E8F00112D3C706049DB1F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/GenericProvider.dll.mui
- SHA256 434946ba725200fc3228eb797cfcde4bb8d3e67f6dd9df81e22855750435651c
- MD5 6445e363593016efdacdea58fd2ad819
- SHA1 17b555978835bde38f7294509d5263a7bfaf84e2
- SHA512 78c5a600fc326768581928d0540970cc6962aa1da4be66944ed6a83d9be3b04f8a394851ecf22a0704dd09b70261b097708eab1e46aa53d451ea0d595031b792
- SSDEEP 48:yFWJ/d/o5bVCbAWL2eD0O70u2qNoQ4cE4IqfxZ3DQtbZWnTtTuC3BPb+fx3g2:/dAQtofcM8+9W553BPAN
- TLSH T157B1BE0BA6FE4119F0D5967447B345E3077FBB117331929ECA8F28281AA76342610BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/ImagingProvider.dll.mui
- SHA256 05a3a84f2f6b60416c912f2619b1714cb7f308e6549d9071de7cd6d4ea2acd13
- MD5 55bbc30336b3dd0e5979f0940f5acfbb
- SHA1 1eab8d6f748ce1baa720b3b649dff05c9dab95bd
- SHA512 b459da19f1f0e0503c5a9a16c9494dfc725c5e613e31587f5b26bf355e4639ba981730f938fd8644a30d25650fc79213b87e74d092fa63963967c4ba13f5154f
- SSDEEP 192:XC4GSFHix4K8qKr+CsO4noIy9kp4rQtEUmMQoacXhCoBTsYZBYmmW25h3:XC4Npi+K8qKrDGy8OLtcXE3mmWMd
- TLSH T1A492764FF9BD8104E9A5D2751A7305E3126BF610233495CA82DF7C6856EB6343328BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/IntlProvider.dll.mui
- SHA256 136023ae62c6692659bef4a18d966238e36f18c1d4d8bc04ded2a8408e8efd82
- MD5 78cec1dccd74abc974bd9398f24e2c1d
- SHA1 69e7cabd5926c6d3bedf88045e686e86c8bdb227
- SHA512 d2917ec2cfac0b3ad9a59ddc3f24f9846ec15f963eaa3c25e068819b87f917a67b1ead2f1202b392b6215196d04dff1ac7540ea730d634e449a25d46f620ff3c
- SSDEEP 192:vW3OP/cIHAaAtfnWdsQ+LK0sA5QWQrOGQE0gWBsKl:veOX8NOdqXsA5QWQKGQFgWWg
- TLSH T147D2894FA9BE9214E490D2751E7348E312ABF710633895DA8ACF7C29539B23473147DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/LogProvider.dll.mui
- SHA256 a556d7372f071ee179a0a1f27a82535f7c1414828bb3e1757f5aea1a3a1dfa46
- MD5 06dabc089235343f497695186abe63d8
- SHA1 e0289c52e4c26c5fb05c6d1271d5d4c0b0a7e5fe
- SHA512 26bfa5e7faed1a2bd79f9e69811967030aad3263c5bc32d554c6c9a11ed2d1dfc9634e4098780a9e52bfce045221937874ebb76ee0dd5f89b0e80195b371a2ba
- SSDEEP 96:PPV/kkmIgxfYis/p9NVYrnDrWrRrqUbrffrnyQzKgLis/k9WM3Bzfb:Pt/QcfrN6rnDrWrRr/brffr/vfkWi1fb
- TLSH T194D1AF0FA7BF8241F15446705BA245D316BEF721775EA1DEC68F3C2464A86383B10AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/MsiProvider.dll.mui
- SHA256 52d9b1ee09a6e6c77a97ec0764d50ce32a667f4092ebb5c6fd7261941edfa42c
- MD5 ed37608167e66badaa8daf434f43f3a0
- SHA1 3e5662d45b0bf1af15cf8162abdbc06e990aef40
- SHA512 e046a6aad7badf6bda2e7657c4797b3df5f4bb0d69f3548c91b1b527a2eb5901002fd80cd6f3e27b7eb33c4d72d20749cae2e3d865ccada6d9da787734471f1f
- SSDEEP 192:FTYMkVyB52+kvtUl3BVmROvkSBDqH05lJAGkB+oXeMWr1ac:F0iNkO96RvS9qilJAlXbWp5
- TLSH T13572310FB5BE4010E46AD2754F6304E3266BB310233594CA969F3C984A9F7747329BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/OSProvider.dll.mui
- SHA256 43f4d624e0882012c4aac8c81ed4f9874e40aa82620b176e24fd04f329661a3e
- MD5 bdaf7695a9cd7446b07f60bcb603e69a
- SHA1 5d2faf0f7c20b4bf463fc7c180d7e8069faaa31b
- SHA512 de113d3802b8e5720beb63f2dbcac6ad453023753f58b5a22701fe539f2d18f59343add8e97aa33512f32888e7a114539713ba79d932563299f90b46762382a8
- TLSH T17B519D0F9FBB0116F0EA0B315BD705D616BD7E137762626FCF0A312828542349AA4EF6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/OfflineSetupProvider.dll.mui
- SHA256 7e97ff1c6cbffe6dfe743b0735c0c1d05f7a5347cddae2dd110931330bdedb0e
- MD5 c505b7d94da149005333b044ae4974ab
- SHA1 e3da84625fa324c6163282ab3389a6429d8a49ca
- SHA512 d6f0666df0023687b9cb21e60192639ed8c3cb3d6341be92fa7f5d439b700b479f9241b693c3252a462f056fa6cfa9e10b68239950889862d0c1e88be27018c8
- TLSH T19751BD4267F61629F4EE073466FB0A2A563F7D21A932D32E4A40112D2C705049DA5F32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/ProvProvider.dll.mui
- SHA256 b7f81ea1a51e994ace79151b49ec870c4ad8eb72151bc53af897428a0b5a8a2e
- MD5 a1cea8519ab1dc822bc2919427a91d59
- SHA1 cbabcff65473f75293f6aa6dc6b2ebe4db9be2e1
- SHA512 3b2b58b2e2230f52818a1af0368171c8decee7ef6a6c9239973870d2d45772e51dd76e0c345e1d79ecea2184ff56e99bfbd746994de3523cba72ec9e6f603e13
- SSDEEP 96:bQ2/9FbyFAMLhFAgd+J8W8kyMLLyD9WQWSZWww:bQ2/9wDlYOjWQWSZWP
- TLSH T17C91350267FA4119F0F71BB89BF749B20B7EFC53A671E22E4704111D2CA2A458DA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/SetupPlatformProvider.dll.mui
- SHA256 28a2dbf208e8071cc1d3e39c0bb69798583f96520cdbbe94b18fdc37b498219f
- MD5 e1349aefb4935060271bbfb2a8a2f4ba
- SHA1 fb522a7dc88ead85e9c0b4b0005dad397dd2878e
- SHA512 12ac909b58b5cac51f67a052ac9234759c6941ddaf5dc814c87cd39c36cf400a227ad9021d2b194e014bffad93ffa633ae8621519e89ff0576e49a61ea599a1a
- SSDEEP 96:v3l5uZDFKZrK9IyKfVKQ/FKPJKxkKk/KSbpi/7i+i/iVKiPO9W73BNbI:PuFEgw198njZ8qWjrbI
- TLSH T194C1BD4FA7BE1015F0A643745FBB49D3127ABF012725E6DFCA8F3C6844982386610BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/SmiProvider.dll.mui
- SHA256 9c88b96892238b6f57b16a3eacb8e135735ac2d410beebc17336bea5e39724bc
- MD5 ed4fe56821a5c1b65fb78054696f5f53
- SHA1 94056fc23ece83971bf90139b7547b2e5e97315d
- SHA512 1fa6e3db08aa356a1f55dffbca807a6ca5f1a1b27395e1a8c8f0f8b2f3684eb40391334c056b7700c02ac3bd819cd8c6296efd3388045e2eb3772e76781afd49
- TLSH T12E51C10297FB5626F0EE0B3456F70A5A173E7D16AA62A32E8F00112D3C701089DB4F77
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/TransmogProvider.dll.mui
- SHA256 a8f49ba12626e98b9c565c1a33a6a61d3ec7f2b769f75aa8fe7d1e4a172612c6
- MD5 58c72c0237fb532048f59213ffebba4f
- SHA1 27a55ba42c16732204cf5e9a96e41f213dbb5df7
- SHA512 a1e906cbae4e21799921cc72ed8cee2008ece6d35f50c5b44965495d9d0486176ec282119f28ef472bc179f293603c8539a135dbab1f9ff84b8104d5943101bd
- SSDEEP 384:MTCNvvIqFlj19nDxBFcZy8DYAapQshauvMrCheWXSWKc:MTCNvvIqFljfnDxDcZy8gc4CoeiWc
- TLSH T14072750FA6BD8150F5A5D2750A7349E3027BBB50233989CA96CF3C6858A97307724BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/UnattendProvider.dll.mui
- SHA256 178eef25afaeb904ead2438602e6900e81b7281f77949821e716ecc068d62842
- MD5 e6b934471f8e87236d102ae3879385ce
- SHA1 af0d1585c7cfd5a0584703e3d4c55f249da18fd2
- SHA512 4d20dc368fad8e676d17dcb95f9cc07604601a324d62642e557198a22ed42d52158e6c6e1794100c91b86fd3d073c589b970ea474af16bb13ae0ab5727459b6b
- SSDEEP 48:yfp+/wF01xhm2/ZIk4cVxwS8udiieRgk9GAbZWc7u93ByPmfx3ga:5D1nm2/qkxxwSpiieRb9Wd3Bys5
- TLSH T19DB1AE4BA6FD8629E49583712F6349D3127EFB206335C2CE868F6C5828543387764FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/VhdProvider.dll.mui
- SHA256 4846bf4d0c9bb1a19815aa2fbf991d36eea652f4ab0e27e76ebb103699ea9615
- MD5 679a84b24281d089f371ccc2aece9081
- SHA1 b3535a34797d7728098d073bc41c9e6a2f01757c
- SHA512 91b355eef5e665438a86ed9ec542d6629bc581033e658c85d857e38b4b1d9226caf1f41f0ea19c08436dfed9adaa587af2d520e7ca9d11e97c8fc3efdc71579c
- SSDEEP 48:yHdOhc/6oUbwIjiGiDiyi7mij43oYxozaVQHofOBYvoz8ozDzrl194oyoQo71JOZ:jkyjiGiDiyi6ijHeq75soHkm9Wh3Bzpv
- TLSH T1FCF19B4FB97E4511F555C2310BA20AF316AEBB21332C62CECA8F7D2910AC57537246EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Dism/ru-RU/WimProvider.dll.mui
- SHA256 c1497f5db03248aad9b59a3acb5d6b04f4ba339ce3bb5ab9c9f56f2248c08994
- MD5 75da2d060172c10a99159bff8258d95f
- SHA1 92b8b319d62e6d7e365c56d303a877d562501f0b
- SHA512 34ead7a8be38d4306b2762ed379119cef3dca688b22fbc2d006d7aba289f1dc9dbdbbec83496b5fd8a1c7da887540c4ed2c4e10690d096db69d3fbbfa0f21bef
- SSDEEP 192:mrNIWl6VkL+WTJ9ilnhNfCRW9wWJXyrId/S/2ugDcoIJYWhFQyEXDRTnVau1YZBj:aNIZml2Gwch07GJSH0WSya
- TLSH T1D7D2554FB9BE4104E991D2791E7305E3167BBB10233495C982DF3C6856AB6347328BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/DriverStore/en-US/prnms003.inf_loc
- SHA256 a8c191822b13e439010c5130b24f9d4e8c52ab1bbed332bfabb012cf032a9752
- MD5 b9b8dcdf1f78e48a8bdcad4f2f0a8aa3
- SHA1 b0885ea8366b3a7b80308e0fccd25eb98056fec4
- SHA512 370ebec229ec27b1047ad2e9f3723c7b8e9390a5d9621cb4f0ee7f87ef782cdf252410125b2703df4c9986859a79e56bc8fc60ace1f570db560e313feb4f3fe7
- TLSH T1A2C00287E6A8A528F0F34E44BE9B65A15FB2AC69AD188D981688050D44E0E04C9A5FE7
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/DriverStore/ru-RU/ntprint.inf_loc
- SHA256 03db2d4d0a84ba156f7a1e7caf1f3eb04615a928a835cc844a754cd076dba230
- MD5 da6fc9be171868145346d1327c604366
- SHA1 7a53c19f49897a0706fdc5616a65767d14fc4bac
- SHA512 79c6a0de31b85d9aacba87ac44a8c4180a11ed85ea66089feabab16b17c0823e461f6310d83a3177f31431351d4888c90a3e6a31541165d5a29779ae038aa314
- TLSH T11AC09B03F55CD528B1F10AC56B471D715771F819990D4DC80DED520C08E0D20D521DDB
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/DxpTaskSync.dll.mun
- SHA256 ea6afbffb964aaa59a131b762e0fd5b61b44485a0685b37a130e99917195d35d
- MD5 aa0d4c0e2cefce89a44efecb89ac5abc
- SHA1 5d92b311cdd23be364d1b2983dbeaabd0f336482
- SHA512 d50112059083f3b359481b1532a7a096ddb649a6df75b2817c1bc57c05877b002267558b9cc4bd3f69d0d4477c8aafc4b53c643ced9843026bae8866eb604305
- SSDEEP 24576:qTl7KCEm6X2gjkz1Sj57nUTSKHn7GCJfMHZGzO:qhAm6XHjkYjlngSa77JuC
- TLSH T19B35AF007302DC4AC32F6630F643EF669584AC51D5464977B1A37BAF39BBE2271DA21E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ETWCoreUIComponentsResources.dll.mun
- SHA256 dbbc56ca8bf79ae5a258da216294313507200d198ed3689e6fb1cd6d3e4b1b3f
- MD5 25e39e5c9fab6ac70f54b370554bcf70
- SHA1 a0ea6ee580131c3102488d8860141e4f8928ac52
- SHA512 ba9ecbdf5f15a6284f99fdafdac1eb798fd7bd09cadd65fc6f1ffaef5e1c51aa4bcced414fbdad45dc1a8b0f9e97d240f2454113d17965b69ef645406e122850
- SSDEEP 768:qe7H4CpmOUFeBB7h/XzNTcRb3kGA9qrI4GWiielGWxE7z:qerX7JD9czA9qrqGWxEX
- TLSH T19BE34513BEEC941DF5B79B706A7A90753632BD6A8F11C22F3045237C5872A009FE2766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/EapTeapExt.dll.mun
- SHA256 a7c87b89465acc902acb3c6ce82d749e41a5faffaaa286fd8b9b7aed583a62ea
- MD5 70bf8a074400ae8b07fcdd4c7b1dd43a
- SHA1 6fc22428153b4e1b012ef563e05f0fa1c45d8fd6
- SHA512 0da9c04ab8a8b1bd5188adb6b987fdd91bcd122ec07715a72a53da4bb5e6ac53a8421588c97fbc285d614c065c678a1cfa3071d9a074d37db6c73ca852669ec9
- TLSH T1E251690267F95669F0FB0B3169FF862662397C249A75831D0540112D2C65612ECB0F3B
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/EaseOfAccessDialog.exe.mun
- SHA256 2c31873aaa63e9ad0ee895eb31f8aa12cb116d5c25df92a874dabba21217b041
- MD5 4c79abf053f019c6824408bce304d6ac
- SHA1 77d3e346d6bab904961d9cd3ee7d105c06a62cc7
- SHA512 8a91bb174c9b197d7fa45017002d8e100b4f63e6368e2aca6e1f9230dace99ec4419b029036b500d1d848a6ef4b40e0997b273f2a8021f8660f32080ee3f7ce0
- SSDEEP 3072:ur+AlGrCUpPcN47V1FOds2Vlt3hg7rXZQG0cg7JOkLNCIei3EnTGD2cS5s2:u6AlGrP6uFz2LJGRg4kLNnei36cw
- TLSH T1F324C0807211AC69C26D1A31EC23DF6448A83C91CC611E2FB1677BDF29B2B70759F56E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
204KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ExplorerFrame.dll.mun
- SHA256 4e68611be5f025eabad30e9980de4adb69538777bc40f4299a9b50923357088c
- MD5 509eb2b8691667382eef6c5ddcc9dbe3
- SHA1 97d022fff60dbf11951bbf25f07a39f60c4fe3d0
- SHA512 cf8829e28605a2daf3f392b2c2e4d3d97d099bc4933087283ffbbffd5ed79ef69a93056965ac010f91813b913485ff04036fc3d6d6d36dfab99a2d3e3de2bec6
- SSDEEP 12288:Ijj67qS8z46GtEHbg4gXGVIODIrd26psxwQXao6KR3t:MjTcEHUflODIrlqxwQXavK
- TLSH T14F4549A1B290C018ED52087ACC7EDAF435267EC1DD2582FF22D2BF7F75732114966A26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/DiagnosticsHub.DataWarehouse.dll
- IMPHASH 055a6e5ad537c10a6245347486dfbf41
- SHA256 d9fca4e9a7b4327b2171f3c0b6538a9e631e1182d173cd96258b3683f15e4c2f
- MD5 f3059ce87d475ce9c18ae50c6df2910e
- SHA1 67121fe38a6d1abb31b3946640c36e0829fdb868
- SHA512 7eea3baacb6a414427dd7f03864db1c8f239e96c27c4110482f15a55751379d221299d1863c2d26ec2c140c79a31e610445276fa866b5661aa02b5ee0dee5ef8
- SSDEEP 12288:S0yYB5d0qqWmxkhF7Be2mN5BhdhjZHBog:dyYjB9F7wvrjZHr
- TLSH T1BBA46D66FE91C835F6BF12F065CD722A10AD9D600BB001EB8794AA7E1F785E14E34F16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
360400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DiagnosticsHub.DataWarehouse.pdb
msvcp_win
?tolower@?$ctype@G@std@@QBEGG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?id@?$collate@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?id@?$ctype@G@std@@2V0locale@2@A
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?_Xbad_function_call@std@@YAXXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-math-l1-1-0
_isnan
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
strnlen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fseeki64
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__stricmp
_o__ui64toa_s
_o__ui64tow_s
_o__ultow_s
_o__unlock_file
_o__wcsnicmp
_o__wfopen_s
_o_ceil
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fgetws
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_iswalpha
_o_iswspace
_o_isxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc
_o_wcstod
_o_wcstok_s
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
strchr
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
FormatMessageW
GetModuleHandleA
LoadLibraryExW
WaitForMultipleObjects
GetProcAddress
GetFileAttributesW
ResetEvent
CompareStringOrdinal
CreateEventW
CloseHandle
CreateThread
SetEvent
GetLastError
WaitForSingleObject
Sleep
InitializeSRWLock
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
RaiseException
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
GetNativeSystemInfo
CreateThreadpool
CreateThreadpoolCleanupGroup
FindResourceExW
EnterCriticalSection
LoadResource
LockResource
SizeofResource
SetEnvironmentVariableW
DeleteCriticalSection
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
GetFullPathNameW
WideCharToMultiByte
QueryPerformanceCounter
OutputDebugStringW
QueryPerformanceFrequency
GetModuleFileNameW
ole32
CoCreateGuid
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
oleaut32
SysStringByteLen
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VarBstrCmp
user32
UnregisterClassA
DllGetClassObject
Name
.text
Size
417KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=13, id=260, version=27412,
count=1350, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=67, id=265, version=27412,
count=26, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/DiagnosticsHub.ScriptedSandboxPlugin.dll
- IMPHASH 2561f44754c8cae9d41aeb339e4b1fd4
- SHA256 b2ed5fbaab7c2ba2131b6a70a166d2adb453a696677433c07dece3b14ce37c42
- MD5 f3d7defbde0deb8d3a1f310101b5534b
- SHA1 f36f08bf48052d73e4f3efb6fb71fdc3bd728dca
- SHA512 b9159f91f27f76d909281cd20219051142930829e942c289ac9afe6a311112bf3a767f9910a3a27a6e9eca7252e82bf8eccac36061ac0c02c558726b57ddc894
- SSDEEP 1536:KFkGYxjOUsS/d22tq5KIrBYpzxwJlZIJRs/8ch8DXEXBXzA69MD:KFoHtq5KgBYQJk7jciDExc6e
- TLSH T1DAC308377AA5C868D1FE49FD69142126836FAE528BF001BB8751D51E097C8F4CE33E26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
90624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DiagnosticsHub.ScriptedSandboxPlugin.pdb
msvcp_win
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Xbad_function_call@std@@YAXXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?widen@?$ctype@G@std@@QBEGD@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
memmove
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o_ceil
_o_free
_o_malloc
_except_handler4_common
wcsrchr
_CxxThrowException
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
_o__purecall
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateThread
RaiseException
GetCurrentThreadId
SetLastError
FreeLibrary
GetModuleFileNameW
InitializeSRWLock
CompareStringOrdinal
SetEvent
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateEventW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
LoadLibraryExW
GetLastError
ResetEvent
GetModuleHandleW
HeapSize
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
ole32
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoCreateInstance
oleaut32
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
SysStringLen
VarBstrCat
VariantClear
SysFreeString
user32
RegisterClassExW
CreateWindowExW
DefWindowProcW
PostMessageW
GetClassInfoExW
LoadCursorW
SetWindowLongW
GetWindowLongW
CallWindowProcW
UnregisterClassA
DestroyWindow
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=13, id=260, version=27412,
count=1253, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=22, id=265, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/DiagnosticsHub_is.dll
- IMPHASH 1ea8b95cd92dec3ebc7bb465a8d5183b
- SHA256 d3f802536021bb641d3cf9a4451fa970a392e039dab95c0106846dbe8558d200
- MD5 db8b3ce242529f0d1607824e2eef4bac
- SHA1 7d1c772c7c88281fdc6c02fb4969132d1dce3c5f
- SHA512 c8cdeacb3deac750c14bc26bd1b662adf0146e5e4dadf59c97fcde34b5bb09b4f39dcec276faece5fe34b6595f7425339b17ae6974f0de872416837d88f21dc2
- SSDEEP 768:f7NOz/cV+I/ntK2L8WgcqEqi3jhKydiedMUjW0H2mkAdaoSfIIMu:f7kzc5ntK2L8xcq/kh/VUfIIM
- TLSH T13D235B13B78580F2D6AE2670695DB37A946CEA909FF001CB5F6317AF6D746C09C3428B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
35824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DiagnosticsHub_is.pdb
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
memmove
_o__register_onexit_function
_o__seh_filter_dll
_o_ceil
_o_free
_o_malloc
_except_handler4_common
_CxxThrowException
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
memset
kernel32
ResetEvent
LeaveCriticalSection
DeleteCriticalSection
RaiseException
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
EnterCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
InitializeCriticalSection
ole32
CoCreateInstance
oleaut32
SysAllocStringLen
SysFreeString
SysAllocString
SysStringLen
tdh
TdhGetPropertySize
TdhGetProperty
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=11, id=260, version=27412,
count=1144, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=7, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/DiagnosticsTap.dll
- IMPHASH 23fcae7fc32e5605b711159ebfa9e300
- SHA256 1f27b066312dda4ba69b8cd8abc615c4e54814f3bd8e3216835fe385e89f14e0
- MD5 874d03c6055d755939da420f5a33a791
- SHA1 7d828de1eea01349ef8bb81026fb58b04db01516
- SHA512 1931142817961e8f09d46ca66d63c9aad5f8fd5f1f6315b8c8fca16a80e62ad62aad2645c2cae0f6e5bf0cbba447014b0dce6e627aeb2e297cb1b1e78b617870
- SSDEEP 3072:RWbPXKVaMJi6BCCgRhc5dGmRv//m//rdqXSizmZmo++74pHUT4gLa3cXrzgL1YeF:RWjaVaMJi6BCCgRhc5dGmRv//m//rdqR
- TLSH T111043A127780C436C67B22B2951B732660D999228F7001EBB75DBF7E2F387C58E38656
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
122928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DiagnosticsTap.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-math-l1-1-0
_isnan
_finite
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__fpclass
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ui64tow_s
_o__wfopen_s
_o_calloc
_o_ceil
_o_fclose
_o_fgetws
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_type_info_compare
__std_terminate
__CxxFrameHandler3
_o__cexit
memcmp
memcpy
advapi32
RegCloseKey
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorLength
MakeSelfRelativeSD
SetSecurityDescriptorDacl
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetSecurityDescriptorOwner
kernel32
FindResourceW
FindClose
FindFirstFileW
GetLastError
FindAtomW
GetModuleHandleW
LoadLibraryExW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
WriteFile
ReadFile
GetCurrentProcessId
DuplicateHandle
CreatePipe
OpenProcess
GetCurrentProcess
CompareStringOrdinal
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
lstrcmpiW
SetLastError
RaiseException
WaitForSingleObject
CreateThread
CreateEventW
GetCurrentThreadId
FreeLibrary
CloseHandle
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
SetEvent
InitializeCriticalSection
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableW
OutputDebugStringW
GetUserDefaultLCID
GetProcAddress
GetModuleHandleExW
oleaut32
SysStringLen
VariantClear
SysAllocString
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
LoadTypeLi
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
SysAllocStringLen
VarBstrCmp
VariantCopy
LoadRegTypeLi
urlmon
CoInternetCombineUrlEx
CreateUri
user32
RegisterWindowMessageW
DefWindowProcW
IsWindow
PostMessageW
PostQuitMessage
UnregisterClassA
CharNextW
CallWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
PostThreadMessageW
SendMessageW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
shlwapi
PathGetCharTypeW
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=17, id=260, version=27412,
count=1264, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=1, id=256, version=27412,
count=34, id=265, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12App.dll
- IMPHASH 580f7afcbee7df1ca32c81d77a14af8c
- SHA256 1de2200b91527f320729b10770c52e1a9a075708513ec8f74652d53a5a33c390
- MD5 6500ad3c0de1525362f29265e8775e70
- SHA1 8b036c413cc620d7298c9ef56f48a0f115c71d6d
- SHA512 6dfa508fd6c1305e78c2245079a8845775649a11a2828c56f327555a4f6b6d774b08972784b6e6c968728623374d308782ee5a02c45ca4c4312a417f75eedf47
- SSDEEP 3072:HYIggflexhMslt3226YzYE4X9Pj/QXrpDr:H/MxOsXRvQPj/M
- TLSH T130B329137754C0B4D1EE19BC992AA376625FAD608FE007E76F71BB6E1CB81C14E38216
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
81216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12App.pdb
api-ms-win-crt-string-l1-1-0
memset
memmove_s
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcslwr_s
_o_calloc
_o_free
_o_iswalpha
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__std_type_info_compare
wcschr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
advapi32
GetSecurityDescriptorSacl
RegQueryValueExW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorLength
MakeSelfRelativeSD
SetSecurityDescriptorDacl
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetSecurityDescriptorDacl
kernel32
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
UnhandledExceptionFilter
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
SetLastError
FindResourceExW
LoadResource
LockResource
SizeofResource
CreatePipe
FreeLibrary
GetProcAddress
LoadLibraryExW
ResetEvent
CreateThread
CreateEventW
CreateActCtxW
GetSystemWindowsDirectoryW
GetLastError
WaitForSingleObject
SetEvent
ActivateActCtx
DeactivateActCtx
GetCurrentThreadId
LocalFree
LocalAlloc
CloseHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
HeapDestroy
ole32
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoRegisterMessageFilter
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
oleaut32
RegisterTypeLi
UnRegisterTypeLi
VarUI4FromStr
DispCallFunc
SysAllocStringLen
VarBstrCat
SysFreeString
VariantClear
VariantInit
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
shlwapi
ord168
ord176
user32
SetParent
SetWindowPos
SetWindowLongW
ReplyMessage
SendMessageW
IsIconic
GetWindowThreadProcessId
GetForegroundWindow
PostMessageW
IsWindow
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
GetClientRect
AttachThreadInput
DestroyWindow
MapWindowPoints
AllowSetForegroundWindow
SetFocus
InSendMessageEx
InSendMessage
DefWindowProcW
RegisterClassExW
GetClassInfoExW
LoadCursorW
GetWindowLongW
CreateWindowExW
CallWindowProcW
CharNextW
UnregisterClassA
SetForegroundWindow
GetSystemMetrics
RegisterWindowMessageW
urlmon
CreateUri
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=17, id=260, version=27412,
count=1283, id=1, productName=Unmarked objects,
count=18, id=257, version=27412,
count=1, id=256, version=27412,
count=21, id=265, version=27412,
count=26, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12AppFrame.dll
- IMPHASH bbe7285c01db2cde951bb23d56c52a7f
- SHA256 e00ad66d5527c66696a3121025829405acddd93861b64402d922ab6f5941ecc5
- MD5 ad55fc60c981f1bc442917dad07aabb4
- SHA1 4779efecc4742e844fdd3e22d7fa9ec2d9d13a4f
- SHA512 a6f0d35a140eeccfec20953bb09a5fd8d23eec3172ef8b4ce8d6e9cef8c92982b050cf5893b86aa112ec89d6552a2f356345cc0f9fd6850687c3fa36d999801b
- SSDEEP 3072:nkCBVJS8Ioycg5Swe5RZYJYGVQ5yor5Wmp6r6RZDsWb3QJQlElXVPIEXDdowxKZ:kRoSgRBGVQ5yoB6r6HgaoFPINTZ
- TLSH T162446B11BB90C4F4C1BF11B4690DB37610AEA9605FF082E7AF9097AE2D359D64E3825F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
187456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12AppFrame.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-stdio-l1-1-0
_wtmpnam
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcslwr_s
memmove
_o__wtoi
_o_free
_o_iswalpha
_o_malloc
_o_strncpy_s
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_o__invalid_parameter_noinfo_noreturn
_CxxThrowException
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__difftime32
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_type_info_compare
wcsrchr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
wcsstr
wcschr
advapi32
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
gdi32
SetLayout
CreatePatternBrush
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
DeleteObject
PatBlt
CreateBitmap
CreateCompatibleDC
kernel32
InterlockedPopEntrySList
ResetEvent
UnhandledExceptionFilter
DelayLoadFailureHook
ResolveDelayLoadedAPI
AddAtomW
FindAtomW
ExitProcess
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
SizeofResource
LockResource
LoadResource
FindResourceExW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
SetEvent
RaiseException
CloseHandle
GetLastError
CreateEventW
CreateThread
WaitForSingleObject
SetLastError
DeleteCriticalSection
GetModuleFileNameW
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
GetEnvironmentVariableW
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
OpenThread
GetProcessIdOfThread
OpenProcess
DuplicateHandle
GetSystemTimeAsFileTime
LocalFree
WideCharToMultiByte
ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
OpenSemaphoreW
IsWow64Process
FindFirstFileW
FindClose
QueryFullProcessImageNameW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
CreateEventExW
K32EnumProcessModulesEx
K32GetModuleFileNameExW
WaitForMultipleObjects
GetVersionExW
lstrlenW
HeapSize
HeapReAlloc
HeapDestroy
VirtualFree
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
ole32
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoCreateInstance
ObjectStublessClient5
CoTaskMemFree
ObjectStublessClient4
HWND_UserMarshal
HWND_UserSize
HWND_UserFree
HWND_UserUnmarshal
ObjectStublessClient3
StringFromCLSID
oleaut32
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayGetUBound
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
SafeArrayLock
SafeArrayUnlock
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SysFreeString
VariantClear
VariantInit
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysStringByteLen
LoadTypeLi
LoadRegTypeLi
SysStringLen
OleCreateFontIndirect
VarBstrCmp
VariantCopy
SysAllocStringLen
SysAllocString
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrOleAllocate
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
shell32
CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW
shlwapi
PathFindFileNameW
PathGetCharTypeW
urlmon
CreateUri
UnregisterWebPlatformPermanentSecurityManager
RegisterWebPlatformPermanentSecurityManager
user32
GetMessageW
PeekMessageW
PostMessageW
IsWindow
SendMessageW
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
LoadCursorW
DestroyWindow
PostQuitMessage
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
GetParent
ClientToScreen
CreateAcceleratorTableW
RedrawWindow
SetWindowPos
CharNextW
GetSysColor
GetClassNameW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
MessageBoxW
IsWindowEnabled
DispatchMessageW
IsIconic
IsZoomed
GetWindowRect
ShowWindow
GetWindowThreadProcessId
SetForegroundWindow
SetCursor
LoadImageW
EnableWindow
SetRect
UpdateWindow
ChangeWindowMessageFilterEx
GetWindowPlacement
InflateRect
SetActiveWindow
MonitorFromWindow
GetMonitorInfoW
SetWindowPlacement
EqualRect
GetForegroundWindow
AllowSetForegroundWindow
TranslateAcceleratorW
SetParent
SetRectEmpty
LoadStringW
LoadMenuW
LoadAcceleratorsW
LoadStringA
GetSystemMetrics
PtInRect
GetCapture
SystemParametersInfoW
GetMessagePos
MapWindowPoints
MessageBeep
DestroyMenu
GetWindowDC
DrawEdge
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
CreatePopupMenu
MonitorFromPoint
UnregisterClassA
GetAncestor
TranslateMessage
IsWindowVisible
GetKeyState
GetAsyncKeyState
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
iertutil
ord650
ord792
ord811
ord654
api-ms-win-rtcore-ntuser-window-l1-1-0
SendMessageTimeoutW
api-ms-win-appmodel-unlock-l1-1-0
IsDeveloperModeEnabled
oleacc
ObjectFromLresult
AttachTools
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EnableDebugMode
GetProxyDllInfo
InjectTools
ShowTools
Name
.text
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=18, id=260, version=27412,
count=1481, id=1, productName=Unmarked objects,
count=27, id=257, version=27412,
count=1, id=256, version=27412,
count=52, id=265, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12AppFrame2.dll
- IMPHASH 4cfd2bd643baaa3f6c9e9506832daef9
- SHA256 46b1e182d85b1d03141432b234ea6f5064752c8a74b75acb97c959fdbe9971e9
- MD5 25da0aaa5e7b8833ca2890a6271e86c5
- SHA1 5fc4400b97292bcecd007d50606e656ab26e8db3
- SHA512 3dd8a0e64992103000fd0813d0cb6bce143fd88d16df1a1baf1791799bc130081411d358ff65a989886580bd294360aa63abf95160fb4305b9ba5045e16d888d
- SSDEEP 6144:nXyPjhsoIg7uaaGRRE/k88+hvwLAvkTtmSHAoqL5PcPk/R:nirsgiG+Rw88T8LBR
- TLSH T1F1445C15B785C4B1E9BF23F065097236029D59205BF085EB9FE1F3BE28396C54E3826B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
211392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12AppFrame2.pdb
msvcp_win
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-string-l1-1-0
wcscspn
memset
wcsspn
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
memmove
_o__wfopen_s
_o__wtmpnam_s
_o_fclose
_o_fputws
_o_free
_o_isalnum
_o_malloc
_o_memcpy_s
_o_strncpy_s
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_type_info_compare
wcsrchr
__std_terminate
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__difftime32
_o__crt_atexit
_o__configure_narrow_argv
_o__get_doserrno
memcmp
memcpy
advapi32
RegEnumKeyExW
RegDeleteValueW
EventWriteEx
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
EventUnregister
EventRegister
EventSetInformation
RegQueryInfoKeyW
gdi32
CreateSolidBrush
BitBlt
CreateCompatibleDC
DeleteObject
CreateCompatibleBitmap
SelectObject
GetDeviceCaps
GetObjectW
GetStockObject
DeleteDC
kernel32
VirtualQuery
VirtualProtect
GetSystemInfo
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
WideCharToMultiByte
HeapDestroy
HeapReAlloc
HeapSize
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
GetCurrentPackageInfo
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseMutex
lstrlenW
GetVersionExW
GetLocalTime
OpenProcess
lstrcmpiW
ReleaseSRWLockExclusive
FreeLibrary
LoadLibraryW
CreateFileW
InitializeCriticalSection
GetEnvironmentVariableW
ReadFile
lstrcmpW
MulDiv
GlobalUnlock
GetModuleFileNameW
GlobalLock
GlobalAlloc
DeleteCriticalSection
SetLastError
WaitForSingleObject
CreateThread
IsDebuggerPresent
OutputDebugStringW
CreateEventExW
MultiByteToWideChar
FindResourceExW
LoadResource
LockResource
SizeofResource
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetTickCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
CloseHandle
RaiseException
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA
LoadLibraryExW
ole32
CoWaitForMultipleHandles
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoGetClassObject
OleInitialize
CLSIDFromString
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
IIDFromString
CoGetMalloc
CoCreateInstance
OleUninitialize
OleLockRunning
CoTaskMemAlloc
CLSIDFromProgID
StringFromGUID2
oleaut32
SysFreeString
VariantInit
VariantClear
VariantCopy
SysAllocString
SysAllocStringLen
VarBstrCmp
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SafeArrayPutElement
SafeArrayCreateVector
shlwapi
PathFindFileNameW
urlmon
CoInternetGetSession
CreateUri
CoInternetParseIUri
ord505
RegisterWebPlatformPermanentSecurityManager
UnregisterWebPlatformPermanentSecurityManager
user32
PeekMessageW
MsgWaitForMultipleObjectsEx
GetWindow
GetAsyncKeyState
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
DispatchMessageW
PostMessageW
UnregisterClassA
GetMonitorInfoW
MonitorFromPoint
CreatePopupMenu
TrackPopupMenuEx
AppendMenuW
GetMenuItemCount
RemoveMenu
GetMenuItemInfoW
DestroyMenu
MessageBeep
MapWindowPoints
GetWindowRect
PtInRect
LoadStringA
LoadAcceleratorsW
LoadMenuW
LoadStringW
TranslateAcceleratorW
IsZoomed
CopyRect
SetTimer
KillTimer
AllowSetForegroundWindow
MsgWaitForMultipleObjects
ChangeWindowMessageFilterEx
RegisterClassW
LoadImageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
IsChild
GetFocus
SetFocus
GetMessageW
GetDlgItem
GetClassNameW
GetSysColor
CharNextW
SetWindowPos
RedrawWindow
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRgn
InvalidateRect
GetDesktopWindow
DestroyAcceleratorTable
BeginPaint
GetDC
EndPaint
ReleaseDC
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
IsWindow
GetAncestor
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
iertutil
ord650
ord597
ord85
ord79
ord654
ord811
ord791
ord855
ord796
ord74
ord81
ord82
ord76
ord793
ord594
ord398
edgehtml
GetWebPlatformObject
dcomp
DCompositionCreateDevice2
userenv
GetProfileType
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
GetTokenInformation
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
ExitProcess
OpenProcessToken
api-ms-win-core-file-l1-1-0
GetFileSizeEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathGetCharTypeW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceInitialize
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_Set
api-ms-win-core-atoms-l1-1-0
AddAtomW
FindAtomW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork
SubmitThreadpoolWork
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
ntdll
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlIsCriticalSectionLocked
RtlIsCriticalSectionLockedByThread
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-appmodel-identity-l1-2-0
AppXGetDevelopmentMode
api-ms-win-appmodel-runtime-l1-1-1
GetStagedPackageOrigin
shell32
SHGetKnownFolderPath
api-ms-win-core-handle-l1-1-0
DuplicateHandle
AttachTools
AttachToolsToDiagnosticsTarget
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
231KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=15, id=260, version=27412,
count=1481, id=1, productName=Unmarked objects,
count=27, id=257, version=27412,
count=1, id=256, version=27412,
count=60, id=265, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12Platform.dll
- IMPHASH cd71a2f96fc54e829f1b03c48b74ea70
- SHA256 e22f0667534861d9cd525c1f5b266adadae7ed86e081a68f4eee985e244ccc61
- MD5 b13b91f3bb7d6fb8dce3473df8222ec4
- SHA1 f9ff305e946bf160d93ec714ecf066d60efadb8e
- SHA512 6c070df53c52db869f6bf290f708f012777489ecdcdefdb74b356a51c1538409f631df2d928ea20eda62ffe9d6ea1089edac98d18b757776f3c8eaa8f4fd5bd0
- SSDEEP 6144:QRsnyCvCyCXr/CcPzOE2Xy/LSsjzNqnMf2OkHvM0ZSroFRzzdOPbD1Hkm6NX+8y:EBzcsjzNJkPXBoVJRQ6z9w
- TLSH T1C5C4F653B7E48074E6BB16B07979AA19CA79BD604F61819F73C02B2E78B0BD14D34723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
424688
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12Platform.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_doserrno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
memmove
_o__wcsicmp
_o__wcstoui64
_o__wfopen_s
_o__wtol
_o_ceil
_o_fclose
_o_feof
_o_fflush
_o_fputws
_o_fread
_o_free
_o_fseek
_o_ftell
_o_fwrite
_o_iswalpha
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
wcschr
__std_type_info_compare
wcsstr
__std_terminate
__CxxFrameHandler3
__RTDynamicCast
memcmp
memcpy
advapi32
EventUnregister
EventSetInformation
EventWriteTransfer
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventWrite
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
gdi32
GetPixel
CreateSolidBrush
kernel32
RemoveDirectoryW
DeleteVolumeMountPointW
GetDriveTypeW
InitializeSListHead
GetSystemTimeAsFileTime
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
HeapDestroy
ExpandEnvironmentStringsW
HeapSize
ReadProcessMemory
GetCurrentProcess
GetModuleHandleExW
GetTempPathW
FindResourceW
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
WriteFile
VerifyVersionInfoW
VerSetConditionMask
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
DeleteFileW
CreateFileW
GetTempFileNameW
CreateDirectoryW
GetCurrentProcessId
GetEnvironmentVariableW
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetTickCount64
SetEvent
CreateThread
CreateEventW
SetLastError
RaiseException
GetCurrentThreadId
Sleep
FindClose
FindNextFileW
FindFirstFileW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetLastError
CloseHandle
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindFirstFileExW
ReadFile
GetExitCodeThread
MoveFileW
GetFileAttributesW
InitializeSRWLock
GetFullPathNameW
CompareStringOrdinal
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
HeapReAlloc
CopyFileW
WaitForMultipleObjects
ole32
PropVariantClear
IIDFromString
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2
CoGetApartmentType
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
oleaut32
VariantClear
SysAllocString
SafeArrayCopy
VariantInit
SysStringLen
LoadRegTypeLi
SafeArrayAllocData
SafeArrayDestroyDescriptor
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayAllocDescriptorEx
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayUnlock
SafeArrayCreate
SafeArrayRedim
SafeArrayLock
VariantCopy
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
SafeArrayGetVartype
SysFreeString
shell32
SHGetKnownFolderPath
SHCreateDirectoryExW
shlwapi
PathGetCharTypeW
PathIsRelativeW
PathFileExistsW
PathFindFileNameW
StrStrIW
user32
CopyRect
PostMessageW
ShowWindow
GetWindowPlacement
SendMessageW
GetMonitorInfoW
CharNextW
ChangeWindowMessageFilterEx
GetMessageW
PeekMessageW
CallWindowProcW
SetWindowLongW
CreateWindowExW
LoadCursorW
AllowSetForegroundWindow
RegisterClassExW
DefWindowProcW
DestroyWindow
PostThreadMessageW
SetForegroundWindow
GetForegroundWindow
RegisterClassW
EnumDisplayMonitors
GetCursorPos
WindowFromPoint
GetDC
SetLayeredWindowAttributes
SetWindowPos
GetDoubleClickTime
MonitorFromPoint
GetSysColor
SystemParametersInfoW
ClientToScreen
UnregisterClassA
ReleaseDC
SendInput
GetClassInfoExW
MonitorFromWindow
IsCharAlphaW
IsWindow
GetWindowLongW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wer
WerReportCloseHandle
WerReportAddFile
WerReportSubmit
WerReportSetParameter
WerReportCreate
windowscodecs
WICConvertBitmapSource
urlmon
CreateUri
wininet
GetUrlCacheEntryInfoW
api-ms-win-core-path-l1-1-0
PathCchCanonicalizeEx
xmllite
CreateXmlReader
CreateXmlWriter
CreatePlatform
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=16, id=260, version=27412,
count=1354, id=1, productName=Unmarked objects,
count=31, id=257, version=27412,
count=1, id=256, version=27412,
count=66, id=265, version=27412,
count=27, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12Platform2.dll
- IMPHASH 784dc6841003d517a330d89d344c7ecc
- SHA256 7225ac69971e4b770910f63e641f33e0aef427e49a3fbc1bedd45d4b1f0f1816
- MD5 45c30c514fb9e981ee13b13913daf28f
- SHA1 a7d67658bb86e0e933a34fe75fe8db4d22a27cbf
- SHA512 4f176ffcffcdae3b60c867baa3e6cc1dd00ab694ba52160fb9e03861e6f0cf0e7f372f1e7ec5a8d9f47374e4658f6bd694129dc16d2ec2865d21e439acafaae1
- SSDEEP 6144:YHbret7scHHjCP8cl7i4t7XNU96NOZM3joibnst8ubuThlmP:Ymt7scjC1bBNkwjoRG+P
- TLSH T1DC843996B7C5C476D17E61B0392DB2A2193DFCA04FA081DBFB86676E6D346C10E38613
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
249696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12Platform2.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcslwr_s
_o__wcstoui64
_o__wfopen_s
_o__wtol
_o_ceil
_o_fclose
_o_feof
_o_fflush
_o_fputws
_o_fread
_o_free
_o_fseek
_o_ftell
_o_fwrite
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__get_doserrno
__std_type_info_compare
wcsstr
__CxxFrameHandler3
_o__crt_atexit
memcmp
memcpy
advapi32
EventUnregister
EventSetInformation
EventWriteTransfer
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
GetSidSubAuthority
CopySid
GetLengthSid
EventWrite
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
IsValidSid
kernel32
GetFileAttributesW
InitializeSRWLock
GetFullPathNameW
CompareStringOrdinal
GetSystemInfo
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
HeapDestroy
HeapReAlloc
HeapSize
CreateSemaphoreExW
CreateMutexExW
ReadProcessMemory
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseMutex
FindResourceW
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetExitCodeThread
WaitForSingleObject
CreateThread
GlobalLock
WideCharToMultiByte
DeleteFileW
CloseHandle
CreateFileW
GetTempFileNameW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetEnvironmentVariableW
GetCurrentProcessId
LockResource
SetLastError
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
LoadLibraryExW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
GetTickCount64
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
GlobalFree
GlobalAlloc
GetLastError
GlobalUnlock
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA
ExpandEnvironmentStringsW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForMultipleObjects
CopyFileW
MoveFileW
FindFirstFileExW
RemoveDirectoryW
DeleteVolumeMountPointW
GetTempPathW
VirtualProtect
GetDriveTypeW
ole32
CreateStreamOnHGlobal
CoGetApartmentType
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoCreateGuid
IIDFromString
oleaut32
VarBstrCmp
SafeArrayCopy
SafeArrayAllocData
SafeArrayDestroyDescriptor
SafeArrayAllocDescriptorEx
SafeArrayRedim
SafeArrayCreate
SysFreeString
SysAllocString
VarUI4FromStr
RegisterTypeLi
SysStringLen
LoadTypeLi
UnRegisterTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantInit
VariantClear
VariantCopy
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayLock
SafeArrayDestroy
SafeArrayUnlock
shell32
SHCreateDirectoryExW
SHGetKnownFolderPath
shlwapi
StrStrIW
PathGetCharTypeW
PathIsRelativeW
PathFileExistsW
PathFindFileNameW
user32
OpenClipboard
CloseClipboard
ChangeWindowMessageFilterEx
CharNextW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
IsWindow
SendMessageW
GetWindowPlacement
ShowWindow
PostMessageW
CopyRect
SetForegroundWindow
AllowSetForegroundWindow
GetDoubleClickTime
EmptyClipboard
SetClipboardData
MonitorFromPoint
GetMonitorInfoW
GetSysColor
SystemParametersInfoW
ClientToScreen
GetClipboardData
UnregisterClassA
DestroyWindow
IsCharAlphaW
urlmon
CoInternetCombineUrlEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
iertutil
ord855
ord793
ord650
wininet
GetUrlCacheEntryInfoW
api-ms-win-core-path-l1-1-0
PathCchCanonicalizeEx
PathCchRemoveFileSpec
CreatePlatform
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
Name
.text
Size
281KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=257, version=27412,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1393, id=1, productName=Unmarked objects,
count=10, id=259, version=27412,
count=17, id=260, version=27412,
count=1, id=256, version=27412,
count=55, id=265, version=27412,
count=28, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12Script.dll
- IMPHASH d5ba580f2b975a270d4fd13e7c4c2300
- SHA256 a09fd35b15d47546178eb90c2f0296eb4f104a206ea2b4844e673dca00f1eb34
- MD5 2eb444f7fea8139bd09dfa60237c3917
- SHA1 a310eaa5086106e87dcb7e52aa1f39bdd84a4630
- SHA512 1fe7d44787f5250e10ecbcbdfd7aef6130908d1e0981ff7b9d2f39883d6ad244986284af5c8f5a1a3206e4e06a1223d6a693b77adc4358e581b3ad3efbe3f0ab
- SSDEEP 49152:kkNMbQPPK/3dp8GXt2I/9dYoUY5sjBlMJRHQ37auZFBwTpkWcrEYSWasgVrr3jyk:kqPceZFBJS
- TLSH T14D762989F655383283A7A1B9657F010BF33B149A8408547CB6ACD8ED1FFD849522BF78
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12Script.pdb
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
DisableThreadLibraryCalls
Name
.text
Size
1024B
Virtual Size
886B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=27412,
count=6, id=1, productName=Unmarked objects,
count=4, id=260, version=27412,
count=1, id=256, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/F12Tab.dll
- IMPHASH 7aa4cbd7b13becd17fa48faddeeb9483
- SHA256 3b321ddf428a40533dbdb1d585f6e8df7445482a9180e78b2ba096e9ec605650
- MD5 186fa435d84b127e3635b371e4222a84
- SHA1 0d3b4ecffbeab12585da159340685f590704958b
- SHA512 76d909a2886df03a60eb9c082b10ebaaddc477fff58141378512b23c741cb0641fedfe1b648baf471460dfda3cf507142d0df8a81445605c490a5665e1e44890
- SSDEEP 3072:AlYMRnjEvCaAAZdRIAt++g8yNsU5yReZJ/ZZRm6KtHXPAP3Oi5JPHYxKeX:tMEvCaAGeAt++g8yyez/ZC6KBXYP3938
- TLSH T182044B227794C076D2AE17B1681FA36520E9AD304FE001DBFBB2AF7E593C5C58E34526
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
123376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F12Tab.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtoi
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
_except_handler4_common
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_type_info_compare
wcsstr
_CxxThrowException
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
kernel32
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
CompareStringOrdinal
WaitForSingleObject
ResetEvent
CreateEventW
CloseHandle
SetEvent
LoadResource
FindResourceExW
LockResource
SizeofResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
GetEnvironmentVariableW
oleaut32
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarBstrCmp
LoadRegTypeLi
VariantInit
VariantClear
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantCopy
SysAllocStringLen
user32
MsgWaitForMultipleObjects
PostMessageW
SendMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA
CharNextW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=16, id=260, version=27412,
count=1229, id=1, productName=Unmarked objects,
count=16, id=257, version=27412,
count=1, id=256, version=27412,
count=24, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/IEChooser.exe
- IMPHASH a92db0d5de47ebbf39db19d43a2f2fd8
- SHA256 35ca3f460f699aa85bea5753b72bd2963180370c25256456f81e1880549a531e
- MD5 6804569e7bab2dd6cd05103c45c1a797
- SHA1 59471d860ead074f662ac83dd50cb5a8a50a6faf
- SHA512 62006486ddafd660dcd3f178f19ca7317353b1577d06dfd216f8c06d35815a184b70671552131453bab5090d3d4baed61ac4ea3d1b2e60cbf6121c75d91be459
- SSDEEP 3072:6M5XaIQyKvr+tWL2LyGRWHoKJsdXy3QkNfIgFa4S80:6M5qIQhvr8WL2Ly6Y3sxaZf1Fa+
- TLSH T1A9F31A167ED0C4F5D2A710B15969F3A561AAFCB10BB002F7B364A3AE2F386C11D38596
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
109280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
IEChooser.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
kernel32
lstrcmpiW
FreeConsole
GetModuleHandleW
GlobalHandle
GlobalFree
EnterCriticalSection
LoadLibraryExW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
K32GetModuleFileNameExW
K32EnumProcessModulesEx
QueryFullProcessImageNameW
CloseHandle
OpenProcess
GetCurrentProcessId
AttachConsole
LeaveCriticalSection
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetLastError
RaiseException
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
FindResourceW
HeapSize
HeapReAlloc
LocalFree
Sleep
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
FormatMessageW
SetEvent
WaitForSingleObject
CreateEventW
CreateThread
WaitForMultipleObjects
ExitProcess
FindAtomW
AddAtomW
gdi32
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
user32
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ShowWindow
GetWindowThreadProcessId
MessageBoxW
SendDlgItemMessageW
IsDialogMessageW
PostMessageW
PostQuitMessage
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
GetClassNameW
GetSysColor
SetWindowPos
RedrawWindow
LoadCursorW
GetClassInfoExW
DestroyWindow
CharNextW
DestroyAcceleratorTable
GetDesktopWindow
EnumChildWindows
EnumWindows
SendMessageTimeoutW
GetWindowPlacement
IsWindowEnabled
UnregisterClassA
SetWindowContextHelpId
MapDialogRect
ReleaseDC
GetDC
InvalidateRect
CallWindowProcW
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
GetParent
ClientToScreen
CreateAcceleratorTableW
CreateWindowExW
SetWindowLongW
GetWindowLongW
CreateDialogIndirectParamW
DefWindowProcW
RegisterClassExW
msvcp_win
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Xbad_function_call@std@@YAXXZ
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?_Xlength_error@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o___p__commode
_o___std_exception_copy
_o___std_exception_destroy
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__fseeki64
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__unlock_file
_o__wcsicmp
_o__wcslwr_s
_o__wsystem
_o__wtoi
_o_calloc
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_iswalpha
_o_malloc
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
memcpy
memcmp
__std_type_info_compare
wcsstr
__std_terminate
__CxxFrameHandler3
wcschr
memmove
ole32
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoInitializeEx
oleaut32
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarBstrCmp
SysAllocString
VarUI4FromStr
VariantCopy
SysAllocStringLen
VariantInit
VariantClear
SysStringByteLen
OleCreateFontIndirect
SysFreeString
shell32
CommandLineToArgvW
ShellExecuteW
iertutil
CreateUri
ord792
ord811
mshtml
GetWebPlatformObject
urlmon
UnregisterWebPlatformPermanentSecurityManager
RegisterWebPlatformPermanentSecurityManager
oleacc
ObjectFromLresult
Name
.text
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=17, id=260, version=27412,
count=27, id=257, version=27412,
count=1401, id=1, productName=Unmarked objects,
count=29, id=265, version=27412,
count=32, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/MemoryAnalyzer.dll
- IMPHASH f1ec9ca76542bbaf296d87b96f3006a7
- SHA256 f246603fb538624d9c5ef7a9777d52356868cf2beaff3052f99630f7b838c09c
- MD5 6844d8776c00c69cd17d16ac74f2de23
- SHA1 0f310878fe4abcec983d138051e2aa8d532cf66a
- SHA512 d5f9202dad2cb6b6beddeb495dac85316c3d6e1057fe0b4f6732c136d0785d694caef07fe55c6a5f287bb4f2b95d3a5fd521782301a0b6bb7c98405bf4db3936
- SSDEEP 49152:VzVkeajbr8SXncBvKSQDCQWlkSupbFynRPorB6A+ISyxiG7drNrhACoNRPdmqjm5:4eajbr9Xni1dMhgbV+iK7sxzD
- TLSH T1938582B38F904E58ED5139F43E58AF05D85A7B58293281DE538339AEC4E4BB1CB16723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
1613200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
MemoryAnalyzer.pdb
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-string-l1-1-0
memset
memmove_s
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcstoi64
_o__wcstoui64
_o_ceil
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_tolower
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__CxxFrameHandler3
__RTDynamicCast
memchr
memcmp
memcpy
ole32
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantCopy
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayCopy
kernel32
HeapCreate
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CloseThreadpool
SetThreadpoolThreadMinimum
CreateThreadpool
ExpandEnvironmentStringsW
HeapFree
GetModuleHandleExW
GetCurrentThreadId
FormatMessageW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
DebugBreak
DeleteCriticalSection
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SizeofResource
GetModuleFileNameA
CloseThreadpoolCleanupGroupMembers
LockResource
LoadResource
FindResourceExW
GetModuleFileNameW
OutputDebugStringW
IsDebuggerPresent
CloseHandle
MultiByteToWideChar
SetLastError
HeapDestroy
CreateEventW
SetEvent
WaitForSingleObject
GetLastError
CreateFileW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
HeapReAlloc
HeapSize
WideCharToMultiByte
ReadFile
user32
UnregisterClassA
CallWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
DestroyWindow
PostMessageW
shell32
SHGetKnownFolderPath
advapi32
GetSidSubAuthorityCount
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
IsValidSid
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=13, id=260, version=27412,
count=1262, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=1, id=256, version=27412,
count=34, id=265, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/Timeline.cpu.xml
- SHA256 a132e2f208ad8b06468a00d4a3d1fd0b5fc254919bc87fcc2d0abd028a80d338
- MD5 819cede1e5a2ba74cff6873e56059b48
- SHA1 1203e44f17fe623996b63d43739e3ab05aee463b
- SHA512 62557c93ab9e60b9fe7eadde7a92a41f4bb129ebfc22cf4167be22c025ea70f8a918b013db02ad2a2f46055883c8b59c63d4042f57aa547f52d074bc11a517ff
- TLSH T17B510830FCADBDA2DD213B6AFC6C5D55946B069B6198FA91BC47603287DFB1808131CE
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/F12/Timeline.dll
- IMPHASH ad351fdcd2720a3a2821555eddc9d258
- SHA256 f0ceeb207c927f198c66c7c0cda2055a35ba0422e24310446224dc101496fce2
- MD5 8ff3ea953b5800194d7aa785a924a672
- SHA1 8b36a2886a3ef56e8a58d2aa1aecbcbfbe9d5f87
- SHA512 a8be9af70cfca7070f0927979714b8b6bc5d86dd0bb588a2937c76bbddb270e9ad65d929c1f0abb66e6cf8e9d146a7e8c93598d6d783f73831bc4e77280f7121
- SSDEEP 6144:Qq+Iuufm6bMH1rF9JnPqkwBzUDJLTqvqT:QpmfmIMlF9hPqzBzS5qiT
- TLSH T1C7245C27B694C4B5D27B26F0A11D22365499AC100FF205FBD3A7FF6D1A389C54E3892E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
164800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Timeline.pdb
msvcp_win
?_Xout_of_range@std@@YAXPBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?toupper@?$ctype@G@std@@QBEGG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Wcscoll
_Wcsxfrm
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPBD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?id@?$ctype@G@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?classic@locale@std@@SAABV12@XZ
?_Xbad_alloc@std@@YAXXZ
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
__CxxFrameHandler3
_o__purecall
memmove
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcstoi64
_o_ceil
_o_floor
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_toupper
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
strchr
wcsstr
__std_terminate
memcmp
memcpy
kernel32
UnhandledExceptionFilter
GetCurrentProcess
HeapDestroy
HeapReAlloc
HeapSize
CompareStringOrdinal
WaitForSingleObject
ResetEvent
SetEvent
IsDebuggerPresent
OutputDebugStringW
FindResourceExW
LoadResource
SetLastError
LockResource
SizeofResource
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetLastError
CreateEventW
InitializeCriticalSection
RaiseException
DeleteCriticalSection
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
user32
UnregisterClassA
ole32
CoCreateInstance
oleaut32
SysFreeString
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
VariantCopy
LoadTypeLi
LoadRegTypeLi
VariantInit
SysStringLen
VariantClear
SysAllocString
shlwapi
PathFileExistsW
PathGetCharTypeW
wininet
InternetCrackUrlW
timeline_is
InitTimelineInfoSources
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=14, id=260, version=27412,
count=1296, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=1, id=256, version=27412,
count=29, id=265, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/Timeline_is.dll
- IMPHASH 36130b97e65223f249cc51cec4075200
- SHA256 2f6320b53ddb7f37bd7c0c220260d5a3eb20a74b02730d8d2088eee604f616d1
- MD5 a790a49b1537835380de862a5e79fcc4
- SHA1 604211eaeae5712331bd2e35cd95a74239c9003c
- SHA512 c909990f4c29dc1681909cb3dc01cc2fe7d1d26c7ea5524f26026bece285019956064c41e2f9acd0d70e20b7d52527258f763ec9c1c1807bba2f335604007767
- SSDEEP 3072:Wf4nlUog7uXjSkE2tdUc16itQZbnkxzeSib7+svA:WwnlUogyz1HtdGgQZbnqzeff+s
- TLSH T1C4D37C22B6D0C07AE17F3771762BE37A62ADADA0CFA001DB5764173F2A389C14D34656
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
105184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Timeline_is.pdb
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__mbslwr_s
_o__mbsstr
_o__purecall
memmove
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__ui64tow_s
_o__wcsicmp
_o__wtoi
_o_ceil
_o_free
_o_malloc
_o_toupper
_o_wcsncpy_s
_o_wcstoul
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
wcsstr
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
kernel32
SizeofResource
LockResource
LoadResource
FindResourceExW
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
MultiByteToWideChar
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetFileAttributesW
WideCharToMultiByte
InitializeCriticalSection
RaiseException
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
user32
UnregisterClassA
ole32
CoCreateInstance
oleaut32
VariantInit
SysAllocString
VariantCopy
VarCmp
VariantChangeType
VariantClear
rpcrt4
UuidFromStringW
shlwapi
SHCreateStreamOnFileEx
tdh
TdhGetPropertySize
TdhGetProperty
xmllite
CreateXmlReader
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitTimelineInfoSources
Name
.text
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=11, id=260, version=27412,
count=1165, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=1, id=256, version=27412,
count=23, id=265, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/msdbg2.dll
- IMPHASH fec2aa5793aa487f27e3c5acad66d5ab
- SHA256 99ef55c714faa0ec1fa2d22d7a0bd962febe8fc029fb167844d4bffb4f17c248
- MD5 0e548d761a7834dd2598b39bfda8abd1
- SHA1 6886842eb538d43894441d6719c7082056981ce3
- SHA512 7314e849900fc2dc15f58837a16827453797778be684e27d268d9fc8e218adc3e112fc84fd00876d012121170c030f162a7307f76d6d00cd964bec77abbafe60
- SSDEEP 3072:RJ3phdbYHA0+hI+PS0XbKf85UIUiGWbvO8cYF1WM1vVEC0wyF/wGk6jpAF6Sve:JGOyX8cYWMqjme
- TLSH T13954C78667B04038F5AF6039445E8320F34C2D11FBD086DADE94BA55ADB3162EF37BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:3c:a8:8b:5a:bc:cd:63:30:60:2d:18:c8:87:30:5d:5f:b5:36:77:2e:14:cd:06:74:dc:86:9f:37:de:7b:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Windows Phone,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 5, 2017
CN=Windows Phone,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Windows Phone,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:95:dd:0e:34:66:c7:05:3e:e7:00:00:00:00:00:95
Issuer
CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Windows Phone Production PCA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0b:fc:f9:8e:58:4c:15:50:bf:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 24, 2012 - Jul 24, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a2:4c:8e:1d:da:a9:21:7c:84:00:00:00:00:00:a2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
6
Entry point
6496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\2\s\binaries\Win32\Release\msdbg2.pdb
rpcrt4
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrStubForwardingFunction
NdrStubCall2
NdrClientCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Invoke
kernel32
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
RaiseException
CreateFileW
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteFile
ole32
HWND_UserSize
HWND_UserFree
HWND_UserUnmarshal
HWND_UserMarshal
oleaut32
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserSize
VARIANT_UserMarshal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=244, version=40116,
count=9, id=239, version=40116,
count=120, id=1, productName=Unmarked objects,
count=9, id=241, version=40116,
count=116, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24723,
count=21, id=261, version=24723,
count=15, id=260, version=24723,
count=72, id=264, version=25019,
count=1, id=256, version=25019,
count=1, id=255, version=25019,
count=1, id=151,
count=1, id=258, version=25019,
apt/SysWOW64/F12/pdm.dll
- IMPHASH 3ef1a57eb05e3eae19455ada5dd7f78b
- SHA256 35543b1d2b626bbd54cbfbe003c52ab55d839b6af153da539f8e785bb9499cc7
- MD5 e1e533fd4e792df13bf3dd0cf7f5bbd8
- SHA1 344587f601c088850cd9a23e94b02b0bf987d4da
- SHA512 32a1e60d9e8224f8c674353a26ac1059ec46ec0c90f32c7afada8eedc7342c7365c266ba361a188b6d2a51df8459c416cbb7d23762780786035ba96ab1acc693
- SSDEEP 6144:LwFRUdSXxNhnozhXC3hBbLQUcQo1qG71nmOLPEqy5+PDMog+M5FL4EFmO:mUWoehiwosG70cEqy9+qFxx
- TLSH T14AA45C70B9898036D23F093655DDA04FD26968508F7848D7D7B8D6BE1EBC0C26F3896B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
40:c6:19:8e:5e:04:9d:24:41:dd:b8:a3:cf:3d:75:1e:b3:88:35:21:52:03:24:fb:e2:44:88:bf:b1:4e:5e:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 1, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6c:c2:14:e5:ea:df:12:cb:31:72:6a:c9:c7:52:e4:1e:88:99:ea:80
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 1, 2017
CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a9:54:70:d9:79:c0:84:65:e2:00:00:00:00:00:a9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
6
Entry point
272032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\2\s\binaries\Win32\Release\pdm.pdb
rpcrt4
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
kernel32
CreateMutexW
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
FreeLibraryAndExitThread
CreateThread
GetThreadLocale
EncodePointer
lstrcmpiW
LoadLibraryExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
OpenFileMappingW
UnmapViewOfFile
Sleep
CreateFileMappingW
MapViewOfFile
GetTickCount
GetCurrentProcess
RegisterWaitForSingleObject
OpenEventW
DuplicateHandle
OpenProcess
CreateEventW
SetEvent
UnregisterWaitEx
WaitForMultipleObjects
GetCurrentThread
GetFileAttributesW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
GetModuleFileNameW
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
LCMapStringW
GetACP
GetStdHandle
GetFileType
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FreeLibrary
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
OutputDebugStringW
CreateFileW
WriteConsoleW
LoadLibraryW
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
TlsFree
TlsGetValue
CreateSemaphoreW
RaiseException
TlsAlloc
WaitForSingleObject
TlsSetValue
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
CloseHandle
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
HeapFree
GetComputerNameW
ProcessIdToSessionId
GetVersion
FormatMessageA
LocalFree
FormatMessageW
LoadLibraryExA
WriteFile
user32
CharNextW
SetWindowLongW
RegisterClassW
UnregisterClassW
SendMessageW
CreateWindowExW
DestroyWindow
PostMessageW
DefWindowProcW
GetWindowLongW
MsgWaitForMultipleObjects
IsWindow
advapi32
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAclInformation
GetSecurityDescriptorGroup
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorControl
CopySid
GetTokenInformation
SetSecurityDescriptorSacl
InitializeSid
GetSecurityDescriptorOwner
IsValidSid
AddAce
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
MakeAbsoluteSD
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetSidIdentifierAuthority
OpenProcessToken
GetSidSubAuthorityCount
RegEnumKeyW
EqualSid
ole32
CoRegisterClassObject
CoSetProxyBlanket
CoGetObjectContext
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoQueryProxyBlanket
CoRegisterPSClsid
CoRegisterMessageFilter
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CLSIDFromString
CoWaitForMultipleHandles
oleaut32
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetDim
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantClear
SysAllocString
SysFreeString
VariantCopyInd
SafeArrayPtrOfIndex
VarBstrCat
VarUI4FromStr
VariantChangeType
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
426KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=262, version=24610,
count=13, id=257, version=24610,
count=10, id=259, version=24610,
count=140, id=261, version=24610,
count=18, id=260, version=24610,
count=18, id=259, version=24723,
count=43, id=261, version=24723,
count=18, id=260, version=24723,
count=263, id=1, productName=Unmarked objects,
count=67, id=265, version=25019,
count=1, id=256, version=25019,
count=1, id=255, version=25019,
count=1, id=151,
count=1, id=258, version=25019,
apt/SysWOW64/F12/pdmproxy100.dll
- IMPHASH 2162d508f66f9f0685d68e8bc89ac920
- SHA256 3d63b81bc11d61f2f6c55232e61deb831b489a85298b93685a150ab90d2e9dac
- MD5 ea176a32692094d524c28b8d27b06442
- SHA1 c3e47f6699566ad2cd890382aa17c705fe43b59b
- SHA512 fc13ea8b18ce3271c8ea039b8b2b207f29a365342c4eea17d50375043608a101f2ef35f41aa3d9886161ba642442553c42919241f0d06179ee30090dae84c6c1
- SSDEEP 1536:UFW2axXFek/6cTczuy5h0su0Mxv6XsW2GcdgVpvJEK7D1DVhbnp:Ujgek/6IIbM9fgVpvJEgpxh7p
- TLSH T131A33A40F8949030D4BE5C380565D6916B3E79A1CF914EEF2FA859694FB42C0FF31E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:ac:2a:1e:fe:6b:58:93:a1:7d:e7:eb:4d:4d:ad:d1:ec:62:55:2f:80:f3:04:a8:ed:b1:cf:6d:ec:04:ca:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 5, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ec:0e:ff:3b:dc:49:5a:79:f2:9d:46:de:e9:bd:cd:80:93:56:a2:75
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 5, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
6
Entry point
5104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\2\s\binaries\Win32\Release\pdmproxy100.pdb
rpcrt4
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
kernel32
MultiByteToWideChar
GetStringTypeW
GetFileType
GetStdHandle
RaiseException
CreateFileW
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetProcessHeap
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
oleaut32
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=244, version=40116,
count=7, id=239, version=40116,
count=111, id=1, productName=Unmarked objects,
count=9, id=241, version=40116,
count=116, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24723,
count=21, id=261, version=24723,
count=15, id=260, version=24723,
count=6, id=264, version=25019,
count=1, id=256, version=25019,
count=1, id=255, version=25019,
count=1, id=151,
count=1, id=258, version=25019,
apt/SysWOW64/F12/ru-RU/F12Platform.dll.mui
- SHA256 d6279dfddae8ee02f98e8feb5405e7ae37766ac360dc926876127e9580163fe9
- MD5 0f63cb9d89da20bd63d98c7871590c5b
- SHA1 c3c76a5f7324880b37db8c7d16acdbd728d65f2b
- SHA512 c55665700a31108516fc8d443d826ab5300e912b6ce22b222b58a3a210b933841dcde8deaa56c91579849bbb9c845a6e20a72944081cbebada28dcd9828721e5
- TLSH T18951EB06D7FA523AF0FE83302AB746A6267D7D215365835D4E40213C38605546EA4FBB
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/ru-RU/F12Platform2.dll.mui
- SHA256 2a8355e8e05eeccc9c9c6da03b8173c10c34604f44c253918eee204805225906
- MD5 134ec49776b6217b21bf6c1c072e1dfd
- SHA1 28dd7a2c082ce577932b93fff63a813f7b31bc57
- SHA512 7d10ea3d0c9eb8d7fa222df1cf97a8ad9f0b390a5e1e55978fb33a943728f4c02ba00532ec7916713ce3d8740714ce92c4d7523f1635ce275cbc3670fb0eab01
- TLSH T15E51FF07D7F9463AF0EF83302DB746AB62797D208264935C0E84263C3824561AE64FAB
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/ru-RU/F12Script.dll.mui
- SHA256 f65e8231ca04ad33777ddca5076e32f63b7aee47d2f8ddd632beaefda98cff3f
- MD5 eef7db4d745ca7dadee4377cfbd0b3d8
- SHA1 40bcb181c5f7c67111a194eff4dbcfa90cd3ab36
- SHA512 ed4a99a87ea0daf5388be969420a781a1e39922f150ac9919183984d1b6ee76b891017450c6f69dc5af0cb613964ee4612ceb3e32b508dba6a3be27e0ece4fae
- SSDEEP 384:FfveyPPYzT2ViAS3PmAGJ2HU3o33nwrGd5PwBTN8jxdj5hXJL+ifHnNM/n0EhVig:1TwzD/9UzGd5IBCXj5vyifNcnfkpn2
- TLSH T1B3938B4FFABCD254F864E2710F968DD7106AB310632695CBC68F7DA9602C63973286C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
89KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/F12/ru-RU/IEChooser.exe.mui
- SHA256 eca336982d0a6a22f7382329f072d85a5b5a647cb020c486ddead925fea1ddde
- MD5 0e4b602ece1fc03af0326e4bb6567c52
- SHA1 b9528badeecb8fcf19bcb528910467d8663fc837
- SHA512 96a7e5fa275ff81dbc4ea1646e802d9b48621475a5b59ff727c10b3bc1702542be4f070866f915f40b09a77ba325c907f989569bfba1821284c30127626d39c8
- TLSH T15A71EC0B9BBA4226F05A87701BA30AD2177DBE127222939FCF4F19283454534AA50E77
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/FirewallControlPanel.dll.mun
- SHA256 715127acbba1c48e3d13dc3843fa3c7f31674e6785507574c0ba4405dffafc6a
- MD5 16567be15b214bf1b8bfb803fa8f3634
- SHA1 72a3504ef2e7b905888269ec87ac807ab46080a9
- SHA512 62985289d9d23bd1bb6aa0482331f24ea40a193ecb1704291913559dcfd42e82475122356e29dc7ff12041f432428e8206ef314de5671da5c7f3c96d2cbc9101
- SSDEEP 6144:GGG+aPx7aCTVJd9Me4s/X5iuhYmUCYJjJ5JjJpJjJRJjJpJGJOj8lr63moRntp5g:YzJHMed87HHjlmoRnJj0ZbC0XWNYacp
- TLSH T106D47D04325A9C5DC37FD174F653AB6A7498BC40C94B09A1A5F337AF2A3AE7160ED207
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
590KB
Virtual Size
589KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/LaunchTM.exe.mun
- SHA256 329e5dfe121642c379cf42bc59fdad5db7691fcb3edd53cf0ba90f1d9094e7e0
- MD5 76c331d4543820e5d2f0bed04fb2ce24
- SHA1 5b6484cf34a2d03a202e03d7247ed7895a0ce6e8
- SHA512 2787faf6f115d991bbab5f8df0e60f08a2b6aecdf0181157f340742f043bd08691a544fc5fb82a2a28c07d535d819329cf1e304c03f859c8e309b1eff7907d6e
- SSDEEP 1536:Z5m8UngMCw2I8FXmzOGDBdpunOl1UIHmejrDwkKgT43FVkXXPKedjXfaW:ZFeCO8FXUO0iOlCIHmeRKPKk
- TLSH T1D5044BF1F625D4A3FCBA5475643B4DA626233C2A8DA0156D324EB2393DB1363207B91F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Licenses/neutral/OEM/Professional/de-license.rtf
- SHA256 ee94189e240a6c554b4dcccb68238a885c8b803acd0ff3ffdc0d83bd33af066b
- MD5 5e17c07ed42223cadda22cee2e97030b
- SHA1 9a0a702a24d022996465ca38046bc891af01bdad
- SHA512 a20f1ee48e44a624a1305386fcfb0f19837b7253cda760fc175561fb4187d9ff20c514ef8115f01553b3da3be542aeb954a6adfeb3842c73690a519227f9b0be
- SSDEEP 768:VsNPzhE96KAtqWKwDcWG1CgF37ZcyzOOse1yt+WeiTyaXFjZ4SJRT/F4hysi6NCW:VsVhS4GF37Z/vNWBT5FjZ4SvVR4bELw
- TLSH T18BB3A5EC4805C749D31AA3C0DB11F8D8792BF61450FE74A9B26FD1FE642A6BCC89D492
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/Licenses/neutral/OEM/Professional/license.rtf
- SHA256 ee94189e240a6c554b4dcccb68238a885c8b803acd0ff3ffdc0d83bd33af066b
- MD5 5e17c07ed42223cadda22cee2e97030b
- SHA1 9a0a702a24d022996465ca38046bc891af01bdad
- SHA512 a20f1ee48e44a624a1305386fcfb0f19837b7253cda760fc175561fb4187d9ff20c514ef8115f01553b3da3be542aeb954a6adfeb3842c73690a519227f9b0be
- SSDEEP 768:VsNPzhE96KAtqWKwDcWG1CgF37ZcyzOOse1yt+WeiTyaXFjZ4SJRT/F4hysi6NCW:VsVhS4GF37Z/vNWBT5FjZ4SvVR4bELw
- TLSH T18BB3A5EC4805C749D31AA3C0DB11F8D8792BF61450FE74A9B26FD1FE642A6BCC89D492
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/Licenses/neutral/Volume/Professional/license.rtf
- SHA256 78a249b6e0f74979d2d2a230abbe5f3c9b558fcc01e61c7c09950304cf95c7c0
- MD5 129ea0e2bda698ae867efe78e0958541
- SHA1 fb5df87a7c5474aef7d72f74b59785ed9d8c10b3
- SHA512 fa2e1c1bce1fa997456b4eecf832dbdeb9c8799e1454c91030575bab31a594d64f98882772b59b341aeb9d386ee2e06f969d3f7c7e34544c03516e9316c93f30
- TLSH T19EF08B2A3054C2A30B4216CCBF87490EEB1B8BA1B4ABF2A2B059C0A43376A2E40B1450
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/Licenses/neutral/_Default/Professional/de-license.rtf
- SHA256 ee94189e240a6c554b4dcccb68238a885c8b803acd0ff3ffdc0d83bd33af066b
- MD5 5e17c07ed42223cadda22cee2e97030b
- SHA1 9a0a702a24d022996465ca38046bc891af01bdad
- SHA512 a20f1ee48e44a624a1305386fcfb0f19837b7253cda760fc175561fb4187d9ff20c514ef8115f01553b3da3be542aeb954a6adfeb3842c73690a519227f9b0be
- SSDEEP 768:VsNPzhE96KAtqWKwDcWG1CgF37ZcyzOOse1yt+WeiTyaXFjZ4SJRT/F4hysi6NCW:VsVhS4GF37Z/vNWBT5FjZ4SvVR4bELw
- TLSH T18BB3A5EC4805C749D31AA3C0DB11F8D8792BF61450FE74A9B26FD1FE642A6BCC89D492
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/Licenses/neutral/_Default/Professional/license.rtf
- SHA256 ee94189e240a6c554b4dcccb68238a885c8b803acd0ff3ffdc0d83bd33af066b
- MD5 5e17c07ed42223cadda22cee2e97030b
- SHA1 9a0a702a24d022996465ca38046bc891af01bdad
- SHA512 a20f1ee48e44a624a1305386fcfb0f19837b7253cda760fc175561fb4187d9ff20c514ef8115f01553b3da3be542aeb954a6adfeb3842c73690a519227f9b0be
- SSDEEP 768:VsNPzhE96KAtqWKwDcWG1CgF37ZcyzOOse1yt+WeiTyaXFjZ4SJRT/F4hysi6NCW:VsVhS4GF37Z/vNWBT5FjZ4SvVR4bELw
- TLSH T18BB3A5EC4805C749D31AA3C0DB11F8D8792BF61450FE74A9B26FD1FE642A6BCC89D492
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/Magnify.exe.mun
- SHA256 6a2b6e4976b44cf3f2296a285384cf10cd1078e4b04362e9a1225c3ce0fc5984
- MD5 84a208f92399c6c79aefff13e63f2507
- SHA1 3618e44ce82f1e23543a0d7a51306bb2442fffa2
- SHA512 a172ed579e563f8fbfeab67341986ec2a4bbd6c84e28bcfcb4c9ccb068da4944b88666bcae2f5248f9bd75714727d46e079c18cbcac2e2e66a943b6238e3a3de
- SSDEEP 768:EIY8OCpXH8Va8MOsS2gL7PSv3j8xSCQZ8dP3qtJIGz3cjlLTEu55Fonpu8UpM:2rXM6LLS7ESCQZ8V3yzoIIpM
- TLSH T1ECB3C932A1DD8C0BD6A6123D051C93268450BFA4BD3FC79766C97D4811B82F8EB58EF6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/NPSMDesktopProvider.dll.mun
- SHA256 eb7406d9f01ea5c2450df4b71536d666496bfe52cc292551310158828d1f8721
- MD5 020ebb61cc23f6da40ed485218e27c7c
- SHA1 ad372a915666adefc2090082cfda80e671c874b3
- SHA512 d38ad2c067fb677554a5ce3f2e51c14bbeacc03ad6b55204718f1953d87896580be1dce6ab3455a4811e8ebc2b54baf1341ff33b195cdeb8154c1d2cf9229ec2
- SSDEEP 96:r9EWVJ7EJ7kb2WwnFKPYFAFrejxbtbd4eI6AFMRh5/5hgAINkRnj2wgVfL1fUP1l:KWT8YyWzwXZ+
- TLSH T11DE48C563554B42CCC2EA23F99EAFCBA840F7CA68C742382B9D6BF5F3C3250815D5A11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
653KB
Virtual Size
652KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Nui/FaceAnalysisColor.mdl
- SHA256 02b4eafd060704716083ddeddf419f951e7501a22e0cdf795165fe2419a9d110
- MD5 139501e473d5237e8071f90754794cca
- SHA1 36dc9892d9c63e917d1866a04ba1703db5771eaa
- SHA512 6e18d30219d562cfc0cd53ea03afd117aca2286caef942ea3f72bec4b7c307143034bfc80d2cc367a4aa8e2ed4de80f42db56c4506db8bfcf375194f29d51c72
- SSDEEP 98304:0jxXfNXJjaunNvwhFSYQCYigAKm6XVQbhD61yQFs231D6h8MPQ8ebeUYkPIRvBmv:0jxvNX5lNIhfrYiqLQd+1yQFs231D6ho
- TLSH T17006F145F823CA25C46446774CAEC2DC3678714BDE066B2731D8A33E7CBA61ADEC3589
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/PortableDeviceStatus.dll.mun
- SHA256 88025929722cfd0af5f99e372d1bcf8cc0a41c51987503ee8a48a735a366e71c
- MD5 460c55951cf31988ac11fc979b628c5f
- SHA1 d357d64c55fff3b4549a0c9cfa8119bab00e9ba9
- SHA512 0ee040a9434f7085703b4eca22966abef8ead2166fb9ee20c75835449fc681ec11efc1dca9df53e9f8cbd659de80829551a13ffe5b80c69c003de03c30a734e0
- SSDEEP 1536:yE9vNSTqbTGeiRRRYSoooL4jiRkSo34RiRRgSooQ4v9dBRRRRARoooof4KsA25nm:b1q9ksAOnoeR1jKiYya/LZeS
- TLSH T1AB741495EBA1815FC48805B30B33ABB51A767DE8C891260EF9EDFE1D9EF32014C095D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
360KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/SearchIndexer.exe.mun
- SHA256 42f3d11f53c06bf856ff8a4a7c370df9437c3d9145483ade6e6e114b2c375b0c
- MD5 8d9708be135647a7805d48aa0c42aea2
- SHA1 ed7acf67241bf1855299c4bddc8375759609e83f
- SHA512 342701f3559eb83807639ab90e4e6885467a254e42dd248aa3eff0282be4ac3fe828cb82d556fcf05bad29cdc6dddfe45d843a247693fca58fcf079749e52f56
- SSDEEP 3072:b7Ntqa7JZ4Eck1nbAZ1bvrOaG+zNBOYI1ihk6kvtfGq0ev3U5WN:dZnWrkR10efUK
- TLSH T13214C7227BEE9808F1B7477079B98A652532FCA9DF49C12F3151230D58B2F019E71B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/SensorsCpl.dll.mun
- SHA256 1a452569993b1e909cca26e4aef61c7038fa2e6abadc475268cb98dcfd1cce0c
- MD5 eb3d7d776679a65b759e91aa759ebab5
- SHA1 113cea22561bf6aaa134ef91b30e7ebb36af15ff
- SHA512 1d13f96bb68ac4439c16e884ed5d7bfedf0e92fe9e0c0c19ed0ec833fcd15c72c5a965102bc1228da4f6c1dedc58854ddf6e463e710e402ad727c703668c0459
- SSDEEP 12288:zlA6mEn27WgCQT8rRaA6XfiOla+A6bTI91Au2HCF:zi6mjqgGlP6aOl06b0ku22
- TLSH T11F556B721206F7BDD41A2EBD8844C88985A8FF247CB4A6FD76D0375F9A3E064EDA404D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/SndVolSSO.dll.mun
- SHA256 d81e88ca347338037aff1da7834bbe16b98a1a9380f1474b2a758da47c3eb110
- MD5 055073bdaa372ff80a25fafd31b971a3
- SHA1 c2b43c51b7380e0fb3365a82f675f06eb0ebc4df
- SHA512 adbac428e09f573a8f585efe50fc0d3fd646abb8810d2aae3ea2ad27dcff0bede06667b6b6806ad04a7f85d2f1223abd0760ced2ff1eb5ee8398e37b8156dff7
- SSDEEP 768:kL5URfy/AfcfKbSF3uLcTG/bcBPy5BnaZCiryuzi5aadu3EpKLsQq49H9p:kdU0/yI3MSwopyXnaZryuzwdu3Lzx
- TLSH T18EC40E557F2AC140C98B21342E6BC5DD2B2CFC86DE68865B74D8B35F86B1F08A90F9C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
573KB
Virtual Size
572KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/SrpUxNativeSnapIn.dll.mun
- SHA256 f3e8fd1b984d9da0ce914d601c0eb9a494507d8719c3dd79090ce63252215ead
- MD5 bc46ca96840a06f027521c1edcfa9461
- SHA1 b120f01525380caf8e9653a5c97e40e0c85aaeee
- SHA512 3406381d208fa6914460b4e0e826f5d599d1794af40f9b69cae93888443c6c28ed423b13d9deca34a1804092ed8b003687bda38c7260fc37256dae3c0a5b0e0d
- SSDEEP 6144:kdGG+aPx7aCTVJd9Me4s/X5iuhYm5GG+aPx7aCTVJd9Me4s/X5iuhYm:kvzJHMed87qzJHMed87
- TLSH T18044F1D6A3AACCD0E44957B9CC175ADC5AA4FC04ED145787C304FA3FBEB1789AC2A241
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
267KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/SyncCenter.dll.mun
- SHA256 9a731ebfbcbc4db61a828648d346fa76b5b7de5a632603e4a1bcbafff364ce99
- MD5 d6e2da1b6dd2ccc890cec1ada124bc39
- SHA1 2e1d23af34b9eb58313dfc3b7523843e9beddfd4
- SHA512 c5eab2007a8612bb2ff716938ce119743bedfd0c36ba1e8438dbce85d3e4f3053e435922453a58f28ae7a80eca4e21e6ca5c17de0e3f9d3291afec2c4ce0b060
- SSDEEP 24576:y+L6lU6v331U9KASfwhPNyUVCAiXwSUFiASnw:DL6vH1U9KpfwhPNyUVC5XwSUFipnw
- TLSH T12BD58D73AAC1CEC0CD8116BAE612E4B8063F3CB7EAD19146798B771B34713A145C5AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Taskmgr.exe.mun
- SHA256 fdab1abb0e32f22422b318ab3ec7c2c3709bfae9142915f68c579534964da1b5
- MD5 cf2d78505105045911460cd866ad7f9a
- SHA1 b5606f1c9c7b9f49705f1d06375cc19a943f506e
- SHA512 ec1183d531681ad0764a655139c929e240ca7ab04038a14b84851cb0397c506d7290ac103328c462a3d821d1cc955c9287195276a101e6f9e94146339aae9f01
- SSDEEP 3072:Tj+NcdXrOjVbcL/6Z3zPK2CzTDoEXJ1auYbE5vq4For7wHyDfDXe:TDKoLC9/E4EXJ2kq4UwHyv
- TLSH T15B84A241BFE8C544F0F79A300A7BCA660A397D2AD854C51EB298F60F18B1759B63B713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/TtlsExt.dll.mun
- SHA256 fafd29a40f28589889f6ac7c86dc21829e22c0eef01be043b5182831281de292
- MD5 dbd96c36cdfaede5f0f8281011ed87c7
- SHA1 d58c6597c7d8872640a8cb197c477b64fb92b91b
- SHA512 ba07e7f3351793402457bf85ce372761ae6df03e54879e08c5f0c0f4224ab14c235431ae2e745623534d53d6b48e840247266ffe6f4cdb2b066e370192724f66
- SSDEEP 384:QfLWZXWmPWZv5zYI2j/Jj84T9okvgGdibpdk:QCAcv/YGo
- TLSH T111A2B81112510C8EE27A6A32DC27DA696364FC0381396A4535CC3E6F3F3F96BF665607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/VAN.dll.mun
- SHA256 52cffbed7a2eac197c8effef83539405116b71cfa92aa921c618107910b88980
- MD5 088dbf0127cbfd1d8b92cc7c51bec2c2
- SHA1 6c3c0403996e17d4e56fc54196ae270f67a1ae17
- SHA512 be8a7efc9403cd785603e2e38a657b9b420a6bd03214a5d6a781b264c8e0dae397a9c1c22e16c215faab328539c9134b27757f9cba3d9faaa388a0ef1c6daff0
- SSDEEP 3072:hUAYpknUPRUUoSb1SO2PlorTCVjWtYTbCNvLhDS0wAy10:iAYbPaJSkOYl2TCVjnbC9HwAye
- TLSH T13524BF517742AC66C06E6331F053CF748F71FC005A7A0647B0F57B9E2B726A5B6A823A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Vault.dll.mun
- SHA256 054a13296ee924e08e2a7a24a5d5f557b84fd6cd198af52bdef3da5975c3af6f
- MD5 d2a5ae4eedf9178ca337a42518cf3dfe
- SHA1 8582c498ddbaf76e1aeed070759d58a9bd3fccab
- SHA512 e3b5df8d0ad90038e97f13bf867fda198731499510cc87a96ab33cd95a15b9fb6bcef17986ebcb4436851bbb979366325348788b6acf4fcb91130e3d6721ea3a
- SSDEEP 6144:Xqc9SlUqc9Sl4T2fg8XXRtr+wkMl1EN/dpR:XMGMPZX1D0
- TLSH T119949E10B1445C1AC2AFB138F332FB2AB2D8A466C5910574F6D356BF19B3F6B60D9326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
417KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Windows.Data.Pdf.dll.mun
- SHA256 ab1e9a2c2b7ce1744b318358e93f5baefabdd1c1f49e7efd71f5e4ba5aea164f
- MD5 8f08e253ac2ff97b9cc9b0ff8dcd8bb3
- SHA1 b83678e565f4f0c22f5961cff72aa58a45fe582a
- SHA512 124e0be39f2d4f1073208d10a3499b51c53d556885d9e40c3e9923a5a207524e2a8c7dd6685ade2b5f4ab9f4efb446328aeab0299f8f7b7ffedf692fa25a2970
- SSDEEP 6144:PdmOCnsYwVyLCCG7/SHTZooB2oh1HD8qi4UPmWajNch/7CRXZo9yXwH1BbruI52l:PGH992YJUOWxCfrXSluYhEjWE
- TLSH T118C4120277E4860BE1F7093D6AB29745B639FCD0CD129ADFB2509F4D6C26E018EA0F56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
580KB
Virtual Size
579KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Windows.UI.Immersive.dll.mun
- SHA256 09df5fb96f275fafbf5d017d5dfbe43f43dbcdce08d2a1e13a110cb2b4b92d7a
- MD5 f53ec23caec4a00467455ad1f01b6441
- SHA1 a2ed2f91db6dd6c20e555f9e3d31602f7eefedad
- SHA512 2d4194ecff70b01b83316d2b94614a645ab4057fe6230c9286278324f1c6df3f34f8df59ce53dc2d3a80d76328b8fe98abf7d9f8071cd6fde7cc4e1b4e19c1a7
- SSDEEP 12288:A39yQzdHjnSbPG1orCvjk9AOsJhulLTNa91uy:ANyQtrj1DjWoJhuZTN01T
- TLSH T1B6D4010073F59624F1FBAF7069F98A256ABBBE139C25D14E1300125D4D70B4CEA7AB27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
604KB
Virtual Size
603KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/Winlangdb.dll.mun
- SHA256 8e3ba0383dd4e673f8e706fd83a9fc8c893baff264739f04752e426052cfbe98
- MD5 8141b2c77f78f124c1e1da4cb5120a85
- SHA1 524340c301c036c726eb4a58cbd87aa663769665
- SHA512 e5f429c8a74462423a3f20fdd2c77bffb78d777eb74542a24fb5ad589920a8d17e2d9fc3ab9e18ea2847823a8ead5e5951155ac69d553c2a4687477bd2f64758
- SSDEEP 3072:3GJWnc3CQPgdlAYFKVQr3bz2y0N7snNDmzTXsWkOAy4wOJnN21k0fMzEtb:3GnKl+F5nS
- TLSH T19D344101D7F8564CFBFB1F3A2EB555A80A77FD63AD34D65D1210220E8971A81AE24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
225KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/WlanMM.dll.mun
- SHA256 fa732bfe88068f257699c64e3621f9cfe3e5f4ddd1fac8541ff34a9e73e1efcb
- MD5 294df54b61b631bce9dcbe66d6fb9b8c
- SHA1 28133a17b6a0f2b9016261533d13d3f7ba2913ab
- SHA512 43e1b7e533b5d5b46c7ff52362d155d01e80190c4eed71ed8282f7fd27040dba62e0652cd2548981b56598a981ad89464a6365c71f2d9c9c5787fec1cd702bba
- SSDEEP 6144:V/nC5sl5zUpB/67ZJvUumqSAvYSropb2Ok:V/wsl5gpByZJPZHfk4
- TLSH T12674AEC3B373C869D48E22311E6FD8B05921FD942E061789B2D6FF2FBF716189856641
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
333KB
Virtual Size
332KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aadWamExtension.dll
- IMPHASH e8b3e8b86a3d3a81889c2918802fc235
- SHA256 95c1e78f97fcdeb5ef12ab9cadd9bee58abcbd80a2338c63d4762b38b944cb1b
- MD5 5e0ea63211be9b72133b5054fa3f6448
- SHA1 bb63160efe4cbc247d261159e310b46ba67bd626
- SHA512 f1a4acaaa9e72eb1028ccbe10a86e8b38490106284efaa99675b64bb7fefd9b028428037361c2ed4dfc0b0abbcd7bf88523180280c80d10513b77a0346bd93eb
- SSDEEP 3072:9+Goyumobrqqad4Bo5BmCy3Jt0h/ReBxHTjcmBQ/Kj3o2Qn2MAkyEJn/l:9hKx4N58D5t0RReBVBIoofCkyq
- TLSH T1B5E33B52BB9C4435E2FB663C38695A25727F7430CFA081DB2355A29D6CA0BC14F3276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:7c:77:2d:0b:93:7d:f2:63:65:36:10:52:ca:85:b2:bd:66:08:90:9d:7a:4d:76:67:7c:2b:fd:86:99:e7:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ed:e1:5f:cb:d5:f7:a5:5d:73:00:01:00:00:01:ed
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
89440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
aadWamExtension.pdb
msvcrt
memcpy
memmove
_errno
_callnewh
realloc
vswprintf_s
_vscwprintf
wcschr
_wcsnicmp
time
swscanf
_wcsicmp
memmove_s
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
_ftol2
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
_vsnprintf_s
??3@YAXPAX@Z
_CxxThrowException
_purecall
_XcptFilter
_amsg_exit
free
malloc
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
_initterm
?terminate@@YAXXZ
??0exception@@QAE@ABQBDH@Z
_lock
_unlock
__dllonexit
memcmp
_except_handler4_common
??1type_info@@UAE@XZ
??_V@YAXPAX@Z
__CxxFrameHandler3
_onexit
isdigit
isxdigit
strtol
isalpha
_wtof
wcsnlen
swprintf_s
_vsnprintf
memset
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
LoadResource
SizeofResource
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
LockResource
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeSRWLock
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
SetThreadStackGuarantee
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
sspicli
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
ntdll
RtlAllocateHeap
RtlInitString
RtlNtStatusToDosError
RtlImageNtHeader
RtlFreeHeap
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
rpcrt4
UuidCreate
crypt32
CryptStringToBinaryW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=14, id=260, version=27412,
count=193, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=23, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aadauthhelper.dll
- IMPHASH a1f1be5194ac4b3bd4282e048fb51322
- SHA256 013e21fc8d42cd168d9a96705d3e4cdcaea72a520ebd8fd0e69b841251714f68
- MD5 06903fbf5f6aeddc57ccf816f8731578
- SHA1 9f3a3086aa58acf384ff78a1ca662d78d5c821fb
- SHA512 d22785684829803dcd5cb7a9df3b0b9633fae79ac3a53f5390c4baa9d445f9b19576f1fccd4a6e95dd6426887177a3f82b10ccad196aa19c8f696ceadbf4b550
- SSDEEP 6144:+g2HAv+umh7DZZxmttSJU0kKh5BjSaf2a/2EBtK0UR7idLrDa3LHvYLmyDO:+g2ghmSEK83a7QPO
- TLSH T172741711A7E99439F2F72F7235B96261487E7C605EB1C18F93508A9E3970AC2C934B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
288128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AADAuthHelper.pdb
msvcrt
memcpy
_ftol2_sse
_ftol2
_CxxThrowException
_unlock
_lock
isdigit
strtol
isxdigit
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
free
malloc
??_V@YAXPAX@Z
memmove
_except_handler4_common
realloc
??1type_info@@UAE@XZ
_onexit
__CxxFrameHandler3
__dllonexit
memcmp
_purecall
memcpy_s
memmove_s
iswspace
wcscpy_s
_wcsicmp
_vscwprintf
vswprintf_s
_vsnwprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_beginthread
_endthreadex
_beginthreadex
wcschr
_time64
_wtoi
wcsncmp
_wcslwr_s
wcsspn
wcscspn
wcsstr
calloc
wcsrchr
wcspbrk
_vsnprintf
swprintf_s
_mbsinc
wcsnlen
_errno
_wcserror
wcsncpy_s
_snwprintf_s
?what@exception@@UBEPBDXZ
_wcslwr
_wcsnicmp
_wtof
isalpha
memset
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
SetThreadStackGuarantee
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
ntdll
RtlGetPersistedStateLocation
RtlGetVersion
RtlNtStatusToDosError
RtlImageNtHeader
RtlFreeHeap
RtlInitString
RtlPublishWnfStateData
RtlAllocateHeap
NtQueryWnfStateData
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringEx
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
SizeofResource
GetProcAddress
FindResourceExW
LockResource
LoadResource
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
wkscli
NetGetJoinInformation
api-ms-win-security-lsalookup-l1-1-0
LookupAccountNameLocalW
netutils
NetApiBufferFree
api-ms-win-core-registry-l1-1-0
RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegGetValueW
RegEnumKeyExW
RegOpenCurrentUser
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegUnLoadKeyW
rpcrt4
UuidIsNil
RpcStringFreeW
UuidToStringW
UuidCreate
NdrMesTypeAlignSize2
NdrMesTypeEncode2
MesHandleFree
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
UuidFromStringW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionEx
SetEvent
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapDestroy
HeapReAlloc
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrRStrIW
StrChrNW
StrStrIW
wldap32
ord18
ord88
ord46
ord203
ord145
ord73
ord224
ord97
ord16
ord41
ord26
ord140
cryptngc
NgcGetSymmetricPopKeyTransportKey
msvcp110_win
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CloseFidoAuthenticationSession
CreateAuthBuffer
CreateResourceAccountAuthBuffer
CreateTokenAuthBuffer
CreateTokenAuthBufferEx
GetFidoAuthenticationSessionStatus
GetSerializedAuthBuffer
StartChangingFidoPin
StartFidoAuthenticationSession
StartSigningFidoClientData
Name
.text
Size
305KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=98, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=16, id=260, version=27412,
count=424, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=104, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aadtb.dll
- IMPHASH 7f6a10b68d0629139f0b7de625b1ee2c
- SHA256 30d29f21f74e7047b39358748b121b4cc8b7aa12601bfcb6ad8106ee5067f376
- MD5 c4907d8c0f9fa24912545dddd7de69ad
- SHA1 280a2b0fd9aba9b850a3fc5f08022c1fde2c3eda
- SHA512 071beae0dcb3057f7ccf6d32944ed56ca72af6c0e466854312f0d4153c694059e3f36c3cbebb429aa533b33a90e8e589e7125312b16f6bd580a01560ebfea08f
- SSDEEP 24576:1a8Q3vngW2ribb4FPbkhPZEy+p2gLOpyYy:sDN4ahPZEy+p2gLOIYy
- TLSH T192452A6036DF9529FABE37705A386A1B486E79514F70C0EB5294BB4E1C31AC34E70B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
700304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
aadtb.pdb
cryptngc
NgcDecryptWithSymmetricPopKey
NgcSignWithSymmetricPopKey
NgcImportSymmetricPopKey
NgcEnumContainers
certenroll
ord51
ord50
dsreg
DsrFreeJoinInfoEx
DsrGetJoinInfoEx
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantInit
crypt32
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CryptProtectData
CryptUnprotectData
CertGetCertificateContextProperty
CryptAcquireCertificatePrivateKey
CryptEncodeObject
CertSetCertificateContextProperty
CryptHashCertificate
CertFreeCertificateContext
CertCreateCertificateContext
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCloseStore
CertOpenStore
ncrypt
NCryptOpenStorageProvider
NCryptOpenKey
NCryptFinalizeKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptDeleteKey
NCryptFreeObject
NCryptSignHash
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
RtlGetDeviceFamilyInfoEnum
RtlImageNtHeader
gdi32
DeleteObject
GetObjectW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
SetEvent
CreateMutexExW
ResetEvent
CreateEventExW
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
WaitForSingleObjectEx
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapSize
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDuplicateString
HSTRING_UserMarshal
WindowsStringHasEmbeddedNull
HSTRING_UserSize
WindowsIsStringEmpty
HSTRING_UserFree
HSTRING_UserUnmarshal
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsConcatString
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-com-l1-1-0
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoGetObjectContext
CoCreateGuid
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoGetCallContext
CoGetInterfaceAndReleaseStream
CoGetApartmentType
api-ms-win-security-cryptoapi-l1-1-0
CryptCreateHash
CryptGetProvParam
CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptAcquireContextW
api-ms-win-core-processthreads-l1-1-0
SetThreadStackGuarantee
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenProcessToken
CreateProcessW
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
InitOnceExecuteOnce
InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
GetLengthSid
GetTokenInformation
CopySid
DuplicateTokenEx
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
rpcrt4
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
NdrOleFree
NdrDllGetClassObject
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrStubCall2
NdrStubForwardingFunction
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction5
CStdStubBuffer2_QueryInterface
ObjectStublessClient7
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient10
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
NdrProxyForwardingFunction4
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
sspicli
LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
wincorlib
?CreateException@Exception@Platform@@SAP$AAV12@HP$AAVString@2@@Z
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?Allocate@Heap@Details@Platform@@SAPAXI@Z
??0Delegate@Platform@@Q$AAA@XZ
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z
??0ClassNotRegisteredException@Platform@@Q$AAA@P$AAVString@1@@Z
??0COMException@Platform@@Q$AAA@HP$AAVString@1@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z
?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z
?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z
?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z
?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?__abi_ObjectToString@__abi_details@@YGP$AAVString@Platform@@P$AAVObject@3@_N@Z
?__abi_make_type_id@@YGP$AAVType@Platform@@ABU__abi_type_descriptor@@@Z
?GetIBoxVtable@Details@Platform@@YGPAXPAX@Z
?CreateValue@Details@Platform@@YGP$AAVObject@2@W4TypeCode@2@PBX@Z
?__abi_cast_Object_to_String@__abi_details@@YGP$AAVString@Platform@@_NP$AAVObject@3@@Z
??0FailureException@Platform@@Q$AAA@XZ
??0OutOfMemoryException@Platform@@Q$AAA@XZ
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
??0Object@Platform@@Q$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPAXII@Z
??0ChangedStateException@Platform@@Q$AAA@XZ
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?__abi_WinRTraiseNotImplementedException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?InitializeData@Details@Platform@@YGJH@Z
?UninitializeData@Details@Platform@@YGXH@Z
?__abi_FailFast@@YGXXZ
?ReCreateFromException@Details@Platform@@YGJP$AAVException@2@@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@P$AAV12@@Z
??0OutOfBoundsException@Platform@@Q$AAA@XZ
msvcrt
_wcsdup
memmove_s
memcpy_s
vswprintf_s
_vscwprintf
_purecall
__ExceptionPtrDestroy
__ExceptionPtrCopy
__ExceptionPtrCurrentException
__ExceptionPtrCreate
?terminate@@YAXXZ
wcsstr
??_V@YAXPAX@Z
_wcsicmp
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
__ExceptionPtrRethrow
wcsnlen
wcschr
??2@YAPAXIHPBDH@Z
wcsrchr
?name@type_info@@QBEPBDXZ
__RTtypeid
malloc
swprintf_s
_wcslwr_s
wcspbrk
iswspace
time
wcscspn
wcsspn
_wcsicoll
wcsncmp
_wcsnicmp
_wcsupr_s
difftime
_vsnwprintf
_vsnprintf_s
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
__ExceptionPtrCopyException
__ExceptionPtrAssign
__CxxFrameHandler3
_wtol
_wtoi
??0exception@@QAE@ABQBDH@Z
memset
wcslen
_CxxThrowException
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
_initterm
realloc
_except_handler4_common
memcmp
_callnewh
memcpy
memmove
_vsnprintf
wcscat_s
wcsncpy_s
_gmtime64_s
wcsftime
free
??3@YAXPAX@Z
__ExceptionPtrToBool
__RTDynamicCast
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-security-capability-l1-1-0
CapabilityCheck
AADTBAcquireToken
AADTBAcquireTokenEx
AADTBFreeString
AADTBFreeStruct
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
754KB
Virtual Size
754KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
70KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=27412,
count=27, id=261, version=27412,
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=65, id=260, version=27412,
count=23, id=257, version=27412,
count=459, id=1, productName=Unmarked objects,
count=212, id=265, version=27412,
count=1, id=256, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/accessibilitycpl.dll
- IMPHASH 2e21f4f1aab9cd319426028b89673e67
- SHA256 c06b9cb8e077307ee35a87c120e824a5afded6b395157dd308f8adb2cd915422
- MD5 d8eae35e865711983a4db1981d1c6af3
- SHA1 f23d82cfccfc23ef579d8563dfe19b5082b1fe6f
- SHA512 e717e5a4511ffc42b17ade147055bed0abed9d33bcee0365b61eee0ae47c127f779c7fc4cbb2f40d6af7d21c8680c0865d9f8b85e5d820e23fc002f16d6c2536
- SSDEEP 6144:JmHcbXiB6WwcTiNyJ4gDH0MYpJE0ioTL3Gm:Ny6TNZgoBDE0ioT7
- TLSH T17E244B1367844871F2A736393268693960BEAD304FE680CB5391B96D5970FCE9D3836F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
180176
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AccessibilityCpl.pdb
msvcrt
wcsspn
_vsnprintf_s
_wcslwr_s
__CxxFrameHandler3
wcscspn
_ltow_s
wcsrchr
?terminate@@YAXXZ
_vsnwprintf
memcpy
memcmp
??1type_info@@UAE@XZ
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
calloc
wcsstr
_wcsicmp
malloc
free
vswprintf_s
_vscwprintf
memmove_s
_itow_s
memcpy_s
_wtoi
wcschr
memset
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapSize
HeapDestroy
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
LockResource
LoadResource
GetModuleHandleW
FindResourceExW
LoadStringW
SizeofResource
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
oleaut32
SysAllocString
VariantClear
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegLoadMUIStringW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegSetValueExW
api-ms-win-core-localization-l1-2-0
GetUserDefaultLCID
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
ntdll
EtwEventWriteTransfer
EtwLogTraceEvent
WinSqmAddToStream
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmIsOptedIn
kernel32
OpenMutexW
OpenJobObjectW
IsProcessInJob
OOBEComplete
GetThreadUILanguage
GetProcessMitigationPolicy
LocalAlloc
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateThreadpoolTimer
LoadLibraryExW
AcquireSRWLockShared
AcquireSRWLockExclusive
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetModuleFileNameW
DeactivateActCtx
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
ActivateActCtx
ReleaseActCtx
CreateActCtxW
InitializeCriticalSectionEx
CompareStringOrdinal
GetAtomNameW
GlobalLock
GlobalUnlock
K32EnumProcesses
ProcessIdToSessionId
OpenProcess
K32EnumProcessModules
K32GetModuleBaseNameW
LocalFree
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
shlwapi
ord278
ord158
ord199
ord219
ord172
ord437
ord256
ord176
ord174
ord204
SHStrDupW
ord156
ord618
ord24
ord514
shell32
ShellExecuteW
ShellExecuteExW
ord155
ord18
SHGetStockIconInfo
SHParseDisplayName
SHBindToObject
ord25
ole32
CoTaskMemAlloc
CoGetObject
user32
SendInput
GetUserObjectInformationW
SystemParametersInfoW
DestroyWindow
SetTimer
GetThreadDesktop
SetDesktopColorTransform
GetFocus
DestroyIcon
UnregisterClassA
GetKeyState
GetShellWindow
GetWindowThreadProcessId
SendMessageW
GetWindowLongW
DefWindowProcW
SendNotifyMessageW
KillTimer
dui70
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
InitProcessPriv
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetClassInfoPtr@TouchSwitch@DirectUI@@SGPAUIClassInfo@2@XZ
?GetOnText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOffText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetToggleValue@TouchSwitch@DirectUI@@QAEHXZ
?SliderUpdated@TouchSlider@DirectUI@@SG?AVUID@@XZ
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?BackgroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?ForegroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetAccName@Element@DirectUI@@QAEJPBG@Z
??1IDataEngine@DirectUI@@UAE@XZ
??0IDataEngine@DirectUI@@QAE@XZ
??1IDataEntry@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
?GetClass@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?Release@Value@DirectUI@@QAEXXZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetShortcut@Element@DirectUI@@QAEJH@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetSelection@Combobox@DirectUI@@QAEJH@Z
GetElementDataEntry
?SetDataEngine@Repeater@DirectUI@@QAEXPAUIDataEngine@2@@Z
?AddString@Combobox@DirectUI@@QAEHPBG@Z
?SelectionChange@Combobox@DirectUI@@SG?AVUID@@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@CCTrackBar@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@CCSysLink@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@CCCheckBox@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@CCBase@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Combobox@DirectUI@@SGPAUIClassInfo@2@XZ
InitThread
UnInitProcessPriv
UnInitThread
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
dwmapi
DwmIsCompositionEnabled
sspicli
GetUserNameExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllInstall
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
182KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=21, id=260, version=27412,
count=434, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=50, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/accessibilitycpl.dll.mun
- SHA256 a6b3e677c6b1ca61c1ad4318d903fb9e4d5e670ce30ae816dd362bfd2f367a77
- MD5 aa6d82de3847730d26d7d4994a7018a0
- SHA1 193b7ad4593365f30ff74de0837f449ebb6958ac
- SHA512 df17016730c874f087e6532e8fc5aab36508032e80e5049b639aac9dadcd0f7af6fd2507589848451bddef2b7c67b1f8977924b8f5690bad60141d4a174f3621
- SSDEEP 98304:c7HYIkVvl0zWISzGZGzybkn2CeYvwCTFaa:c7oVIWDy4n2Hyaa
- TLSH T164F59E007304EC99C67E5131F913EFB51A907C61DD000A27B1E7B75F2AB6E22B5AE61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/accountaccessor.dll
- IMPHASH 5764f9e820a9e770a74d7f327e5d52b1
- SHA256 e9c85c93fd29c004faafec358aad84078f6da74ff5caa96a402f9e086ac9eeef
- MD5 d79c2203a19c050082d01d25ac53ad22
- SHA1 b3fef6ca825a9ac156a3ca7dca119f89b971441b
- SHA512 77778d2830dba8360d1446104699cfdd6f4d3328cd9743a71ee9d21aae035bb572c81fdff205c9d61612da80c25db25f41f7c4cdc066f155d63e054575b2fe7f
- SSDEEP 6144:vhdluzvtjvFizAeZ2gWIwbIKwXg+8YXpL/qLlAsA:ngt6AeZ2gWIwbIKwXg+8YXpL/WAsA
- TLSH T10F144AA282840DB9EFB723B534AF777C627CA1518B52E7C7534183F34A466C1AD3126E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
173088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AccountAccessor.pdb
msvcrt
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
iswspace
_wcsnicmp
memcmp
realloc
_initterm
memcpy
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
_strnicmp
wcsstr
_stricmp
_wcsicmp
_vsnwprintf
memcpy_s
wcschr
__CxxFrameHandler3
memset
ntdll
RtlCaptureContext
RtlReportException
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcess
GetCurrentThread
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SafeArrayGetDim
SafeArrayGetElemsize
BSTR_UserMarshal
SafeArrayDestroy
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
SafeArrayCreate
VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantInit
VarCmp
SysFreeString
VariantCopy
SystemTimeToVariantTime
SafeArrayLock
SafeArrayUnlock
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
InitOnceComplete
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegFlushKey
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-core-com-l1-1-0
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
syncutil
ord27
ord470
ord25
ord26
ord112
ord29
ord4
InitializeMsaStore
SetAuthCertHash
ord475
ord38
ord3
ord2
ord10
ord119
ord118
ord71
ord17
ord28
ord135
DeleteAuthCertHash
ord134
MarkUserDataAccountAsHidden
GetDefaultDeviceType
ord125
ord40
ord122
ord74
ord121
ord120
ord307
TryGetDefaultSignInAccountInfo
ord133
GetGoldenPartnershipId
ord296
ord87
ord109
DeletePwd
ord132
ord130
ReleaseDataStoreLock
ord93
AcquireDataStoreLock
ord308
ord21
SetDefaultStoreDirty
ord257
ord1
CoCreateInstanceElevated
ord94
ord31
ord39
ord290
ord111
ord95
DoesServerSupportAutoMoveSentItem
ord24
GetAuthCertHash
DeleteOAuthRefreshTokenForPartnership
ord23
WriteOAuthRefreshTokenForPartnership
ord255
ord242
ord131
ord108
mccsengineshared
GetAccountDomainForAccountAccessor
GetDomainNamesForEmailSyncList
IsDomainInDelimitedList
pimstore
GetPartnerGUID
rpcrt4
RpcExceptionFilter
RpcBindingFree
RpcBindingSetAuthInfoExW
NdrClientCall4
RpcStringBindingComposeW
RpcStringFreeW
RpcSsDestroyClientContext
RpcBindingFromStringBindingW
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
GetTokenInformation
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CloseThreadpoolWait
DisassociateCurrentThreadFromCallback
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateDefaultWindowsLiveAccount
DllCanUnloadNow
DllGetClassObject
FindMatchingPartnership
GetConversationSyncDateFilter
GetConversationSyncEnabled
GetUnifiedInboxEnabled
GetUnifiedInboxServerValue
IsExtendedConversationSyncDateFiltersSupported
LoadGoldenPartnershipAccessor
SetConversationSyncDateFilter
SetConversationSyncEnabled
SetUnifiedInboxEnabled
UnenrollAndMarkAccountForDeletion
UpdateGoogleAccountConversationFlags
UpdateGoogleAccountServerSendsMeetingProp
UpdateWebDavAccountProperties
Name
.text
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=16, id=260, version=27412,
count=249, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=1, id=256, version=27412,
count=22, id=265, version=27412,
count=6, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/acledit.dll
- IMPHASH 73b56fcaa206b14596a4684588e01d6d
- SHA256 21931694874bdb65642d6fea9410298703836ec5d7258123a734de7a0a30bdc7
- MD5 4a2e04302b180c7c6f42acc015da5e59
- SHA1 3037d3de78a1b8dc4b245da8e462dd2d72e16cc2
- SHA512 c77a573bee705f922dc0de63531c70c2e94be843829b59e2a21942b174633b69f189ea7d86000081059347baf7af60829f0bc96ed3685c4b10a4727abfd5eda3
- SSDEEP 96:wUsyq7l8N0sN+CeuPzQ2+QZ3ehTDLUASwpBArn/6rstCPzCEW1YTWw9oOA:lq7l8N02Pz5+QxgZBAWDPzPW2TWRO
- TLSH T19C02E982FBD84969E6DB17742CBE1E3E127EB5300F719BC709510A6E2CA49D1E874336
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
acledit.pdb
msvcrt
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset
user32
MessageBoxW
LoadStringW
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor
SedSystemAclEditor
SedTakeOwnership
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=24, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aclui.dll
- IMPHASH 0314d8dbe7713e425b31788a84d5fd91
- SHA256 1e255c236c38d5f2077f39ab03698bbe9638e77dc554d90dc9c06e9646d4ab52
- MD5 7c6e258094494c019087e23d9497de7e
- SHA1 d0918f8bef5e0081271be06bcbc862a9508cdf66
- SHA512 2ccc3036ba01bd9006d5914ee7d23a56cc6f42c59389b64075deae522e1cf0f22b08919506cd0292b158dcc5d3329fad04da1c3c42f972b2f0a1a24ee03518c0
- SSDEEP 12288:C5sFYS8IASov7ccDYrdfU2ZBROkymfpDqY+QeyG:kmrAredbZirmxRey
- TLSH T118948E32B69C4076C2963378051EB635796EEA601B3841FB638897FD39306C1DD792AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
54288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
aclui.pdb
msvcrt
wcstok_s
_wcsnicmp
_wcstoui64
_ultow_s
iswctype
wcstoul
swprintf_s
wcsncpy_s
_ultow
_ui64tow_s
_i64tow_s
_CxxThrowException
_wcstoi64
memcpy_s
??1exception@@UAE@XZ
__RTDynamicCast
_ftol2_sse
floor
memcmp
memcpy
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
__CxxFrameHandler3
free
_vsnwprintf
wcschr
memmove_s
_itow_s
wcsncmp
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
wcspbrk
wcsspn
wcscspn
iswspace
wcscpy_s
malloc
wcsrchr
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_errno
realloc
_except_handler4_common
memmove
wcsnlen
memset
shell32
ord259
ord258
ord6
shlwapi
PathAppendW
ord628
ord12
ord165
ord219
StrChrW
StrRChrW
advapi32
EventWrite
InitializeAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
EqualPrefixSid
AllocateAndInitializeSid
EqualSid
GetLengthSid
IsValidSid
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetThreadToken
AdjustTokenPrivileges
DuplicateTokenEx
OpenThreadToken
LsaGetAppliedCAPIDs
GetWindowsAccountDomainSid
LsaLookupSids
GetSidSubAuthority
IsValidAcl
IsValidSecurityDescriptor
IsWellKnownSid
LookupAccountSidW
DeleteAce
LookupAccountNameW
OpenProcessToken
GetSidSubAuthorityCount
LsaOpenPolicy
AddConditionalAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAccessAllowedAce
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
CopySid
EventUnregister
EventRegister
GetAce
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
InitializeSecurityDescriptor
gdi32
CreateDIBSection
DeleteObject
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
SetTextColor
SetBkColor
SetBkMode
GetObjectW
CreateFontIndirectW
kernel32
LoadLibraryExW
CreateThread
FreeLibrary
FreeLibraryAndExitThread
HeapReAlloc
GetCurrentProcess
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GlobalLock
GlobalUnlock
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
lstrcmpiW
HeapSize
HeapDestroy
VirtualFree
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
OutputDebugStringA
lstrcmpW
FindResourceW
GetCurrentThread
CreateActCtxW
ActivateActCtx
DeactivateActCtx
DelayLoadFailureHook
ResolveDelayLoadedAPI
ReleaseActCtx
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
RaiseException
MulDiv
InitOnceExecuteOnce
CompareStringW
CheckElevationEnabled
CreateThreadpoolWait
SetThreadpoolWait
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
CompareStringEx
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
InitializeCriticalSection
TlsAlloc
TlsFree
DeleteCriticalSection
LocalReAlloc
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlLengthSid
RtlCreateUnicodeString
RtlFreeUnicodeString
RtlIsPackageSid
RtlInitializeCriticalSectionEx
RtlDeleteCriticalSection
RtlGetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlEqualSid
RtlFirstFreeAce
RtlAddAccessDeniedObjectAce
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAceEx
RtlCopySid
RtlAbsoluteToSelfRelativeSD
RtlGetGroupSecurityDescriptor
RtlAddAce
RtlSubAuthorityCountSid
RtlGetOwnerSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlAddAuditAccessAceEx
RtlGetAce
RtlConvertSidToUnicodeString
RtlSetDaclSecurityDescriptor
RtlSubAuthoritySid
RtlAddAuditAccessObjectAce
RtlGetControlSecurityDescriptor
RtlInitializeSid
RtlSetOwnerSecurityDescriptor
RtlValidSid
RtlSetSaclSecurityDescriptor
RtlValidAcl
RtlRunOnceExecuteOnce
EtwTraceMessage
RtlGetSaclSecurityDescriptor
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlGetNtProductType
RtlInitUnicodeString
RtlAddScopedPolicyIDAce
RtlCreateAcl
WinSqmIsOptedIn
WinSqmEndSession
WinSqmSetString
WinSqmStartSession
WinSqmIsOptedInEx
WinSqmSetDWORD
WinSqmIncrementDWORD
WinSqmAddToStream
RtlIsCapabilitySid
ntdsapi
DsBindWithSpnExW
DsFreeNameResultW
DsCrackNamesW
DsUnBindW
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoGetMalloc
CoTaskMemRealloc
ReleaseStgMedium
CoCreateGuid
oleaut32
SafeArrayUnaccessData
SafeArrayAccessData
SysReAllocStringLen
SysAllocStringLen
SysAllocString
SysFreeString
user32
GetParent
EnableWindow
SetDlgItemTextW
SetWindowPos
MapWindowPoints
ShowWindow
GetDlgItem
LoadCursorW
SetCursor
SendDlgItemMessageW
SendMessageW
DestroyWindow
LoadStringW
GetDlgItemTextW
SetWindowLongW
PostMessageW
EndDialog
GetActiveWindow
SetWindowTextW
DialogBoxParamW
ReleaseDC
GetDC
RedrawWindow
IsWindowEnabled
GetWindowLongW
MessageBoxW
LoadIconW
GetAncestor
LoadImageW
RegisterWindowMessageW
GetWindow
GetWindowPlacement
GetFocus
SetFocus
IsWindowVisible
GetClientRect
GetWindowRect
SetWindowPlacement
RegisterClassW
UnregisterClassW
MapDialogRect
SystemParametersInfoW
UnregisterClassA
DrawTextW
RegisterClipboardFormatW
ClientToScreen
KillTimer
SetTimer
keybd_event
CreateWindowExW
EnumDisplaySettingsW
DrawFocusRect
GetSysColor
GetSysColorBrush
FrameRect
InflateRect
ShowScrollBar
MoveWindow
OffsetRect
CallWindowProcW
SetScrollInfo
ScrollWindow
SetScrollPos
GetScrollInfo
DefWindowProcW
GetDlgCtrlID
DestroyIcon
GetSystemMetrics
xmllite
CreateXmlReader
CreateSecurityPage
EditConditionalAceClaims
EditResourceCondition
EditSecurity
EditSecurityAdvanced
GetLocalizedStringForCondition
GetTlsIndexForClaimDictionary
IID_ISecurityInformation
Name
.text
Size
377KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=260, version=27412,
count=728, id=1, productName=Unmarked objects,
count=25, id=257, version=27412,
count=10, id=261, version=27412,
count=5, id=259, version=27412,
count=1, id=256, version=27412,
count=46, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aclui.dll.mun
- SHA256 45b5ed6e02c83d5dacd9fedebf2e9f941d6715660f93c9d16ce03873b7e075b4
- MD5 09b7cd7cdf0a87e9ef0b0c0ce965c4c0
- SHA1 1970f7fe45cdfad741ceba7d02baece180e28a31
- SHA512 57036c950b03e3bf78d7f96e0a0dba63ceefb1638036a54116dc39b8fe125588fe3604699ec7f140bb92f2680817fdb97173b212fd08f6b42a383e82bfb34e56
- SSDEEP 6144:pxvIAh88/8xZKbHq92dHfRmddnL0LI8sKSqvpyi826ZHyipEJ3ynD4H8:pxAQ8f92dH8L0LI8s8kiL65yQEJynDW
- TLSH T179D49D30B886CE81C79B53BAF84297B280E46C13F7D1288BE94D785B74758A433D917E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
633KB
Virtual Size
633KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/acppage.dll
- IMPHASH 6ae48159d48814f1d530e9ce8be5c36a
- SHA256 9e5bff41207bfff6135e1584192041180faae0b21e7090415d12ccfd81cbe617
- MD5 93dd01a4a032b008f3a34d9901811509
- SHA1 9ea37ec360a7b68a45dfa4ef4dd024145b25fa71
- SHA512 8e46ab4d005382bcc6556812a6967dae7a5209654b6fefcc6d154c353e0dbfc0c2e355134dc36565ad6e26e6fe1b12e489cf0ea9a5826d95d39bb158684e5511
- SSDEEP 1536:FurHS443WFYEfi58gVIFRg72FbQgzpzeplCSYnStBzbx:kp436f9SIqobQ8pSjCSYS
- TLSH T1D7737C0173C85839E5FA243C659A6B319A7FF9302F8107C737344ABA6F246D09D3636A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
61792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
acppage.pdb
msvcrt
sscanf_s
wcsncmp
wcschr
_wcslwr
wcsrchr
_purecall
memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_wcsnicmp
wcsstr
_wcsupr
_wcsicmp
_vsnwprintf
wcscat_s
memset
ntdll
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwOpenKey
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
ZwClose
ZwEnumerateKey
RtlReAllocateHeap
NtQuerySection
RtlNtStatusToDosError
NtCreateSection
RtlImageRvaToVa
RtlImageDirectoryEntryToData
RtlFreeHeap
RtlAllocateHeap
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlIsPartialPlaceholder
RtlInitUnicodeString
kernel32
GetLocalTime
CreateFileMappingW
MapViewOfFile
FileTimeToSystemTime
SystemTimeToFileTime
GetFileTime
GetVersionExW
QueryActCtxW
UnmapViewOfFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
FindFirstFileW
FindClose
GetLastError
lstrcmpiA
RegQueryValueExW
HeapFree
BasepGetExeArchType
ExpandEnvironmentStringsW
EncodePointer
RegOpenKeyExW
GetSystemDirectoryW
CloseHandle
LoadLibraryW
HeapAlloc
DecodePointer
CheckElevationEnabled
GetProcAddress
LocalFree
GetProcessHeap
CreateProcessW
RegCloseKey
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
CreateFileW
GetModuleHandleW
user32
GetWindowLongW
SendMessageW
EndDialog
GetSystemMetrics
SetWindowTextW
SendDlgItemMessageW
SetThreadDpiAwarenessContext
IsWindowEnabled
SetWindowLongW
GetDlgItem
GetParent
EnableWindow
GetWindowTextW
LoadStringA
LoadStringW
InsertMenuW
DialogBoxParamW
shlwapi
ord176
PathFindExtensionW
PathFindFileNameW
StrCmpIW
advapi32
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
shell32
ShellExecuteW
ord155
SHParseDisplayName
SHGetPathFromIDListW
SHGetNameFromIDList
SHChangeNotify
SHGetItemFromDataObject
ole32
CoTaskMemFree
CoCreateInstance
HWND_UserMarshal
StringFromGUID2
HWND_UserFree
HWND_UserUnmarshal
ObjectStublessClient3
HWND_UserSize
CoGetObject
rpcrt4
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrDllGetClassObject
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_Invoke
sfc
SfcIsFileProtected
msi
ord201
ord173
aepic
PicRetrieveFileInfo
PicFreeFileInfo
apphelp
SdbQueryFlagMask
SdbGetMatchingExe
SdbInitDatabase
SdbReleaseDatabase
SdbGetPathSystemSdb
DllCanUnloadNow
DllGetClassObject
GetExeFromLnk
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=15, id=260, version=27412,
count=274, id=1, productName=Unmarked objects,
count=33, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=34, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/activeds.dll
- IMPHASH a84d85413a75cd6302ee7e19425039c3
- SHA256 07ef33a67fca0cf487c5dde36aad1cc2d84343711cb9c409a2a126842cae0bad
- MD5 8cd6ee856c43c048fd3ba3273b22c926
- SHA1 94b1222652f7659b96f5f01c7e45f7745e0ff4b1
- SHA512 62c610bb38ac4e98c31667981e4a97bfb15a39ad9c7207613c0ffff34476e620e4acd7b3b94e442d8255b41478a38b6d84c5a2de81ea968d657bcbbb1e076872
- SSDEEP 6144:i8iujLX00xZ05Oca+hPn2lmM0XMb6Phj:1/jLXdZ0IInymM6O6F
- TLSH T1B7243A2226884676C6A32170424FF7246FAD9E31CBD28DDF9250C6ED7E82FD15E34687
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
34096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
activeds.pdb
msvcrt
?terminate@@YAXXZ
memset
_ftol2_sse
memcmp
malloc
memcpy
free
_initterm
_except_handler4_common
_amsg_exit
_XcptFilter
iswspace
_wcsnicmp
_snwprintf_s
memcpy_s
wcstok
wcschr
wcscpy_s
swscanf_s
wcscat_s
swprintf_s
_wcsicmp
wcsncpy_s
__CxxFrameHandler3
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLCID
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
TerminateProcess
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegGetKeySecurity
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegSetKeySecurity
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
ntdll
RtlNtStatusToDosError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
adsldpc
FreeADsMem
AllocADsMem
AllocADsStr
ConvertU2TrusteeToSid
LdapCrackUserDNtoNTLMUser2
ConvertSidToString
ConvertSidToU2Trustee
GetServerAndPort
GetDomainDNSNameForDomain
ADsGetLastError
ADsSetLastError
ReallocADsMem
FreeADsStr
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ADsBuildEnumerator
ADsBuildVarArrayInt
ADsBuildVarArrayStr
ADsDecodeBinaryData
ADsEncodeBinaryData
ADsEnumerateNext
ADsFreeEnumerator
ADsGetLastError
ADsGetObject
ADsOpenObject
ADsSetLastError
AdsFreeAdsValues
AdsTypeToPropVariant
AdsTypeToPropVariant2
AllocADsMem
AllocADsStr
BinarySDToSecurityDescriptor
ConvertSecDescriptorToVariant
ConvertSecurityDescriptorToSecDes
ConvertTrusteeToSid
DllCanUnloadNow
DllGetClassObject
FreeADsMem
FreeADsStr
PropVariantToAdsType
PropVariantToAdsType2
ReallocADsMem
ReallocADsStr
SecurityDescriptorToBinarySD
Name
.text
Size
180KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=261, version=27412,
count=2, id=259, version=27412,
count=19, id=260, version=27412,
count=168, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=70, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/activeds.tlb
- SHA256 55ddf51378f46a1cc1924e0a89dab95ff72054e961a28d376b438a6a73fd7f27
- MD5 fa66db1c0cb93d24af19e4a5424db81a
- SHA1 b6ddacac4e5586844a66acff7a31ed2f62bb4dbe
- SHA512 d3f7a730feb9bcbf5d344a2131edd015d51db9864986dc596f2fad62f678949b4c9f23b8d15c0d6c5679356e721749e12aa6c1f5ff4eab5e39221395c2ed2d89
- SSDEEP 768:tBv2qbbf4gDZVTJKQwCF/hP6nqolkqKvLnToz5mUJBs7Qz2/ztQrcytOmmH5qb38:tBe+nDZxqCTP6nqix2LLCBYAh/fe
- TLSH T12AB30E86B741D9E2C80D12315C1BD3EA6FB4B54AAF42F26B33C4476E6EB33C17A06615
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/actxprxy.dll
- IMPHASH 666252afad3d07fb7f2f7534f9775e09
- SHA256 50d05cf2a729e5676e492e92288aeee6a65641b1a47f93317a549415dc9d18da
- MD5 e7019642e60d1d9dd16c607a30733259
- SHA1 aba92ee7ef6e1180802331f0fee532386867d683
- SHA512 a74fe6f2f038dc056e691980779a606018825d0960a13436fa3751f0bc29f5543931d3d7965a2aa54254829e9d875bb5e96f73441f7910be600d0e0b8769ce68
- SSDEEP 3072:Ee8AdZ7iep9ZVJhZVxF6fhN7MuadPu3gG4zeqrT9mxDwd1KMPlEybD:ENfj7gG/gFn
- TLSH T13E544FA06A6D1D66C02A653961D7DF3BD2092901B3D151DB8284E65C787F0E2FF33F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
236144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ActXPrxy.pdb
msvcrt
_initterm
malloc
free
_except_handler4_common
_XcptFilter
_amsg_exit
memcmp
memcpy
rpcrt4
CStdStubBuffer_IsIIDSupported
NdrStubForwardingFunction
NdrClientCall4
NdrGetUserMarshalInfo
RpcRaiseException
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrStubCall2
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction7
ObjectStublessClient24
ObjectStublessClient25
NdrProxyForwardingFunction23
NdrProxyForwardingFunction12
ObjectStublessClient30
ObjectStublessClient21
NdrProxyForwardingFunction29
NdrProxyForwardingFunction25
ObjectStublessClient17
ObjectStublessClient26
NdrProxyForwardingFunction10
CStdAsyncStubBuffer_QueryInterface
NdrProxyForwardingFunction30
ObjectStublessClient29
NdrProxyForwardingFunction9
NdrProxyForwardingFunction13
ObjectStublessClient19
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_AddRef
NdrProxyForwardingFunction31
ObjectStublessClient3
CStdAsyncStubBuffer_Connect
NdrProxyForwardingFunction11
NdrProxyForwardingFunction6
NdrProxyForwardingFunction19
ObjectStublessClient4
NdrProxyForwardingFunction21
ObjectStublessClient16
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
ObjectStublessClient7
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient5
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient15
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient23
CStdAsyncStubBuffer_Release
NdrProxyForwardingFunction27
NdrProxyForwardingFunction26
NdrProxyForwardingFunction16
NdrProxyForwardingFunction24
NdrProxyForwardingFunction18
CStdAsyncStubBuffer_Disconnect
NdrProxyForwardingFunction22
NdrProxyForwardingFunction17
NdrProxyForwardingFunction14
ObjectStublessClient31
NdrProxyForwardingFunction15
NdrProxyForwardingFunction20
ObjectStublessClient20
ObjectStublessClient28
NdrProxyForwardingFunction28
NdrProxyForwardingFunction8
ObjectStublessClient22
ObjectStublessClient27
ObjectStublessClient18
api-ms-win-core-marshal-l1-1-0
HICON_UserFree
HWND_UserFree
HBITMAP_UserMarshal
HWND_UserSize
HWND_UserMarshal
HMENU_UserSize
HICON_UserSize
HMONITOR_UserUnmarshal
HWND_UserUnmarshal
HMENU_UserMarshal
HMENU_UserFree
HICON_UserUnmarshal
HMONITOR_UserSize
HMONITOR_UserMarshal
HMENU_UserUnmarshal
HICON_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HMONITOR_UserFree
HBITMAP_UserFree
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=158, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=118, id=269, version=27412,
count=21, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/acwow64.dll
- IMPHASH f5ea38112753322b67a75bd4f0cdcffc
- SHA256 99c6d28b981552f92341da34deee0a4e0212bfb76f0d5b29711331ad47b9ed25
- MD5 94e972f7e5f6662dece2c435047d9fa0
- SHA1 4f782489bd2cf9f3cf97a17dd2ab158d75022599
- SHA512 7c4dc945c9c69681cd72329696c9837d60c413bcc0b35429ebc3868bdb30b814e80ce36682cb97aca21130cfd963600631da59acbd3fe3de4fa1f735e16047c2
- SSDEEP 768:+6cW1qHGnnU5yadOKjGfDVoHOqAQG2gcwO6:+6c6q2nedO2GfZoHOqm2gcwO6
- TLSH T1E3031715AAC441B2E69B1771B878533703AEFC102BE666CBAB2313D92CB12D2F534757
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
28656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
AcWow64.pdb
apphelp
SE_COM_Lookup
SE_ShimDPF
SE_GetShimId
SE_COM_AddServer
SE_COM_AddHook
msvcrt
memcpy
_CxxThrowException
memmove
_amsg_exit
__CxxFrameHandler3
tolower
_wcsnicmp
_strnicmp
_wcsicmp
wcsncmp
toupper
strstr
_stricmp
wcstombs
wcsstr
_strlwr
iswctype
towlower
wcschr
wcspbrk
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
memset
_XcptFilter
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlDosPathNameToNtPathName_U
NtOpenFile
NtClose
NtQueryInformationProcess
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
RtlFreeUnicodeString
kernel32
Wow64RevertWow64FsRedirection
GetSystemInfo
Wow64DisableWow64FsRedirection
VirtualAlloc
ExpandEnvironmentStringsW
lstrlenA
ExpandEnvironmentStringsA
GetSystemWow64DirectoryW
SetLastError
GetWindowsDirectoryA
IsWow64Process
GetCommandLineW
lstrlenW
GetFileAttributesW
FindFirstFileW
FileTimeToSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
AddVectoredExceptionHandler
FindClose
CloseHandle
GetFileSize
CreateFileW
VirtualQuery
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegCloseKey
api-ms-win-core-registry-l2-1-0
RegQueryValueA
api-ms-win-core-versionansi-l1-1-0
VerQueryValueA
GetFileVersionInfoExA
GetHookAPIs
NotifyShims
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=27412,
count=2, id=259, version=27412,
count=15, id=260, version=27412,
count=9, id=257, version=27412,
count=147, id=1, productName=Unmarked objects,
count=29, id=265, version=27412,
count=1, id=256, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adprovider.dll
- IMPHASH 8ab90d842ada1ec9b31aaed761f57b64
- SHA256 453357824d79a4d4eef65a7dc0e9c9ee18ec2e4fe7d9967ebfdb9f90b38661c2
- MD5 f0cbb6ddb806bcb8536b1f842149045d
- SHA1 f7b6c49c01b3ea934152a6707f536f94e860b735
- SHA512 966be9969a42beebbf9a416bab90ebd3428d7498f51148191315930f886155c3aa181e80b7648d064416fca08dbd2d8ca3c9417c8e96f1ef0ca9d1191dce3e72
- SSDEEP 768:on/g38tFh1YNi7X277LXPdDXv+JtmOKZp9rw71aad4/qWQa5cM3GlqesRtgjEB9Z:onuUFcNi7gXPdDXv+JtmbrQ1aadIqu51
- TLSH T1F2231B02B780C4F6D2A522317C6B97FA493EBD106F8547C73707336E6CB26E16939296
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
30480
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adprovider.pdb
msvcrt
memcmp
realloc
_errno
memcpy
_onexit
__dllonexit
wcscpy_s
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_atoi64
_wcsicmp
_wcsnicmp
wcstoul
_ultow
_purecall
wcschr
memcpy_s
malloc
wcsncpy_s
wcscat_s
free
_vsnwprintf
memset
oleaut32
SysFreeString
VarUI4FromStr
LoadTypeLi
UnRegisterTypeLi
SysAllocString
RegisterTypeLi
SysStringLen
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
FindResourceExW
DisableThreadLibraryCalls
LoadResource
SizeofResource
api-ms-win-core-localization-l1-2-0
SetThreadLocale
GetThreadLocale
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegOpenCurrentUser
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
logoncli
DsGetDcNameW
netutils
NetApiBufferFree
wldap32
ord145
ord88
ord142
ord301
ord167
ord79
ord14
ord224
ord97
ord73
ord190
ord140
ord127
ord26
ord208
ord18
ord118
ord12
ord147
ord10
ord41
ord40
ord16
ord152
ord13
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
crypt32
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptHashCertificate
CertAddSerializedElementToStore
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
sspicli
GetUserNameExW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
advapi32
CryptAcquireContextW
CryptGetUserKey
CryptDestroyKey
CryptReleaseContext
kernel32
lstrcmpiW
ntdsapi
DsUnBindW
DsReplicaFreeInfo
DsReplicaGetInfo2W
DsBindW
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=14, id=260, version=27412,
count=179, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=9, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adrclient.dll
- IMPHASH 14add8dc76195382e4a76be8a2bec2dd
- SHA256 7e3ba04edc4ee6c37bb9c7133369abe7fee401613ed4a17416b734965e104b91
- MD5 c7dff4916afc48f598f18bc7146bf35d
- SHA1 b55567795988c78b0b80a80871f9ed3bed7a0228
- SHA512 bff7d2a9e24a13070e0420109268176f7357a83cd797aaf3d6a97006e7706f370abdf4b37c2cd32ec6e716754ba449eac8dd65d829bf61426168b15399438f0c
- SSDEEP 3072:ae8M6jXYgIKPwlCQkDUHCO9rjUVTITlL13:aeF61PwlCQkDUiOl4al53
- TLSH T18FA32A117AD4843AF3FA267A343A722963A77071CF71464BB7244B2D2EB46D38D20B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
67888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adrclient.pdb
msvcrt
malloc
??0exception@@QAE@XZ
_callnewh
??0exception@@QAE@ABV0@@Z
_CxxThrowException
iswalpha
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_wcsnicmp
??3@YAXPAX@Z
free
iswdigit
_vsnprintf
_snwscanf_s
_vsnwprintf
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__CxxFrameHandler3
_purecall
memmove
memcmp
?what@exception@@UBEPBDXZ
wcsncmp
??_V@YAXPAX@Z
memcpy
memset
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
oleaut32
GetErrorInfo
SysStringLen
SysAllocString
LoadRegTypeLi
SysFreeString
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadStringW
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleA
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-file-l1-1-0
GetDriveTypeW
mpr
WNetGetUniversalNameW
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
GetCurrentProcess
TerminateProcess
dfscli
NetDfsGetClientInfo
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
GetSecurityDescriptorOwner
GetFileSecurityW
GetTokenInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
ws2_32
WSAStartup
GetAddrInfoW
WSACleanup
FreeAddrInfoW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
WinSqmIsOptedIn
RtlFreeUnicodeString
WinSqmIncrementDWORD
RtlDosPathNameToNtPathName_U
NtOpenFile
user32
SendMessageW
shell32
ShellExecuteW
mi
MI_Application_InitializeV1
srmtrace
ord7
ord6
ord11
ord5
ord10
ord8
ord9
ord3
dui70
UnInitThread
?_ZeroRelease@Value@DirectUI@@AAEXXZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateString@Value@DirectUI@@SGPAV12@PBGPAUHINSTANCE__@@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
CreateDUIWrapper
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
InitThread
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
UnInitProcessPriv
InitProcessPriv
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
RegisterEventSourceW
DeregisterEventSource
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=3, id=259, version=27412,
count=230, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=10, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adsldp.dll
- IMPHASH 65f2f1a46d0f4fe541026969d6f109ab
- SHA256 1cebacc9649859b951a92d7f3b89402d6b3aa40f3fd431ffe11f57fdf2c09d38
- MD5 fb0c2a6f1f58cfd082f3258a28672514
- SHA1 80036c393d17d46aa3a2a76223fde981c85a9dd4
- SHA512 4eda6f614e213cecd1912a1004858dabccab7a1c1cca64a26a6eb503029f0f57b1871bd170181d226d51fd8370ee8184b6c75ef5255f4e6dc840fe071a5ba764
- SSDEEP 3072:nK0vk2n2gn0vqPA/GwOR+T6+Uer+hB9Ps8J0NONysyoy3rmGELv:ndk2nPn0vWAefIT6+UAaPs8J0ky3rm
- TLSH T16A143A11F78C42B5E7E360B0428CB33DE56DB941CBA18ACF725485A6B8517C29F34B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adsldp.pdb
msvcrt
_except_handler4_common
_initterm
free
_amsg_exit
_XcptFilter
_itow_s
swscanf_s
_wtoi64
_wtol
_ltow
qsort
wcstok
wcsncpy_s
wcschr
swprintf_s
_purecall
wcscat_s
_wcsnicmp
wcsstr
_wcslwr
wcscpy_s
memcpy
memcmp
malloc
_wcsicmp
memset
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
wldap32
ord53
ord54
ord12
ord14
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-l1-2-0
FormatMessageW
activeds
ord28
ord3
ord27
ord7
ord22
ord25
ord26
ord31
ord16
ord17
ord12
ord18
ord15
ord14
adsldpc
SchemaGetSyntaxOfAttribute
SchemaGetClassInfo
SchemaAddRef
LdapMakeSchemaCacheObsolete
LdapGetSubSchemaSubEntryPath
LdapGetSchemaObjectCount
LdapcKeepHandleAround
SchemaGetPropertyInfo
LdapNextAttribute
LdapAttributeFree
LdapFirstAttribute
LdapValueFreeLen
UnMarshallLDAPToLDAPSynID
SchemaGetStringsFromStringTable
FindSearchTableIndex
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
SortAndRemoveDuplicateOIDs
LdapTypeFreeLdapModObject
LdapGetSyntaxIdOfAttribute
LdapTypeBinaryToString
Component
?GetNextToken@CLexer@@QAEJPAGPAK@Z
GetDisplayName
LdapDeleteExtS
LdapTypeToAdsTypeCopyConstruct
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
LdapGetSyntaxOfAttributeOnServer
LdapcSetStickyServer
FindEntryInSearchTable
LdapRenameExtS
LdapModDnS
GetLDAPTypeName
LdapDeleteS
LdapReadAttribute
BuildADsPathFromParent
LdapTypeFreeLdapObjects
LdapSearchS
BerEncodingQuotaControl
LdapAddS
LdapAddExtS
LdapModifyS
LdapModifyExtS
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
LdapOpenObject
SchemaGetPropertyInfoByIndex
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaOpen
ADsObject
LdapMemFree
intcmp
FreeObjectInfo
PathName
?SetFSlashDisabler@CLexer@@QAEXH@Z
?SetAtDisabler@CLexer@@QAEXH@Z
InitObjectInfo
?InitializePath@CLexer@@QAEJPAG@Z
??1CLexer@@QAE@XZ
??0CLexer@@QAE@XZ
LdapGetValues
LdapGetDn
LdapNextEntry
LdapFirstEntry
ADsHelperGetCurrentRowMessage
ADSIPrint
BuildADsParentPathFromObjectInfo2
LdapTypeToAdsTypeUTCTime
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
MapADSTypeToLDAPType
MapLDAPTypeToADSType
AdsTypeToLdapTypeCopyTime
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
GetServerAndPort
LdapInitializeSearchPreferences
LdapCloseObject
LdapCacheAddRef
ADsSetObjectAttributes
ADsGetObjectAttributes
ReadSecurityDescriptorControlType
ADsCreateDSObjectExt
SchemaClose
ADsDeleteDSObject
ADsEnumAttributes
ADsCreateAttributeDefinition
ADsWriteAttributeDefinition
ADsDeleteAttributeDefinition
ADsEnumClasses
ADsCreateClassDefinition
ADsWriteClassDefinition
ADsDeleteClassDefinition
LdapSearchAbandonPage
ADsSetSearchPreference
ADsExecuteSearch
ADsAbandonSearch
ADsCloseSearchHandle
ADsGetFirstRow
ADsGetNextRow
ADsGetPreviousRow
ADsGetColumn
ADsGetNextColumnName
ADsFreeColumn
IsGCNamespace
GetDefaultServer
LdapOpenObject2
LdapReadAttributeFast
BuildADsPathFromLDAPPath2
BuildADsParentPath
LdapValueFree
BuildLDAPPathFromADsPath2
ReadPagingSupportedAttr
LdapSearchInitPage
LdapSearchExtS
LdapCountEntries
LdapGetNextPageS
LdapMsgFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=272, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=59, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adsldpc.dll
- IMPHASH bb23d8b9605e5bd2bd028eaafcaa9a1d
- SHA256 0519c38757f961846e5d742d30d9dc34d3de9df7a804f8c31cb5bc233387d092
- MD5 ed437af4b511c9eab7780acf33d2bd45
- SHA1 eafbf9f0b9e48328d54cca9337152ad6522a5e5b
- SHA512 b5912072b0a6a9b4afa6fadc33809f96c345dee94bec6242c891664bd572e3e5117c7ead6fb043befb8937ca813fadd4d77f2d863cfe544014fcece57c20037a
- SSDEEP 3072:OL7Z8TT1uyNQedB6NQ1h+jIKlpF0bjfZMMFbFT1QdIB/K0zU34pKJuYylKNAjnD0:OZWzU34pKJelIAj0R8FAIy3
- TLSH T10B24704563E95228F2F36B701ABD516A493ABC15EFF5C38F0244914E6A71AC1DE30B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
97168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adsldpc.pdb
msvcrt
malloc
free
_initterm
_except_handler4_common
_XcptFilter
_itow_s
wcstoul
_wcsnicmp
wcsstr
qsort
wcschr
wcsncat_s
swscanf_s
memcpy_s
iswdigit
_wtoi
_wtol
_vsnwprintf
wcsrchr
wcscat_s
swprintf_s
_wcsicmp
memcmp
memcpy
bsearch
wcsncpy_s
_amsg_exit
wcscpy_s
memset
wldap32
ord216
ord210
ord13
ord16
ord73
ord190
ord88
ord14
ord309
ord310
ord304
ord301
ord311
ord300
ord146
ord53
ord145
ord54
ord91
ord94
ord321
ord319
ord173
ord100
ord116
ord191
ord138
ord135
ord134
ord206
ord194
ord203
ord18
ord133
ord147
ord79
ord224
ord77
ord120
ord219
ord29
ord142
ord97
ord157
ord140
ord155
ord165
ord188
ord161
ord69
ord12
ord167
ord65
ord127
ord27
ord26
ord113
ord111
ord41
ord179
ord40
ord85
ord10
ord36
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
TerminateProcess
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
ntdll
EtwEventWrite
EtwEventUnregister
EtwEventRegister
RtlIdentifierAuthoritySid
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CompareFileTime
GetFileSize
ReadFile
CreateFileW
WriteFile
DeleteFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegCloseKey
RegDeleteValueW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0CLexer@@QAE@XZ
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?InitializePath@CLexer@@QAEJPAG@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSIPrint
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BerEncodingQuotaControl
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetServerAndPort
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp
Name
.text
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=12, id=260, version=27412,
count=198, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=29, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adsmsext.dll
- IMPHASH e058556a51521ec94d20d7986eb0d423
- SHA256 9ce1ab300bd894aa185ffefcf495b59b80946ad8cb1103c441948a3e7c8d0f64
- MD5 212f04dbf4274bd8fdd6675012a3def9
- SHA1 e43d8fdb77b9c9d2cad1085e7b61435cd9aa17ff
- SHA512 9ab26f5a090bdf8d0dfcae0ffbe6d0e1cac17ba8d2d0ba5e81ae457c2f4af2bcfedb8a5a3126f6d8be79fa59e823c7fb890ea4bc775809d5eb04e7d3220c4242
- SSDEEP 1536:nN8wDsEgpkekXknkOUKGe9UO6zwJ9U6EII3zmRbK88Uf1Gcj:ndJETkXknkOU4GwJ9U6EIkmRbp8Uf1Gc
- TLSH T1AC83B611729954D4F5F31ABC127A3132967FF9215BB893CB8A20A2DA5C717C38E3835B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
72272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adsmsext.pdb
msvcrt
memcpy
_wcsicmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcstok
wcscat_s
wcscpy_s
_purecall
swscanf_s
wcschr
_wcsnicmp
swprintf_s
memset
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
api-ms-win-core-file-l1-1-0
LocalFileTimeToFileTime
FileTimeToLocalFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
ntdll
RtlInitUnicodeString
RtlInitString
activeds
ord9
ord17
ord15
ord16
ord14
ord7
ord18
adsldpc
GetDefaultServer
LdapCrackUserDNtoNTLMUser2
ChangeSeparator
ReadServerSupportsIsADControl
LdapCloseObject
FreeObjectInfo
LdapModifyS
ReadServerSupportsIsADAMControl
LdapGetSyntaxOfAttributeOnServer
ADsObject
LdapCompareExt
BuildLDAPPathFromADsPath2
BuildADsPathFromLDAPPath
LdapValueFree
LdapReadAttributeFast
ADSIPrint
LdapOpenObject
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=15, id=260, version=27412,
count=135, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=41, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adsnt.dll
- IMPHASH a5de288603ce61ec53ba7262c4d8fd17
- SHA256 00532226f21dd21d9889030889bad56e904bc1ad1be505b920fb01ed5c5a07d9
- MD5 db31959714d70cf01c9cce0573f2e171
- SHA1 bab6466093c8c2596b3e9edf04b1cd25feb60f57
- SHA512 1b47f2313a2fed0c599fe0374554f33f44f366e639b56b85f964622d8a46a53d7ec86c11322733e99558eed4a58102286f0a46fc3502cb2d771d7b70ffbd2235
- SSDEEP 3072:vBsJiaCgb+eVcKxGzardk+CdZmvzb4gTbroYpbXhKBcp/jQtTaQ5vi2nvRDP3j1k:GJOG+iJVq+zLroY97QhacvRDPT1IpZ
- TLSH T1AE544D11658452BEEFD1207481DE3138779DE5214B60CACBE3B1A2EEBA616C1CF3539B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
42016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
adsnt.pdb
msvcrt
_CxxThrowException
_ftol2
memcmp
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
memset
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsnicmp
wcsncpy_s
wcsrchr
wcsncat_s
_ltow
wcschr
_wtol
swprintf_s
_purecall
_wcsicmp
_itow_s
wcscat_s
wcscpy_s
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ntdll
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970
RtlIpv6StringToAddressW
RtlInitUnicodeString
RtlRunEncodeUnicodeString
RtlRunDecodeUnicodeString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-file-l1-1-0
LocalFileTimeToFileTime
FileTimeToLocalFileTime
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-l1-2-0
FormatMessageW
activeds
ord17
ord14
ord18
ord7
ord21
ord23
ord22
ord16
ord15
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
229KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=3, id=259, version=27412,
count=203, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=91, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/adtschema.dll
- SHA256 920749ea1213a5a98aa45c854f1863d468cfbc1eb48e5dec5f8a8b8bbe72dfd3
- MD5 17bac022803cbfe4d8ecca87baca0cb0
- SHA1 2f377166b0f5cc3e2f66ca0896d1dfad4f849a55
- SHA512 e7f0102b540a6d7403e4d4c9c5d25d0f17e617ea70d4022d3fdb9d6add428651e7add920b097859e1c5f028dc3e3f2822e58946ae2c67982543740e700484d1e
- SSDEEP 1536:ObAuOuwWCMunsfdCx359QQzMjbCaQH1+ULrCuQLW+du1Y4YdLgysmeYkOjY8XQTa:ObAuOuwWCkdS1quQL9udpdyqcZQiqMD
- TLSH T14E05D5025BEE9409F1FB6B356A3A85651A32BD36AA30D46F3215D21E7861F40CEF1733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
848KB
Virtual Size
848KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/advapi32.dll
- IMPHASH cbe9eb70ba8dbd80242243c3689a0ebe
- SHA256 e200c411aeeeb02c7aee8227ada9103a05b4781b663817f57a5aa1801ee19e16
- MD5 af8f93d50dcaddc6c337faf4d23c0b67
- SHA1 34e4f25c192b3b1ee26dbbf7c74724762f752c70
- SHA512 56e699688262f6966d6f8e9419b0b6244216a6213f055f6608bd4b600f1e20f8261632c083173990115519b878660b70fcada32461064ef0b70493f52f76b6a8
- SSDEEP 12288:zhSoUqCuGqN0FCSKvY4MTciBwtYG/Bd7/WOW2Mu6yuW5qWOmyOya6iy+KJrPuMZD:zBUqCuGqN0FCSKvY4MTciBG/T7eOW2ML
- TLSH T178B48E12B694ABA3F5B36270066EB735126EFD750F5085CB62841BEE78359C09F3930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f8:07:86:a1:26:58:7f:78:4b:d0:6d:98:61:9a:e5:87:e6:e9:04:e9:e8:da:6b:27:2c:f4:27:06:a9:43:58:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 12, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fe:d0:a8:c2:7b:34:21:0b:01:00:01:00:00:01:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
75792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32.pdb
msvcrt
_wcsicmp
_wcsnicmp
tolower
strstr
strchr
_ultow_s
iswctype
wcstoul
_wcstoui64
_wcstoi64
_ultow
wcstok_s
_errno
_ui64tow_s
_i64tow_s
_stricmp
wcsnlen
swprintf_s
iswalpha
wcsncmp
_vsnprintf
__CxxFrameHandler3
wcscpy_s
wcsstr
wcsncpy_s
wcsrchr
memcpy_s
_ftol2
memcmp
memcpy
memmove
_except_handler4_common
wcschr
swscanf_s
_resetstkoflw
_vsnwprintf
wcscat_s
memset
ntdll
NtOpenThreadToken
NtOpenProcessToken
RtlEqualSid
RtlLengthSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtDuplicateToken
NtCompareTokens
RtlAllocateAndInitializeSid
RtlFreeSid
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlCreateUnicodeString
NtQueryInformationProcess
RtlGetLastNtStatus
NtQueryKey
RtlValidSid
LdrLoadDll
RtlImageNtHeader
LdrUnloadDll
NtDeviceIoControlFile
NtQuerySystemInformation
EtwEventRegister
EtwEventWrite
NtCreateKey
NtSetValueKey
RtlDeleteElementGenericTable
RtlAppendUnicodeToString
NtDeleteKey
RtlInsertElementGenericTable
RtlCopySid
RtlInitializeHandleTable
RtlDestroyHandleTable
EtwEventUnregister
NtEnumerateKey
RtlIntegerToUnicodeString
RtlStringFromGUID
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
RtlInitializeGenericTable
RtlQueryRegistryValuesEx
RtlLookupElementGenericTable
RtlNumberGenericTableElements
RtlGUIDFromString
RtlUpcaseUnicodeChar
NtQueryVolumeInformationFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlDetermineDosPathNameType_U
NtQueryInformationFile
RtlGetFullPathName_U
RtlUnicodeToMultiByteN
RtlNtStatusToDosErrorNoTeb
RtlUnicodeToMultiByteSize
RtlAnsiCharToUnicodeChar
RtlMultiByteToUnicodeN
NtTraceControl
RtlSetLastWin32Error
RtlInitAnsiStringEx
RtlInitUnicodeStringEx
RtlCreateUnicodeStringFromAsciiz
NtRenameKey
RtlQueryPackageIdentity
RtlOemStringToUnicodeString
RtlIsTextUnicode
NtSetInformationThread
RtlAddAce
RtlValidAcl
RtlSetSaclSecurityDescriptor
RtlInitializeSid
RtlGetControlSecurityDescriptor
RtlAddAuditAccessObjectAce
RtlSetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetAce
RtlAddAuditAccessAceEx
RtlxAnsiStringToUnicodeSize
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
RtlAddAccessDeniedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlFirstFreeAce
RtlSetGroupSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlDosPathNameToNtPathName_U
EtwEventWriteTransfer
EtwEventSetInformation
NtClose
RtlAdjustPrivilege
RtlCopyString
NtQuerySystemTime
RtlTimeToSecondsSince1970
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtWaitForSingleObject
RtlGetVersion
NtQueryInformationThread
NtQuerySecurityObject
RtlRunOnceExecuteOnce
RtlRunOnceBeginInitialize
RtlRunOnceInitialize
NtQueryPerformanceCounter
RtlDeleteBoundaryDescriptor
NtCreateMutant
NtOpenPrivateNamespace
NtCreatePrivateNamespace
RtlAddSIDToBoundaryDescriptor
RtlCreateBoundaryDescriptor
NtWaitForMultipleObjects
RtlCreateAcl
RtlValidRelativeSecurityDescriptor
NtCreateFile
NtWriteFile
NtReadFile
RtlWaitOnAddress
RtlWakeAddressAll
RtlQueryPerformanceCounter
RtlDllShutdownInProgress
RtlAcquireSRWLockExclusive
RtlInsertElementGenericTableAvl
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlLookupElementGenericTableAvl
RtlReleaseSRWLockShared
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlWakeAddressSingle
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlInitializeSRWLock
RtlEqualUnicodeString
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
NtAlpcQueryInformation
RtlCreateQueryDebugBuffer
NtQueryObject
NtQueryMutant
RtlAddAccessAllowedAce
RtlOpenCurrentUser
NtReplaceKey
NtOpenKeyEx
NtSaveKey
NtSaveMergedKeys
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlGetNtProductType
NtOpenKey
RtlFreeHandle
RtlIsValidIndexHandle
RtlAllocateHandle
RtlUnicodeStringToInteger
RtlConvertSidToUnicodeString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlGetThreadPreferredUILanguages
RtlMakeSelfRelativeSD
RtlFreeHeap
RtlxUnicodeStringToAnsiSize
NtQueryInformationToken
RtlFreeUnicodeString
RtlAllocateHeap
RtlImpersonateSelf
RtlInitializeCriticalSection
RtlDeleteCriticalSection
NtSetSystemInformation
RtlLeaveCriticalSection
RtlEnterCriticalSection
DbgPrint
RtlNtStatusToDosError
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetCurrentTransaction
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeAnsiString
NtQueryValueKey
api-ms-win-eventing-controller-l1-1-0
EventAccessRemove
EventAccessControl
QueryAllTracesW
StopTraceW
EnumerateTraceGuidsEx
ControlTraceW
TraceSetInformation
EnableTraceEx2
EventAccessQuery
StartTraceW
api-ms-win-eventing-consumer-l1-1-0
CloseTrace
ProcessTrace
OpenTraceW
api-ms-win-eventing-consumer-l1-1-1
QueryTraceProcessingHandle
kernelbase
PackageIdFromFullName
RegKrnGetHKEY_ClassesRootAddress
RegKrnGetClassesEnumTableAddressInternal
RegKrnGetTermsrvRegistryExtensionFlags
lstrlenW
LocalAlloc
LocalReAlloc
CreateProcessAsUserW
CreateProcessAsUserA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
lstrcmpiW
lstrcmpW
Sleep
GetStagedPackagePathByFullName
RegOpenKeyExInternalA
DisablePredefinedHandleTableInternal
RegCreateKeyExInternalA
RemapPredefinedHandleInternal
RegDeleteKeyExInternalA
MapPredefinedHandleInternal
CLOSE_LOCAL_HANDLE_INTERNAL
RegOpenKeyExInternalW
RegCreateKeyExInternalW
RegDeleteKeyExInternalW
sechost
QueryAllTracesA
ControlTraceA
StartTraceA
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
api-ms-win-service-core-l1-1-1
QueryServiceDynamicInformation
EnumDependentServicesW
EnumServicesStatusExW
api-ms-win-service-core-l1-1-2
GetServiceKeyNameW
GetServiceDisplayNameW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
DeleteService
StartServiceW
OpenSCManagerW
OpenServiceW
ControlServiceExW
CreateServiceW
api-ms-win-service-management-l2-1-0
NotifyServiceStatusChangeW
QueryServiceObjectSecurity
QueryServiceStatusEx
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW
SetServiceObjectSecurity
ChangeServiceConfig2W
api-ms-win-service-private-l1-1-4
CreateServiceEx
api-ms-win-service-private-l1-1-2
QueryLocalUserServiceName
I_ScReparseServiceDatabase
QueryUserServiceName
api-ms-win-service-private-l1-1-3
QueryUserServiceNameForContext
api-ms-win-service-private-l1-1-0
I_ScRpcBindA
I_ScRpcBindW
WaitServiceState
I_ScSetServiceBitsA
I_ScSetServiceBitsW
api-ms-win-service-winsvc-l1-1-0
OpenServiceA
ControlServiceExA
ChangeServiceConfig2A
StartServiceA
ControlService
RegisterServiceCtrlHandlerW
ChangeServiceConfigA
OpenSCManagerA
RegisterServiceCtrlHandlerA
QueryServiceConfig2A
CreateServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
NotifyServiceStatusChangeA
QueryServiceConfigA
RegisterServiceCtrlHandlerExA
api-ms-win-core-namedpipe-l1-1-0
ImpersonateNamedPipeClient
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentThread
GetPriorityClass
CreateThread
GetProcessId
OpenThreadToken
SetThreadToken
OpenThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorOwner
IsTokenRestricted
GetPrivateObjectSecurity
CreateWellKnownSid
CreatePrivateObjectSecurity
AddAccessDeniedAceEx
SetSecurityAccessMask
GetSecurityDescriptorControl
CopySid
ObjectPrivilegeAuditAlarmW
IsWellKnownSid
DeleteAce
PrivilegedServiceAuditAlarmW
InitializeSid
GetSecurityDescriptorOwner
ImpersonateAnonymousToken
ImpersonateSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorSacl
EqualDomainSid
AddAce
AddAuditAccessAce
AccessCheckByTypeResultListAndAuditAlarmW
SetAclInformation
IsValidSecurityDescriptor
AddAccessDeniedAce
CreateRestrictedToken
FreeSid
EqualPrefixSid
GetFileSecurityW
AccessCheckAndAuditAlarmW
CheckTokenMembership
InitializeSecurityDescriptor
GetAce
DuplicateToken
SetPrivateObjectSecurityEx
AddAccessAllowedObjectAce
GetKernelObjectSecurity
MapGenericMask
SetKernelObjectSecurity
AddAccessAllowedAceEx
GetLengthSid
SetSecurityDescriptorControl
DuplicateTokenEx
IsValidAcl
GetSecurityDescriptorLength
AddAccessAllowedAce
AddAccessDeniedObjectAce
MakeSelfRelativeSD
AccessCheckByType
AddAuditAccessAceEx
MakeAbsoluteSD
SetSecurityDescriptorGroup
GetSidIdentifierAuthority
GetTokenInformation
PrivilegeCheck
AccessCheckByTypeResultList
ObjectCloseAuditAlarmW
AccessCheck
EqualSid
AdjustTokenGroups
CreatePrivateObjectSecurityEx
GetAclInformation
SetFileSecurityW
AddAuditAccessObjectAce
AllocateLocallyUniqueId
ObjectOpenAuditAlarmW
SetSecurityDescriptorRMControl
GetSecurityDescriptorRMControl
AreAnyAccessesGranted
SetTokenInformation
GetSidSubAuthorityCount
ObjectDeleteAuditAlarmW
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AllocateAndInitializeSid
GetSecurityDescriptorGroup
GetSidSubAuthority
AreAllAccessesGranted
CreatePrivateObjectSecurityWithMultipleInheritance
GetSidLengthRequired
DestroyPrivateObjectSecurity
GetWindowsAccountDomainSid
InitializeAcl
ConvertToAutoInheritPrivateObjectSecurity
GetSecurityDescriptorDacl
RevertToSelf
QuerySecurityAccessMask
SetPrivateObjectSecurity
AdjustTokenPrivileges
SetSecurityDescriptorDacl
AccessCheckByTypeAndAuditAlarmW
FindFirstFreeAce
GetSecurityDescriptorSacl
IsValidSid
api-ms-win-security-base-private-l1-1-0
MakeAbsoluteSD2
api-ms-win-core-registry-l1-1-0
RegDeleteTreeA
RegDisablePredefinedCacheEx
RegNotifyChangeKeyValue
RegGetKeySecurity
RegLoadAppKeyW
RegDeleteKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW
RegGetValueA
RegSaveKeyExA
RegLoadMUIStringA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCreateKeyExW
RegUnLoadKeyA
RegOpenUserClassesRoot
RegDeleteKeyExA
RegEnumKeyExW
RegSetKeySecurity
RegSaveKeyExW
RegDeleteTreeW
RegLoadMUIStringW
RegSetValueExW
RegLoadAppKeyA
RegSetValueExA
RegCopyTreeW
RegLoadKeyA
RegUnLoadKeyW
RegQueryInfoKeyA
RegLoadKeyW
RegOpenKeyExA
RegGetValueW
RegRestoreKeyW
RegEnumValueA
RegDeleteValueW
RegRestoreKeyA
RegDeleteValueA
RegEnumValueW
RegEnumKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueA
RegSetKeyValueA
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-registry-l1-1-2
RegQueryMultipleValuesW
RegQueryMultipleValuesA
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetComputerNameExA
GetLocalTime
GetSystemTime
GetTickCount
GetSystemWindowsDirectoryW
kernel32
GetFullPathNameW
MultiByteToWideChar
LocalFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DelayLoadFailureHook
ResolveDelayLoadedAPI
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
CreateEventW
CloseHandle
GetThreadUILanguage
GetCommandLineW
GetModuleHandleExW
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
CreateFileW
FormatMessageW
GetFileAttributesExW
OutputDebugStringW
DeleteFileW
MoveFileW
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLongPathNameW
CompareFileTime
FindResourceExW
LoadResource
GetVolumePathNameW
DeleteCriticalSection
WaitForSingleObject
InitOnceBeginInitialize
CompareStringOrdinal
ReleaseMutex
InitOnceComplete
GetComputerNameW
ExpandEnvironmentStringsA
GetModuleFileNameW
AreFileApisANSI
SearchPathW
GetFileAttributesW
SleepEx
LoadLibraryExA
LoadLibraryA
CreateMutexW
InitializeCriticalSection
IsWow64Process
Wow64DisableWow64FsRedirection
SizeofResource
LockResource
Wow64RevertWow64FsRedirection
SetEvent
ResetEvent
GetFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
TermsrvDeleteKey
TermsrvOpenUserClasses
ReadProcessMemory
DecodePointer
LoadLibraryW
DuplicateHandle
FreeLibraryAndExitThread
EncodePointer
FreeLibraryWhenCallbackReturns
CloseThreadpoolIo
CancelIoEx
CancelThreadpoolIo
CreateThreadpoolIo
DeviceIoControl
StartThreadpoolIo
GetFileMUIPath
EnumUILanguagesW
SetErrorMode
RaiseException
SetFileInformationByHandle
CopyFileExW
FindClose
FindNextFileW
FindFirstFileExW
GetFileSize
SetLastError
rpcrt4
RpcBindingCreateW
RpcBindingBind
I_RpcSNCHOption
RpcSsDestroyClientContext
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall4
RpcExceptionFilter
UuidToStringW
UuidFromStringW
RpcBindingFromStringBindingW
RpcRaiseException
RpcStringBindingComposeW
RpcBindingSetAuthInfoA
RpcEpResolveBinding
I_RpcExceptionFilter
I_RpcMapWin32Status
RpcBindingSetAuthInfoW
api-ms-win-core-timezone-l1-1-0
GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
api-ms-win-security-audit-l1-1-1
AuditLookupSubCategoryNameW
AuditQuerySecurity
AuditSetPerUserPolicy
AuditEnumerateSubCategories
AuditQueryGlobalSaclW
AuditEnumerateCategories
AuditEnumeratePerUserPolicy
AuditLookupCategoryNameW
AuditSetGlobalSaclW
AuditSetSecurity
AuditQueryPerUserPolicy
api-ms-win-security-audit-l1-1-0
AuditFree
AuditSetSystemPolicy
AuditQuerySystemPolicy
AuditComputeEffectivePolicyBySid
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-pcw-l1-1-0
PcwEnumerateInstances
PcwCreateQuery
PcwAddQueryItem
PcwRemoveQueryItem
PcwSendNotification
PcwSendStatelessNotification
PcwCreateNotifier
PcwSetQueryItemUserData
PcwCollectData
A_SHAFinal
A_SHAInit
A_SHAUpdate
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConditionalAce
AddMandatoryAce
AddUsersToEncryptedFile
AddUsersToEncryptedFileEx
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
AuditComputeEffectivePolicyBySid
AuditComputeEffectivePolicyByToken
AuditEnumerateCategories
AuditEnumeratePerUserPolicy
AuditEnumerateSubCategories
AuditFree
AuditLookupCategoryGuidFromCategoryId
AuditLookupCategoryIdFromCategoryGuid
AuditLookupCategoryNameA
AuditLookupCategoryNameW
AuditLookupSubCategoryNameA
AuditLookupSubCategoryNameW
AuditQueryGlobalSaclA
AuditQueryGlobalSaclW
AuditQueryPerUserPolicy
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetGlobalSaclA
AuditSetGlobalSaclW
AuditSetPerUserPolicy
AuditSetSecurity
AuditSetSystemPolicy
BackupEventLogA
BackupEventLogW
BaseRegCloseKey
BaseRegCreateKey
BaseRegDeleteKeyEx
BaseRegDeleteValue
BaseRegFlushKey
BaseRegGetVersion
BaseRegLoadKey
BaseRegOpenKey
BaseRegRestoreKey
BaseRegSaveKeyEx
BaseRegSetKeySecurity
BaseRegSetValue
BaseRegUnLoadKey
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA
BuildTrusteeWithSidW
CancelOverlappedAccess
ChangeServiceConfig2A
ChangeServiceConfig2W
ChangeServiceConfigA
ChangeServiceConfigW
CheckForHiberboot
CheckTokenMembership
ClearEventLogA
ClearEventLogW
CloseCodeAuthzLevel
CloseEncryptedFileRaw
CloseEventLog
CloseServiceHandle
CloseThreadWaitChainSession
CloseTrace
CommandLineFromMsiDescriptor
ComputeAccessTokenFromCodeAuthzLevel
ControlService
ControlServiceExA
ControlServiceExW
ControlTraceA
ControlTraceW
ConvertAccessToSecurityDescriptorA
ConvertAccessToSecurityDescriptorW
ConvertSDToStringSDDomainW
ConvertSDToStringSDRootDomainA
ConvertSDToStringSDRootDomainW
ConvertSecurityDescriptorToAccessA
ConvertSecurityDescriptorToAccessNamedA
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
ConvertStringSDToSDDomainA
ConvertStringSDToSDDomainW
ConvertStringSDToSDRootDomainA
ConvertStringSDToSDRootDomainW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidA
ConvertStringSidToSidW
ConvertToAutoInheritPrivateObjectSecurity
CopySid
CreateCodeAuthzLevel
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateRestrictedToken
CreateServiceA
CreateServiceEx
CreateServiceW
CreateTraceInstanceId
CreateWellKnownSid
CredBackupCredentials
CredDeleteA
CredDeleteW
CredEncryptAndMarshalBinaryBlob
CredEnumerateA
CredEnumerateW
CredFindBestCredentialA
CredFindBestCredentialW
CredFree
CredGetSessionTypes
CredGetTargetInfoA
CredGetTargetInfoW
CredIsMarshaledCredentialA
CredIsMarshaledCredentialW
CredIsProtectedA
CredIsProtectedW
CredMarshalCredentialA
CredMarshalCredentialW
CredProfileLoaded
CredProfileLoadedEx
CredProfileUnloaded
CredProtectA
CredProtectW
CredReadA
CredReadByTokenHandle
CredReadDomainCredentialsA
CredReadDomainCredentialsW
CredReadW
CredRenameA
CredRenameW
CredRestoreCredentials
CredUnmarshalCredentialA
CredUnmarshalCredentialW
CredUnprotectA
CredUnprotectW
CredWriteA
CredWriteDomainCredentialsA
CredWriteDomainCredentialsW
CredWriteW
CredpConvertCredential
CredpConvertOneCredentialSize
CredpConvertTargetInfo
CredpDecodeCredential
CredpEncodeCredential
CredpEncodeSecret
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
CveEventWrite
DecryptFileA
DecryptFileW
DeleteAce
DeleteService
DeregisterEventSource
DestroyPrivateObjectSecurity
DuplicateEncryptionInfoFile
DuplicateToken
DuplicateTokenEx
ElfBackupEventLogFileA
ElfBackupEventLogFileW
ElfChangeNotify
ElfClearEventLogFileA
ElfClearEventLogFileW
ElfCloseEventLog
ElfDeregisterEventSource
ElfFlushEventLog
ElfNumberOfRecords
ElfOldestRecord
ElfOpenBackupEventLogA
ElfOpenBackupEventLogW
ElfOpenEventLogA
ElfOpenEventLogW
ElfReadEventLogA
ElfReadEventLogW
ElfRegisterEventSourceA
ElfRegisterEventSourceW
ElfReportEventA
ElfReportEventAndSourceW
ElfReportEventW
EnableTrace
EnableTraceEx
EnableTraceEx2
EncryptFileA
EncryptFileW
EncryptedFileKeyInfo
EncryptionDisable
EnumDependentServicesA
EnumDependentServicesW
EnumDynamicTimeZoneInformation
EnumServiceGroupW
EnumServicesStatusA
EnumServicesStatusExA
EnumServicesStatusExW
EnumServicesStatusW
EnumerateTraceGuids
EnumerateTraceGuidsEx
EqualDomainSid
EqualPrefixSid
EqualSid
EventAccessControl
EventAccessQuery
EventAccessRemove
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEndScenario
EventWriteEx
EventWriteStartScenario
EventWriteString
EventWriteTransfer
FileEncryptionStatusA
FileEncryptionStatusW
FindFirstFreeAce
FlushEfsCache
FlushTraceA
FlushTraceW
FreeEncryptedFileKeyInfo
FreeEncryptedFileMetadata
FreeEncryptionCertificateHashList
FreeInheritedFromArray
FreeSid
GetAccessPermissionsForObjectA
GetAccessPermissionsForObjectW
GetAce
GetAclInformation
GetAuditedPermissionsFromAclA
GetAuditedPermissionsFromAclW
GetCurrentHwProfileA
GetCurrentHwProfileW
GetDynamicTimeZoneInformationEffectiveYears
GetEffectiveRightsFromAclA
GetEffectiveRightsFromAclW
GetEncryptedFileMetadata
GetEventLogInformation
GetExplicitEntriesFromAclA
GetExplicitEntriesFromAclW
GetFileSecurityA
GetFileSecurityW
GetInformationCodeAuthzLevelW
GetInformationCodeAuthzPolicyW
GetInheritanceSourceA
GetInheritanceSourceW
GetKernelObjectSecurity
GetLengthSid
GetLocalManagedApplicationData
GetLocalManagedApplications
GetManagedApplicationCategories
GetManagedApplications
GetMultipleTrusteeA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetMultipleTrusteeW
GetNamedSecurityInfoA
GetNamedSecurityInfoExA
GetNamedSecurityInfoExW
GetNamedSecurityInfoW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetOverlappedAccessResults
GetPrivateObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSecurityDescriptorSacl
GetSecurityInfo
GetSecurityInfoExA
GetSecurityInfoExW
GetServiceDisplayNameA
GetServiceDisplayNameW
GetServiceKeyNameA
GetServiceKeyNameW
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetStringConditionFromBinary
GetThreadWaitChain
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetTrusteeFormA
GetTrusteeFormW
GetTrusteeNameA
GetTrusteeNameW
GetTrusteeTypeA
GetTrusteeTypeW
GetUserNameA
GetUserNameW
GetWindowsAccountDomainSid
I_QueryTagInformation
I_ScGetCurrentGroupStateW
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterPreshutdownRestart
I_ScReparseServiceDatabase
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScValidatePnPService
IdentifyCodeAuthzLevelW
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
ImpersonateSelf
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
InitiateShutdownA
InitiateShutdownW
InitiateSystemShutdownA
InitiateSystemShutdownExA
InitiateSystemShutdownExW
InitiateSystemShutdownW
InstallApplication
IsTextUnicode
IsTokenRestricted
IsTokenUntrusted
IsValidAcl
IsValidRelativeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
IsWellKnownSid
LockServiceDatabase
LogonUserA
LogonUserExA
LogonUserExExW
LogonUserExW
LogonUserW
LookupAccountNameA
LookupAccountNameW
LookupAccountSidA
LookupAccountSidW
LookupPrivilegeDisplayNameA
LookupPrivilegeDisplayNameW
LookupPrivilegeNameA
LookupPrivilegeNameW
LookupPrivilegeValueA
LookupPrivilegeValueW
LookupSecurityDescriptorPartsA
LookupSecurityDescriptorPartsW
LsaAddAccountRights
LsaAddPrivilegesToAccount
LsaClearAuditLog
LsaClose
LsaCreateAccount
LsaCreateSecret
LsaCreateTrustedDomain
LsaCreateTrustedDomainEx
LsaDelete
LsaDeleteTrustedDomain
LsaEnumerateAccountRights
LsaEnumerateAccounts
LsaEnumerateAccountsWithUserRight
LsaEnumeratePrivileges
LsaEnumeratePrivilegesOfAccount
LsaEnumerateTrustedDomains
LsaEnumerateTrustedDomainsEx
LsaFreeMemory
LsaGetAppliedCAPIDs
LsaGetQuotasForAccount
LsaGetRemoteUserName
LsaGetSystemAccessAccount
LsaGetUserName
LsaICLookupNames
LsaICLookupNamesWithCreds
LsaICLookupSids
LsaICLookupSidsWithCreds
LsaInvokeTrustScanner
LsaLookupNames
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeName
LsaLookupPrivilegeValue
LsaLookupSids
LsaLookupSids2
LsaManageSidNameMapping
LsaNtStatusToWinError
LsaOpenAccount
LsaOpenPolicy
LsaOpenPolicySce
LsaOpenSecret
LsaOpenTrustedDomain
LsaOpenTrustedDomainByName
LsaQueryCAPs
LsaQueryDomainInformationPolicy
LsaQueryForestTrustInformation
LsaQueryForestTrustInformation2
LsaQueryInfoTrustedDomain
LsaQueryInformationPolicy
LsaQuerySecret
LsaQuerySecurityObject
LsaQueryTrustedDomainInfo
LsaQueryTrustedDomainInfoByName
LsaRemoveAccountRights
LsaRemovePrivilegesFromAccount
LsaRetrievePrivateData
LsaSetCAPs
LsaSetDomainInformationPolicy
LsaSetForestTrustInformation
LsaSetForestTrustInformation2
LsaSetInformationPolicy
LsaSetInformationTrustedDomain
LsaSetQuotasForAccount
LsaSetSecret
LsaSetSecurityObject
LsaSetSystemAccessAccount
LsaSetTrustedDomainInfoByName
LsaSetTrustedDomainInformation
LsaStorePrivateData
MD4Final
MD4Init
MD4Update
MD5Final
MD5Init
MD5Update
MIDL_user_free_Ext
MSChapSrvChangePassword
MSChapSrvChangePassword2
MakeAbsoluteSD
MakeAbsoluteSD2
MakeSelfRelativeSD
MapGenericMask
NotifyBootConfigStatus
NotifyChangeEventLog
NotifyServiceStatusChange
NotifyServiceStatusChangeA
NotifyServiceStatusChangeW
NpGetUserName
ObjectCloseAuditAlarmA
ObjectCloseAuditAlarmW
ObjectDeleteAuditAlarmA
ObjectDeleteAuditAlarmW
ObjectOpenAuditAlarmA
ObjectOpenAuditAlarmW
ObjectPrivilegeAuditAlarmA
ObjectPrivilegeAuditAlarmW
OpenBackupEventLogA
OpenBackupEventLogW
OpenEncryptedFileRawA
OpenEncryptedFileRawW
OpenEventLogA
OpenEventLogW
OpenProcessToken
OpenSCManagerA
OpenSCManagerW
OpenServiceA
OpenServiceW
OpenThreadToken
OpenThreadWaitChainSession
OpenTraceA
OpenTraceW
OperationEnd
OperationStart
PerfAddCounters
PerfCloseQueryHandle
PerfCreateInstance
PerfDecrementULongCounterValue
PerfDecrementULongLongCounterValue
PerfDeleteCounters
PerfDeleteInstance
PerfEnumerateCounterSet
PerfEnumerateCounterSetInstances
PerfIncrementULongCounterValue
PerfIncrementULongLongCounterValue
PerfOpenQueryHandle
PerfQueryCounterData
PerfQueryCounterInfo
PerfQueryCounterSetRegistrationInfo
PerfQueryInstance
PerfRegCloseKey
PerfRegEnumKey
PerfRegEnumValue
PerfRegQueryInfoKey
PerfRegQueryValue
PerfRegSetValue
PerfSetCounterRefValue
PerfSetCounterSetInfo
PerfSetULongCounterValue
PerfSetULongLongCounterValue
PerfStartProvider
PerfStartProviderEx
PerfStopProvider
PrivilegeCheck
PrivilegedServiceAuditAlarmA
PrivilegedServiceAuditAlarmW
ProcessIdleTasks
ProcessIdleTasksW
ProcessTrace
QueryAllTracesA
QueryAllTracesW
QueryLocalUserServiceName
QueryRecoveryAgentsOnEncryptedFile
QuerySecurityAccessMask
QueryServiceConfig2A
QueryServiceConfig2W
QueryServiceConfigA
QueryServiceConfigW
QueryServiceDynamicInformation
QueryServiceLockStatusA
QueryServiceLockStatusW
QueryServiceObjectSecurity
QueryServiceStatus
QueryServiceStatusEx
QueryTraceA
QueryTraceProcessingHandle
QueryTraceW
QueryUserServiceName
QueryUserServiceNameForContext
QueryUsersOnEncryptedFile
ReadEncryptedFileRaw
ReadEventLogA
ReadEventLogW
RegCloseKey
RegConnectRegistryA
RegConnectRegistryExA
RegConnectRegistryExW
RegConnectRegistryW
RegCopyTreeA
RegCopyTreeW
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyTransactedA
RegCreateKeyTransactedW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteKeyTransactedA
RegDeleteKeyTransactedW
RegDeleteKeyValueA
RegDeleteKeyValueW
RegDeleteKeyW
RegDeleteTreeA
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegDisablePredefinedCache
RegDisablePredefinedCacheEx
RegDisableReflectionKey
RegEnableReflectionKey
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegGetKeySecurity
RegGetValueA
RegGetValueW
RegLoadAppKeyA
RegLoadAppKeyW
RegLoadKeyA
RegLoadKeyW
RegLoadMUIStringA
RegLoadMUIStringW
RegNotifyChangeKeyValue
RegOpenCurrentUser
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyTransactedA
RegOpenKeyTransactedW
RegOpenKeyW
RegOpenUserClassesRoot
RegOverridePredefKey
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryMultipleValuesA
RegQueryMultipleValuesW
RegQueryReflectionKey
RegQueryValueA
RegQueryValueExA
RegQueryValueExW
RegQueryValueW
RegRenameKey
RegReplaceKeyA
RegReplaceKeyW
RegRestoreKeyA
RegRestoreKeyW
RegSaveKeyA
RegSaveKeyExA
RegSaveKeyExW
RegSaveKeyW
RegSetKeySecurity
RegSetKeyValueA
RegSetKeyValueW
RegSetValueA
RegSetValueExA
RegSetValueExW
RegSetValueW
RegUnLoadKeyA
RegUnLoadKeyW
RegisterEventSourceA
RegisterEventSourceW
RegisterIdleTask
RegisterServiceCtrlHandlerA
RegisterServiceCtrlHandlerExA
RegisterServiceCtrlHandlerExW
RegisterServiceCtrlHandlerW
RegisterTraceGuidsA
RegisterTraceGuidsW
RegisterWaitChainCOMCallback
RemoteRegEnumKeyWrapper
RemoteRegEnumValueWrapper
RemoteRegQueryInfoKeyWrapper
RemoteRegQueryMultipleValues2Wrapper
RemoteRegQueryMultipleValuesWrapper
RemoteRegQueryValueWrapper
RemoveTraceCallback
RemoveUsersFromEncryptedFile
ReportEventA
ReportEventW
RevertToSelf
SafeBaseRegGetKeySecurity
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
SaferGetLevelInformation
SaferGetPolicyInformation
SaferIdentifyLevel
SaferRecordEventLogEntry
SaferSetLevelInformation
SaferSetPolicyInformation
SaferiChangeRegistryScope
SaferiCompareTokenLevels
SaferiIsDllAllowed
SaferiIsExecutableFileType
SaferiPopulateDefaultsInRegistry
SaferiRecordEventLogEntry
SaferiSearchMatchingHashRules
SetAclInformation
SetEncryptedFileMetadata
SetEntriesInAccessListA
SetEntriesInAccessListW
SetEntriesInAclA
SetEntriesInAclW
SetEntriesInAuditListA
SetEntriesInAuditListW
SetFileSecurityA
SetFileSecurityW
SetInformationCodeAuthzLevelW
SetInformationCodeAuthzPolicyW
SetKernelObjectSecurity
SetNamedSecurityInfoA
SetNamedSecurityInfoExA
SetNamedSecurityInfoExW
SetNamedSecurityInfoW
SetPrivateObjectSecurity
SetPrivateObjectSecurityEx
SetSecurityAccessMask
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorRMControl
SetSecurityDescriptorSacl
SetSecurityInfo
SetSecurityInfoExA
SetSecurityInfoExW
SetServiceBits
SetServiceObjectSecurity
SetServiceStatus
SetThreadToken
SetTokenInformation
SetTraceCallback
SetUserFileEncryptionKey
SetUserFileEncryptionKeyEx
StartServiceA
StartServiceCtrlDispatcherA
StartServiceCtrlDispatcherW
StartServiceW
StartTraceA
StartTraceW
StopTraceA
StopTraceW
SystemFunction001
SystemFunction002
SystemFunction003
SystemFunction004
SystemFunction005
SystemFunction006
SystemFunction007
SystemFunction008
SystemFunction009
SystemFunction010
SystemFunction011
SystemFunction012
SystemFunction013
SystemFunction014
SystemFunction015
SystemFunction016
SystemFunction017
SystemFunction018
SystemFunction019
SystemFunction020
SystemFunction021
SystemFunction022
SystemFunction023
SystemFunction024
SystemFunction025
SystemFunction026
SystemFunction027
SystemFunction028
SystemFunction029
SystemFunction030
SystemFunction031
SystemFunction032
SystemFunction033
SystemFunction034
SystemFunction035
SystemFunction036
SystemFunction040
SystemFunction041
TraceEvent
TraceEventInstance
TraceMessage
TraceMessageVa
TraceQueryInformation
TraceSetInformation
TreeResetNamedSecurityInfoA
TreeResetNamedSecurityInfoW
TreeSetNamedSecurityInfoA
TreeSetNamedSecurityInfoW
TrusteeAccessToObjectA
TrusteeAccessToObjectW
UninstallApplication
UnlockServiceDatabase
UnregisterIdleTask
UnregisterTraceGuids
UpdateTraceA
UpdateTraceW
UsePinForEncryptedFilesA
UsePinForEncryptedFilesW
WaitServiceState
WmiCloseBlock
WmiDevInstToInstanceNameA
WmiDevInstToInstanceNameW
WmiEnumerateGuids
WmiExecuteMethodA
WmiExecuteMethodW
WmiFileHandleToInstanceNameA
WmiFileHandleToInstanceNameW
WmiFreeBuffer
WmiMofEnumerateResourcesA
WmiMofEnumerateResourcesW
WmiNotificationRegistrationA
WmiNotificationRegistrationW
WmiOpenBlock
WmiQueryAllDataA
WmiQueryAllDataMultipleA
WmiQueryAllDataMultipleW
WmiQueryAllDataW
WmiQueryGuidInformation
WmiQuerySingleInstanceA
WmiQuerySingleInstanceMultipleA
WmiQuerySingleInstanceMultipleW
WmiQuerySingleInstanceW
WmiReceiveNotificationsA
WmiReceiveNotificationsW
WmiSetSingleInstanceA
WmiSetSingleInstanceW
WmiSetSingleItemA
WmiSetSingleItemW
WriteEncryptedFileRaw
Name
.text
Size
428KB
Virtual Size
428KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=4, id=261, version=27412,
count=806, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=142, id=269, version=27412,
count=12, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/advapi32res.dll
- SHA256 b82b072342b08e2fb5fe97cb28a9c02289ad6ce501510f7e61eea0fd56297ee0
- MD5 5f0cba32090f0a295ff21949d1d81dc3
- SHA1 505fb000950d469ac57f208948061850732f933f
- SHA512 8980043af0ee746bd3e2b684580e9edd3b1c6525c22add8ac54270abfed740897eb6392661727b30bba125feec1dbd046d11748293c7dd1054795410c9a29403
- TLSH T198519D476BFC0A69F4FB0B7525FB0626623DBC248A71871C0940112E2C68A25DDB0F37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/advpack.dll
- IMPHASH 9b8a301a1aebca3289ff213fdcdbc165
- SHA256 634ca0884082eda73898f435cb0d8ce1e42eb2cf8c6299d962424a308edb2d43
- MD5 b02f760c49e0bb41ba24576e9e30130e
- SHA1 c7229043dee25455f7b87ff22985ef1729832779
- SHA512 2b7618cfdffd979e18d0255264c40288e616d9bcde8ee9e0030059aa27c8670bbe6e70496b7ad37c5f4ce46d68bef4e9ed9c3fed55e466cb510d7129ad42e50e
- SSDEEP 3072:NUcCdrEZyY755X5YTC81g6txQsfZtPrFv:EiyS5JYN1g6txQsfZt
- TLSH T115C33B02B6C091B6E67311306EAF623355B9FC311BAAD0CBD35096A774B16C0F936B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
103680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advpack.pdb
msvcrt
_except_handler4_common
_lock
_unlock
_setjmp3
__dllonexit
_onexit
iswalpha
wcschr
wcsncmp
memmove
_initterm
malloc
free
_amsg_exit
_XcptFilter
_ultow_s
longjmp
_wtoi
memcpy_s
_wtol
_vsnwprintf
_vsnprintf
memset
user32
ExitWindowsEx
IsWindow
SendDlgItemMessageW
PeekMessageW
LoadStringW
CharNextW
SystemParametersInfoW
CharPrevW
MessageBeep
MessageBoxW
DialogBoxParamW
GetDesktopWindow
SetWindowTextW
CharNextA
DestroyWindow
UpdateWindow
SetDlgItemTextW
EndDialog
EnableWindow
GetDlgItem
GetDlgItemTextW
SendMessageW
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
OemToCharA
CharUpperW
MsgWaitForMultipleObjects
DispatchMessageW
GetSystemMetrics
CreateDialogParamW
ShowWindow
gdi32
GetStockObject
DeleteObject
GetDeviceCaps
CreateFontIndirectW
kernel32
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
OutputDebugStringW
MulDiv
GetDiskFreeSpaceW
EnumResourceLanguagesW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
WaitForSingleObjectEx
OpenSemaphoreW
FindClose
GetLastError
LocalFree
GetDriveTypeW
GetEnvironmentVariableW
GetTempPathW
GetWindowsDirectoryW
GetTempFileNameW
FindResourceW
SizeofResource
LockResource
LoadResource
WritePrivateProfileStringW
CreateFileW
WriteFile
CloseHandle
LocalAlloc
SetFilePointer
GetModuleFileNameW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
LocalReAlloc
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetFullPathNameW
GetFileAttributesW
CompareStringW
FormatMessageW
GetPrivateProfileIntW
GetCurrentProcess
SearchPathW
GetPrivateProfileStringW
lstrcmpW
FreeLibrary
GetVersionExW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetShortPathNameW
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetFileSize
GetVolumeInformationW
CreateDirectoryW
SetFileAttributesW
CreateProcessW
CopyFileW
GetPrivateProfileSectionW
LoadLibraryW
CreateFileMappingW
MapViewOfFileEx
SetLastError
UnmapViewOfFile
MoveFileExW
MoveFileW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
GetCurrentProcessId
GetSystemInfo
HeapFree
GetProcessHeap
GetLocalTime
HeapAlloc
lstrcmpiA
GetProfileStringW
WritePrivateProfileSectionW
GetFileTime
ReadFile
SetFileTime
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
CreateMutexExW
advapi32
AllocateAndInitializeSid
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegSetValueExW
OpenProcessToken
RegSaveKeyW
RegFlushKey
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
GetTokenInformation
RegDeleteKeyW
EqualSid
FreeSid
RegQueryInfoKeyW
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
setupapi
SetupOpenInfFileW
SetupOpenAppendInfFileW
SetupInstallFromInfSectionW
SetupCloseFileQueue
SetupCommitFileQueueW
SetupQueueCopyW
SetupDefaultQueueCallbackW
SetupTermDefaultQueueCallback
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindNextLine
SetupFindFirstLineW
SetupGetLineTextW
SetupSetDirectoryIdW
SetupCloseInfFile
SetupInitDefaultQueueCallbackEx
shlwapi
StrChrW
ord217
StrStrIW
PathAddBackslashW
StrRChrW
PathRemoveFileSpecW
PathFileExistsW
PathBuildRootW
PathCombineW
ord215
AddDelBackupEntry
AddDelBackupEntryA
AddDelBackupEntryW
AdvInstallFile
AdvInstallFileA
AdvInstallFileW
CloseINFEngine
DelNode
DelNodeA
DelNodeRunDLL32
DelNodeRunDLL32A
DelNodeRunDLL32W
DelNodeW
DoInfInstall
DoInfInstallA
DoInfInstallW
ExecuteCab
ExecuteCabA
ExecuteCabW
ExtractFiles
ExtractFilesA
ExtractFilesW
FileSaveMarkNotExist
FileSaveMarkNotExistA
FileSaveMarkNotExistW
FileSaveRestore
FileSaveRestoreA
FileSaveRestoreOnINF
FileSaveRestoreOnINFA
FileSaveRestoreOnINFW
FileSaveRestoreW
GetVersionFromFile
GetVersionFromFileA
GetVersionFromFileEx
GetVersionFromFileExA
GetVersionFromFileExW
GetVersionFromFileW
IsNTAdmin
LaunchINFSection
LaunchINFSectionA
LaunchINFSectionEx
LaunchINFSectionExA
LaunchINFSectionExW
LaunchINFSectionW
NeedReboot
NeedRebootInit
OpenINFEngine
OpenINFEngineA
OpenINFEngineW
RebootCheckOnInstall
RebootCheckOnInstallA
RebootCheckOnInstallW
RegInstall
RegInstallA
RegInstallW
RegRestoreAll
RegRestoreAllA
RegRestoreAllW
RegSaveRestore
RegSaveRestoreA
RegSaveRestoreOnINF
RegSaveRestoreOnINFA
RegSaveRestoreOnINFW
RegSaveRestoreW
RegisterOCX
RegisterOCXW
RunSetupCommand
RunSetupCommandA
RunSetupCommandW
SetPerUserSecValues
SetPerUserSecValuesA
SetPerUserSecValuesW
TranslateInfString
TranslateInfStringA
TranslateInfStringEx
TranslateInfStringExA
TranslateInfStringExW
TranslateInfStringW
UserInstStubWrapper
UserInstStubWrapperA
UserInstStubWrapperW
UserUnInstStubWrapper
UserUnInstStubWrapperA
UserUnInstStubWrapperW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=27412,
count=2, id=259, version=27412,
count=222, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=1, id=256, version=27412,
count=24, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aeevts.dll
- SHA256 bd85c5996acce8a41494cd8170dcb9803fa1c9328880f5c1dcf9743d3103fe2a
- MD5 872819a6d8b9be5d7ab1afd09ffdff76
- SHA1 58091be7c1298d7580d36762a2afe24b3dd81a31
- SHA512 ba0c76788d9285d70109893a935e26df5991d7cf5d2d8b5c69201a6186cf941de5fe44421af4b9f7674afac76b9003a48268d191bc79ebce6098a3f732902c60
- SSDEEP 384:rWNTWFPQAI2mNCAvC8lNvp0JG9+gRheKOreJB1aLaGauaEMO9CilXZ:2IUeKnY
- TLSH T111D299116BFD830AF4F74F786AB992127A76FE1A5E15C18F6069471C2864BA0CD30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aepic.dll
- IMPHASH c990e4658a4455a089d0b841a7032fb0
- SHA256 8bf1b5d7cfdc3ff433a9d43c425b0d16723c79b647444b51fe5702d0948150c7
- MD5 75ba19eb28ca21fe67a882f129ae05b7
- SHA1 64b4ae1a30812170a8e5b7b3a9f1a2380e9d3873
- SHA512 c9d27d82c9838675498c10bf27c24ee0ea61ff275f57769e9a17bff93349400982eac8029a270fd9dc01faf7c416450bc65a2d0fe9e6489e14b19801d6700781
- SSDEEP 12288:crrClT+fv5OyjjklWZTOwUvGTSm4NNuMw6x4QrX0IFrwFg:crkqfvkW5UO2m4NNi6xeIFrwe
- TLSH T1EFB48E237A40C972D3BB7934395CA53F44ADB1304B64C0C797808B7AAEB5AD24936B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
110000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
aepic.pdb
msvcrt
wcscpy_s
wcscat_s
wcsstr
strncmp
_wcslwr
towlower
_wtoi
_wtoi64
iswspace
isspace
iscntrl
tolower
_vscwprintf
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
wcstombs
strnlen
wcstoul
wcsrchr
strcpy_s
wcschr
setlocale
memcpy
strerror
memmove
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
__pctype_func
_wcsnicmp
calloc
__crtLCMapStringW
___lc_collate_cp_func
__crtCompareStringW
memcmp
abort
__CxxFrameHandler3
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_vsnwprintf_s
strchr
_wsplitpath_s
_set_errno
strtol
_errno
strncpy_s
sprintf_s
realloc
free
malloc
_vsnprintf
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
_wcsicmp
_strnicmp
strrchr
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
_vsnwprintf
iswcntrl
memset
ntdll
RtlReleaseRelativeName
NtLoadKeyEx
RtlDosPathNameToRelativeNtPathName_U
RtlStringFromGUID
RtlRandomEx
NtQueryKey
RtlFreeSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlAdjustPrivilege
RtlImageDirectoryEntryToData
RtlVerifyVersionInfo
LdrResSearchResource
RtlTimeToTimeFields
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLeaveCriticalSection
NtQueryLicenseValue
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlEqualString
RtlDeleteCriticalSection
RtlSecondsSince1970ToTime
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
ZwClose
RtlInitializeCriticalSection
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
WinSqmIsOptedInEx
VerSetConditionMask
RtlGetVersion
EtwTraceMessage
rpcrt4
UuidCreate
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FreeLibraryAndExitThread
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
InitializeSRWLock
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSectionEx
ReleaseSRWLockShared
ReleaseMutex
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateMutexW
AcquireSRWLockShared
SetWaitableTimer
CreateMutexExW
InitializeCriticalSection
OpenWaitableTimerW
CreateEventExW
LeaveCriticalSection
CreateEventW
SetEvent
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
CallbackMayRunLong
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetThreadPriority
TlsAlloc
OpenProcessToken
ResumeThread
SetThreadPriority
GetCurrentThread
TlsSetValue
GetCurrentThreadId
TlsGetValue
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsStringHasEmbeddedNull
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount64
GetSystemDirectoryW
GetTickCount
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
LoadLibraryA
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
RoUninitialize
RoInitialize
api-ms-win-core-com-l1-1-0
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoUninitialize
CoMarshalInterface
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoGetCallContext
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
WakeAllConditionVariable
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
DuplicateTokenEx
GetTokenInformation
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
SetProcessReference
GetProcessReference
SHSetThreadRef
api-ms-win-core-realtime-l1-1-0
QueryThreadCycleTime
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-registry-l1-1-0
RegFlushKey
RegEnumKeyExW
RegDeleteTreeW
RegSetKeySecurity
RegSaveKeyExW
RegGetValueW
RegLoadAppKeyW
RegQueryInfoKeyW
RegDeleteKeyExW
RegLoadKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegUnLoadKeyW
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
SetNamedPipeHandleState
api-ms-win-core-file-l1-1-0
GetVolumeInformationByHandleW
FindClose
QueryDosDeviceW
GetLogicalDriveStringsW
GetLongPathNameW
WriteFile
GetTempFileNameW
CreateFileW
GetFileAttributesW
DeleteFileW
FindNextFileW
GetDriveTypeW
FindFirstFileW
GetFileTime
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
RegOpenKeyW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathUnExpandEnvStringsW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
GetCommandLineW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathAllocCombine
PathCchCanonicalizeEx
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-featurestaging-l1-1-0
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
GetFeatureEnabledState
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-shcore-path-l1-1-0
ord170
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
oleaut32
VariantChangeType
SysFreeString
VariantInit
SysAllocString
VariantCopy
VariantClear
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
CreateWaitableTimerW
WaitForMultipleObjects
bcrypt
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-security-cryptoapi-l1-1-0
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
QueryActCtxW
CreateActCtxW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
GetAppInventoryCore
GetPrivacyLevel
PicAmiClose
PicAmiInitialize
PicFreeFileInfo
PicRetrieveFileInfo
PicRetrieveFileInfoAppx
PicRetrieveFileLastRunTime
PicUpdateFileLastRunTime
UpdateSoftwareInventoryTC2
Name
.text
Size
444KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=120, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=423, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=17, id=261, version=27412,
count=28, id=260, version=27412,
count=1, id=256, version=27412,
count=62, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/agentactivationruntime.dll
- IMPHASH fea38e7ec5165a2455bcd69c35102a9d
- SHA256 3ed47ef5d2b28269f0e01208340d9f92038474c4222bee81c360e021356f8607
- MD5 e3d6a3b26c3e660ee7a5da7d8ef49d49
- SHA1 beb4fa726e051582ee5e79110db132ab5eda3940
- SHA512 665e8c8a68d93fd22b7c65661b80aabbe348d71b4bbf331fe01b99fa657d3e9c46b5cbf5386cbd0500e18bb56bcc80b197c0be88ab1bb149b3bd493fb94d2b29
- SSDEEP 12288:S/emTCy3zcQEXHvmzbCVgLFLzmHCUkXhr/Bo4Ap/5MOY0Nuv:Ke1jXHQlZzEIr2sOY0N0
- TLSH T13FE45D326984903AF02F9333755F85B994EC52F1079C8AF32ED29F6E29644C39638D76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
376896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
agentactivationruntime.pdb
msvcp_win
_Mtx_destroy_in_situ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Syserror_map@std@@YAPBDH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Cnd_broadcast
_Thrd_detach
_Cnd_timedwait
_Mtx_current_owns
_Xtime_get_ticks
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
_Thrd_sleep
_Query_perf_frequency
_Cnd_destroy_in_situ
_Thrd_join
_Thrd_id
_Cnd_wait
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Cnd_signal
?_Xlength_error@std@@YAXPBD@Z
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
__RTDynamicCast
_o__register_onexit_function
_o__seh_filter_dll
_o__wfopen
_o__wgetenv
_o_ceil
_o_cos
_o_exp
_o_fclose
_o_fread
_o_free
_o_fseek
_o_ftell
_o_log
_o_malloc
_o_rewind
_o_sin
_o_sqrt
_o_terminate
_o_toupper
_o_towlower
_o_wcstol
_except_handler4_common
_CxxThrowException
__std_terminate
__std_type_info_compare
__CxxFrameHandler3
memchr
memcmp
memcpy
memmove
strchr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
CreateEventW
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
SetEvent
WaitForSingleObject
ResetEvent
AcquireSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
agentactivationruntimewindows
?GetAgentActivationRuntimePalComponentFactory@@YGPAVIAgentActivationRuntimePalComponentFactory@VoiceAgentServices@Microsoft@@XZ
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchAddBackslash
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-file-l1-1-0
ReadFile
GetFileSizeEx
api-ms-win-core-file-l1-2-0
CreateFile2
?CreateAgentActivationRuntime@@YG?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
?GetAgentActivationRuntime@@YG?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
?GetLoggerInstance@@YGAAVLogger@VoiceAgentServices@Microsoft@@XZ
?ReleaseAgentActivationRuntime@@YGXXZ
Name
.text
Size
593KB
Virtual Size
593KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=261, version=27043,
count=1, id=260, version=27043,
count=4, id=261, version=27042,
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=11, id=260, version=27412,
count=1227, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=29, id=265, version=27412,
count=25, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/agentactivationruntimewindows.dll
- IMPHASH 79cd7fa2afbf54bcfa34c594bafd859e
- SHA256 8a083fc02aa921da3fd0db353533bbe5947728107aff7c2fb68e80ac3bd552d9
- MD5 1f0b38bc47d7139949fa264850223c57
- SHA1 8fb509aa8a3b1376a47d17f79abea1c81ccea06e
- SHA512 a991e0a981eceb29885ffcf85afc6b7b5cfad9df0bed4ede41facfbca39b84c9d5f9b15468a83c99e7f50572b34e1e39d90b51e3c9eef77a01f20cb54edafef3
- SSDEEP 12288:QfcUwoMEgY8d94TCLsRV0pB9wC7wi5fsII7acIXQXBAqLNGNl56ZN:vwi5fsIfcIgXBAqJGAZN
- TLSH T1BFD45C263BE44077E12F2332280E57B59069F5720FF446E73E949B2F2E755C28931A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
462336
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
agentactivationruntimewindows.pdb
msvcp_win
_Cnd_do_broadcast_at_thread_exit
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
_Cnd_timedwait
_Mtx_current_owns
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
_Cnd_wait
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_signal
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Thrd_join
_Thrd_id
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPBDH@Z
_Xtime_get_ticks
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?uncaught_exception@std@@YA_NXZ
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fseeki64
_o__get_stream_buffer_pointers
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___std_exception_destroy
memmove
_o__unlock_file
_o__wcsnicmp
_o__wdupenv_s
_o__wgetenv
_o__wrename
_o_ceil
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_floor
_o_fputc
_o_fputwc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_toupper
_o_ungetc
_o_ungetwc
_o_wcstol
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vsprintf_s
_o___std_exception_copy
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
__RTDynamicCast
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexW
AcquireSRWLockShared
ReleaseSRWLockShared
ResetEvent
InitializeSRWLock
CreateEventExW
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
CreateEventW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSemaphore
SetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapSize
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
TerminateProcess
GetExitCodeThread
SetThreadPriority
SetPriorityClass
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
TerminateThread
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
FormatMessageW
ResolveLocaleName
GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysFreeString
SysAllocString
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-com-l1-1-0
IIDFromString
CoTaskMemAlloc
PropVariantClear
CoGetApartmentType
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeSecurity
StringFromGUID2
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegNotifyChangeKeyValue
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteTreeW
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
DestroyPrivateObjectSecurity
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
GetTokenInformation
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegCreateKeyW
RegEnumKeyW
RegDeleteKeyW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
mmdevapi
ord27
ord21
ord17
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-power-base-l1-1-0
PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification
GetPwrCapabilities
api-ms-win-power-setting-l1-1-0
PowerReadDCValue
PowerSettingRegisterNotification
PowerGetActiveScheme
PowerSettingUnregisterNotification
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
GlobalAlloc
GlobalFree
powrprof
PowerReadACValueIndex
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData
RtlPublishWnfStateData
RtlQueryWnfStateData
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
umpdc
PdcSignalClientRegister
Pdcv2ActivationClientDeactivate
PdcSignalClientPulse
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
PdcSignalClientUnregister
Pdcv2ActivationClientRegister
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
systemeventsbrokerclient
SebQueryEventPackage
SebSignalEvent
SebEnumerateEventsByType
rpcrt4
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall2
RpcStringFreeW
RpcBindingFree
api-ms-win-core-file-l1-1-0
DeleteFileW
CreateDirectoryW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
?GetAgentActivationRuntimePalComponentFactory@@YGPAVIAgentActivationRuntimePalComponentFactory@VoiceAgentServices@Microsoft@@XZ
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=96, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=27412,
count=14, id=260, version=27412,
count=1475, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=1, id=256, version=27412,
count=65, id=265, version=27412,
count=29, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/altspace.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 25d17dc8589352b7e38ccf293155ac9dfdae5c5703ac092762a4b872a28eb369
- MD5 970a473e7d246d3ad2f7a9e411b498bb
- SHA1 bd36e063de63ac18e9a18fd895aa9e13374bf8fd
- SHA512 5841a2dfd58cad97b70250cb4ca81e25e4fea0933600bb0266016fd8f6f1c23170eb66924dab8791f1143c3dcc0cb6a0a9f02b414e29791f9c353de0e5265bb4
- SSDEEP 1536:fHYa4LgpIhR7GOoXzP015ULiegPsFxBNUYEeJzWCoHTQD/4BAnIHrRX1NfKwan23:fUKEjoL/iKxbUYPtVoHTcAmY
- TLSH T114F354C15F18C868DC999231F0F61A371B7192493916D3D51BB288F7E9BA38A431A3F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
168754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
altspace.pdb
mscoree
_CorDllMain
Name
.text
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
apt/SysWOW64/amsi.dll
- IMPHASH 5d28867d6e8659cb14adcce290ab3709
- SHA256 78250252f016973a2255f8d9aa19fdae424154634a005960196479233a13345a
- MD5 510480f044b3640a83514c7881ccd7c8
- SHA1 ab2cb8df729d3500b54c3f0592e704963b46d114
- SHA512 4a6eeb317ff42484d2816e9a8765bf4f248a837d1ae6f1d94dc266318808d6e4921a89b1e95d71f01cd6f24576aa67d9c31c7f1af63d2744113a93a4a100dcf3
- SSDEEP 1536:gMW+12s234qIPUcYI+NLhnPWPr/b2v1DhCsAl9BhvsnDCHg+UReGrzMKNLEBjwTa:ZW+z23pu+N9PWPr/b2vOFl9BhUnDCHg4
- TLSH T1C2734B12BBC44671C6FF223D2D2AA67583BF74B08FE056C76A2047AEAC706C15D7524E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
56256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Amsi.pdb
msvcrt
memcpy_s
memmove
srand
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
rand
memmove_s
_purecall
_vsnprintf_s
memcmp
wcsnlen
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
??0exception@@QAE@XZ
_lock
?terminate@@YAXXZ
_except_handler4_common
??3@YAXPAX@Z
_vsnwprintf
_initterm
_amsg_exit
??_V@YAXPAX@Z
_XcptFilter
__CxxFrameHandler3
malloc
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
free
time
memset
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
DeleteCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventProviderEnabled
EventRegister
EventUnregister
EventWriteTransfer
EventWrite
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
rpcrt4
UuidFromStringW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
NtQueryInformationProcess
AmsiCloseSession
AmsiInitialize
AmsiOpenSession
AmsiScanBuffer
AmsiScanString
AmsiUacInitialize
AmsiUacScan
AmsiUacUninitialize
AmsiUninitialize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=16, id=260, version=27412,
count=139, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=8, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/amstream.dll
- IMPHASH 590513b8f79a95d59b42f432383613b7
- SHA256 b79c6e7e11a09b00e6ca82431e3d540fdae6ae7b26ea9379d9455b9079f6d3f8
- MD5 33edc3623069bc43b8d2535bfa9c2986
- SHA1 5e8de2b7d6fd5dfddb77fb776db5ec462b5013d9
- SHA512 97f8dabb80da6e4d7f6031af766fbe48129edae0a08fa808e21e6c25a9185d034f1a502ce1d08d202dbc83079ea45e1054fadadbb28f22689b7ec9b94ed340ee
- SSDEEP 1536:/dU7/5Bhm7TAfeOhjFVxEslHyH5kuAbzPftb7bLAbZbNumSbeZpy5BgKbAP95b1p:i7/5YOhZIslTuNlFPVXqP00KIkOPW5Aw
- TLSH T15F73E51926485A6DC9F322B2052FB1B093AEC471233242CB73149BD6BE447E15EFD6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
65712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
amstream.pdb
msvcrt
_vsnwprintf
memcmp
memcpy
realloc
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_purecall
malloc
free
memset
kernel32
GetModuleHandleW
FreeLibrary
lstrcpyW
lstrcmpiW
HeapDestroy
DisableThreadLibraryCalls
CreateEventW
SetEvent
ResetEvent
lstrcmpW
Sleep
ReleaseSRWLockExclusive
DeleteCriticalSection
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
MulDiv
ReleaseSemaphore
CreateSemaphoreW
FindResourceW
QueueUserAPC
CreateThread
LoadResource
LoadLibraryW
AcquireSRWLockExclusive
GetProcAddress
CloseHandle
GetCurrentThread
GetLastError
MultiByteToWideChar
GetCurrentThreadId
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
lstrcpynW
GetCurrentProcess
EnterCriticalSection
SizeofResource
LoadLibraryExW
DuplicateHandle
user32
IsRectEmpty
CharNextW
advapi32
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
oleaut32
LoadTypeLi
SysFreeString
RegisterTypeLi
VarI4FromStr
ddraw
DirectDrawCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=20, id=260, version=27412,
count=154, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=15, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/apds.dll
- IMPHASH 02b67b6e176ff613ee8b25b6f803728a
- SHA256 0378e195e985212f99b7b8047fbcb70a5e1da8e20aa69c003c2ca95a4806da97
- MD5 53d5f2722c2b19907e247056011db186
- SHA1 be76f7e4c1d23bef1091ab00477a4603305af075
- SHA512 e6c4ce0d2b756c08b11dd2d40a4aad9b6a75a508c2578a0b25e277c6577188e5930a5086eea0692a626bfc7a8d85753fcc08c9492271d2690e5fc4a935cc10bf
- SSDEEP 3072:SLcfcjZgWQzZXP/HG6R0ge/iAKg0EUmY4Dfm/AwWhhRLY:SlrQzZXHHG6R03iAKg0EUmY4K/Aw+hR
- TLSH T179144A107662C1BAE1772235296E92ACFBF9B0364F114387366C63AD1F309C45D74BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
86112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
apds.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__strtoui64
_o__ui64toa_s
_o__wcsicmp
_o__wcslwr_s
_o_calloc
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
wcschr
wcsstr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
kernel32
GetLocaleInfoEx
FindClose
FindFirstFileExW
FindNextFileW
DisableThreadLibraryCalls
DeleteCriticalSection
GlobalUnlock
EnterCriticalSection
LeaveCriticalSection
CreateFileW
GlobalSize
GlobalLock
FindResourceExW
LoadResource
LockResource
GetTempFileNameW
GetTempPathW
CloseHandle
RaiseException
GlobalAlloc
SizeofResource
GetModuleHandleW
FindResourceW
GetProductInfo
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetProcAddress
WriteFile
InitializeSListHead
GetLastError
GetVersionExW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
LoadLibraryW
LocalAlloc
LocalFree
ExpandEnvironmentStringsW
MultiByteToWideChar
lstrcmpiW
FreeLibrary
GetWindowsDirectoryW
InitializeCriticalSection
LoadLibraryExW
GetModuleFileNameW
user32
UnregisterClassA
CharNextW
advapi32
RegisterTraceGuidsW
GetTraceEnableFlags
RegOpenKeyW
TraceEvent
GetTraceLoggerHandle
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
UnregisterTraceGuids
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetTraceEnableLevel
oleaut32
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadRegTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayCreate
SafeArrayUnlock
SafeArrayLock
SysAllocStringLen
VarBstrCat
VarUI4FromStr
VariantClear
shlwapi
ord12
SHCreateStreamOnFileEx
AssocQueryStringW
SHRegGetValueW
PathFileExistsW
PathFindExtensionW
PathCombineW
PathAppendW
UrlUnescapeW
cabinet
ord20
ord22
ord23
ord21
api-ms-win-core-com-l1-1-0
GetHGlobalFromStream
CreateStreamOnHGlobal
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoTaskMemFree
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=1270, id=1, productName=Unmarked objects,
count=16, id=257, version=27412,
count=1, id=256, version=27412,
count=36, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/apphelp.dll
- IMPHASH 48212ae40fbe559a9a626b0808967d50
- SHA256 3743dcf98e5fe117d3e03f289208090997e6eb93745ae52df3f45077b2788cde
- MD5 2a73976f1b1334bf4f81b7b9bd5e75be
- SHA1 5f92e8feada7d9689941a711e4b248a848f04ad6
- SHA512 5f9fe15672a924cceb7658acd0c30e4dc9d9ccafe6b06fac1b6fa4a6df94cec6457dbaafcce6942bfb6b9dffc356f8a0c81305fa7c50461feed14da6aa39f261
- SSDEEP 12288:e0idGW5lq8mIoWJVukJrZBsQYRi9ixKWjVHO5z7:eGW5lBmfWJVVJrZrjiZVHO5z7
- TLSH T122D49F12B78C45A3C1FA21B12B965B7185ADE994073F40E712C04FED8C79BD12A37B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
246416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
apphelp.pdb
ntdll
RtlEqualSid
RtlGetDaclSecurityDescriptor
RtlIdentifierAuthoritySid
wcsncmp
RtlGetNtSystemRoot
EtwEventWriteNoRegistration
NtQueryAttributesFile
NtQueryObject
_wcsupr_s
RtlAddVectoredExceptionHandler
strcpy_s
_strlwr
strstr
_wcslwr
RtlInitAnsiString
RtlAllocateAndInitializeSid
RtlCheckTokenMembership
NtClose
strchr
sprintf_s
sscanf_s
LdrGetProcedureAddressEx
RtlInitString
RtlImageDirectoryEntryToData
LdrGetProcedureAddress
RtlLengthRequiredSid
NtOpenFile
NtQuerySecurityObject
RtlGetOwnerSecurityDescriptor
RtlCompareMemory
NtProtectVirtualMemory
RtlInitializeSRWLock
LdrEnumerateLoadedModules
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
ZwUnmapViewOfSection
RtlGUIDFromString
toupper
ZwCreateFile
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
ZwCreateKey
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
ZwQueryInformationToken
ZwMapViewOfSection
strncmp
ZwEnumerateKey
ZwOpenProcessToken
VerSetConditionMask
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlEqualString
RtlMultiByteToUnicodeN
RtlUnwind
RtlCreateServiceSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
_strnicmp
SbSelectProcedure
RtlNtStatusToDosError
NtQueryInformationProcess
strtok_s
LdrInitShimEngineDynamic
RtlAnsiStringToUnicodeString
RtlInitAnsiStringEx
RtlCaptureStackBackTrace
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlTryEnterCriticalSection
_vsnprintf
_stricmp
strrchr
RtlDeleteCriticalSection
RtlInitializeCriticalSection
LdrFindEntryForAddress
RtlWow64GetProcessMachines
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
ZwOpenKey
ZwSetValueKey
RtlUnicodeStringToInteger
ZwEnumerateValueKey
ZwQueryKey
_wtoi
RtlTimeToTimeFields
RtlSecondsSince1970ToTime
NtDeleteKey
NtSetInformationKey
NtCreateKey
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeString
RtlRunOnceExecuteOnce
RtlDosPathNameToNtPathName_U
ZwQuerySystemInformation
RtlGetVersion
NtDeleteValueKey
NtSetValueKey
RtlDoesFileExists_U
RtlCreateUnicodeString
NtQueryInformationFile
RtlGetFileMUIPath
_vscwprintf
wcscat_s
wcscpy_s
ZwClose
ZwQueryValueKey
wcschr
wcsspn
qsort
NtWriteFile
ZwQuerySystemTime
NtReadFile
RtlDestroyEnvironment
RtlReAllocateHeap
RtlSizeHeap
RtlSetEnvironmentVar
RtlCreateEnvironmentEx
NtCreateFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlGetFullPathName_UEx
RtlInitUnicodeString
swprintf_s
NtApphelpCacheControl
LdrGetDllHandle
atol
memmove
RtlCaptureContext
wcsrchr
EtwEventWrite
_vsnwprintf
_wcsnicmp
EtwEventUnregister
EtwEventEnabled
EtwEventRegister
_wcsicmp
LdrLoadDll
wcsstr
RtlExpandEnvironmentStrings_U
NtQueryValueKey
NtOpenKey
RtlFreeHeap
RtlFreeUnicodeString
RtlDuplicateUnicodeString
RtlStringFromGUID
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlAllocateHeap
RtlFormatCurrentUserKeyPath
RtlFreeSid
RtlInitUnicodeStringEx
memcmp
memcpy
memset
api-ms-win-core-appcompat-l1-1-1
BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess
api-ms-win-core-appcompat-l1-1-0
BaseFlushAppcompatCache
BaseIsAppcompatInfrastructureDisabled
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
WriteFile
DeleteFileW
GetDriveTypeW
CreateFileW
GetLongPathNameW
FindFirstFileW
GetFinalPathNameByHandleW
SetFilePointer
GetFileAttributesW
FindClose
FindNextFileW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-processthreads-l1-1-0
GetProcessTimes
ProcessIdToSessionId
CreateThread
CreateProcessW
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
kernel32
WaitNamedPipeW
GetOverlappedResult
CancelIo
LocalFree
LocalAlloc
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
PackageIdFromFullName
SetNamedPipeHandleState
GetPackageFullName
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
GetSecurityDescriptorDacl
api-ms-win-core-registry-l1-1-0
RegGetKeySecurity
RegCloseKey
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-synch-l1-1-0
OpenMutexW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
WaitForSingleObject
CreateWaitableTimerExW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadLibraryExW
LockResource
GetModuleHandleExW
LoadResource
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
SizeofResource
FreeLibrary
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-processenvironment-l1-1-0
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-localization-l1-2-0
VerLanguageNameW
IsDBCSLeadByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
AllowPermLayer
ApphelpCheckExe
ApphelpCheckIME
ApphelpCheckInstallShieldPackage
ApphelpCheckModule
ApphelpCheckMsiPackage
ApphelpCheckRunApp
ApphelpCheckRunAppEx
ApphelpCheckShellObject
ApphelpChpeModSettingsFromQueryResult
ApphelpCreateAppcompatData
ApphelpFixMsiPackage
ApphelpFixMsiPackageExe
ApphelpFreeFileAttributes
ApphelpGetFileAttributes
ApphelpGetMsiProperties
ApphelpGetNTVDMInfo
ApphelpGetShimDebugLevel
ApphelpIsPortMonAllowed
ApphelpParseModuleData
ApphelpQueryModuleData
ApphelpQueryModuleDataEx
ApphelpShowDialog
ApphelpUpdateCacheEntry
DWM8And16Bit_ChangeDisplaySettingsExW_CallOut
DWM8And16Bit_DirectDrawCreateEx_CallOut
DWM8And16Bit_DirectDrawCreate_CallOut
DWM8And16Bit_EnumDisplaySettingsExW_CallOut
DWM8And16Bit_IsShimApplied_CallOut
DWM8And16Bit_RestoreDisplayMode_CallOut
GetPermLayers
SE_AddHookset
SE_CALLBACK_AddHook
SE_CALLBACK_Lookup
SE_COM_AddHook
SE_COM_AddServer
SE_COM_HookInterface
SE_COM_HookObject
SE_COM_Lookup
SE_DllLoaded
SE_DllUnloaded
SE_DynamicShim
SE_GetHookAPIs
SE_GetMaxShimCount
SE_GetProcAddressForCaller
SE_GetProcAddressIgnoreIncExc
SE_GetProcAddressLoad
SE_GetShimCount
SE_GetShimId
SE_InitializeEngine
SE_InstallAfterInit
SE_InstallBeforeInit
SE_IsShimDll
SE_LdrEntryRemoved
SE_LdrResolveDllName
SE_LookupAddress
SE_LookupCaller
SE_ProcessDying
SE_ShimDPF
SE_ShimDllLoaded
SE_WINRT_AddHook
SE_WINRT_HookObject
SdbAddLayerTagRefToQuery
SdbApphelpNotify
SdbApphelpNotifyEx
SdbApphelpNotifyEx2
SdbBeginWriteListTag
SdbBuildCompatEnvVariables
SdbCloseApphelpInformation
SdbCloseDatabase
SdbCloseDatabaseWrite
SdbCloseLocalDatabase
SdbCommitIndexes
SdbCreateDatabase
SdbCreateHelpCenterURL
SdbCreateMsiTransformFile
SdbDeclareIndex
SdbDeletePermLayerKeys
SdbDumpSearchPathPartCaches
SdbEndWriteListTag
SdbEnumMsiTransforms
SdbEscapeApphelpURL
SdbFindCustomActionForPackage
SdbFindFirstDWORDIndexedTag
SdbFindFirstGUIDIndexedTag
SdbFindFirstMsiPackage
SdbFindFirstMsiPackage_Str
SdbFindFirstNamedTag
SdbFindFirstStringIndexedTag
SdbFindFirstTag
SdbFindFirstTagRef
SdbFindMsiPackageByID
SdbFindNextDWORDIndexedTag
SdbFindNextGUIDIndexedTag
SdbFindNextMsiPackage
SdbFindNextStringIndexedTag
SdbFindNextTag
SdbFindNextTagRef
SdbFormatAttribute
SdbFreeDatabaseInformation
SdbFreeFileAttributes
SdbFreeFileInfo
SdbFreeFlagInfo
SdbGUIDFromString
SdbGUIDToString
SdbGetAppCompatDataSize
SdbGetAppPatchDir
SdbGetBinaryTagData
SdbGetDatabaseGUID
SdbGetDatabaseID
SdbGetDatabaseInformation
SdbGetDatabaseInformationByName
SdbGetDatabaseMatch
SdbGetDatabaseVersion
SdbGetDllPath
SdbGetEntryFlags
SdbGetFileAttributes
SdbGetFileImageType
SdbGetFileImageTypeEx
SdbGetFileInfo
SdbGetFirstChild
SdbGetImageType
SdbGetIndex
SdbGetItemFromItemRef
SdbGetLayerName
SdbGetLayerTagRef
SdbGetLocalPDB
SdbGetMatchingExe
SdbGetMsiPackageInformation
SdbGetNamedLayer
SdbGetNextChild
SdbGetNthUserSdb
SdbGetPDBFromGUID
SdbGetPathCustomSdb
SdbGetPathSystemSdb
SdbGetPermLayerKeys
SdbGetShowDebugInfoOption
SdbGetShowDebugInfoOptionValue
SdbGetStandardDatabaseGUID
SdbGetStringTagPtr
SdbGetTagDataSize
SdbGetTagFromTagID
SdbGrabMatchingInfo
SdbGrabMatchingInfoEx
SdbInitDatabase
SdbInitDatabaseEx
SdbIsDbRuntimePlatformSupportedOnHost
SdbIsNullGUID
SdbIsStandardDatabase
SdbIsTagrefFromLocalDB
SdbIsTagrefFromMainDB
SdbLoadString
SdbMakeIndexKeyFromString
SdbOpenApphelpDetailsDatabase
SdbOpenApphelpDetailsDatabaseSP
SdbOpenApphelpInformation
SdbOpenApphelpInformationByID
SdbOpenApphelpResourceFile
SdbOpenDatabase
SdbOpenDbFromGuid
SdbOpenLocalDatabase
SdbPackAppCompatData
SdbQueryApphelpInformation
SdbQueryBlockUpgrade
SdbQueryContext
SdbQueryData
SdbQueryDataEx
SdbQueryDataExTagID
SdbQueryFlagInfo
SdbQueryFlagMask
SdbQueryName
SdbQueryReinstallUpgrade
SdbReadApphelpData
SdbReadApphelpDetailsData
SdbReadBYTETag
SdbReadBYTETagRef
SdbReadBinaryTag
SdbReadDWORDTag
SdbReadDWORDTagRef
SdbReadEntryInformation
SdbReadMsiTransformInfo
SdbReadPatchBits
SdbReadQWORDTag
SdbReadQWORDTagRef
SdbReadStringTag
SdbReadStringTagRef
SdbReadWORDTag
SdbReadWORDTagRef
SdbRegisterDatabase
SdbRegisterDatabaseEx
SdbReleaseDatabase
SdbReleaseMatchingExe
SdbResolveDatabase
SdbSetApphelpDebugParameters
SdbSetEntryFlags
SdbSetImageType
SdbSetPermLayerKeys
SdbShowApphelpDialog
SdbShowApphelpFromQuery
SdbStartIndexing
SdbStopIndexing
SdbStringDuplicate
SdbStringReplace
SdbStringReplaceArray
SdbTagIDToTagRef
SdbTagRefToTagID
SdbTagToString
SdbUnpackAppCompatData
SdbUnpackQueryResult
SdbUnregisterDatabase
SdbWriteBYTETag
SdbWriteBinaryTag
SdbWriteBinaryTagFromFile
SdbWriteDWORDTag
SdbWriteNULLTag
SdbWriteQWORDTag
SdbWriteStringRefTag
SdbWriteStringTag
SdbWriteStringTagDirect
SdbWriteWORDTag
SetPermLayerState
SetPermLayerStateEx
SetPermLayers
ShimDbgPrint
ShimDumpCache
ShimFlushCache
Name
.text
Size
509KB
Virtual Size
509KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27412,
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=27412,
count=277, id=1, productName=Unmarked objects,
count=6, id=259, version=27412,
count=9, id=260, version=27412,
count=1, id=256, version=27412,
count=73, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/appidapi.dll
- IMPHASH 4c5ffcf0cb839b744d0e9115e253a0ce
- SHA256 2827e2a738ad0337979739558e6da19a012dc91ecad863e594ff268f78e93575
- MD5 9803723f2be4fb990b88b3cc883731c0
- SHA1 fb7b51ba3aff0df9bde338a28efaafa5e9520454
- SHA512 34bdc8e091c6348d42699e7f21fe9c620d786b542dcc2542ef097a2d93d2fcc5e6a2720b3d13c58a488719fffa35a59b58ab4c35f6caca97a3d7aa4d57490fca
- SSDEEP 1536:SZWOik+pqC5ZflGtJmU32to/UdWxPwBs+zue0:SoqUtvf4PmU32twUm6q5
- TLSH T1ED436C11B79848F5E6F625702129D6B7697EAA720FE180C76742A20E2D703C3BE3535F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:41:d9:c4:44:fe:b6:4e:ee:69:1f:ba:a1:23:1b:75:0c:fa:fa:58:e8:24:1c:30:7d:37:86:93:aa:10:71:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b4:fb:80:08:44:05:d2:2d:fa:00:01:00:00:01:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
34128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
appidapi.pdb
msvcrt
??0exception@@QAE@ABV0@@Z
memcpy_s
memmove_s
__CxxFrameHandler3
wcscat_s
?what@exception@@UBEPBDXZ
wcsstr
_wtol
_vsnwprintf
iswspace
memmove
_except_handler4_common
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
memcpy
memcmp
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
malloc
_vsnprintf
??0exception@@QAE@ABQBD@Z
free
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-file-l1-1-0
DeleteFileW
ReadFile
GetFileSize
CreateFileW
WriteFile
GetFinalPathNameByHandleW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
crypt32
CryptSIPLoad
CertGetEnhancedKeyUsage
CertGetNameStringW
CryptSIPRetrieveSubjectGuidForCatalogFile
api-ms-win-core-synch-l1-2-0
Sleep
ntdll
RtlAllocateHeap
RtlFreeHeap
NtReadFile
NtWaitForSingleObject
NtQueryInformationFile
RtlUpcaseUnicodeString
RtlEqualUnicodeString
RtlInitializeSRWLock
RtlGetNtSystemRoot
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlCopyUnicodeString
NtOpenFile
NtClose
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtQueryObject
EtwTraceMessage
RtlPrefixUnicodeString
NtOpenKey
NtQueryValueKey
LdrResSearchResource
RtlCompareUnicodeString
NtDeviceIoControlFile
RtlNtStatusToDosErrorNoTeb
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlInitUnicodeString
RtlRunOnceExecuteOnce
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
NtQuerySystemInformation
advapi32
ord1000
srpapi
SrpIsAllowed
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AppIDConstructAppxAttributes
AppIDDecodeAttributeString
AppIDEncodeAttributeString
AppIDFreeAttributeString
AppIDGetAppxFileAttributes
AppIDGetFileAttributes
AppIDGetMsiVersionInfo
AppIDReleaseAppxFileAttributes
AppIDReleaseFileAttributes
CompareToSystemCIPolicy
UpdateSystemCIPolicy
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=13, id=260, version=27412,
count=173, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=19, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/appmgmts.dll
- IMPHASH a2b3373dade3c47b3e158eb11b9b189e
- SHA256 33fdeb1b5ba02f2fa61b0ed64421ba45f3bb43c125a171675019dd89b466427c
- MD5 396c20fa19413bc8cdedf690fa4b1a24
- SHA1 d5e112d6b2540685ea2f81814e5a139495b269c4
- SHA512 581ca319238bc8e0e6bfa442cf4e8e039ed6f8b565910db7faec0ccc4ef4833ffd77c598db90ea3aa15168c66787c6ae016faae68368ab05f4daee629b0fd95d
- SSDEEP 3072:kP+FKTWdSH/+O/bWhpsxLR6jGVWo9GJaeb+PdmcQ6iCl4L/FFNoA/XAs:MvHBTjxsiVEJaopcICl4L/FFNoA/Xt
- TLSH T1C3F36B51A7A16139E2B7657096AE73376CBDB9300B8454CBC3508AA5B9301F1BA7C33F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
140512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
appmgmts.pdb
msvcrt
_vsnwprintf
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsrchr
_purecall
wcschr
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
__CxxFrameHandler3
wcstoul
wcsncmp
_wcslwr
_wcsnicmp
_wcsicmp
swscanf
??0exception@@QAE@ABQBD@Z
memset
rpcrt4
RpcRaiseException
RpcStringFreeW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcServerInterfaceGroupClose
UuidFromStringW
RpcServerInterfaceGroupCreateW
RpcImpersonateClient
NdrServerCall2
RpcServerInterfaceGroupActivate
UuidCreate
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenProcessToken
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
CreateThread
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegOpenCurrentUser
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
GetAce
AllocateAndInitializeSid
GetLengthSid
SetFileSecurityW
RevertToSelf
DeleteAce
InitializeAcl
AddAccessAllowedAce
AddAccessAllowedAceEx
EqualSid
ImpersonateLoggedOnUser
CheckTokenMembership
InitializeSecurityDescriptor
DuplicateToken
SetSecurityDescriptorDacl
FreeSid
DuplicateTokenEx
GetTokenInformation
CopySid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
userenv
LeaveCriticalPolicySection
RsopAccessCheckByType
EnterCriticalPolicySection
ForceSyncFgPolicy
GetAppliedGPOListW
RsopSetPolicySettingStatus
RsopResetPolicySettingStatus
FreeGPOListW
api-ms-win-core-file-l1-1-0
DeleteFileW
WriteFile
SetFileAttributesW
GetFileAttributesExW
GetFileSize
SetEndOfFile
CreateFileW
SetFilePointer
ReadFile
FindFirstFileW
GetFullPathNameW
CreateDirectoryW
FindClose
GetFileAttributesW
CompareFileTime
FindNextFileW
ReadFileEx
RemoveDirectoryW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
ResetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
EnterCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
WaitForSingleObjectEx
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetLocalTime
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetSystemDefaultLangID
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
api-ms-win-service-core-l1-1-0
SetServiceStatus
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
ExpandEnvironmentStringsW
oleaut32
SysStringLen
SysFreeString
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
VariantInit
adsldpc
ADSIGetObjectAttributes
ADSISetSearchPreference
FreeADsMem
BuildADsParentPath
ADSIOpenDSObject
ADSIGetColumn
ADSIDeleteDSObject
ADSICreateDSObject
ADSIFreeColumn
ADSIGetNextRow
ADSIGetFirstRow
ADSISetObjectAttributes
ADSICloseSearchHandle
ADSIExecuteSearch
ADSICloseDSObject
ADsEncodeBinaryData
BuildADsPathFromParent
advapi32
GetUserNameW
RegEnumKeyW
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
ReportEventW
OpenEventLogW
CloseEventLog
RegDeleteKeyW
kernel32
lstrcmpW
GetComputerNameW
lstrcmpiW
MoveFileW
ntdll
RtlAdjustPrivilege
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlLeaveCriticalSection
RtlEnterCriticalSection
CsCreateClassStore
CsEnumApps
CsGetAppCategories
CsGetClassAccess
CsGetClassStore
CsGetClassStorePath
CsRegisterAppCategory
CsServerGetClassStore
CsSetOptions
CsUnregisterAppCategory
DllCanUnloadNow
DllGetClassObject
GenerateGroupPolicy
IID_IClassAdmin
ProcessGroupPolicyObjectsEx
ReleaseAppCategoryInfoList
ReleasePackageDetail
ReleasePackageInfo
ServiceMain
Name
.text
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=243, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=9, id=261, version=27412,
count=16, id=260, version=27412,
count=1, id=256, version=27412,
count=58, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/appmgr.dll
- IMPHASH 7138cb42ab2ac0d05d0db10a68e3cc75
- SHA256 9d56460d3776c7069a2f76802829c2d6d9cfc56999f8fcf174290a3ef8bae63b
- MD5 7111b2dfdb8605c3233819b2c87637f3
- SHA1 49aa3e8b137943d23738e45f9e461f83328015fd
- SHA512 869036fd1c5905b43f7efeda2faaccea3a96fedcc9d8ea1fe354429ad26c11d6b32f34546f22227e10e24acb90928375eac0e6bf1c8bb544691663e498a6ba00
- SSDEEP 6144:kVVKQRf2BlhthU45DDmxkJiao6Q0R9No0mNLn8:kVwB7HUGJiaov0RL+b8
- TLSH T13E847C2136819B79E26336360B1FFABB605FBDA14FD019CBB2447B7E29301C1993561B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
238128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
appmgr.pdb
mfc42u
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4370
ord5261
ord2293
ord5679
ord6211
ord4155
ord860
ord4124
ord941
ord4272
ord1899
ord489
ord768
ord1764
ord6362
ord2405
ord2016
ord4214
ord2573
ord6051
ord1768
ord4395
ord5286
ord3397
ord4418
ord3634
ord818
ord567
ord692
ord2294
ord4253
ord6024
ord4352
ord4829
ord5283
ord4848
ord4371
ord4942
ord4970
ord4736
ord4899
ord5154
ord5156
ord5155
ord4219
ord3871
ord2810
ord6195
ord927
ord2809
ord6466
ord2971
ord6451
ord2637
ord5949
ord2281
ord5798
ord3312
ord536
ord2755
ord6278
ord6219
ord6218
ord4197
ord2756
ord2606
ord4199
ord2574
ord4396
ord3365
ord3635
ord693
ord3991
ord925
ord3993
ord6898
ord6003
ord3281
ord3566
ord2385
ord2406
ord1560
ord268
ord3658
ord3621
ord1143
ord1634
ord547
ord2813
ord6279
ord1262
ord1258
ord561
ord815
ord3948
ord2717
ord1128
ord3733
ord4616
ord3396
ord5710
ord5285
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord3694
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord1165
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord535
ord823
ord6370
ord6330
ord940
ord942
ord538
ord3798
ord4847
ord5977
ord2859
ord2634
ord4195
ord2854
ord3087
ord4704
ord858
ord4229
ord2362
ord2350
ord861
ord800
ord540
ord641
ord324
ord537
ord825
msvcrt
memset
memcpy
realloc
_errno
memcmp
_ftol2_sse
__dllonexit
_unlock
_lock
_except_handler4_common
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
free
malloc
wcsncpy_s
wcsrchr
_wfopen
_vsnprintf_s
_purecall
fclose
fgetws
rewind
_fileno
_setmode
tmpfile
fwprintf
swscanf
wcsncmp
_vsnwprintf
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
??0exception@@QAE@ABV0@@Z
_wcsnicmp
_wcsicmp
__CxxFrameHandler3
_onexit
oleaut32
VariantClear
VarUI4FromStr
SysAllocString
VariantInit
SysStringLen
SysAllocStringLen
SysFreeString
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoCreateGuid
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoSetProxyBlanket
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
LocalFree
GlobalFree
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
GetModuleHandleA
GetModuleHandleW
LoadStringW
GetModuleFileNameW
GetProcAddress
FindResourceExW
GetModuleHandleExW
LoadLibraryExW
SizeofResource
LoadResource
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegOpenKeyExA
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-file-l1-1-0
DeleteFileW
FindFirstFileW
GetTempFileNameW
FindClose
CreateDirectoryW
WriteFile
SetFilePointer
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
logoncli
DsGetDcNameW
netutils
NetApiBufferFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
CreateMutexExW
ReleaseSemaphore
AcquireSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSection
ReleaseSRWLockShared
ReleaseMutex
api-ms-win-security-base-l1-1-0
IsValidSecurityDescriptor
GetSecurityDescriptorLength
MapGenericMask
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
mpr
WNetGetUniversalNameW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
aclui
ord1
advapi32
OpenEventLogW
ReportEventW
CloseEventLog
RegOpenKeyW
appmgmts
CsGetClassStorePath
CsGetClassStore
CsRegisterAppCategory
CsUnregisterAppCategory
CsGetAppCategories
ReleasePackageDetail
ReleasePackageInfo
CsCreateClassStore
CsServerGetClassStore
CsSetOptions
framedynos
?GetFILETIME@WBEMTime@@QBEHPAU_FILETIME@@@Z
??4WBEMTime@@QAEABV0@QAG@Z
gdi32
GetTextExtentPoint32W
gpedit
BrowseForGPO
kernel32
GetPrivateProfileStringW
MoveFileW
lstrcmpiW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
LoadLibraryExA
ExpandEnvironmentStringsA
msi
ord228
ord158
ord141
ord165
ord32
ord8
ord118
ord116
ord160
ord159
ord92
ord78
ord150
ord19
ole32
CoInitialize
CoUninitialize
shell32
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
DragQueryFileW
user32
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
SendMessageW
UnregisterClassA
GetActiveWindow
MessageBoxW
LoadBitmapW
LoadImageW
ReleaseDC
SetCursor
LoadCursorW
RegisterClipboardFormatW
GetParent
GetFocus
EnableWindow
GetDC
GetClientRect
DllCanUnloadNow
DllGetClassObject
GenerateScript
Name
.text
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=27412,
count=17, id=260, version=27412,
count=27, id=257, version=27412,
count=455, id=1, productName=Unmarked objects,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=48, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/apprepapi.dll
- IMPHASH 0b7424109505c3b9240a96c2e91871fe
- SHA256 afe04c513a6b177ec7b5203e68c50f277409d5e9b4c6fe540fd99b1a50095d8f
- MD5 f443d481301a2dd1c7f14c2d913bffe6
- SHA1 76c8c79c62fef3f08cd9de2f575875a7dcc6f478
- SHA512 6a28bcbc890b09891439bc1304320906261128c1dd73ec78b0e5825e4fa3bfc8c02a9d4975964e03149fb4b8cd34788df4960b21494faea2c8f3927e0adca01d
- SSDEEP 192:uFZTmhgFqfyBfTsiiqJNrjOXw+p7gL4EEkvaWn3WAPLpv:uF0xfsnjJNrjG5yL/vaWn3WAPLp
- TLSH T18122F842FBD14DA6EABE0B3A69E255364A2CFE205F6181D75FC1121E082D4D2BD30F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
apprepapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
AppRepComputeImageHash
AppRepComputeImageHashWithOffset
AppRepComputeSignatureInfo
AppRepFreeAttributeLib
AppRepInitializeAttributeLib
AppRepParameterCleanup
AppRepPartialTelemetryCleanup
RepGetFileInformation
RepInformUserAction
ReputationInfoCleanup
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1105, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=14, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/appwiz.cpl
- IMPHASH d6eaa37afb612238b553e61b472effb4
- SHA256 607708e4d98a260feb10de6d209525e96822955961e9a14d8f811adfdbdab2ac
- MD5 9d85388a53802da4ad9db300bf6f8048
- SHA1 0cb0d74c80dee1143fa3898eee9e1ef1277139b3
- SHA512 64ca588ca32ca98dc3fb1ccc7b3a2bc007be2ff7a83b94f89f31e287e9ec32388ddec061f3d95434300631e982929a97597b23fd3288579eda5305fd9b38c0ad
- SSDEEP 12288:kOhBcDxQ0JRUuI1xtPaSJSDgGjzMscjaE+sIo:13cDxQQRUuYxtPa0SDgGjo9jL+sIo
- TLSH T174A44B02FB488265E2D13430055FA76999ADAA738B1506CFA3448FF9BD707C65E3A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
68160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
appwiz.pdb
msvcrt
_ftol2_sse
??1type_info@@UAE@XZ
_vsnwprintf
?terminate@@YAXXZ
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_vsnprintf
_vsnprintf_s
memcmp
__CxxFrameHandler3
realloc
_errno
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
isdigit
vswprintf_s
_vscwprintf
wcsrchr
wcscpy_s
_wcslwr_s
wcsstr
free
malloc
wcsncpy_s
_wcsicmp
wcstoul
memmove_s
qsort
memcpy_s
towlower
memset
propsys
PSGetPropertyDescription
VariantToPropVariant
PSFormatForDisplay
PropVariantToStrRet
PropVariantToStringWithDefault
PropVariantToInt32WithDefault
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
PropVariantCompareEx
VariantToUInt64
PropVariantToVariant
PropVariantToUInt32WithDefault
VariantCompare
shcore
ord200
SHAnsiToUnicode
ord160
ord126
SHCreateMemStream
SHDeleteKeyW
IsOS
SHCreateThread
SHSetThreadRef
ord187
ord182
ord186
CommandLineToArgvW
ord193
SHCreateThreadRef
SetProcessReference
ord192
ord170
SHStrDupW
IUnknown_Set
SHQueryValueExW
ord190
IUnknown_QueryService
SHSetValueW
ord184
SHRegGetValueW
SHGetValueW
ord145
shell32
ord47
SHFileOperationW
ord709
SHGetStockIconInfo
SHGetSpecialFolderLocation
ord100
ord866
SHGetNameFromIDList
ord744
ord940
ord190
SHCreateItemFromIDList
ord28
ShellExecuteExW
SHGetKnownFolderPath
SHGetPathFromIDListW
ord196
SHBrowseForFolderW
SHParseDisplayName
ord63
ord180
ord51
ord173
ord147
ord13
ord10
ord9
SHEvaluateSystemCommandTemplate
ord6
AssocGetDetailsOfPropKey
SHCreateDefaultContextMenu
ord256
ord763
SHChangeNotify
ShellExecuteW
ord730
SHGetFileInfoW
ord152
ord21
SHBindToFolderIDListParentEx
ord25
ord19
ord18
ord155
SHBindToParent
ord680
ord171
shlwapi
PathStripToRootW
ord191
StrCmpNIW
PathRemoveBackslashW
ord236
PathCombineW
StrCmpNW
PathFindFileNameW
PathIsRootW
PathGetArgsW
ord156
PathRemoveBlanksW
PathIsPrefixW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindExtensionW
PathQuoteSpacesW
SHAutoComplete
StrToIntW
PathParseIconLocationW
AssocCreate
ord388
ord460
ord157
ord158
StrDupW
PathFileExistsW
PathIsRelativeW
PathRemoveArgsW
StrChrW
PathIsUNCW
ord219
PathUnquoteSpacesW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
FindResourceExW
LoadResource
SizeofResource
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
LoadLibraryExA
LockResource
FreeLibrary
LoadStringW
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
CreateMutexW
OpenSemaphoreW
SetEvent
InitializeCriticalSectionEx
CreateMutexExW
CreateEventW
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapAlloc
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
SetThreadPriority
GetCurrentProcess
OpenProcessToken
ResumeThread
GetExitCodeProcess
CreateProcessW
GetExitCodeThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
SysAllocStringByteLen
SystemTimeToVariantTime
VariantTimeToSystemTime
rpcrt4
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrOleFree
IUnknown_QueryInterface_Proxy
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegDeleteValueW
RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalFree
LocalFree
LocalReAlloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventRegister
api-ms-win-core-com-l1-1-0
CoMarshalInterface
CoUnmarshalInterface
CreateStreamOnHGlobal
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
StringFromGUID2
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
CoWaitForMultipleHandles
CoGetApartmentType
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetTickCount
GetSystemWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-file-l1-1-0
FindClose
FindFirstFileW
WriteFile
CompareFileTime
FindNextFileW
GetDriveTypeW
GetDiskFreeSpaceExW
CreateFileW
DeleteFileW
FileTimeToLocalFileTime
CreateDirectoryW
api-ms-win-core-timezone-l1-1-0
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformationForYear
api-ms-win-core-io-l1-1-0
CreateIoCompletionPort
GetQueuedCompletionStatus
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
HSTRING_UserUnmarshal
HSTRING_UserFree
WindowsCreateString
WindowsDeleteString
HSTRING_UserMarshal
WindowsCompareStringOrdinal
WindowsCreateStringReference
HSTRING_UserSize
WindowsDuplicateString
api-ms-win-core-string-l2-1-0
CharNextW
IsCharAlphaNumericW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
OpenProcess
FlushInstructionCache
IsProcessorFeaturePresent
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient4
ObjectStublessClient3
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction3
ObjectStublessClient6
CStdStubBuffer2_Disconnect
ObjectStublessClient7
NdrProxyForwardingFunction5
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
osbaseln
OpenOsBaseline
CloseOsBaseline
GetOsInstalledComponentInfoW
GetOsBaselineComponentInfoW
advapi32
RegEnumKeyW
InstallApplication
GetManagedApplications
GetLocalManagedApplicationData
RegQueryValueW
kernel32
lstrcmpW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
lstrlenW
CreateActCtxW
MoveFileW
VerifyVersionInfoW
GetActiveProcessorCount
lstrcmpiW
SetTermsrvAppInstallMode
TermsrvAppInstallMode
MulDiv
SetInformationJobObject
QueryInformationJobObject
AssignProcessToJobObject
CreateJobObjectW
GetUserDefaultUILanguage
msi
ord45
ord201
ord141
ord70
ord244
ord113
ord16
ord131
ord173
ord215
ord92
ord78
ord150
ord8
ord270
ord238
ntdll
WinSqmAddToStream
NtSetInformationProcess
EtwCheckCoverage
WinSqmStartSession
WinSqmEndSession
WinSqmSetDWORD
WinSqmSetString
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
EtwTraceMessage
EtwEventWriteTransfer
WinSqmAddToStreamEx
ole32
CoInitialize
CoGetObject
HWND_UserUnmarshal
HWND_UserFree
HWND_UserSize
HWND_UserMarshal
user32
DestroyWindow
LoadIconW
SetRect
SetMenuDefaultItem
MessageBoxW
GetWindowLongW
AdjustWindowRect
AllowSetForegroundWindow
SendDlgItemMessageW
GetSysColor
ExitWindowsEx
GetDlgItem
GetWindowThreadProcessId
GetSystemMetrics
SetTimer
KillTimer
LockWindowUpdate
SystemParametersInfoW
ReleaseDC
GetDC
DispatchMessageW
TranslateMessage
GetMessageW
DestroyIcon
LoadCursorW
RegisterClassW
GetWindowRect
SendMessageW
PostMessageW
GetCursorPos
SwitchToThisWindow
GetWindowTextLengthW
DialogBoxParamW
GetParent
EndDialog
InsertMenuW
CreateWindowExW
GetWindow
GetLastActivePopup
FindWindowW
SetDlgItemTextW
GetFocus
SetWindowPos
CallWindowProcW
GetSysColorBrush
SetThreadDpiAwarenessContext
SetForegroundWindow
ShowWindow
GetDpiForSystem
EnableWindow
SetWindowTextW
IsWindowVisible
GetDlgItemTextW
SetCursor
GetActiveWindow
ChangeWindowMessageFilterEx
RegisterWindowMessageW
IntersectRect
GetMonitorInfoW
MonitorFromPoint
SetFocus
SetWindowLongW
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
UnregisterClassA
UnregisterClassW
GetClassNameW
DefWindowProcW
duser
InvalidateGadget
SetGadgetStyle
gdi32
GetTextExtentPointW
GdiGradientFill
SelectObject
DeleteObject
GetStockObject
GetObjectW
GetDeviceCaps
GetTextMetricsW
CreateFontIndirectW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ConfigStartMenu
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllGetVersion
GetProgramsOnline
NewLinkHereW
RunFODW
RunOCMW
RunSPADW
Name
.text
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=260, version=27412,
count=905, id=1, productName=Unmarked objects,
count=31, id=257, version=27412,
count=8, id=261, version=27412,
count=4, id=259, version=27412,
count=1, id=256, version=27412,
count=84, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/appwiz.cpl.mun
- SHA256 d561be96e0958425d827d3c9f46dd8bb3b617a669a4ef283c870bad45524d410
- MD5 ca44d18a77aa43a124fa566c619bc5e4
- SHA1 6189a89d6c4de1132a914b3e07ca72c636e8eb9c
- SHA512 b68cc4143a71e4dd3084f3edd86b69f2fce3cfc0507875c655c4a6ed9d8e41f0b9323d957462efab321b825f84ee870ab77e47a859ddda60978e57840faed7c9
- SSDEEP 6144:jBpxyN90vE8zgthRmLgWpxyN90vEdaGZU:Vy90sRmRy90MaG
- TLSH T12884BE5173629CA2C4AE4332E5038F750EF1BC25ED21052A36F3BE1F3C72A51A9EA557
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
380KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ar-SA/SyncRes.dll.mui
- SHA256 0607d1c7fdf275cc875822d76490f83fb93104f4d47eccaece63a06c0217b3a2
- MD5 5f23e7aaa58d1c11d59ae185fd25e435
- SHA1 2c438327cc045c5bfd4d9d53982f74fadefedcb6
- SHA512 174b22ecf9a99b39ae2317f3f49a7ee7cf36b1a3cc33235aa7fce3f1293678531f9671a97182b87a05b7065cb021c87aa68d6a227ecae21da12f200d90cf794f
- SSDEEP 384:pntmRmN1ddXWT7OMO0Mo3sSCrYz/Gdu4KfET14ZRWWFW6:ZIRmN1dds7OMO0Mo3P9z/pfE4bL
- TLSH T1A5B2DA111D9CC23CE5D76778C217C6A3526C009A9CCD323B5A788B1819E4136EBDFAFA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ar-SA/cdosys.dll.mui
- SHA256 37e5d8f1d96c01f369267aa46660d8bdb5935ecdb9bd051cad736488c72391fe
- MD5 aa44d7f5f7eb8fba5425f4a867cc2823
- SHA1 fe79c2901931972328ce4014b417eaef262ddf51
- SHA512 f16ebd0dc4b43990dc13e0dd2ca2735030a35a0368645ba0b1b2fe2bee2e70a95e7578dc66858b74e30676ce95bad369a15f7ce48167179d2adc70bc97114925
- SSDEEP 768:mRoJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjf9e8BVYhIAAInmVLHPSyzik:jJ6ivyUcEsx7fNXjTV8PszW7yYsznPy6
- TLSH T1AA23F31257FEC628F0F37B38D8B691B31A357C92E87CE26C01A4421D19B1E558D66BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ar-SA/comctl32.dll.mui
- SHA256 7caac140711dc7a2009dafacc87abd65a5b504685043f48f19e6721e64d69e3d
- MD5 bc68c4e3186ba7dc52a95410783b5b37
- SHA1 767918ff80b6c6277fd20d7522644162775e5f03
- SHA512 1ab65a2f2975ddf4795b631e7832d702a580e2c72ee0ac1ee61cbb5918abcb93a52f42d16536a865fff8e409d78840bd8b887ed59b5bd9149fa6581e026ab809
- SSDEEP 48:yT5PaqmsopGTLj4U0ntO05rdqReC4epMpKcWdS4yQWSeA7C1ERR2SlQiu4HZW6i6:SaOfD/eC/pMpQShQWWhR2Sl4sWutWwr
- TLSH T15EC1FF019B5AD53AF0575634C693C383377ED813AACA233FCF608A1820616789D6EEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ar-SA/quickassist.exe.mui
- SHA256 bae3e64df9e167cf8baeda5e557cc68c63cdee39f00d8bceb8146509d996ae4b
- MD5 d3f7567a4cd66c27b959f64f98aac29f
- SHA1 ef18d9737efc6666929d94754e6fd5c06d8ff0bc
- SHA512 f6d82fa10cc66defb32fb63f4f23de51e41e6e8ad915f9578993cb50e086cbd1dfbe39dccc868cb47263352569d4f8e200d82b53b6831cdada2baff77cfd4e68
- TLSH T18971DE015AADD6BDF8E74B30C597C713513A7851CDEA733D0E6402292860530EEBABFA
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ar-SA/windows.ui.xaml.dll.mui
- SHA256 6e3e7dc941ae1c8ba51cfeb0cadc521730836030ce6ac02c57036195da5b7222
- MD5 9110ace5733b9f5365d2c22041d0e58c
- SHA1 eae6c57241928c4483b360c349f386a0469d65bd
- SHA512 71ed80b7c70c95194c947f541fac1476c4848820839084f9119a0135a93b8918c82064b919021e577535a102daa7139c1f8839f92aee6e56fdc44659ccf57d74
- SSDEEP 384:eeUgUhjY/kQFHLL40AJLWW+4PHLmoK2ZhJHuMsWfVWr:eAUwnAPe2Zh57W
- TLSH T1D872E2416AF8C63CE0E35730D27ED2D36219B5E7ACE8A33D06744B1A2C905648DD65FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/archiveint.dll
- IMPHASH 12dfeb0eb8d0ae985f7f94154025e953
- SHA256 e5a6d0d5e1c274d81825867f8f035024d0550f8869ae04626e0c12adeeaa7b7d
- MD5 d9d8d222e2ad0e4da7965d639f034d05
- SHA1 3af2ae530aa5e13be6f67d18573d788f41d3cac1
- SHA512 262d6bb75dcd05183871be01c6b3e07806584081b35f8d5414c03ab05d0fec25e289ee745f28f75049c74c4d745db15a6dd983b2df11902175715870ab389e12
- SSDEEP 12288:mTxKT6N7i/EbPONUzGMRbviZL5nhV2Wphsfxj9x/as91y9t2Xn:Cy6Zi/ErTGSbaZxhV2Ehs5H/l91et2X
- TLSH T181C4AE41A9C00EB2E5E63170554E7B364A5DE1600F39D6C756981BF8BC38AE27B3938F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
514896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
archiveint.pdb
api-ms-win-crt-string-l1-1-0
memset
strspn
strncpy
strcspn
strnlen
wcsncmp
strncmp
wcsncpy
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__close
_o__configure_narrow_argv
_o__ctime64_s
_o__errno
_o__execute_onexit_table
_o__fileno
_o__fseeki64
_o__get_osfhandle
_o__get_timezone
_o__gmtime64_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__localtime64_s
_o__lseeki64
_o__mkgmtime64
_o__mktime32
_o__open_osfhandle
_o__seh_filter_dll
memmove
_o__setmode
_o__sopen_s
_o__strdup
_o__umask
_o__wcsdup
_o__wrename
_o__wrmdir
_o__wsopen_s
_o__wunlink
_o_abort
_o_atoi
_o_bsearch
_o_calloc
_o_exit
_o_ferror
_o_fread
_o_free
_o_fwrite
_o_getenv
_o_isalnum
_o_isdigit
_o_isprint
_o_isspace
_o_isupper
_o_malloc
_o_mbstowcs
_o_qsort
_o_realloc
_o_setlocale
_o_strftime
_o_strtol
_o_tolower
_o_toupper
_o_wcrtomb
_except_handler4_common
_o___stdio_common_vfprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___acrt_iob_func
_o____mb_cur_max_func
strstr
wcsrchr
wcschr
strchr
strrchr
memchr
memcmp
memcpy
bcrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptDeriveKeyPBKDF2
BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptEncrypt
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-security-cryptoapi-l1-1-0
CryptDestroyHash
CryptGenRandom
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptHashData
CryptReleaseContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-file-l1-1-0
GetDiskFreeSpaceW
FindNextFileW
FindClose
SetFileTime
GetVolumePathNameW
CreateFileW
GetFileInformationByHandle
GetDriveTypeW
FindFirstFileW
GetFileAttributesW
FindFirstFileA
GetFullPathNameW
WriteFile
GetFileAttributesA
SetFilePointer
CreateFileA
GetFileType
CreateDirectoryW
ReadFile
SetFileAttributesW
SetEndOfFile
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-synch-l1-1-0
CreateEventW
ResetEvent
api-ms-win-core-handle-l1-1-0
CloseHandle
SetHandleInformation
DuplicateHandle
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
CreatePipe
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-0
GetACP
IsValidCodePage
GetOEMCP
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateProcessA
GetExitCodeProcess
TerminateProcess
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
GetCurrentDirectoryW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-processenvironment-l1-2-0
SearchPathA
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
_archive_bzlib_version@0
_archive_clear_error@4
_archive_compression@4
_archive_compression_name@4
_archive_copy_error@8
_archive_entry_acl@4
_archive_entry_acl_add_entry@24
_archive_entry_acl_add_entry_w@24
_archive_entry_acl_clear@4
_archive_entry_acl_count@8
_archive_entry_acl_from_text@12
_archive_entry_acl_from_text_w@12
_archive_entry_acl_next@28
_archive_entry_acl_reset@8
_archive_entry_acl_text@8
_archive_entry_acl_text_w@8
_archive_entry_acl_to_text@12
_archive_entry_acl_to_text_w@12
_archive_entry_acl_types@4
_archive_entry_atime@4
_archive_entry_atime_is_set@4
_archive_entry_atime_nsec@4
_archive_entry_birthtime@4
_archive_entry_birthtime_is_set@4
_archive_entry_birthtime_nsec@4
_archive_entry_clear@4
_archive_entry_clone@4
_archive_entry_copy_bhfi@8
_archive_entry_copy_fflags_text@8
_archive_entry_copy_fflags_text_w@8
_archive_entry_copy_gname@8
_archive_entry_copy_gname_w@8
_archive_entry_copy_hardlink@8
_archive_entry_copy_hardlink_w@8
_archive_entry_copy_link@8
_archive_entry_copy_link_w@8
_archive_entry_copy_mac_metadata@12
_archive_entry_copy_pathname@8
_archive_entry_copy_pathname_w@8
_archive_entry_copy_sourcepath@8
_archive_entry_copy_sourcepath_w@8
_archive_entry_copy_stat@8
_archive_entry_copy_symlink@8
_archive_entry_copy_symlink_w@8
_archive_entry_copy_uname@8
_archive_entry_copy_uname_w@8
_archive_entry_ctime@4
_archive_entry_ctime_is_set@4
_archive_entry_ctime_nsec@4
_archive_entry_dev@4
_archive_entry_dev_is_set@4
_archive_entry_devmajor@4
_archive_entry_devminor@4
_archive_entry_digest@8
_archive_entry_fflags@12
_archive_entry_fflags_text@4
_archive_entry_filetype@4
_archive_entry_free@4
_archive_entry_gid@4
_archive_entry_gname@4
_archive_entry_gname_utf8@4
_archive_entry_gname_w@4
_archive_entry_hardlink@4
_archive_entry_hardlink_utf8@4
_archive_entry_hardlink_w@4
_archive_entry_ino64@4
_archive_entry_ino@4
_archive_entry_ino_is_set@4
_archive_entry_is_data_encrypted@4
_archive_entry_is_encrypted@4
_archive_entry_is_metadata_encrypted@4
_archive_entry_linkify@12
_archive_entry_linkresolver_free@4
_archive_entry_linkresolver_new@0
_archive_entry_linkresolver_set_strategy@8
_archive_entry_mac_metadata@8
_archive_entry_mode@4
_archive_entry_mtime@4
_archive_entry_mtime_is_set@4
_archive_entry_mtime_nsec@4
_archive_entry_new2@4
_archive_entry_new@0
_archive_entry_nlink@4
_archive_entry_partial_links@8
_archive_entry_pathname@4
_archive_entry_pathname_utf8@4
_archive_entry_pathname_w@4
_archive_entry_perm@4
_archive_entry_rdev@4
_archive_entry_rdevmajor@4
_archive_entry_rdevminor@4
_archive_entry_set_atime@12
_archive_entry_set_birthtime@12
_archive_entry_set_ctime@12
_archive_entry_set_dev@8
_archive_entry_set_devmajor@8
_archive_entry_set_devminor@8
_archive_entry_set_fflags@12
_archive_entry_set_filetype@8
_archive_entry_set_gid@12
_archive_entry_set_gname@8
_archive_entry_set_gname_utf8@8
_archive_entry_set_hardlink@8
_archive_entry_set_hardlink_utf8@8
_archive_entry_set_ino64@12
_archive_entry_set_ino@12
_archive_entry_set_is_data_encrypted@8
_archive_entry_set_is_metadata_encrypted@8
_archive_entry_set_link@8
_archive_entry_set_link_utf8@8
_archive_entry_set_mode@8
_archive_entry_set_mtime@12
_archive_entry_set_nlink@8
_archive_entry_set_pathname@8
_archive_entry_set_pathname_utf8@8
_archive_entry_set_perm@8
_archive_entry_set_rdev@8
_archive_entry_set_rdevmajor@8
_archive_entry_set_rdevminor@8
_archive_entry_set_size@12
_archive_entry_set_symlink@8
_archive_entry_set_symlink_type@8
_archive_entry_set_symlink_utf8@8
_archive_entry_set_uid@12
_archive_entry_set_uname@8
_archive_entry_set_uname_utf8@8
_archive_entry_size@4
_archive_entry_size_is_set@4
_archive_entry_sourcepath@4
_archive_entry_sourcepath_w@4
_archive_entry_sparse_add_entry@20
_archive_entry_sparse_clear@4
_archive_entry_sparse_count@4
_archive_entry_sparse_next@12
_archive_entry_sparse_reset@4
_archive_entry_stat@4
_archive_entry_strmode@4
_archive_entry_symlink@4
_archive_entry_symlink_type@4
_archive_entry_symlink_utf8@4
_archive_entry_symlink_w@4
_archive_entry_uid@4
_archive_entry_uname@4
_archive_entry_uname_utf8@4
_archive_entry_uname_w@4
_archive_entry_unset_atime@4
_archive_entry_unset_birthtime@4
_archive_entry_unset_ctime@4
_archive_entry_unset_mtime@4
_archive_entry_unset_size@4
_archive_entry_update_gname_utf8@8
_archive_entry_update_hardlink_utf8@8
_archive_entry_update_link_utf8@8
_archive_entry_update_pathname_utf8@8
_archive_entry_update_symlink_utf8@8
_archive_entry_update_uname_utf8@8
_archive_entry_xattr_add_entry@16
_archive_entry_xattr_clear@4
_archive_entry_xattr_count@4
_archive_entry_xattr_next@16
_archive_entry_xattr_reset@4
_archive_errno@4
_archive_error_string@4
_archive_file_count@4
_archive_filter_bytes@8
_archive_filter_code@8
_archive_filter_count@4
_archive_filter_name@8
_archive_format@4
_archive_format_name@4
_archive_free@4
_archive_liblz4_version@0
_archive_liblzma_version@0
_archive_libzstd_version@0
_archive_match_exclude_entry@12
_archive_match_exclude_pattern@8
_archive_match_exclude_pattern_from_file@12
_archive_match_exclude_pattern_from_file_w@12
_archive_match_exclude_pattern_w@8
_archive_match_excluded@8
_archive_match_free@4
_archive_match_include_date@12
_archive_match_include_date_w@12
_archive_match_include_file_time@12
_archive_match_include_file_time_w@12
_archive_match_include_gid@12
_archive_match_include_gname@8
_archive_match_include_gname_w@8
_archive_match_include_pattern@8
_archive_match_include_pattern_from_file@12
_archive_match_include_pattern_from_file_w@12
_archive_match_include_pattern_w@8
_archive_match_include_time@16
_archive_match_include_uid@12
_archive_match_include_uname@8
_archive_match_include_uname_w@8
_archive_match_new@0
_archive_match_owner_excluded@8
_archive_match_path_excluded@8
_archive_match_path_unmatched_inclusions@4
_archive_match_path_unmatched_inclusions_next@8
_archive_match_path_unmatched_inclusions_next_w@8
_archive_match_set_inclusion_recursion@8
_archive_match_time_excluded@8
_archive_position_compressed@4
_archive_position_uncompressed@4
_archive_read_add_callback_data@12
_archive_read_add_passphrase@8
_archive_read_append_callback_data@8
_archive_read_append_filter@8
_archive_read_append_filter_program@8
_archive_read_append_filter_program_signature@16
_archive_read_close@4
_archive_read_data@12
_archive_read_data_block@16
_archive_read_data_into_fd@8
_archive_read_data_skip@4
_archive_read_disk_can_descend@4
_archive_read_disk_current_filesystem@4
_archive_read_disk_current_filesystem_is_remote@4
_archive_read_disk_current_filesystem_is_synthetic@4
_archive_read_disk_descend@4
_archive_read_disk_entry_from_file@16
_archive_read_disk_gname@12
_archive_read_disk_new@0
_archive_read_disk_open@8
_archive_read_disk_open_w@8
_archive_read_disk_set_atime_restored@4
_archive_read_disk_set_behavior@8
_archive_read_disk_set_gname_lookup@16
_archive_read_disk_set_matching@16
_archive_read_disk_set_metadata_filter_callback@12
_archive_read_disk_set_standard_lookup@4
_archive_read_disk_set_symlink_hybrid@4
_archive_read_disk_set_symlink_logical@4
_archive_read_disk_set_symlink_physical@4
_archive_read_disk_set_uname_lookup@16
_archive_read_disk_uname@12
_archive_read_extract2@12
_archive_read_extract@12
_archive_read_extract_set_progress_callback@12
_archive_read_extract_set_skip_file@20
_archive_read_finish@4
_archive_read_format_capabilities@4
_archive_read_free@4
_archive_read_has_encrypted_entries@4
_archive_read_header_position@4
_archive_read_new@0
_archive_read_next_header2@8
_archive_read_next_header@8
_archive_read_open1@4
_archive_read_open2@24
_archive_read_open@20
_archive_read_open_FILE@8
_archive_read_open_fd@12
_archive_read_open_file@12
_archive_read_open_filename@12
_archive_read_open_filename_w@12
_archive_read_open_filenames@12
_archive_read_open_memory2@16
_archive_read_open_memory@12
_archive_read_prepend_callback_data@8
_archive_read_set_callback_data2@12
_archive_read_set_callback_data@8
_archive_read_set_close_callback@8
_archive_read_set_filter_option@16
_archive_read_set_format@8
_archive_read_set_format_option@16
_archive_read_set_open_callback@8
_archive_read_set_option@16
_archive_read_set_options@8
_archive_read_set_passphrase_callback@12
_archive_read_set_read_callback@8
_archive_read_set_seek_callback@8
_archive_read_set_skip_callback@8
_archive_read_set_switch_callback@8
_archive_read_support_compression_all@4
_archive_read_support_compression_bzip2@4
_archive_read_support_compression_compress@4
_archive_read_support_compression_gzip@4
_archive_read_support_compression_lzip@4
_archive_read_support_compression_lzma@4
_archive_read_support_compression_none@4
_archive_read_support_compression_program@8
_archive_read_support_compression_program_signature@16
_archive_read_support_compression_rpm@4
_archive_read_support_compression_uu@4
_archive_read_support_compression_xz@4
_archive_read_support_filter_all@4
_archive_read_support_filter_by_code@8
_archive_read_support_filter_bzip2@4
_archive_read_support_filter_compress@4
_archive_read_support_filter_grzip@4
_archive_read_support_filter_gzip@4
_archive_read_support_filter_lrzip@4
_archive_read_support_filter_lz4@4
_archive_read_support_filter_lzip@4
_archive_read_support_filter_lzma@4
_archive_read_support_filter_lzop@4
_archive_read_support_filter_none@4
_archive_read_support_filter_program@8
_archive_read_support_filter_program_signature@16
_archive_read_support_filter_rpm@4
_archive_read_support_filter_uu@4
_archive_read_support_filter_xz@4
_archive_read_support_filter_zstd@4
_archive_read_support_format_7zip@4
_archive_read_support_format_all@4
_archive_read_support_format_ar@4
_archive_read_support_format_by_code@8
_archive_read_support_format_cab@4
_archive_read_support_format_cpio@4
_archive_read_support_format_empty@4
_archive_read_support_format_gnutar@4
_archive_read_support_format_iso9660@4
_archive_read_support_format_lha@4
_archive_read_support_format_mtree@4
_archive_read_support_format_rar5@4
_archive_read_support_format_rar@4
_archive_read_support_format_raw@4
_archive_read_support_format_tar@4
_archive_read_support_format_warc@4
_archive_read_support_format_xar@4
_archive_read_support_format_zip@4
_archive_read_support_format_zip_seekable@4
_archive_read_support_format_zip_streamable@4
_archive_seek_data@16
_archive_utility_string_sort@4
_archive_version_details@0
_archive_version_number@0
_archive_version_string@0
_archive_write_add_filter@8
_archive_write_add_filter_b64encode@4
_archive_write_add_filter_by_name@8
_archive_write_add_filter_bzip2@4
_archive_write_add_filter_compress@4
_archive_write_add_filter_grzip@4
_archive_write_add_filter_gzip@4
_archive_write_add_filter_lrzip@4
_archive_write_add_filter_lz4@4
_archive_write_add_filter_lzip@4
_archive_write_add_filter_lzma@4
_archive_write_add_filter_lzop@4
_archive_write_add_filter_none@4
_archive_write_add_filter_program@8
_archive_write_add_filter_uuencode@4
_archive_write_add_filter_xz@4
_archive_write_add_filter_zstd@4
_archive_write_close@4
_archive_write_data@12
_archive_write_data_block@20
_archive_write_disk_gid@16
_archive_write_disk_new@0
_archive_write_disk_set_group_lookup@16
_archive_write_disk_set_options@8
_archive_write_disk_set_skip_file@20
_archive_write_disk_set_standard_lookup@4
_archive_write_disk_set_user_lookup@16
_archive_write_disk_uid@16
_archive_write_fail@4
_archive_write_finish@4
_archive_write_finish_entry@4
_archive_write_free@4
_archive_write_get_bytes_in_last_block@4
_archive_write_get_bytes_per_block@4
_archive_write_header@8
_archive_write_new@0
_archive_write_open2@24
_archive_write_open@20
_archive_write_open_FILE@8
_archive_write_open_fd@8
_archive_write_open_file@8
_archive_write_open_filename@8
_archive_write_open_filename_w@8
_archive_write_open_memory@16
_archive_write_set_bytes_in_last_block@8
_archive_write_set_bytes_per_block@8
_archive_write_set_compression_bzip2@4
_archive_write_set_compression_compress@4
_archive_write_set_compression_gzip@4
_archive_write_set_compression_lzip@4
_archive_write_set_compression_lzma@4
_archive_write_set_compression_none@4
_archive_write_set_compression_program@8
_archive_write_set_compression_xz@4
_archive_write_set_filter_option@16
_archive_write_set_format@8
_archive_write_set_format_7zip@4
_archive_write_set_format_ar_bsd@4
_archive_write_set_format_ar_svr4@4
_archive_write_set_format_by_name@8
_archive_write_set_format_cpio@4
_archive_write_set_format_cpio_bin@4
_archive_write_set_format_cpio_newc@4
_archive_write_set_format_cpio_odc@4
_archive_write_set_format_cpio_pwb@4
_archive_write_set_format_filter_by_ext@8
_archive_write_set_format_filter_by_ext_def@12
_archive_write_set_format_gnutar@4
_archive_write_set_format_iso9660@4
_archive_write_set_format_mtree@4
_archive_write_set_format_mtree_classic@4
_archive_write_set_format_option@16
_archive_write_set_format_pax@4
_archive_write_set_format_pax_restricted@4
_archive_write_set_format_raw@4
_archive_write_set_format_shar@4
_archive_write_set_format_shar_dump@4
_archive_write_set_format_ustar@4
_archive_write_set_format_v7tar@4
_archive_write_set_format_warc@4
_archive_write_set_format_xar@4
_archive_write_set_format_zip@4
_archive_write_set_option@16
_archive_write_set_options@8
_archive_write_set_passphrase@8
_archive_write_set_passphrase_callback@12
_archive_write_set_skip_file@20
_archive_write_zip_set_compression_deflate@4
_archive_write_zip_set_compression_store@4
_archive_zlib_version@0
archive_set_error
Name
.text
Size
541KB
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=24610,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1192, id=1, productName=Unmarked objects,
count=12, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=164, id=264, version=27412,
count=15, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/asferror.dll
- SHA256 ed8302716d7c9d39a80702efd7ed865a669db2df5a687a06a6107a227966fb91
- MD5 3e1c2c63b41f77ddcfe959e4c3b3dbee
- SHA1 d682b73823176688cefcd9eddac882597a87b1c8
- SHA512 2c169cfa1548c4e3c1440d58eb1f539609190382fbefc5493a7ec80dda15583285470ab7aad975ccc7d6a8209073d640074f36a57c6edf2ba5980c4cb62156f8
- TLSH T14E514B0B67FD062AF4FA47302ABB4726657A7C249A62935C0940016C3875654EDB5F37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/aspnet_counters.dll
- IMPHASH 3cdf8bcf4c8055777f49b971cf87418b
- SHA256 68f272c75b602c09b933a17f751e7e29d3caf1194c9173d36580aff403d4cb48
- MD5 f83b6c16e0f0e4bdc35e55f6aa649f54
- SHA1 783abbed9b7277736e1696442b51a524ee2433d0
- SHA512 e860cc500def09654b68118af984f3bd01f9ff8ec57380fd72af69ad400828b310625f29f64afb1fef128c645ebc6d0d47ca0e9f0b0cf312205a7a4fcedb08e5
- SSDEEP 384:HcPubjXJ0x8IDKrtnxCv58TjG2rEpsycW9d9WGyHRN7Ky50ZSxR9zusGL4:9qD8nxIr2wp5vuR50Zi9zuX4
- TLSH T123B26D89AB688583EDE7363075F5DE26A97CF6B10F5010935382E9081CB37C1AB3476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
98:eb:52:8e:c7:5c:3b:cb:50:20:06:2d:bc:7c:ee:e2:4b:1d:73:4f:26:b1:86:4b:2e:40:c1:8a:b0:a3:4b:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 25, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ad:fc:df:4d:58:e3:5d:32:e9:00:01:00:00:01:ad
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
9184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
aspnet_counters.pdb
kernel32
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
SwitchToThread
Sleep
GetLastError
LoadLibraryW
GetModuleFileNameW
DisableThreadLibraryCalls
GetProcessHeap
GetProcAddress
HeapCreate
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentProcess
HeapFree
HeapAlloc
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
vcruntime140_clr0400
memset
_except_handler4_common
__std_type_info_destroy_list
ucrtbase_clr0400
_initterm_e
_cexit
_seh_filter_dll
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initialize_narrow_environment
_initterm
CloseGenericCounters
CloseStateCounters
CloseVersion4Counters
CollectGenericCounters
CollectStateCounters
CollectVersion4Counters
OpenGenericCounters
OpenStateCounters
OpenVersion4Counters
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=30034,
count=12, id=261, version=30034,
count=10, id=260, version=30034,
count=2, id=259, version=30034,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=260, version=29395,
count=11, id=257, version=29395,
count=78, id=1, productName=Unmarked objects,
count=11, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=256, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,
apt/SysWOW64/asycfilt.dll
- IMPHASH 1806481d5ec9f8f131401d4b4e121583
- SHA256 aafeec0242d873b5762f0f3baa937cf5b6723f647361d687d389eb9ebdeaad7a
- MD5 ced6520614e89cded89c23f44127adac
- SHA1 4a8ecca1f590abb8bf4da8584475de56ccec02a1
- SHA512 3136f1a6f6efb58b5961ffdbcd5a92c6100428b76c12202ece5b08bc0225ad8d250b314ef0339f961a515ea0707f0015170a76e109f25ae177699224015e1204
- SSDEEP 1536:0nAU5Az+1YV9WCq+Sj52ej7sGtqqEyqnYcPvWkhI+:0nAnz+uGvLqq8ndmkhI
- TLSH T1F5734B20E69000A1E0D3253D426EB6B1956FBBF10758DFD3893496E8E9607D27D7A3CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
68160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
asycfilt.pdb
msvcrt
memset
_setjmp3
memcpy
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
free
malloc
sscanf_s
getenv
__iob_func
__CxxFrameHandler3
realloc
longjmp
_purecall
_callnewh
_snprintf_s
fprintf
kernel32
InitializeCriticalSectionAndSpinCount
GlobalAddAtomA
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnterCriticalSection
LeaveCriticalSection
GetLastError
GlobalDeleteAtom
DeleteCriticalSection
ole32
ReleaseStgMedium
user32
UnionRect
gdi32
SetMapMode
GetCurrentObject
SelectObject
SelectPalette
DeleteObject
CreateSolidBrush
GetObjectW
PatBlt
SetDIBits
GetNearestPaletteIndex
SetDIBColorTable
GetNearestColor
SetDIBitsToDevice
StretchDIBits
SetStretchBltMode
DllCanUnloadNow
FilterCreateInstance
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=14, id=260, version=27412,
count=59, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=53, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/atl.dll
- IMPHASH 9770a95c6b6c769aa3c12b78be296801
- SHA256 5efa81cbef269775ad9863de31809527d6c8d7908df82d673d47b1be38e41ae7
- MD5 2b0568228a21499c133c18afb2301bd2
- SHA1 cb13cdc92e67179796ccecd0187053027f9098f1
- SHA512 2732726ebab2edb75efafa930f524c28a3fc43be3d6e8dc5f261e5c732e0e005fa883205a6cc8d9e6f1e78bd54402ed92a9d7200d15eff01f092c1ac2b06eda0
- SSDEEP 1536:nooxMcfySmRocrpftzxn17bC9T3YtlHGQuBLwnmsyT8TxyzXfQZBIL613AcXwi9w:FuZY34RHmsyT8TIzXfQZBVE6Hk
- TLSH T15F832B11B1C480B6E9E6247C051E3232D96FFC680BC96AC71B2477AE6FF42C19F39256
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atl.pdb
msvcrt
_except_handler4_common
_initterm
_XcptFilter
_callnewh
wcscat_s
realloc
free
_amsg_exit
wcscpy_s
malloc
memcpy
memcmp
memset
kernel32
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
GetProcessHeap
GetACP
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsProcessorFeaturePresent
DecodePointer
HeapAlloc
EncodePointer
LoadLibraryExA
WaitForSingleObject
GetCurrentProcess
FormatMessageW
HeapDestroy
GetModuleFileNameW
GetLastError
LoadLibraryExW
GetProcAddress
FreeLibrary
lstrcpyW
RaiseException
GetCurrentThreadId
UnhandledExceptionFilter
HeapFree
CreateFileW
GetFileSize
ReadFile
CloseHandle
FindResourceExW
SizeofResource
SetUnhandledExceptionFilter
TerminateProcess
MultiByteToWideChar
GetSystemInfo
WideCharToMultiByte
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
GetModuleHandleW
SetLastError
DisableThreadLibraryCalls
QueryPerformanceCounter
FindResourceA
GetCurrentProcessId
FreeResource
GetSystemTimeAsFileTime
GetTickCount
Sleep
ResolveDelayLoadedAPI
DelayLoadFailureHook
GlobalHandle
GlobalFree
lstrcmpW
LockResource
LoadResource
FindResourceW
GlobalUnlock
VirtualFree
GlobalLock
GlobalAlloc
user32
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDlgItem
SendMessageW
GetDesktopWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
SetWindowLongW
DefWindowProcW
GetWindowLongW
GetClassNameW
GetParent
DialogBoxIndirectParamW
IsWindow
RedrawWindow
EndPaint
FillRect
DialogBoxIndirectParamA
CreateDialogIndirectParamW
CreateDialogIndirectParamA
RegisterWindowMessageW
GetClientRect
CallWindowProcW
DestroyWindow
BeginPaint
CreateWindowExW
GetWindow
SetFocus
GetFocus
IsChild
GetSysColor
UnregisterClassW
ReleaseDC
CharPrevW
GetDC
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CharNextW
SetWindowPos
gdi32
GetObjectW
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetDeviceCaps
CreateDCW
GetStockObject
AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_GetSizeMax
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlMarshalPtrInProc
AtlModuleAddCreateWndData
AtlModuleAddTermFunc
AtlModuleExtractCreateWndData
AtlModuleGetClassObject
AtlModuleInit
AtlModuleLoadTypeLib
AtlModuleRegisterClassObjects
AtlModuleRegisterServer
AtlModuleRegisterTypeLib
AtlModuleRegisterWndClassInfoA
AtlModuleRegisterWndClassInfoW
AtlModuleRevokeClassObjects
AtlModuleTerm
AtlModuleUnRegisterTypeLib
AtlModuleUnregisterServer
AtlModuleUnregisterServerEx
AtlModuleUpdateRegistryFromResourceD
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlSetErrorInfo
AtlSetErrorInfo2
AtlUnadvise
AtlUnmarshalPtr
AtlWaitWithMessageLoop
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=260, version=27412,
count=4, id=259, version=27412,
count=195, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=5, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/atl100.dll
- IMPHASH 0bbf1228f837ecb83ec693b705100bde
- SHA256 5ba9cc3111adaf2c2d83c659a2973d6f8fc9c83fb1303c868099d54c8e5bb5ed
- MD5 ced2d6cd452572aba1107dcdbfec7b91
- SHA1 ec2fa75335c2d4993de4e131b6bb6c26b16dea91
- SHA512 42a85dbef27af88445b3f441ffa23931639f17987130ae91a85d78f707d1412ce2db12b7797e50d3939239a4d40da032f7ffa6576aafb68905bb0964f1a63732
- SSDEEP 3072:1Ei2/YxBFZNAWH6Gk5BsyGfGM8Wzk8gCj:wOFZKWaj5BstfbZV
- TLSH T1CFE35C1172E4C132E4E220B4869CF6720A3DBEA1076195C726953BEE9DF43D49F38B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d9:57:c1:f3:e5:a1:da:25:fe:d8:af:60:a7:ad:43:4a:72:01:d4:3a:48:7e:4c:96:49:c4:a8:a1:62:22:66:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
d9:57:c1:f3:e5:a1:da:25:fe:d8:af:60:a7:ad:43:4a:72:01:d4:3a:48:7e:4c:96:49:c4:a8:a1:62:22:66:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:8A82-E34F-9DDA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c2:fa:7d:87:0e:54:53:47:24:00:01:00:00:01:c2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 4, 2022 - Feb 2, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Minor OS version
1
Major OS version
5
Entry point
69685
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atl100.i386.pdb
kernel32
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetModuleFileNameW
WideCharToMultiByte
WaitForSingleObject
GlobalAlloc
FindResourceA
MulDiv
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
lstrcmpW
GlobalUnlock
GlobalLock
SetLastError
GlobalFree
GlobalHandle
LockResource
LocalAlloc
InterlockedExchange
LoadLibraryA
HeapFree
DecodePointer
EncodePointer
HeapAlloc
GetCommandLineA
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
WriteFile
GetStdHandle
ExitProcess
HeapReAlloc
HeapSize
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
InterlockedCompareExchange
InterlockedPushEntrySList
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateControlLic
AtlAxCreateControlLicEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlCallTermFunc
AtlComModuleGetClassObject
AtlComModuleRegisterClassObjects
AtlComModuleRevokeClassObjects
AtlComModuleUnregisterServer
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateRegistrar
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetPerUserRegistration
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlLoadTypeLib
AtlMarshalPtrInProc
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlSetErrorInfo
AtlSetPerUserRegistration
AtlUnadvise
AtlUnmarshalPtr
AtlUpdateRegistryFromResourceD
AtlWaitWithMessageLoop
AtlWinModuleAddCreateWndData
AtlWinModuleExtractCreateWndData
AtlWinModuleInit
AtlWinModuleRegisterClassExA
AtlWinModuleRegisterClassExW
AtlWinModuleRegisterWndClassInfoA
AtlWinModuleRegisterWndClassInfoW
AtlWinModuleTerm
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=97, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=220, id=1, productName=Unmarked objects,
count=45, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
apt/SysWOW64/atl110.dll
- IMPHASH e4a6b094cdcc4132831ddfe978d2211d
- SHA256 0fd6a0287be607c01bcde438a82eb2def5384697cffafec4ac8b29ac2dd400cc
- MD5 cb3b8201ec7254e4dd75e4c529f8c292
- SHA1 d7ac7881c202421fa36d8ba95beb3caf37f6638f
- SHA512 e081a9de291c91e7149e72e066f0878c761eb325551bedf38b6d7ed195fe107eb3496ea0d361e15b2298e5632fa277667105f482e9c77e5e05e665693eaa7eb1
- SSDEEP 3072:GDZdGcL1pRgH9DQ7hFa6OMlk2AhuchQd040wKDjpSQVeUq:GDvLnRgdEhFv4ACQV0wKD7Y
- TLSH T1C7E36D01F3D1D071D16B02315A67B75257BD7E724EF9DE0A2B9C2E4E1EB02C0A629B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7a:69:2f:70:d3:1f:9a:64:12:1b:ca:7b:5a:89:c2:0b:56:ae:e5:39
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 31, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
6
Entry point
77054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atl110.i386.pdb
kernel32
CreateFileW
GetFileSize
ReadFile
CloseHandle
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
FindResourceW
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
WaitForSingleObject
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
LockResource
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
MulDiv
lstrcmpW
FindResourceA
WideCharToMultiByte
InterlockedExchange
LoadLibraryExA
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
GetCommandLineA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
HeapReAlloc
RtlUnwind
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateControlLic
AtlAxCreateControlLicEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlCallTermFunc
AtlComModuleGetClassObject
AtlComModuleRegisterClassObjects
AtlComModuleRevokeClassObjects
AtlComModuleUnregisterServer
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateRegistrar
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetPerUserRegistration
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlLoadTypeLib
AtlMarshalPtrInProc
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlSetErrorInfo
AtlSetPerUserRegistration
AtlUnadvise
AtlUnmarshalPtr
AtlUpdateRegistryFromResourceD
AtlWaitWithMessageLoop
AtlWinModuleAddCreateWndData
AtlWinModuleExtractCreateWndData
AtlWinModuleInit
AtlWinModuleRegisterClassExA
AtlWinModuleRegisterClassExW
AtlWinModuleRegisterWndClassInfoA
AtlWinModuleRegisterWndClassInfoW
AtlWinModuleTerm
Name
.text
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=190, version=30716,
count=1, id=188, version=30716,
count=13, id=205, version=50929,
count=104, id=206, version=50929,
count=3, id=185, version=30716,
count=219, id=1, productName=Unmarked objects,
count=53, id=207, version=50929,
count=1, id=202, version=50929,
count=1, id=201, version=50929,
count=1, id=204, version=50929,
apt/SysWOW64/atlthunk.dll
- IMPHASH e60640221abf28fcf2f6ba5fc570c445
- SHA256 fc8a1b7850073f7ee8dc4fd0786d07a16b3ad9f74562570a9b77f469bef23877
- MD5 165cb8aa68a774fef338a9ee4c0ef7b8
- SHA1 e1a865a3d6d56901a37a8b016fc86878aa900951
- SHA512 33ce479e0f069d063ffffbe0a917bfc8a718ad03776868ee3260aaadee94138245d4bd78576bbb8cd6676680e6f6a098f8bd9e9fe26534f40bea4f1e35e18908
- SSDEEP 384:Hx8MgAioSoI3gxq+s7b7AU0OOOEkDKZ5Czzzo8cGkxGAAvoFFsjDj0oouuuY4na6:HxN/XXCRrP8TGs8VWtH9u
- TLSH T1C6F2B88CB6D309B0D23F24F08747FBF78B5D0E6626F821719729E52E59F90DA2872215
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atlthunk.pdb
ntdll
NtClose
RtlAcquireSRWLockExclusive
LdrDisableThreadCalloutsForDll
RtlFreeHeap
NtAreMappedFilesTheSame
RtlReleaseSRWLockExclusive
RtlAllocateHeap
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
VirtualProtect
MapViewOfFile
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
api-ms-win-core-file-l1-1-0
CreateFileW
AtlThunk_AllocateData
AtlThunk_DataToCode
AtlThunk_FreeData
AtlThunk_InitData
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
754B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27412,
count=19, id=1, productName=Unmarked objects,
count=5, id=260, version=27412,
count=1, id=256, version=27412,
count=2, id=259, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/atmlib.dll
- IMPHASH e8b7cfaec2bbf9eebaccd923741ce7f9
- SHA256 ed050366bd9387902d0d5967fba592ef2326e982e11a024aef55c17480afbe6c
- MD5 5241a96c58e9626c175d15f027664242
- SHA1 c1e972f38ca1492722da0ef65da88e3c9b1920ea
- SHA512 af2dfb8be63c1da48367fe4d5ed6a6572987ce2d866b192f174d85b7fbb2b9a88710e408ce7b61c7796f7ef0b438b77e4e536e3b9958f5850235107eaf2b68d2
- SSDEEP 768:8p8l8SJNroT38LhTw2jSg0LWfViA1JMnbEtADZDXGl48:86l8SJ1oT38Vlh0LWf7Qn4W9XGlD
- TLSH T1E8131852B994C422CE1A20732D3ADB65C56CB670EF6894C7F3F1472F28B65E3A07814B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
30192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atmlib.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vsprintf
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memmove
_o__seh_filter_dll
_o__stricmp
_o__wcsicmp
_o_atoi
_o_calloc
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_except_handler4_common
wcsrchr
wcschr
_o___std_type_info_destroy_list
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
UnmapViewOfFile
_lwrite
WideCharToMultiByte
CreateSemaphoreW
GetFileSize
GetWindowsDirectoryW
ResetEvent
CloseHandle
DisableThreadLibraryCalls
SetEvent
GetLastError
MultiByteToWideChar
CreateEventW
GetSystemDefaultLangID
ReleaseMutex
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
SetFilePointer
WaitForMultipleObjects
WriteFile
ReleaseSemaphore
ReadFile
InitOnceExecuteOnce
gdi32
GetGlyphOutlineW
AddFontResourceExW
NamedEscape
EnumFontFamiliesExW
GetFontData
GetFontResourceInfoW
RemoveFontResourceExW
user32
GetDC
ReleaseDC
PostMessageW
advapi32
RegOpenKeyExW
EventWriteTransfer
EventRegister
EventSetInformation
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey
EventUnregister
ATMAddFont
ATMAddFontA
ATMAddFontEx
ATMAddFontExA
ATMAddFontExW
ATMAddFontW
ATMBBoxBaseXYShowText
ATMBBoxBaseXYShowTextA
ATMBBoxBaseXYShowTextW
ATMBeginFontChange
ATMClient
ATMEndFontChange
ATMEnumFonts
ATMEnumFontsA
ATMEnumFontsW
ATMEnumMMFonts
ATMEnumMMFontsA
ATMEnumMMFontsW
ATMFinish
ATMFontAvailable
ATMFontAvailableA
ATMFontAvailableW
ATMFontSelected
ATMFontStatus
ATMFontStatusA
ATMFontStatusW
ATMForceFontChange
ATMGetBuildStr
ATMGetBuildStrA
ATMGetBuildStrW
ATMGetFontBBox
ATMGetFontInfo
ATMGetFontInfoA
ATMGetFontInfoW
ATMGetFontPaths
ATMGetFontPathsA
ATMGetFontPathsW
ATMGetGlyphList
ATMGetGlyphListA
ATMGetGlyphListW
ATMGetMenuName
ATMGetMenuNameA
ATMGetMenuNameW
ATMGetNtmFields
ATMGetNtmFieldsA
ATMGetNtmFieldsW
ATMGetOutline
ATMGetOutlineA
ATMGetOutlineW
ATMGetPostScriptName
ATMGetPostScriptNameA
ATMGetPostScriptNameW
ATMGetVersion
ATMGetVersionEx
ATMGetVersionExA
ATMGetVersionExW
ATMInstallSubstFontA
ATMInstallSubstFontW
ATMMakePFM
ATMMakePFMA
ATMMakePFMW
ATMMakePSS
ATMMakePSSA
ATMMakePSSW
ATMProperlyLoaded
ATMRemoveFont
ATMRemoveFontA
ATMRemoveFontW
ATMRemoveSubstFontA
ATMRemoveSubstFontW
ATMSelectEncoding
ATMSelectObject
ATMSetFlags
ATMXYShowText
ATMXYShowTextA
ATMXYShowTextW
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=27412,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1156, id=1, productName=Unmarked objects,
count=4, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=15, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/audiodev.dll
- IMPHASH 673f05cdb64d67595c750107e3e2f90d
- SHA256 3c44b3e68c7652394e5bc11ea49f8894d0f6665caa9ac6b5dce5167b05fba3ed
- MD5 74d5cebee17cae9c0b5ee4b88340c022
- SHA1 72fd763ef7b9872be0ae96bddec4aa1a31658fbe
- SHA512 535b5f933ec7849d614d686cd78f733071632f9b51ddee4cb4a092dbfcf442c76f32f157a8dcf00063056c9ee16b09c0c8867c7f23fe245962388fd4ff68d89e
- SSDEEP 6144:AqVR64apwIDJ6esiBfYl00JmmEFmAEaCnMj+w:jowIDJ6es6fYKFgApW
- TLSH T1E5344B12BA48C6F9C5A37131952FA6B106A99D69DB1044C7E3607F7F78332C35E3A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
133040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
audiodev.pdb
msvcrt
memcpy
_vsnwprintf
_initterm
malloc
free
_amsg_exit
wcsnlen
strnlen
_XcptFilter
_wtoi
_except_handler4_common
memset
kernel32
RegSetValueExW
FreeEnvironmentStringsA
GetEnvironmentStringsW
GlobalMemoryStatusEx
GetLocalTime
FreeEnvironmentStringsW
GetVersionExW
DeviceIoControl
GetDiskFreeSpaceW
GlobalFree
GlobalAlloc
GlobalReAlloc
LocalFree
GetLastError
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
Sleep
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateThread
GetExitCodeThread
GetSystemTime
SystemTimeToFileTime
UnmapViewOfFile
DeleteFileW
GetTempPathW
CreateFileW
CreateFileMappingW
MapViewOfFile
ReadFile
SetFilePointer
lstrcmpW
RegCreateKeyExW
GlobalSize
GlobalLock
GlobalUnlock
GetCurrentProcessId
GetModuleFileNameW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
GetModuleHandleW
GetLocaleInfoEx
GetUserPreferredUILanguages
HeapAlloc
GetProcessHeap
HeapFree
InitializeCriticalSection
DeleteCriticalSection
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
SetEvent
CreateEventW
WaitForMultipleObjects
FormatMessageW
GetLocaleInfoW
GetNumberFormatW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
DelayLoadFailureHook
lstrcmpiW
ResolveDelayLoadedAPI
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
user32
GetShellWindow
GetSubMenu
LoadMenuW
DialogBoxParamW
GetDlgItem
GetMenuItemCount
GetMenuItemInfoW
RegisterClipboardFormatW
DestroyWindow
GetLastActivePopup
SwitchToThisWindow
SendMessageTimeoutW
GetWindowThreadProcessId
GetClassNameW
GetWindow
FindWindowW
CreateWindowExW
RegisterClassW
LoadCursorW
GetClassInfoW
SetWindowTextW
KillTimer
SetTimer
WinHelpW
SendDlgItemMessageW
DestroyMenu
TrackPopupMenu
SetMenuDefaultItem
CopyImage
DestroyIcon
PostMessageW
SetFocus
ShowWindow
SetDlgItemTextW
LoadStringW
LoadIconW
SetWindowLongW
EndDialog
SendMessageW
RemoveMenu
GetWindowLongW
DefWindowProcW
shlwapi
StrToIntW
ord174
SHGetThreadRef
SHStrDupW
StrRetToBufW
ord10
ord7
ord9
ord8
StrFormatKBSizeW
PathRemoveBlanksW
StrCmpW
ord172
ord354
PathFindExtensionW
PathFindFileNameW
ord388
StrCmpIW
ord168
ord176
AssocCreate
ord199
StrFormatByteSizeW
ord16
StrCmpLogicalW
StrRChrW
ord158
ord219
PathRemoveFileSpecW
PathAppendW
PathCombineW
wmvcore
WMCreateEditor
ntdll
RtlGetPersistedStateLocation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_CDefFolderMenu_MergeMenu@16
_CIDLData_CreateFromIDArray@16
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=26715,
count=3, id=259, version=27412,
count=21, id=260, version=27412,
count=244, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=63, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/auditpolcore.dll
- IMPHASH d5bd9664055c1f3537916818f155a97b
- SHA256 22cfd0f6e0dccaf229cae4c4fe983f4885c966aa7b5932424dafa8cc174faff9
- MD5 2f0cf68a67a087163c972366a2812456
- SHA1 d2cc5f8eb930718095cd1aa2c0bc3bc007461469
- SHA512 e9519c5d995e9c784dd9cc18e7624d86163ab056f7432ce2465504038053dd4e4f98c35009bce4c3975d46345cf9a135bf230487cb3409c24d8dd7b5591894bc
- SSDEEP 1536:YK+j9YbaHau9v12kFwlQc2E01dkgvnZ0zdD:d+L6K12kVFE01qgvnGzd
- TLSH T175437E12A70085B9DAFD2534366D273A12BE65104FE583C3971387AA2E703D1EE3878F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
41792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
auditpolcore.pdb
msvcrt
memcmp
_onexit
_initterm
__dllonexit
malloc
__iob_func
_unlock
free
_lock
_XcptFilter
_amsg_exit
__CxxFrameHandler3
_vsnwprintf
ferror
memcpy_s
_wcsicmp
fclose
??3@YAXPAX@Z
_purecall
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
wcschr
_wfopen
wscanf
fgetws
feof
_wcsnicmp
wprintf
??_V@YAXPAX@Z
_vsnwprintf_s
vfwprintf
qsort
_wtoi
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UAE@XZ
_except_handler4_common
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetThreadStackGuarantee
OpenProcessToken
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObject
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
IsWellKnownSid
IsValidSid
InitializeSecurityDescriptor
EqualSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-file-l1-1-0
DeleteFileW
WriteFile
CreateFileW
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-rtlsupport-l1-2-0
RtlCompareMemory
api-ms-win-security-audit-l1-1-0
AuditSetSystemPolicy
AuditQuerySystemPolicy
AuditFree
api-ms-win-security-audit-l1-1-1
AuditQueryGlobalSaclW
AuditEnumerateCategories
AuditEnumerateSubCategories
AuditSetPerUserPolicy
AuditLookupSubCategoryNameW
AuditEnumeratePerUserPolicy
AuditQueryPerUserPolicy
AuditLookupCategoryNameW
AuditSetGlobalSaclW
api-ms-win-security-provider-l1-1-0
GetExplicitEntriesFromAclW
SetEntriesInAclW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
ntdll
RtlAllocateHeap
RtlNtStatusToDosError
RtlGUIDFromString
RtlImageNtHeader
RtlFreeHeap
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
AdtBackupPolicy
AdtBackupPolicyGeneralized
AdtClearPolicy
AdtConstructAllCategoryGuids
AdtConvertGuidStringToGuid
AdtConvertGuidToString
AdtDisableSinglePrivilege
AdtEnableSinglePrivilege
AdtGetOption
AdtGetPerUserPolicy
AdtGetSystemPolicy
AdtListCategories
AdtListSubCategories
AdtLoadStringEx
AdtParseAuditOptionName
AdtParseGuidOrNameArray
AdtRemoveAllUsers
AdtRemoveBasePolicy
AdtRestorePolicy
AdtRestorePolicyGeneralized
AdtSetOption
AdtSetPerUserPolicy
AdtSetSystemPolicy
AuditPolicyData_DeleteAuditDataInstance
DisplayMessage
DisplayMessageToSpecificConsoleHandle
GetDisplayPolicy
LoadFormatStringAndPrintToConsole
SetDisplayPolicy
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=3, id=259, version=27412,
count=129, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=10, id=261, version=27412,
count=1, id=256, version=27412,
count=9, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/auditpolmsg.dll
- SHA256 bd2cd7243e0a2f6e4790375cedafbdd7c4cdf43a5e9f443aa0e19851636b1303
- MD5 aa3951f5c2554435c07fa3eb67596c14
- SHA1 8620d0c7e32e8b0a71cc60b73f3850ac8b204b7f
- SHA512 f5cdc87bddc1b03a755a96aa16aa3e18d148597648419426d6ded25f5649e6cb02b687593ebe11d053852cb7dcc0e05b6e010aa3924eed00020fa737c2d9209a
- SSDEEP 1536:DR9sSnIh8Pxvp1Jz1mEmzJ0RtW9yBozETuEGeJvO41ZZnr26:DR9d7PxB3m10RgFz/4vB1Tn1
- TLSH T14E93E193628027A0EC09C931A427CAE45EBD7CD3A804037AB3D5FA5F1E70355DDE6A79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/authfwcfg.dll
- IMPHASH a796a1b746a9874af9a786f7e71d6eea
- SHA256 a17bf6dfea2357260f133fe10f3b5e9f23b3da396985d5afde3adc24ecd87e30
- MD5 d76f16a3f8d03186b520b7a5e1876400
- SHA1 67babe8bd080f44532f5b605c06bd150000bbbc1
- SHA512 fb30d173e6565564d8d82aa92b291779e2c3e2a15ba0fb0cba7c4593486018033b5d28a9ca34b842be01c694a22fb2d8878ab4a564a8754a847084b59bca933d
- SSDEEP 6144:QvFjVddhnbC0RF5cP0L38YHeChnjGsk/ZEAtAMOO9HGsO7dJ7JAn2++o:QvFjXmucP0RvGOO9HGsO9Jo2+
- TLSH T12B841C10D7B56031C496C570EA1BA7E7B56B543827D14BC3A3A86F47A8300E37E72B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
312528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
authfwcfg.pdb
msvcrt
wcstok_s
??3@YAXPAX@Z
wcscpy_s
_wcsicmp
_purecall
_vsnwprintf
?what@exception@@UBEPBDXZ
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_initterm
_amsg_exit
_XcptFilter
isdigit
isalnum
abort
_wsetlocale
__crtLCMapStringW
_wcsdup
memchr
tolower
isspace
__uncaught_exception
_unlock
_lock
setlocale
calloc
__pctype_func
memset
_ismbblead
___lc_codepage_func
___lc_handle_func
_errno
___mb_cur_max_func
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
_callnewh
localeconv
ldexp
_wcsnicmp
??_V@YAXPAX@Z
_itow_s
iswdigit
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
free
malloc
_vsnprintf
__CxxFrameHandler3
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
bcrypt
BCryptGetFipsAlgorithmMode
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
ntdll
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
WinSqmAddToStream
ws2_32
htonl
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
netsh.exe
RegisterContext
RegisterHelper
PrintMessageFromModule
PrintError
PrintMessage
MatchTagsInCmdLine
MatchToken
fwpolicyiomgr
FwCopyPortsContents
firewallapi
FWFreeCryptoSet
FWRestoreGPODefaults
FWRestoreDefaults
FWExportPolicy
FWImportPolicy
FWClosePolicyStore
FwBstrToPorts
FWFreeFirewallRule
FWFreeConnectionSecurityRule
FWEnumPhase2SAs
FWEnumPhase1SAs
FWFreeAuthenticationSets
FWCopyAuthenticationSet
FWEnumAuthenticationSets
FWFreeCryptoSets
FWCopyCryptoSet
FWFreeConnectionSecurityRules
FWCopyConnectionSecurityRule
FWEnumConnectionSecurityRules
FWFreeFirewallRules
FWCopyFirewallRule
FWEnumFirewallRules
FWGetGlobalConfig
FWOpenPolicyStore
FWStatusMessageFromStatusCode
FWDeletePhase2SAs
FWDeletePhase1SAs
FWFreePhase2SAs
FWFreePhase1SAs
FWDeleteFirewallRule
FWAddFirewallRule
FWVerifyFirewallRule
FWEnumMainModeRules
FWSetMainModeRule
FWDeleteMainModeRule
FWFreeMainModeRules
FWAddMainModeRule
FWVerifyMainModeRule
FwGetAddressesAsString
FWSetCryptoSet
FwCopyWFAddressesContents
FWSetConnectionSecurityRule
FWEnumCryptoSets
FWDeleteCryptoSet
FWDeleteAuthenticationSet
FWDeleteConnectionSecurityRule
FWAddConnectionSecurityRule
FWAddAuthenticationSet
FWAddCryptoSet
FWFreeAuthenticationSet
FwFreeAddresses
FWVerifyConnectionSecurityRule
FWVerifyAuthenticationSet
FwStringToAddresses
FWFreeProducts
FWEnumProducts
FwIsRemoteManagementEnabled
FWGetConfig
FWSetConfig
FWVerifyCryptoSet
FWSetGlobalConfig
FWSetFirewallRule
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetResourceString
InitHelperDll
Name
.text
Size
329KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=224, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=18, id=261, version=27412,
count=62, id=260, version=27412,
count=1, id=256, version=27412,
count=10, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/authui.dll
- IMPHASH b0156f490a7c652e9b7ada17630db4cd
- SHA256 ca02134ca5bd35c84d0042794fd31051399c7cdfaec1a07c0b1d79bf428a3852
- MD5 3e533b521896268cc7961db618a19afb
- SHA1 3c7dd6ac7afbb8d8e7f3ffedad41ec78b013d307
- SHA512 3fa1714cf3d995e21fe52a289e673a3d798dce73402853a033e2070a986a2e64c434b139b5987f0c8535a3773504f1c2f20a0527a9fc75bbf053b96515890151
- SSDEEP 3072:3U8afxL7cu4EvqpXMZjc4BQD7nyjN4rsjzrnb+RRyzr3ZRXrb:TafxL7cu5vEcW4BQD7SRLiRRwr3Z
- TLSH T1BF044911EA6145B1C9B732342A6F3A34A0BE91608BD941CF9E185FF5AC617C25F30B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
46320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
authui.pdb
msvcrt
_onexit
memmove
memcpy
memcmp
floor
??1type_info@@UAE@XZ
?terminate@@YAXXZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
__dllonexit
_except_handler4_common
_initterm
malloc
__CxxFrameHandler3
_get_errno
_set_errno
_ftol2_sse
_CxxThrowException
_XcptFilter
??1exception@@UAE@XZ
free
_lock
_amsg_exit
_unlock
memset
shcore
IUnknown_Set
ord123
ord109
IsOS
SHCreateThread
ord188
ord141
shlwapi
ord219
ord172
PathFileExistsW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
ntdll
_wcsnicmp
_vsnprintf_s
memcpy_s
_vsnwprintf
RtlCopySid
RtlLengthSid
RtlSubAuthorityCountSid
_wcsicmp
RtlSubAuthoritySid
NtQueryWnfStateData
RtlPublishWnfStateData
EtwEventActivityIdControl
WinSqmSetDWORD
WinSqmIsOptedIn
NtPowerInformation
WinSqmAddToStream
EtwEventWriteTransfer
RtlEqualUnicodeString
RtlNtStatusToDosError
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwEventRegister
EtwEventUnregister
EtwEventSetInformation
EtwTraceMessage
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TlsAlloc
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
SetProcessShutdownParameters
TlsSetValue
OpenProcessToken
GetProcessId
TlsFree
TerminateProcess
TlsGetValue
GetCurrentProcess
GetExitCodeProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetSystemDirectoryW
GetComputerNameExW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseSemaphore
CreateEventExW
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
CreateEventW
CreateMutexExW
EnterCriticalSection
WaitForMultipleObjectsEx
ResetEvent
ReleaseMutex
OpenEventW
SetEvent
CreateSemaphoreExW
WaitForSingleObject
AcquireSRWLockShared
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameA
LoadResource
GetModuleHandleW
FreeLibrary
LockResource
GetProcAddress
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
FormatMessageW
SetThreadUILanguage
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-security-base-l1-1-0
GetTokenInformation
AdjustTokenPrivileges
GetLengthSid
CopySid
api-ms-win-core-com-l1-1-0
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoGetApartmentType
api-ms-win-ntuser-sysparams-l1-1-0
GetSystemMetrics
SystemParametersInfoW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegDeleteKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegGetValueW
RegOpenKeyExW
api-ms-win-service-management-l1-1-0
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-rtcore-ntuser-window-l1-1-0
SetTimer
DestroyWindow
KillTimer
DefWindowProcW
GetWindowRect
GetWindowLongW
EnumWindows
SetWindowPos
SetWindowLongW
SendMessageW
GetWindowThreadProcessId
PostMessageW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-shutdown-l1-1-1
InitiateShutdownW
powrprof
SetSuspendState
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
api-ms-win-rtcore-ntuser-draw-l1-1-0
RedrawWindow
api-ms-win-rtcore-ntuser-winevent-l1-1-0
UnhookWinEvent
SetWinEventHook
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-rtcore-ntuser-private-l1-1-0
CreateWindowInBand
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
api-ms-win-ntuser-rectangle-l1-1-0
PtInRect
gdi32
DeleteObject
CreateDIBSection
GetObjectW
dwmapi
DwmIsCompositionEnabled
user32
GetLastInputInfo
GetKeyState
BuildReasonArray
MonitorFromPoint
DefWindowProcA
IsWindowUnicode
RecordShutdownReason
IsSETEnabled
SetPropW
GetUserObjectInformationW
GetThreadDesktop
RemovePropW
DestroyReasons
NotifyWinEvent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
oleaut32
SysFreeString
VariantClear
SysAllocString
api-ms-win-core-com-private-l1-1-0
CoRegisterInitializeSpy
CoRevokeInitializeSpy
api-ms-win-core-path-l1-1-0
PathCchAppend
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=110, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=260, version=27412,
count=4, id=259, version=27412,
count=4, id=261, version=27412,
count=727, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=57, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/authui.dll.mun
- SHA256 c62515f2aa6cf3f59a4e6512466ba9f806f033a6248fed492760025fc1580186
- MD5 3cc4c57a5c91ab0488999a327cc66283
- SHA1 bfb014c1c1385265639977dd423492a6938109f9
- SHA512 1043e14a534ff6977ac999bf64f93526c8cc62be79d3280f2ea2409c5dbd461539f9559b5757c5177d47897d7ace108b5885e40c17248a2b727f9f89520eb2a7
- SSDEEP 768:wS/Tf7bZb/Jcwwgl2Gm0K234CES2JSiGeyAN1CvcRYS:wmTf7lb/Jcwwgl2yIi2lyECsY
- TLSH T16A346AC3E6614F84CCBE5BF156CD46F82A6A2D0B7861726C66F4FD995E33180270C2E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/authz.dll
- IMPHASH 67ca6bdc300ed9bea08813e07ce2ffc2
- SHA256 b5ab0205becd7a8e72050b9f8c12a6e3f901d1e2d1579b60c0f80e134c6083de
- MD5 203afa7dc4fdc288e3a0c8c4976fe920
- SHA1 87a5903c197accb4ef472bb18084eabbb6366ce6
- SHA512 83a1d6949052fe065629253893e402f9e7fd5d69b9ff0132f2f0b2b2f3e2663cf0a50767dc0e9555835aec301462e5f756b45b10e87cf42b7ab012561d9f5bc8
- SSDEEP 3072:TKafxL7cuh3r3H+zKCgiFGTszFgH29rjYOINrnqd4croQLOIsRJQIOG/5Drx3ZKc:uafxL7cuh3ruzK5i6mF429r3NaccQ3st
- TLSH T16F047D52F640ACFAD9B71630A1DBB335197EA8360FA414CB72781E6B78711C1DF38296
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
52160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
authz.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__wtoi64
_o_free
_o_malloc
_o_wcstol
_except_handler4_common
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
wcsstr
memcmp
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-1-0
SetEvent
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
SetThreadStackGuarantee
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThread
CreateThread
SetThreadPriority
GetCurrentProcessId
api-ms-win-security-base-l1-1-0
InitializeAcl
IsWellKnownSid
CreateWellKnownSid
EqualDomainSid
AddAccessAllowedAce
AllocateAndInitializeSid
IsValidSid
IsValidSecurityDescriptor
GetSidSubAuthorityCount
AdjustTokenPrivileges
GetTokenInformation
GetLengthSid
GetSecurityDescriptorControl
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
GetSecurityDescriptorLength
InitializeSid
GetSidSubAuthority
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegEnumValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
GetComputerNameExW
api-ms-win-core-rtlsupport-l1-2-0
RtlCompareMemory
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
RtlValidSecurityDescriptor
RtlOwnerAcesPresent
RtlLengthSecurityDescriptor
RtlMakeSelfRelativeSD
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
NtClose
RtlLengthRequiredSid
RtlIsPackageSid
RtlIsCapabilitySid
RtlCopySid
RtlValidSid
RtlValidRelativeSecurityDescriptor
RtlEqualSid
RtlCopyLuidAndAttributesArray
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlInitString
RtlGetNtProductType
EtwTraceMessage
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlCompareUnicodeString
RtlUpcaseUnicodeChar
RtlIsNameInExpression
NtAllocateLocallyUniqueId
RtlAcquireResourceShared
RtlDeleteResource
RtlInitializeResource
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlSidHashInitialize
NtQuerySecurityAttributesToken
NtQueryInformationToken
RtlReleaseResource
RtlAcquireResourceExclusive
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlLengthSid
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlInitializeSid
RtlNtStatusToDosError
RtlCopyLuid
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AuthzAccessCheck
AuthzAddSidsToContext
AuthzCachedAccessCheck
AuthzComputeEffectivePermission
AuthzEnumerateSecurityEventSources
AuthzEvaluateSacl
AuthzFreeAuditEvent
AuthzFreeCentralAccessPolicyCache
AuthzFreeContext
AuthzFreeHandle
AuthzFreeResourceManager
AuthzGetInformationFromContext
AuthzInitializeCompoundContext
AuthzInitializeContextFromAuthzContext
AuthzInitializeContextFromSid
AuthzInitializeContextFromToken
AuthzInitializeObjectAccessAuditEvent
AuthzInitializeObjectAccessAuditEvent2
AuthzInitializeRemoteAccessCheck
AuthzInitializeRemoteResourceManager
AuthzInitializeResourceManager
AuthzInitializeResourceManagerEx
AuthzInstallSecurityEventSource
AuthzModifyClaims
AuthzModifySecurityAttributes
AuthzModifySids
AuthzOpenObjectAudit
AuthzRegisterCapChangeNotification
AuthzRegisterSecurityEventSource
AuthzReportSecurityEvent
AuthzReportSecurityEventFromParams
AuthzSetAppContainerInformation
AuthzShutdownRemoteAccessCheck
AuthzUninstallSecurityEventSource
AuthzUnregisterCapChangeNotification
AuthzUnregisterSecurityEventSource
AuthziAccessCheckEx
AuthziAllocateAuditParams
AuthziCheckContextMembership
AuthziFreeAuditEventType
AuthziFreeAuditParams
AuthziFreeAuditQueue
AuthziGenerateAdminAlertAuditW
AuthziInitializeAuditEvent
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditParamsFromArray
AuthziInitializeAuditParamsWithRM
AuthziInitializeAuditQueue
AuthziInitializeContextFromSid
AuthziLogAuditEvent
AuthziModifyAuditEvent
AuthziModifyAuditEvent2
AuthziModifyAuditEventType
AuthziModifyAuditQueue
AuthziModifySecurityAttributes
AuthziQuerySecurityAttributes
AuthziSourceAudit
FreeClaimDefinitions
FreeClaimDictionary
GenerateNewCAPID
GetCentralAccessPoliciesByCapID
GetCentralAccessPoliciesByDN
GetClaimDefinitions
GetClaimDomainInfo
GetDefaultCAPESecurityDescriptor
InitializeClaimDictionary
RefreshClaimDictionary
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1349, id=1, productName=Unmarked objects,
count=3, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=35, id=269, version=27412,
count=18, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/autoplay.dll
- IMPHASH a2a46e615c19a58e299193d5a1544332
- SHA256 660267e6f2d05baad168a21f974b13fbb5e2e027a19a38316bd343392fb4513b
- MD5 0f3f17524b5f68cc971fd69ec1f89c41
- SHA1 393bf1e04f462994a3f713b37885965be13f489e
- SHA512 f5d0ad7054665137032de750b34cf0fe6570cf7e4e59055fd34a1436d809823fb925b548c028e0b8f3ac175559160c224d70a41fb015b4ad7b1ca601b2686e38
- SSDEEP 3072:c6XPugAwcxdmzuztVNLThZM1t47A7IcG2a2wZzNgf1MiHdd5pTjFqUwPom:hBAddrVBTy27A7JZz2gzPPTkUm
- TLSH T132045C00B2904861C3FA323CA57A6F35656B6830CBC915DB5F18A7AA3C71BC2AD7535F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
autoplay.pdb
msvcrt
memcpy_s
_unlock
free
_onexit
_except_handler4_common
_initterm
malloc
_amsg_exit
__dllonexit
_XcptFilter
_lock
memcpy
memcmp
_vsnwprintf
_vsnprintf_s
memmove_s
memset
atl
ord30
shell32
ord155
ord18
ord25
SHBindToObject
ShellExecuteExW
SHParseDisplayName
shlwapi
ord437
SHGetValueW
ord256
ord199
ord219
ord544
ord158
ord514
ord24
ord156
ord204
ord174
ord176
SHStrDupW
ord618
SHDeleteValueW
ord538
SHSetValueW
StrCmpIW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FindResourceExW
LockResource
GetModuleHandleW
LoadResource
GetModuleFileNameW
DisableThreadLibraryCalls
LoadLibraryExW
LoadStringW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateMutexExW
ReleaseSemaphore
OpenSemaphoreW
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockShared
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
devobj
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjDestroyDeviceInfoList
kernel32
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
ntdll
EtwEventRegister
EtwEventUnregister
EtwLogTraceEvent
WinSqmAddToStream
EtwEventSetInformation
EtwEventWriteTransfer
dui70
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?GetAtom@Value@DirectUI@@QAEGXZ
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
?GetID@Element@DirectUI@@QAEGXZ
?GetType@Value@DirectUI@@QBEHXZ
?GetBool@Value@DirectUI@@QAE_NXZ
?GetDisplayNode@Element@DirectUI@@QAEPAUHGADGET__@@XZ
?IsDestroyed@Element@DirectUI@@QAE_NXZ
?GetWidth@Element@DirectUI@@QAEHXZ
?GetHeight@Element@DirectUI@@QAEHXZ
?SetHeight@Element@DirectUI@@QAEJH@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?GetHWNDParent@HWNDHost@DirectUI@@QAEPAUHWND__@@XZ
?GetTransparent@HWNDHost@DirectUI@@QAE_NXZ
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?Register@HWNDHost@DirectUI@@SGJXZ
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?CreateAccNameLabel@HWNDHost@DirectUI@@IAEPAUHWND__@@PAU3@@Z
?SyncRect@HWNDHost@DirectUI@@IAEXI_N@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?GetBoolFalse@Value@DirectUI@@SGPAV12@XZ
??1HWNDHost@DirectUI@@UAE@XZ
??0HWNDHost@DirectUI@@QAE@XZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?HeightProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetInt@Value@DirectUI@@QAEHXZ
?GetString@Value@DirectUI@@QAEPBGXZ
?Release@Value@DirectUI@@QAEXXZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetVisible@Element@DirectUI@@QAE_NXZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?GetSelected@Element@DirectUI@@QAE_NXZ
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
??0Macro@DirectUI@@QAE@XZ
??1Macro@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?BuildElement@Macro@DirectUI@@MAEJXZ
?Add@Macro@DirectUI@@UAEJPAPAVElement@2@I@Z
?OnPropertyChanged@Macro@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetIntZero@Value@DirectUI@@SGPAV12@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateInt@Value@DirectUI@@SGPAV12@HW4DynamicScaleValue@@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??0Element@DirectUI@@QAE@XZ
??1Element@DirectUI@@UAE@XZ
?GetClassInfoPtr@Macro@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@Macro@DirectUI@@QAEJPAVElement@2@PAK@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?Register@Element@DirectUI@@SGJXZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?Register@Macro@DirectUI@@SGJXZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
duser
ForwardGadgetMessage
AttachWndProcW
gdi32
SelectObject
GetTextExtentPoint32W
ExcludeClipRect
user32
GetDC
SetWindowPos
GetSystemMetrics
CallWindowProcW
SendMessageW
DestroyIcon
EnableWindow
CreateWindowExW
GetWindowLongW
GetComboBoxInfo
GetParent
MapWindowPoints
ReleaseDC
WindowFromDC
GetWindowRect
LoadCursorW
SetCursor
GetFocus
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=260, version=27412,
count=2, id=261, version=27412,
count=350, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=17, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/avicap32.dll
- IMPHASH 0a42828b1fd6f66ea9c00d06dfef96ed
- SHA256 6b55044f470b4e9649c7f941855feb7e99b2ff6b34c211ca276cf45c634f97ad
- MD5 99feba3327e13ca5cc9412dc56c67311
- SHA1 1608d14aeb084f7274b0c43f0675ceda904ca9b2
- SHA512 cda15eb916b3823d748a5d214f18a69550e783c619e80630416049a68b7a0de4da3c6ab245009d1b654a8c03f6f029924a96c844b656c2cc555c41fab57274fc
- SSDEEP 1536:yVJ/TdAJgOAD/FXo4YMRhacit9tgFPTKay:yVRWJgOAjFXhZRhadPgFPO
- TLSH T11E637D62F2EC64B6DCA255701926AF33DAFDB530423C4AD78F4045277C60AE5E93872B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
57520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
avicap32.pdb
msvcrt
memmove
_vsnwprintf
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
atoi
_vsnprintf
_ftol2
memcpy
memset
msvfw32
ICSeqCompressFrame
DrawDibBegin
ICImageDecompress
DrawDibClose
ICCompressorFree
DrawDibRealize
DrawDibOpen
ICCompressorChoose
DrawDibDraw
DrawDibGetPalette
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalLock
LocalAlloc
GlobalFree
LocalFree
LocalUnlock
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenA
lstrcmpiW
lstrlenW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleHandleW
LoadStringA
GetModuleFileNameW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalReAlloc
GlobalLock
GlobalHandle
api-ms-win-mm-time-l1-1-0
timeGetTime
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetThreadPriority
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetThreadPriority
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetSystemInfo
GetLocalTime
GetTickCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-file-l1-1-0
WriteFile
GetFileAttributesW
GetFullPathNameW
GetFileSize
GetDiskFreeSpaceW
DeleteFileW
CreateFileW
SetFilePointer
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegQueryValueExA
api-ms-win-core-registry-l2-1-0
RegOpenKeyA
RegEnumKeyW
RegOpenKeyW
RegCreateKeyW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-localization-l1-2-0
GetACP
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileStringW
gdi32
SelectPalette
SetWindowOrgEx
RealizePalette
GetObjectW
GetNearestPaletteIndex
GetStockObject
GetPaletteEntries
PatBlt
SelectObject
DeleteObject
CreatePalette
GetClipBox
GetDCOrgEx
GetSystemPaletteEntries
GetDeviceCaps
kernel32
LocalHandle
user32
PostMessageW
IsWindow
DispatchMessageW
TranslateMessage
DefWindowProcW
GetParent
EqualRect
SendMessageW
MsgWaitForMultipleObjects
SetTimer
ClientToScreen
GetClipboardData
SetWindowLongW
KillTimer
LoadCursorW
RegisterClassW
EndPaint
MessageBeep
PeekMessageW
GetDC
MessageBoxW
GetAsyncKeyState
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
SetCursor
GetClientRect
SetRect
UpdateWindow
InvalidateRect
ReleaseDC
GetWindowLongW
CreateWindowExW
UnregisterClassW
GetClassInfoW
BeginPaint
winmm
mmioWrite
waveInClose
waveInStop
mmioOpenW
waveInAddBuffer
mmioSeek
mmioClose
mmioRead
mmioCreateChunk
mmioAscend
mmioDescend
mmioFlush
waveOutGetNumDevs
mciSendStringW
CloseDriver
OpenDriver
SendDriverMessage
waveInStart
waveInOpen
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
AppCleanup
capCreateCaptureWindowA
capCreateCaptureWindowW
capGetDriverDescriptionA
capGetDriverDescriptionW
videoThunk32
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=12, id=260, version=27412,
count=186, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=15, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/avifil32.dll
- IMPHASH f2314692d73d6a7fb58709ef095af4bd
- SHA256 c81c89be3b8fcff5cb76b96d481ac3208fda37cfe4a4693d43cfed25db4bf5b5
- MD5 af5991813865f242a2bb3a43c8f0d509
- SHA1 b8cfb46323526c541b13efe5cf1c7547b85da6a2
- SHA512 089ae4b5abf0fe46fefabac2f26ffdb92d144e25141d854adf6b25d53cde1e3c0aa6e758da4fe14ec742d04512158b6e52ca0187e815df2270ef01550bd4bb6a
- SSDEEP 1536:w1vuz7VyovaxIMbL65/SH/4ZSj2NwEgPXjgmLoSHsAVqDh01V6zgG:wU8rxIMidyQcj2NSPNjWDh0b6zgG
- TLSH T1FE933A11B5101577CBA235B01ACC3F7763ADC9314B5266CBC3248AF5B9706C1AB36BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
83696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
avifil32.pdb
msvcrt
mbstowcs
memcpy
memcmp
memmove
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_purecall
atoi
_vsnwprintf
_ftol2_sse
memset
msvfw32
ICOpen
ICLocate
ICGetInfo
ICCompressorFree
ICClose
ICCompressorChoose
ICDecompress
ICCompress
ICGetDisplayFormat
ICSendMessage
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalSize
GlobalHandle
GlobalReAlloc
GlobalLock
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrlenA
lstrcmpW
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
LocalAlloc
GlobalAlloc
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
api-ms-win-core-com-l1-1-0
CoGetMarshalSizeMax
CoGetMalloc
CoCreateInstance
CoMarshalInterface
CoUnmarshalInterface
CreateStreamOnHGlobal
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
GetLastError
api-ms-win-core-string-l2-1-0
CharPrevW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExA
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegOpenKeyA
RegQueryValueW
RegEnumKeyW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
ResetEvent
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CreateEventW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
GetFullPathNameW
GetFileSize
ReadFile
GetDiskFreeSpaceW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
gdi32
CreatePalette
CreateHalftonePalette
msacm32
acmStreamPrepareHeader
acmStreamClose
acmFormatSuggest
acmStreamOpen
acmStreamConvert
acmFormatDetailsW
acmFormatChooseW
acmFormatTagDetailsW
acmGetVersion
acmStreamSize
acmMetrics
acmStreamUnprepareHeader
ole32
OleInitialize
OleSetClipboard
OleUninitialize
ReleaseStgMedium
OleGetClipboard
OleFlushClipboard
user32
MessageBeep
EndDialog
SendDlgItemMessageW
SendMessageW
MessageBoxW
ReleaseDC
TranslateMessage
PeekMessageW
DispatchMessageW
GetDC
DestroyWindow
IsDlgButtonChecked
SetRect
SetRectEmpty
IsRectEmpty
GetDlgItemInt
GetDlgItem
CheckDlgButton
SetDlgItemInt
DialogBoxParamW
SetDlgItemTextW
EnableWindow
winmm
mmioWrite
mmioSeek
mmioOpenW
mmioClose
mmioRead
AVIBuildFilter
AVIBuildFilterA
AVIBuildFilterW
AVIClearClipboard
AVIFileAddRef
AVIFileCreateStream
AVIFileCreateStreamA
AVIFileCreateStreamW
AVIFileEndRecord
AVIFileExit
AVIFileGetStream
AVIFileInfo
AVIFileInfoA
AVIFileInfoW
AVIFileInit
AVIFileOpen
AVIFileOpenA
AVIFileOpenW
AVIFileReadData
AVIFileRelease
AVIFileWriteData
AVIGetFromClipboard
AVIMakeCompressedStream
AVIMakeFileFromStreams
AVIMakeStreamFromClipboard
AVIPutFileOnClipboard
AVISave
AVISaveA
AVISaveOptions
AVISaveOptionsFree
AVISaveV
AVISaveVA
AVISaveVW
AVISaveW
AVIStreamAddRef
AVIStreamBeginStreaming
AVIStreamCreate
AVIStreamEndStreaming
AVIStreamFindSample
AVIStreamGetFrame
AVIStreamGetFrameClose
AVIStreamGetFrameOpen
AVIStreamInfo
AVIStreamInfoA
AVIStreamInfoW
AVIStreamLength
AVIStreamOpenFromFile
AVIStreamOpenFromFileA
AVIStreamOpenFromFileW
AVIStreamRead
AVIStreamReadData
AVIStreamReadFormat
AVIStreamRelease
AVIStreamSampleToTime
AVIStreamSetFormat
AVIStreamStart
AVIStreamTimeToSample
AVIStreamWrite
AVIStreamWriteData
CreateEditableStream
DllCanUnloadNow
DllGetClassObject
EditStreamClone
EditStreamCopy
EditStreamCut
EditStreamPaste
EditStreamSetInfo
EditStreamSetInfoA
EditStreamSetInfoW
EditStreamSetName
EditStreamSetNameA
EditStreamSetNameW
IID_IAVIEditStream
IID_IAVIFile
IID_IAVIStream
IID_IGetFrame
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=14, id=260, version=27412,
count=135, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=2, id=261, version=27412,
count=1, id=256, version=27412,
count=24, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/avrt.dll
- IMPHASH 95a7e62f0b2e2596fa0e286d442d690a
- SHA256 fc5942e7308caa1e6389e655c386be2f184a50ee3a6750adc0f5ba2b202d521b
- MD5 fd6eb4b72d967811bb987b3161be5387
- SHA1 4811196ca86e511d31cce1ffed042001f27b4aa3
- SHA512 fbe8e07e2492d5b81282a00af95380338194d56385075e62bc37194c387806f151fe884548a3bd65061ed4d018e8d6b80c9b6f72a360de2a0091c976697f6241
- SSDEEP 384:yb6DM9dpKshxqW5WW2oWx3T7pOlW/IFDBRJY+Hj+R9z3CG:y9DKi5+/7Ih1PHHji9z
- TLSH T1D6D2F942EBEC9546E4FB2A706A7AD1277A397A564F00D0EB2045A36C0C75BC49F70B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
27:6c:84:e6:fa:c9:6e:bc:f0:7f:12:3a:44:6f:44:c1:4e:d7:92:af:68:5c:8d:f5:9a:d2:19:61:c1:1d:a1:8d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b4:fb:80:08:44:05:d2:2d:fa:00:01:00:00:01:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
avrt.pdb
ntdll
NtCreateFile
RtlUnhandledExceptionFilter
NtTerminateProcess
NtDeviceIoControlFile
LdrDisableThreadCalloutsForDll
RtlMultiByteToUnicodeN
RtlNtStatusToDosError
NtClose
NtSetInformationThread
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-service-management-l1-1-0
OpenServiceW
CloseServiceHandle
OpenSCManagerW
StartServiceW
AvCreateTaskIndex
AvQuerySystemResponsiveness
AvQueryTaskIndexValue
AvRevertMmThreadCharacteristics
AvRtCreateThreadOrderingGroup
AvRtCreateThreadOrderingGroupExA
AvRtCreateThreadOrderingGroupExW
AvRtDeleteThreadOrderingGroup
AvRtJoinThreadOrderingGroup
AvRtLeaveThreadOrderingGroup
AvRtWaitOnThreadOrderingGroup
AvSetMmMaxThreadCharacteristicsA
AvSetMmMaxThreadCharacteristicsW
AvSetMmThreadCharacteristicsA
AvSetMmThreadCharacteristicsW
AvSetMmThreadPriority
AvSetMultimediaMode
AvTaskIndexYield
AvTaskIndexYieldCancel
AvThreadOpenTaskIndex
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
356B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27412,
count=25, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=5, id=260, version=27412,
count=1, id=256, version=27412,
count=5, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/azman.msc
- SHA256 2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180
- MD5 c5b3e109b3b88b0cc420304ea7bf6b70
- SHA1 75c0f59c487bdb4efb937fb996730f696ade0530
- SHA512 e0f6b4efef1c96ca1b101eeed65f87bf3823b60ae4cc80cfe077c7840d4e2757e8789f08fd1dd37372ff39348cff900db0b3e1ce29dc55a0ed98506f65264ea3
- SSDEEP 192:wPZ/vtP4EfpAs41Yqjghaj7P7yzLYykP7yHPDP7yjP7y6H:0Nss4zj7PUYVPEDPoP9H
- TLSH T1F0131B325CC2A7D157360C00C18CF7AC9D3907972A8AA5A7B64C76667FAA0704B7F97C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/azroles.dll
- IMPHASH a8aef7c8040b3b06d40ec5b530e378ee
- SHA256 0cb60383cce3a70f1fad9a11eeb68b15b4faa222ac9b476bb09ea1728239ee3e
- MD5 52383da8719133eba89f79fd1c1a718e
- SHA1 1ca500ff89abaf01bfa6fed9c328ae957c243612
- SHA512 08652103b4e372be3920b686dcd57c6ef4315399faca0f05a02486b308932c3b008b5819439d8f5e5a40e296a66cdbe95641a9f79820a4c59dbda6525cbf57d2
- SSDEEP 12288:b8JYxOScDfdDIaxSVke76URT6PkB8gd0cWnXyKCTtOOdN:b8JYQPtIaxOko6U8PkB840HwTtOOD
- TLSH T16BB44A52B68590B2D2E6213051DE3336A5BEA4E04F719AD32310D6F97CE66C17F3A34E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
392256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
azroles.pdb
msvcrt
_lock
realloc
_errno
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
_wtoi64
wcstol
iswxdigit
towlower
wcsstr
_wcsupr
bsearch
qsort
_wcsnicmp
_unlock
wcsncmp
iswspace
wcspbrk
wcschr
ldiv
strrchr
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_vsnprintf
_purecall
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
_wcsicmp
__dllonexit
_onexit
memmove
memcmp
_wtol
memset
memcpy
wcsrchr
_vsnwprintf
swscanf
srand
__CxxFrameHandler3
ntdll
RtlCopySid
RtlLengthSid
RtlNtStatusToDosError
NtAllocateLocallyUniqueId
RtlDeleteResource
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
RtlIdentifierAuthoritySid
RtlValidSecurityDescriptor
RtlValidSid
RtlNumberGenericTableElementsAvl
RtlEnumerateGenericTableAvl
NtClose
RtlFreeHeap
NtCreateFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlInitString
RtlEqualSid
RtlImageNtHeader
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlConvertExclusiveToShared
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlConvertSharedToExclusive
user32
CharUpperW
UnregisterClassA
CharNextW
kernel32
ResolveDelayLoadedAPI
SetThreadStackGuarantee
CompareStringW
GetSystemInfo
VirtualAlloc
DelayLoadFailureHook
VirtualQuery
QueryPerformanceCounter
GetCurrentThreadId
GetTickCount
VirtualProtect
CreateFileW
GetLastError
CloseHandle
MultiByteToWideChar
FindResourceW
SizeofResource
LoadResource
LockResource
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
WideCharToMultiByte
LocalAlloc
LocalFree
GetEnvironmentVariableW
CreateDirectoryW
GetCurrentProcessId
WriteFile
GetLocalTime
GetVersionExW
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetCurrentThread
GetCurrentProcess
GetComputerNameW
GetSystemTimeAsFileTime
GetFileAttributesW
GetVolumeInformationW
GetFileAttributesExW
CompareFileTime
DeleteFileW
GetFullPathNameW
LoadLibraryW
SetLastError
FormatMessageW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CoInitializeEx
CoUninitialize
CLSIDFromProgID
StringFromCLSID
StringFromGUID2
oleaut32
SafeArrayUnaccessData
SafeArrayDestroy
VariantInit
SafeArrayCreate
VariantClear
SafeArrayPutElement
VariantChangeType
SafeArrayGetVartype
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VarCmp
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SafeArrayGetDim
VariantCopy
SysFreeString
VarUI4FromStr
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
SafeArrayAccessData
LoadRegTypeLi
advapi32
RegCloseKey
LsaNtStatusToWinError
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
CreateWellKnownSid
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
LookupAccountNameW
LookupAccountSidW
ConvertSidToStringSidW
PerfCreateInstance
PerfSetCounterRefValue
PerfSetCounterSetInfo
PerfStartProvider
PerfStopProvider
ConvertStringSidToSidW
RegQueryValueExW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
MakeSelfRelativeSD
AdjustTokenPrivileges
SetSecurityDescriptorSacl
AddAuditAccessAceEx
AddAccessAllowedObjectAce
AddAccessAllowedAceEx
IsValidSid
GetAce
GetAclInformation
GetSecurityDescriptorLength
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
CopySid
DuplicateTokenEx
OpenProcessToken
EqualDomainSid
SetThreadToken
OpenThreadToken
GetTokenInformation
GetLengthSid
LsaOpenPolicy
authz
AuthziInitializeAuditEventType
AuthziAllocateAuditParams
AuthziInitializeAuditParamsWithRM
AuthziInitializeAuditEvent
AuthziLogAuditEvent
AuthzAccessCheck
AuthzInitializeContextFromSid
AuthzInitializeContextFromToken
AuthzAddSidsToContext
AuthzGetInformationFromContext
AuthzFreeContext
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzFreeAuditEvent
AuthziFreeAuditEventType
AuthziFreeAuditParams
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
UuidToStringA
RpcStringFreeA
UuidFromStringW
dsparse
DsQuoteRdnValueW
ntdsapi
DsFreeNameResultW
DsBindW
DsCrackNamesW
DsUnBindW
odbc32
ord145
ord132
ord9
ord141
ord139
ord107
ord31
ord77
ord29
ord111
ord13
ord26
ord43
ord4
ord72
ord176
ord136
AzAddPropertyItem
AzApplicationClose
AzApplicationCreate
AzApplicationDelete
AzApplicationEnum
AzApplicationOpen
AzAuthorizationStoreDelete
AzCloseHandle
AzContextAccessCheck
AzContextGetAssignedScopesPage
AzContextGetRoles
AzFreeMemory
AzGetProperty
AzGroupCreate
AzGroupDelete
AzGroupEnum
AzGroupOpen
AzInitialize
AzInitializeContextFromName
AzInitializeContextFromToken
AzOperationCreate
AzOperationDelete
AzOperationEnum
AzOperationOpen
AzRemovePropertyItem
AzRoleCreate
AzRoleDelete
AzRoleEnum
AzRoleOpen
AzScopeCreate
AzScopeDelete
AzScopeEnum
AzScopeOpen
AzSetProperty
AzSubmit
AzTaskCreate
AzTaskDelete
AzTaskEnum
AzTaskOpen
AzUpdateCache
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
401KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=23, id=260, version=27412,
count=372, id=1, productName=Unmarked objects,
count=25, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=34, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/azroles.dll.mun
- SHA256 fb96fdf59b9dea5e965704bf43c3b6daaecb82a54b35e4b52ec567c902dc75e1
- MD5 a5c520d770028524fa220ee93043ea22
- SHA1 afcc3eab959d4f52592cf360c10460a1a39c6990
- SHA512 b5254a2125c08b1ebaa7e6e72407b95d16430eb2ffb65a3d620da6d4b6dcf86a61a64fa362048bd5790e58cba5f3b2770bf049fb00d79bcc5a87b4d9ef4ec744
- SSDEEP 768:1570u4sLnJfA5ZWVc7Zy5VfpD48NltQvJOtDK+2/htdQO+DzwTYIw4PKumdNhoIE:157lVohtdQ5z+gXFOIy
- TLSH T11844A793554B81B0A276D7367565FC10E839A33B88EE5C08B4FC90816F35A65FBB93C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/azroleui.dll
- IMPHASH c7bfd1696d82a1c9befdd80688a2f53f
- SHA256 a522ce0ac035af02ba68848e070e649cc6516c51b13429e0521615ba19cba59b
- MD5 73ae97fe03eabc5c5630676651683bb1
- SHA1 169dbe2feae119f1ed4829b5ce83f143cd1c5b9d
- SHA512 8bb4608422c122a83cdcc153ad4a86509cafab3578f695385a864077750c674041595d73f500dbf0cea51cf67b3cd51efa26ff73e8e40819a9b4af911a275628
- SSDEEP 6144:T5kE9qx38Nov4Lvw0H+hoY4XmOLkrrJiIiQ2RTIeoCaDNCqs:T5kE9qmNosY4UMDRTIeo
- TLSH T11A642822B744D476E5DE12785509A3BAD0FE95A12FE082CBDB14EB9E2C373C14F38469
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
212320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
azroleui.pdb
mfc42u
ord4418
ord4616
ord5285
ord5303
ord4074
ord5296
ord3341
ord2388
ord6237
ord3281
ord6667
ord693
ord2574
ord6051
ord1768
ord4396
ord5286
ord3635
ord567
ord942
ord496
ord771
ord4352
ord2520
ord4371
ord6195
ord2634
ord3867
ord3087
ord535
ord5977
ord858
ord4273
ord4197
ord925
ord3948
ord2717
ord561
ord815
ord1128
ord3733
ord3396
ord5710
ord4692
ord5298
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord656
ord4831
ord4279
ord6688
ord6211
ord1662
ord2644
ord1560
ord268
ord2776
ord5679
ord4470
ord3084
ord354
ord665
ord5647
ord3122
ord3611
ord350
ord5180
ord3313
ord5438
ord4294
ord539
ord3993
ord6898
ord6896
ord922
ord927
ord5706
ord6919
ord6921
ord3296
ord941
ord4272
ord6640
ord2755
ord2756
ord3605
ord4270
ord3792
ord4124
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord3592
ord5276
ord4847
ord4370
ord641
ord324
ord4229
ord6024
ord3871
ord4829
ord2859
ord825
ord6266
ord2858
ord1637
ord1143
ord2430
ord3649
ord2576
ord4215
ord6451
ord2371
ord3694
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2385
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2036
ord2440
ord5830
ord2640
ord4435
ord3793
ord5283
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4704
ord4992
ord4848
ord5261
ord4942
ord4970
ord4736
ord4899
ord5154
ord5156
ord5155
ord768
ord489
ord4253
ord1008
ord1197
ord538
ord940
ord5568
ord2910
ord2606
ord823
ord6390
ord5446
ord6379
ord5436
ord2099
ord3658
ord2836
ord861
ord2248
ord2810
ord1165
ord4155
ord6466
ord800
ord540
ord4238
msvcrt
_wtoi64
_ltow
_wcsicmp
_itow
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
iswprint
wcstoul
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
__RTDynamicCast
_wcsnicmp
_wcsicoll
realloc
free
_amsg_exit
iswdigit
malloc
_purecall
??0exception@@QAE@ABQBD@Z
_lock
_unlock
__dllonexit
_onexit
??_V@YAXPAX@Z
__CxxFrameHandler3
??0exception@@QAE@ABQBDH@Z
_wtol
memset
atl
ord22
ord21
ord15
ord18
ord16
ord44
ord45
ord32
ord43
ntdll
RtlCreateUnicodeString
RtlFreeUnicodeString
kernel32
GetSystemWindowsDirectoryW
GlobalFree
SetEvent
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CreateEventW
CloseHandle
OutputDebugStringA
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
SetLastError
InitializeCriticalSection
GetLastError
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
ResetEvent
LoadLibraryA
GetTickCount
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
Sleep
LocalFree
LocalAlloc
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DeactivateActCtx
FindFirstFileW
FindClose
MultiByteToWideChar
GetVersionExW
FormatMessageW
CompareStringW
GetCommandLineW
ExpandEnvironmentStringsW
GetFullPathNameW
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
HeapAlloc
ActivateActCtx
ReleaseActCtx
DecodePointer
IsProcessorFeaturePresent
GetProcessHeap
FlushInstructionCache
InterlockedPopEntrySList
InterlockedPushEntrySList
UnhandledExceptionFilter
GetProcAddress
CreateActCtxW
SetUnhandledExceptionFilter
user32
MsgWaitForMultipleObjects
GetDlgCtrlID
LoadMenuW
GetSubMenu
ScreenToClient
ChildWindowFromPointEx
RegisterClipboardFormatW
LoadStringW
DestroyWindow
CreateWindowExW
GetSysColor
GetSysColorBrush
SetFocus
GetClientRect
MapWindowPoints
GetFocus
MessageBoxW
MessageBeep
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
EnumWindows
FindWindowExW
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
EnableWindow
GetWindowTextW
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
PostMessageW
LoadBitmapW
LoadImageW
SetForegroundWindow
LoadIconW
SendMessageW
GetParent
DispatchMessageW
PeekMessageW
SetWindowTextW
CallNextHookEx
GetDlgItem
KillTimer
SetTimer
PostThreadMessageW
CloseClipboard
oleaut32
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
SafeArrayGetElement
SafeArrayGetLBound
SysStringLen
VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString
SafeArrayGetUBound
ole32
CoUninitialize
ReleaseStgMedium
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
LsaOpenPolicy
ConvertSidToStringSidW
LsaClose
LsaFreeMemory
EqualPrefixSid
LsaLookupSids
ConvertStringSidToSidW
CopySid
GetLengthSid
shlwapi
PathAddBackslashW
PathFindFileNameW
PathRemoveFileSpecW
PathStripPathW
secur32
TranslateNameW
shell32
SHGetFolderLocation
ord258
SHGetMalloc
CommandLineToArgvW
ord259
SHBrowseForFolderW
SHGetPathFromIDListW
netutils
NetApiBufferFree
dsrole
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
logoncli
DsGetDcNameW
gdi32
GetObjectW
DeleteObject
dsuiext
ord10
ntdsapi
DsFreeNameResultW
DsCrackNamesW
activeds
ord13
ord9
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
230KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=27412,
count=15, id=260, version=27412,
count=39, id=257, version=27412,
count=466, id=1, productName=Unmarked objects,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=33, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/basecsp.dll
- IMPHASH 18ea49613516a1130c5ed0ebcc3e9fba
- SHA256 d6a3ea2acba2224c8e25565968bab070941ead2746b9c933914af00388e1982d
- MD5 1873441cc15ac90d8936194692abf1f3
- SHA1 d6d8e69772a96975a5da69de5307f667415c4825
- SHA512 a234cea107a1b646c0148ce0c1f5eaac411431ceb13859b2a79d434a511f5768112aa0628f84a236b460a1545412c3a0007526432a97e9854fcd16a44a427880
- SSDEEP 3072:sZZzcp+ViQX2DbJUk5i2x7qigdtV3gmcmDjJYcx2KoAxA0WE7Jso:svcmi7ZUWxDgdXbvD9Ycx2KD6EF
- TLSH T1FD147C25B1A6C83EDE332634463B227BA8BD6D992F6594C335D4FD2A9C35AC01731B0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5d:c2:e9:e0:ed:c0:df:82:0f:ff:29:1d:36:2e:cc:11:6a:3d:17:ad:41:94:9a:ad:9d:b2:9f:aa:84:a7:35:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 17, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f7:58:20:75:04:ca:fb:c2:f4:00:01:00:00:01:f7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
143936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
basecsp.pdb
msvcrt
__dllonexit
_unlock
??1type_info@@UAE@XZ
__CxxFrameHandler3
_onexit
?terminate@@YAXXZ
_except_handler4_common
_initterm
malloc
free
memcpy
memcmp
_ftol2
_CxxThrowException
_amsg_exit
_XcptFilter
wcsncmp
memmove_s
wcschr
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
_vsnprintf
wcsnlen
time
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
_lock
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
LoadStringW
LoadLibraryExA
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegSetValueExA
RegCreateKeyExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
CreateSemaphoreExW
EnterCriticalSection
ReleaseSRWLockExclusive
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSectionEx
CreateEventW
ReleaseSRWLockShared
ReleaseMutex
WaitForSingleObject
SetEvent
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSection
AcquireSRWLockExclusive
OpenEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
IsThreadpoolTimerSet
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
OpenProcessToken
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
GetSystemDefaultLCID
GetThreadLocale
FormatMessageW
LocaleNameToLCID
GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
rpcrt4
RpcStringFreeW
I_RpcExceptionFilter
NdrClientCall2
UuidToStringW
UuidCreate
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-security-base-l1-1-0
GetTokenInformation
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptCreateHash
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-string-obsolete-l1-1-0
lstrlenA
lstrlenW
ntdll
RtlImageNtHeader
EtwTraceMessage
RtlNtStatusToDosError
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeAnsiString
RtlInitAnsiString
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CPAcquireContext
CPAcquireContextW
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer
Name
.text
Size
147KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=27412,
count=13, id=260, version=27412,
count=4, id=259, version=27412,
count=217, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=40, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/batmeter.dll
- IMPHASH 892b04df0b14d559ab317e382f67bf91
- SHA256 043ec0edc6be8421b349dd503e7c8f41dd14d9356a4edaf0b67d6f6951757ee8
- MD5 a42603fc9523c41ed1517d46d07c47a7
- SHA1 ab028a5c05c4f853b2c630a000bf95f2e912977f
- SHA512 491e1f6e26bd248604bd9f07d60aeadbd8d05bffc02bd7e5b1d948101a7ae1a9744956b2dadeb41902eae51cfc1f938b1821f0e645ca255654391a692f97f877
- SSDEEP 768:J12OfGz5Sg6gfl3yVAr+ioRKb/duLZB6ic:SgG1b7+iZ/KZoic
- TLSH T103E22B20A50880A3D963167C587BAF2B92BE54602F301ADFA6407DFD6F743E17B3164B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
batmeter.pdb
msvcrt
qsort
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_except_handler4_common
memset
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
api-ms-win-power-base-l1-1-0
GetPwrCapabilities
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
CreateEventW
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObject
ResetEvent
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
GetSystemPowerStatus
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
ntdll
RtlPublishWnfStateData
NtQueryWnfStateData
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwRegisterTraceGuidsW
gdi32
CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
SetStretchBltMode
GetDIBits
CreateDIBSection
StretchBlt
user32
RegisterDeviceNotificationW
GetSystemMetrics
UnregisterDeviceNotification
PostMessageW
LoadImageW
GetDC
SystemParametersInfoW
DestroyIcon
GetSystemMetricsForDpi
ReleaseDC
advapi32
RegOpenKeyW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BatMeterIconAnimationReset
BatMeterIconThemeReset
BatMeterOnDeviceChange
CleanupBatteryData
CreateBatteryData
GetBatMeterIconAnimationState
GetBatMeterIconAnimationTimeDelay
GetBatMeterIconAnimationUpdate
GetBatteryCapacityInfo
GetBatteryDetails
GetBatteryImmersiveIcon
GetBatteryInfo
GetBatteryStatusText
GetBatteryWorkingState
IsBatteryBad
IsBatteryHealthWarningEnabled
IsBatteryLevelCritical
IsBatteryLevelLow
IsBatteryLevelReserve
PowerCapabilities
QueryBatteryData
SetBatteryHealthWarningState
SetBatteryLevel
SetBatteryWorkingState
SubscribeBatteryUpdateNotification
UnsubscribeBatteryUpdateNotification
UpdateBatteryData
UpdateBatteryDataAsync
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=110, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=1, id=261, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=8, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/batmeter.dll.mun
- SHA256 0428b7d95b6ead354c5bc191a8d3513707cf54e0e2dac6d1301e3090cd4e39ff
- MD5 081a9ce9ee41363fb06ca3eeb39d18b6
- SHA1 8708b5b5e712a8ead92e607edd36a0ce8b509603
- SHA512 04de4b3805f20c176f6190630abfaaf26e4321521254f5db316fca2b4bc6269df88c5ea0b413ef2665ff22c43ff5cd36d6ef1de687ded9d001792a9404588e6e
- SSDEEP 6144:AP0LLLCLLeLLL9UXIFw3333333BF3xIH3VQ:WXPIH3
- TLSH T169754E80BA91C623F4144AB9ECABD6FE0E217D17DD80A18BB6F47F7F38B0654690905D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bcastdvr.proxy.dll
- IMPHASH 1b05ea5f90a138982c4f04f953c32511
- SHA256 77acd1774a7b49cfd31fdbf0a9d0fab8a9ff32bb1275f14984b6416f04a0ca37
- MD5 84f7a71425aa3d2f99cf4e94eb32d8a7
- SHA1 52e1891686f12fa5742085a6696d96d4f8cdfd2e
- SHA512 540c8474ecf16b6bf1118fc3445012dd12ddfc19ad62725cbba04298223d0ff4b489c5d0750e2d20d1c3bc93b65a592698bfb3a4e4e726d0fc0637ab41faa36c
- SSDEEP 1536:IyMzOwjmlDa0tp7ptlTNwu6ylZUVG74po30:IyMLmlbpLNwCleVGEpo30
- TLSH T178D33424E7AD1038C19DB6BDC44513B9960E1F22FFD186C668486ED46FB20529F327B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
107440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcastdvr.proxy.pdb
msvcrt
_except_handler4_common
_initterm
malloc
_XcptFilter
_amsg_exit
free
memcmp
rpcrt4
CStdStubBuffer_Disconnect
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_CountRefs
NdrStubCall2
CStdStubBuffer_IsIIDSupported
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
ObjectStublessClient27
CStdStubBuffer2_CountRefs
ObjectStublessClient28
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient11
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
CStdStubBuffer2_Connect
ObjectStublessClient26
ObjectStublessClient24
ObjectStublessClient10
NdrProxyForwardingFunction3
ObjectStublessClient25
ObjectStublessClient22
ObjectStublessClient18
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient17
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=80, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=17, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bcd.dll
- IMPHASH df5b05ae22cdebbeaa8e3c66cc5e87bd
- SHA256 999eb9d00ef06c9b5a0ac7f5cbbff41cb54e13831df83c0bda1a031323128fa8
- MD5 1f562c7b4190c4f5c8586c2c64f558e2
- SHA1 8810fb9c2bee9d92da6f0bdf010492624ef5a0f3
- SHA512 51e3d72e640e928031472090bdcb5f0b17782feeb26c9bc00b8306c7475aa9ff4d8fa2976faf8924266979551e0905b6a09b81f2ae1649570768b735a896cfcf
- SSDEEP 1536:T2uqOA8VMdjHAk3lpJUDh+QHII7ZNh4KZYnMXFFTOh35jGl9Ph+zg:qu5A8VMRHt3L4h+QoI5PynMXLzl9I0
- TLSH T1BDB3F9427AE58550F2F3BC7C16BA4E7A083BBD2459B1D54F6300825E7F32AA2C53771A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:47:84:7c:fc:1f:7c:5d:ca:00:06:71:10:0a:a4:2c:dd:8f:2b:d2:48:95:75:bd:f7:04:9a:3a:fe:98:20:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b4:fb:80:08:44:05:d2:2d:fa:00:01:00:00:01:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
88016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcd.pdb
ntdll
wcscpy_s
wcscat_s
wcsrchr
wcsncpy_s
ZwAllocateUuids
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
ZwQueryKey
RtlSetDaclSecurityDescriptor
ZwCreateFile
ZwCreateKey
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlAllocateAndInitializeSid
RtlLengthSid
ZwFlushKey
ZwDeleteValueKey
ZwSaveKey
RtlFreeSid
ZwDeleteKey
wcschr
ZwEnumerateKey
ZwQueryValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
ZwSetValueKey
ZwQuerySystemInformation
ZwOpenKey
RtlAppendUnicodeToString
_ultow_s
wcstoul
_vsnwprintf
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
_wcsicmp
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
strcpy_s
RtlGetVersion
ZwOpenDirectoryObject
_wcsnicmp
_vsnwprintf_s
ZwWaitForSingleObject
ZwReleaseMutant
ZwOpenMutant
LdrGetProcedureAddress
ZwQueryVolumeInformationFile
LdrGetDllHandle
ZwQueryInformationProcess
RtlInitAnsiString
ZwDeleteFile
ZwQueryInformationFile
ZwOpenProcess
memmove
RtlUnwind
RtlCompareMemory
wcsstr
swprintf_s
strncmp
_wcsupr
RtlGUIDFromString
wcsnlen
ZwClose
ZwOpenFile
RtlFreeHeap
RtlStringFromGUID
RtlInitUnicodeString
RtlFreeUnicodeString
ZwQueryAttributesFile
RtlAllocateHeap
NtQuerySystemInformation
NtAdjustPrivilegesToken
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx
NtClose
NtPrivilegeCheck
RtlImpersonateSelf
NtOpenSymbolicLinkObject
NtOpenKey
NtQuerySymbolicLinkObject
_snwscanf_s
_wcslwr
NtDeviceIoControlFile
NtSetValueKey
NtOpenFile
NtQueryValueKey
NtDeleteKey
NtQueryBootEntryOrder
NtQueryBootOptions
NtSetSecurityObject
NtTranslateFilePath
NtOpenDirectoryObject
NtQueryDirectoryObject
NtEnumerateBootEntries
NtCreateKey
memcmp
memcpy
memset
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
BcdCloseObject
BcdCloseStore
BcdCopyObject
BcdCopyObjectEx
BcdCopyObjects
BcdCreateObject
BcdCreateStore
BcdDeleteElement
BcdDeleteObject
BcdDeleteObjectReferences
BcdDeleteSystemStore
BcdEnumerateAndUnpackElements
BcdEnumerateElementTypes
BcdEnumerateElements
BcdEnumerateElementsWithFlags
BcdEnumerateObjects
BcdExportStore
BcdFlushStore
BcdForciblyUnloadStore
BcdGetElementData
BcdGetElementDataWithFlags
BcdGetSystemStorePath
BcdImportStore
BcdImportStoreWithFlags
BcdMarkAsSystemStore
BcdMigrateObjectElementValues
BcdOpenObject
BcdOpenStore
BcdOpenStoreFromFile
BcdOpenSystemStore
BcdQueryObject
BcdSetElementData
BcdSetElementDataWithFlags
BcdSetLogging
BcdSetSystemStoreDevice
GUID_BAD_MEMORY_GROUP
GUID_BOOT_LOADER_SETTINGS_GROUP
GUID_CURRENT_BOOT_ENTRY
GUID_DEBUGGER_SETTINGS_GROUP
GUID_DEFAULT_BOOT_ENTRY
GUID_EMS_SETTINGS_GROUP
GUID_FIRMWARE_BOOTMGR
GUID_GLOBAL_SETTINGS_GROUP
GUID_HYPERVISOR_SETTINGS_GROUP
GUID_KERNEL_DEBUGGER_SETTINGS_GROUP
GUID_RESUME_LOADER_SETTINGS_GROUP
GUID_WINDOWS_BOOTMGR
GUID_WINDOWS_LEGACY_NTLDR
GUID_WINDOWS_MEMORY_TESTER
GUID_WINDOWS_OS_TARGET_TEMPLATE_EFI
GUID_WINDOWS_OS_TARGET_TEMPLATE_PCAT
GUID_WINDOWS_RESUME_TARGET_TEMPLATE_EFI
GUID_WINDOWS_RESUME_TARGET_TEMPLATE_PCAT
GUID_WINDOWS_SETUP_EFI
GUID_WINDOWS_SETUP_PCAT
GUID_WINDOWS_SETUP_RAMDISK_OPTIONS
PARTITION_BASIC_DATA_GUID
PARTITION_CLUSTER_GUID
PARTITION_ENTRY_UNUSED_GUID
PARTITION_LDM_DATA_GUID
PARTITION_LDM_METADATA_GUID
PARTITION_MSFT_RECOVERY_GUID
PARTITION_MSFT_RESERVED_GUID
PARTITION_MSFT_SNAPSHOT_GUID
PARTITION_SPACES_GUID
PARTITION_SYSTEM_GUID
SyspartDirectGetSystemDisk
SyspartDirectGetSystemPartition
SyspartDirectSetSystemDevice
SyspartGetPhysicalPartitions
SyspartGetSystemDisk
SyspartGetSystemPartition
SyspartIsSpace
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=3, id=257, version=27412,
count=112, id=1, productName=Unmarked objects,
count=7, id=260, version=27412,
count=1, id=256, version=27412,
count=20, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bcrypt.dll
- IMPHASH b6a247bebbe359a2c85c40344e34ab03
- SHA256 92b82358a9339d0d139173d2c047f89047fefe09b9c6abb733997c053546c0f1
- MD5 96a03b66d1eefa72b7e53a132e33b91c
- SHA1 ed67a176a3bd901e4977200c84de8485c15bc0b5
- SHA512 ab390462dd35865c4284d2b7ced3dc9e3de3befd495939f6e656eded77ad42124a4d2941aca099bc6bd94e53cf81adec5a8792286c9c0af31a643d68f503c442
- SSDEEP 1536:TZqoyE6ZOXynuDW5ehRbRpLQ6b7OO0NX9oU2E4KWiB0brCZ3DFPzzP:ljyE6gCnuiehJr3OO0NtoZE4KWTrYTFv
- TLSH T1ADA36C01FAD888B1E9F1303951EAA67A637E93600B9076DB9304D79F6DA17C19E3025F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a2:6a:65:29:41:2f:76:49:3e:d4:da:22:cf:46:2a:07:c2:6e:da:b6:86:d4:5c:2f:99:83:41:70:8b:aa:45:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 4, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fa:fb:3b:44:d3:77:33:c6:d3:00:01:00:00:01:fa
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
37856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcrypt.pdb
ntdll
RtlInitUnicodeString
NtClose
NtQueryValueKey
RtlAllocateHeap
NtQueryInformationProcess
RtlDeleteCriticalSection
RtlDeleteResource
RtlAcquireResourceShared
RtlReleaseResource
RtlEnterCriticalSection
RtlInitializeResource
RtlAcquireResourceExclusive
RtlInitializeCriticalSection
RtlLeaveCriticalSection
NtOpenKey
NtDeviceIoControlFile
NtOpenFile
RtlNtStatusToDosError
RtlCompareUnicodeString
_wcsicmp
RtlImageNtHeader
RtlUnwind
EtwTraceMessage
memcpy
RtlUnhandledExceptionFilter
NtTerminateProcess
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
LdrDisableThreadCalloutsForDll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventWrite
RtlFreeHeap
wcsncmp
_alloca_probe
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-processthreads-l1-1-0
SetThreadStackGuarantee
GetCurrentProcess
OpenProcessToken
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
PrivilegeCheck
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemDirectoryW
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
VirtualAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BCryptAddContextFunction
BCryptAddContextFunctionProvider
BCryptCloseAlgorithmProvider
BCryptConfigureContext
BCryptConfigureContextFunction
BCryptCreateContext
BCryptCreateHash
BCryptCreateMultiHash
BCryptDecrypt
BCryptDeleteContext
BCryptDeriveKey
BCryptDeriveKeyCapi
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptDuplicateHash
BCryptDuplicateKey
BCryptEncrypt
BCryptEnumAlgorithms
BCryptEnumContextFunctionProviders
BCryptEnumContextFunctions
BCryptEnumContexts
BCryptEnumProviders
BCryptEnumRegisteredProviders
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptFreeBuffer
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptGetFipsAlgorithmMode
BCryptGetProperty
BCryptHash
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptKeyDerivation
BCryptOpenAlgorithmProvider
BCryptProcessMultiOperations
BCryptQueryContextConfiguration
BCryptQueryContextFunctionConfiguration
BCryptQueryContextFunctionProperty
BCryptQueryProviderRegistration
BCryptRegisterConfigChangeNotify
BCryptRegisterProvider
BCryptRemoveContextFunction
BCryptRemoveContextFunctionProvider
BCryptResolveProviders
BCryptSecretAgreement
BCryptSetAuditingInterface
BCryptSetContextFunctionProperty
BCryptSetProperty
BCryptSignHash
BCryptUnregisterConfigChangeNotify
BCryptUnregisterProvider
BCryptVerifySignature
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27412,
count=99, id=1, productName=Unmarked objects,
count=6, id=259, version=27412,
count=6, id=260, version=27412,
count=1, id=256, version=27412,
count=20, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bcryptprimitives.dll
- IMPHASH 4cce8d9ecc924490b99f23b06cc1be0c
- SHA256 ed60e23bece1ae79a8453e2f86af74747e67bdadfc016e8b82224f134011fb10
- MD5 6d18ede65422902af6976a5121eba761
- SHA1 fb21429153a21303ebcb60c1b33a189eb4fb002d
- SHA512 46906a56a6cdc8b0fe20e8144dd4b93e73677ea63b34d697fd6ee4d7dad3fcaa8697ea8c5856602686a25c95b57e3005204c6f536e9726afed5b83227e2809fb
- SSDEEP 6144:jm0otolqqD/w/1yODuOB9ZuXd7rNytg2Tx5G2Gp+LgWozmHRCFkeryX:EoIqTruB9ZuXlNqlJRozoRsker+
- TLSH T10A84AF12F6C0A497E4522170619F33BF257D5EB107E400D78B9839AF6B32BE06A3579B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b0:45:e1:bd:bc:a1:b4:2b:2d:28:79:49:39:5d:17:d6:b2:88:16:cd:7c:66:2c:17:1f:12:4f:52:47:ca:af:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:8d:7b:46:06:30:18:cc:48:62:00:00:00:00:04:8d
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 16, 2024 - May 14, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:99:99:95:f1:dc:e3:20:eb:00:01:00:00:01:e2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
210880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcryptprimitives.pdb
ntdll
RtlAllocateHeap
RtlFreeHeap
NtOpenKey
NtClose
NtQueryValueKey
NtQueryInformationProcess
wcscpy_s
RtlGetCurrentProcessorNumberEx
RtlImageNtHeader
qsort
RtlUnwind
EtwGetTraceEnableFlags
EtwTraceMessage
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlInitUnicodeString
memmove
RtlUnhandledExceptionFilter
EtwRegisterTraceGuidsW
NtTerminateProcess
_wcsicmp
NtOpenFile
_vsnwprintf
_alloca_probe
memcmp
memcpy
memset
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
SetThreadStackGuarantee
TerminateProcess
GetCurrentProcess
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualAlloc
VirtualProtect
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
api-ms-win-core-xstate-l2-1-0
GetEnabledXStateFeatures
GetAsymmetricEncryptionInterface
GetCipherInterface
GetHashInterface
GetKeyDerivationInterface
GetRngInterface
GetSecretAgreementInterface
GetSignatureInterface
MSCryptConvertRsaPrivateBlobToFullRsaBlob
ProcessPrng
ProcessPrngGuid
Name
.text
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27412,
count=66, id=1, productName=Unmarked objects,
count=13, id=259, version=27412,
count=1, id=256, version=27412,
count=113, id=269, version=27412,
count=7, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bdaplgin.ax
- IMPHASH 27c4f5d7c9693e94433e5cf3fc2cbda7
- SHA256 6d6c4729e8de9d89fdc71f8dea7db48fce1065e859574026ce79f54364c06883
- MD5 431e60d6afb31ed1bbd760bfddf1a585
- SHA1 9c27f32a91eb630075596a294b0e3677dc9dff32
- SHA512 12873fff657e82c148a0468802387ed19fb0587830283ba667be8b959053328ae15509183bd6ed02d857eb589d9b46b79dbbb2224641f9f8ff248d173a0fc1f3
- SSDEEP 1536:9ASVfy92UBL69uSUC3oHqjz7ay4YSEvBwUZIi:9b9y92kmuSUyoHq/7aFYSEvBwUZF
- TLSH T18573386237D48979F5EA21BD002D7376A1BF90704BE01AC74F2452DBAEF87D25A30587
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
62816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bdaplgin.pdb
msvcrt
wcschr
strcpy_s
swscanf_s
memcpy_s
_vsnwprintf
malloc
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
strcat_s
?what@exception@@UBEPBDXZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
__CxxFrameHandler3
?terminate@@YAXXZ
_vsnprintf
free
calloc
_purecall
??1exception@@UAE@XZ
wcscpy_s
??1type_info@@UAE@XZ
_errno
realloc
_except_handler4_common
memcpy
wcstok_s
memset
kernel32
RaiseException
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetTickCount
GetCurrentProcess
GetModuleFileNameA
GetVersionExW
DisableThreadLibraryCalls
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
OutputDebugStringA
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
GetLastError
OutputDebugStringW
SetEvent
CloseHandle
CreateThread
ResetEvent
DeleteCriticalSection
WriteFile
GetTempPathW
CreateFileW
GetCurrentThreadId
GetLocalTime
advapi32
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
user32
CharUpperBuffW
ole32
CoFreeUnusedLibraries
CoInitializeEx
StringFromGUID2
StringFromIID
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
IIDFromString
CoCreateInstance
CoWaitForMultipleHandles
CoCreateGuid
oleaut32
SafeArrayDestroy
SafeArrayUnaccessData
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayAccessData
VarBstrCat
ws2_32
ntohs
ntohl
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=125, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=6, id=261, version=27412,
count=20, id=260, version=27412,
count=1, id=256, version=27412,
count=20, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bg-BG/SyncRes.dll.mui
- SHA256 88c3910640b6143f01c2e92e3629a42c7c1ef31d4f1ea19e05b95ad8866024f4
- MD5 f8a3ca8c1c8df481e4dc60623f701d9a
- SHA1 764e3097cf5e59290defcd76ff73ea9258c5aa5f
- SHA512 83d7e42a380b90e7aac8c038dfd35c7049c1401cbec9e37890d888fe1cd45b3e89de5863e989fe8393f0fa6674dc5407f507b89bf477f84b354a418161992581
- SSDEEP 768:L0c3mquvs9ybpMXRsml26RcHZZhZ379n/Q/G/i9THhjWGr:L0mmquvpbiX5lNRcHZ53JI+6eGr
- TLSH T1F6E2EC4FF97D9600F698E3710E6246E721BA7B4077280ACA528F7D78702CA3177292C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bg-BG/comctl32.dll.mui
- SHA256 378b8dfd58a1b178d85929c2b860b78aadc3175603f22be27c44240c31a78b67
- MD5 254f1961ea87ef954a13000a149f551c
- SHA1 f6c27df824663b1f8643d91c82c2f17c162a3fab
- SHA512 27578816707fec6493fdaf230e0a602c97e1939a31be938ae69859e4a3e16c1cc3cd5e5fd34959ed4e3e2db85219db767d2cc4d413b0759398496f89cd6941db
- SSDEEP 96:3iksGWa4W2jWrapspVir6Hue+HXWA/Weps:39A5SC6K1Weps
- TLSH T1FFC1C60FFB799511F44AD7760A9707E2267ABA117325538BCB4F7C1D7028630BB24AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bg-BG/quickassist.exe.mui
- SHA256 16806a2b8786a6aec06acc65c6c5bd8396fa652e873c184240f485af63db9816
- MD5 b8111525b1c39fcf576637bcd3b74ed4
- SHA1 1b3459d43d428b28398516eb497694d6c6df350b
- SHA512 8267027f6c6c009337d2a20fc4ecce395d19aff57cd9fec62b793750dd74c0303655d67d3655bf9ea9e57af2bf1d4b522b49b1b8f25ab608c80f49c47987e4b6
- TLSH T15F818D4FA6BA4105F555CB304EE209D726BD3B127776669E8B0F34243024634B775BA3
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bg-BG/windows.ui.xaml.dll.mui
- SHA256 59c3a552c241fda9f0c05e20f7a8638ce2799275d07affe0677eda910e29c0a7
- MD5 8bd37f4033b3775ac2431a4c438bb49c
- SHA1 61e5d460d434cfa8f269553e5eaed789b3571eef
- SHA512 4c614a40afff21249dd0f6af48401ec3129a7b4633bcdc19ff51fa772980bd1fb4b65a8defd136fc4bb54f0ab4a6c28e098d6729584cf1d44b27c6360483f198
- SSDEEP 192:YV6xNzAHJLmDomQASMJDuV+rhAPjUa6Od80Ec6E+Xe69nWjB7:FApd+r+DQHuMnWjx
- TLSH T1C782850FB9FDA214F665D2700FAA47E722BA7711732187C9928F3D29641C6307B216DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bidispl.dll
- IMPHASH 6ae9d908fa1df7f3df94ed06bd390150
- SHA256 e5b07c24020f9c60cf912a119df766eeb526841b8da7b5a8b0a9df9bfd87ad73
- MD5 4fc8b7f83a5f28683663ae22e60f5424
- SHA1 58093684c47fafb6da33d90de78bb1370e3e1d5f
- SHA512 a558618dfa9542f0bfe8006b977cb701b2fb723c55c085b0be7434f6a715916eafbcc70acbf0c3f1e425a99ef373833b7c92b8ecfe34dbc14ff179d8b746993b
- SSDEEP 768:sXsy6ODHxHufc0IuBaleTsfkSwuEs++OFY5crHFlSl:esy6OrxOfczu8ysfXE3+Bcrz
- TLSH T11B330941AAC989B6D3F239B411693570BA7EB51717A000C3726FD3563B72DC2AD3B21B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
39632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bidispl.pdb
msvcrt
_amsg_exit
_initterm
_XcptFilter
_unlock
malloc
swscanf
_vsnwprintf
memcpy_s
free
_callnewh
_lock
__dllonexit
_onexit
_except_handler4_common
_wcsicmp
memcpy
memset
kernel32
GetCurrentProcessId
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
IsDebuggerPresent
DebugBreak
GetProcessHeap
CreateMutexExW
GetModuleFileNameW
SetLastError
GetLastError
GetModuleHandleW
GetProcAddress
FindResourceW
SizeofResource
LoadResource
LockResource
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
oleaut32
SysStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit
SysAllocStringLen
winspool.drv
OpenPrinterW
ClosePrinter
crypt32
CryptBinaryToStringW
CryptStringToBinaryW
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=260, version=27412,
count=3, id=259, version=27412,
count=81, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=2, id=261, version=27412,
count=1, id=256, version=27412,
count=14, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bitsperf.dll
- IMPHASH ecadf0428408ba7cd17471037a52cf50
- SHA256 937a83a1d023ad6cae7c3d9677c7c33cf8f5f7afa3b263c17e1bb6409e06a5d2
- MD5 82ca769f90474d5193abd865d12be7ed
- SHA1 41928814db8f3b5eaa437816fafff69b5f2ea6cb
- SHA512 4948bd414a8c6fa4aabbb9ff93fc3de97fab7801f0728e1209d2a9d2d5f3618f14842caea82e93d68eeb989abd8c7a6f20fc6e78644eff86af1d3180d0e8d49f
- SSDEEP 768:VrfH5teup/XrZOA2jlX3YGB9X7/EKm4fTx/LzUmrI:VrSuBrZMjlX30ITxUmrI
- TLSH T1A3C22950B3ED4670F2F9667058B9B17A8A2CB9584FB1C0CF4B75016F17702E16A3479B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bitsperf.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcpy
_o__seh_filter_dll
_o__wcsicmp
_except_handler4_common
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
ntdll
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceLoggerHandle
RtlGetPersistedStateLocation
RtlNtStatusToDosError
EtwGetTraceEnableLevel
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
??0CPerfMon@@QAE@PAGPAU_PERF_ITEM@0@@Z
??1CPerfMon@@QAE@XZ
??4CPerfMon@@QAEAAV0@ABV0@@Z
?CalcBytesForPerfObject@CPerfMon@@ABEKPAU__OBJECT_ORD@1@@Z
?CalcPerfMetrics@CPerfMon@@ABEXPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@PAU_PERF_METRICS@1@PAPAU_PERF_ITEM@1@@Z
?Collect@CPerfMon@@QAEKPAGPAPAEPAK2@Z
?CollectAllObjects@CPerfMon@@ABEKPAGPAPAEPAK2@Z
?CollectAnObject@CPerfMon@@ABEKPAU__OBJECT_ORD@1@PAPAE@Z
?ConvertInstIdToInUseInstId@CPerfMon@@ABEHPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@@Z
?CounterIdToObjectOrd@CPerfMon@@ABEPAU__OBJECT_ORD@1@PAU__COUNTER_ID@1@PAH@Z
?CounterIdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__COUNTER_ID@1@@Z
?CounterIdToPerfItemIndex@CPerfMon@@ABEHPAU__COUNTER_ID@1@PAH@Z
?CounterOrdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ORD@1@PAU__COUNTER_ORD@1@@Z
?DetermineObjectsToCollect@CPerfMon@@ABEXPAU__OBJECT_ORD@1@@Z
?GetCounter32@CPerfMon@@QAEPAJPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?GetCounter64@CPerfMon@@QAEPA_JPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?GetCounter@CPerfMon@@AAEPAEPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?HowManyInstancesAreInUse@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?IdToPerfItemIndex@CPerfMon@@ABEHHK@Z
?Initialize@CPerfMon@@QAEKH@Z
?InitializePerfMon@CPerfMon@@AAEKH@Z
?IsValidInstId@CPerfMon@@ABEHPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@@Z
?IsValidObjOrd@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?ObjectIdToObjectOrd@CPerfMon@@ABEPAU__OBJECT_ORD@1@PAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItemIndex@CPerfMon@@ABEHPAU__OBJECT_ID@1@@Z
?ObjectOrdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ORD@1@@Z
?ObjectOrdToPerfItemIndex@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?VerifyPerfItemTable@CPerfMon@@AAEKXZ
PerfMon_Close
PerfMon_Collect
PerfMon_Open
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=27412,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1136, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=5, id=270, version=27412,
count=15, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/biwinrt.dll
- IMPHASH a6051a89155d8b7f5985043adfe2a85c
- SHA256 0e3f19821b82e4e9a61bf19066ac90ce53bc890a908bca5d0acb4fb2dee11f30
- MD5 7dfc499727295df32f5fc7fd8c23a8f2
- SHA1 82584f80076388be974b168a88c430af78e13696
- SHA512 3b330567d82b271c419a2233342ec5c217580e06cf990859043f282e902b97a0b6dd4cf1f8b111de5b06362340fcedf1a4fb992a2eb2558ed73b6e2236167a4e
- SSDEEP 3072:8b8lxN0SWSGwjqO6iHC3PaaxttVarVXX+NdXuSmZI74YhJZaWMbKAw7rpokVSMf1:6ONOys1RmZ8vn43bKfFrx
- TLSH T1D44449A1AAF8597ADBF63274655D353680AEA6614FE0C3CF0760C5E96D207C24C3C26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
94:0d:40:f2:fc:6d:62:17:fe:a0:85:b4:a7:37:e5:5f:d8:ef:55:0b:2d:bd:cd:5f:d7:e4:78:2d:dd:92:34:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dc:c1:e0:8c:c2:5f:58:5e:8e:00:01:00:00:01:dc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
98064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
biwinrt.pdb
msvcrt
_initterm
?terminate@@YAXXZ
_amsg_exit
??1type_info@@UAE@XZ
realloc
_except_handler4_common
malloc
free
_lock
memmove_s
__CxxFrameHandler3
__dllonexit
_XcptFilter
wcschr
toupper
?what@exception@@UBEPBDXZ
_callnewh
_CxxThrowException
_vsnprintf_s
_unlock
memmove
memcpy
??0exception@@QAE@ABV0@@Z
memcmp
_ftol2
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
_onexit
memset
ntdll
RtlCompareUnicodeString
RtlInitUnicodeString
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
WinSqmAddToStreamEx
RtlFreeHeap
RtlQueryPackageClaims
RtlAllocateHeap
RtlCompareMemory
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlRunOnceBeginInitialize
RtlRunOnceInitialize
RtlReportException
RtlRunOnceComplete
RtlCaptureContext
NtQueryInformationToken
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObjectEx
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSemaphore
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
DeleteCriticalSection
ReleaseMutex
OpenSemaphoreW
InitializeSRWLock
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
LeaveCriticalSection
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDuplicateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsCreateStringReference
api-ms-win-core-com-l1-1-0
CoDecrementMTAUsage
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoUnmarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoGetClassObject
CoIncrementMTAUsage
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
GlobalFree
oleaut32
SysFreeString
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventProviderEnabled
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
rpcrt4
RpcBindingBind
RpcBindingCreateW
RpcBindingFree
NdrAsyncClientCall2
RpcAsyncCompleteCall
RpcExceptionFilter
NdrClientCall4
RpcAsyncInitializeHandle
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-service-private-l1-1-0
WaitServiceState
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BiRtCreateEventForApp
BiRtDeleteEventForApp
BiRtEnumerateBrokeredEvents
BiRtIsValidActivationTypeForEventType
BiRtQueryBrokerEventId
BiRtRegisterWorkItem
BiRtRegisterWorkItemClsid
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
Name
.text
Size
218KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=6, id=259, version=27412,
count=179, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=19, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/boot.sdi
- SHA256 cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd
- MD5 22d9945b4aae36dd59620a918f2e65f4
- SHA1 bb025cedca07887916c4b7e5fa7a641ed3e30c14
- SHA512 dd2d0ea7d5cf98064838ce0b74711f77534e1a2a14c7f74d44ed4b83acdb6f413d74671d2c6a8574aee88afb456b53a6b8452419a3bdddf2f7e9095c9d1d272e
- SSDEEP 3072:S/pcj53vs/InbrTIHvPnHmC5irUuMo/+ncoZZihnh:acRn7y/EouH/cpi
- TLSH T1F3E54B52E6209B16E2FEC339D9BB1B2673A6AC06D302410FF606B3D96DBB7509DC4453
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/bopomofo.uce
- SHA256 a5e7c6508a2196f0cf43bd0883a169399862d1b7f1bcbf6edfa27bacb869a93f
- MD5 405e1ef8e3c88e9bcd2853382bb12430
- SHA1 1969eac326713e1ee48b7cecf58d74a7df2d2613
- SHA512 958eb1071464c284ead6e8289b06440e4bbe53780af78e57210c40890f9e81f46a74b153cb0fe9805e6568a79a1181c416526ba2c46397777dbeb54b6efee2a9
- SSDEEP 384:m9QFLE7LikPjEwAyoJFBmUntV4hsMeJRW+/TVa:bFLSVESetIy/pa
- TLSH T193A25B1F161630DBF9BB117428E8A92BC3A03B691AF69F5944F710B7913D74FA049C28
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/browcli.dll
- IMPHASH b8e81fa15afc02e922bf3ba0e990e504
- SHA256 55ff7266051318b287be1efdf29d79f46b35044c95fd157834263c317b8ce92c
- MD5 52c1869865209499b08360fd6cac5ce4
- SHA1 e671c6c136ef247de4eee56e313720170e888a14
- SHA512 6d4981274a7c783fe2424ec5434bd2fcdd76f52dcbca99fee7af68e708fd9431663ff4a0ab21fb8ae652510ecf8526ec2b0935c4f56e0f0ca988e0abee78a709
- SSDEEP 768:j52+Ns0dQXFEYgcn7tE9LQYYI/yAuIWyQhhCiyue9lo+J+jIGR:jNNs0uX5gcn7CVRyAuIYEx9lou+jIGR
- TLSH T19F136C42F3828CE5C66A22711497A775226FBE325FD40DCBA317182DBA905D39E3C387
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
browcli.pdb
msvcrt
__RTDynamicCast
strcpy_s
??3@YAXPAX@Z
??1type_info@@UAE@XZ
wcscat_s
strchr
wcsncpy_s
isdigit
qsort
_wcsnicmp
wcscpy_s
_itow_s
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
memset
rpcrt4
NdrClientCall4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObjectEx
api-ms-win-core-handle-l1-1-0
CloseHandle
ntdll
RtlInitializeResource
RtlGetLastNtStatus
RtlNtStatusToDosError
RtlInitAnsiString
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtSetInformationThread
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
NtOpenFile
NtDeviceIoControlFile
RtlCopyUnicodeString
NtClose
RtlInitUnicodeString
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
LocalReAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
I_BrowserDebugCall
I_BrowserDebugTrace
I_BrowserQueryEmulatedDomains
I_BrowserQueryOtherDomains
I_BrowserQueryStatistics
I_BrowserResetNetlogonState
I_BrowserResetStatistics
I_BrowserServerEnum
I_BrowserSetNetlogonState
NetBrowserStatisticsGet
NetServerEnum
NetServerEnumEx
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=12, id=260, version=27412,
count=109, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=47, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/browseui.dll
- IMPHASH b429f31c58eeee044a709f8379118854
- SHA256 3148ab1453328e58ff77a058994b5732093bb9180ce43eae5f767e4f6750d331
- MD5 2eb41df7c70da5c6a1b298a1ba034ffc
- SHA1 66fc1c3e7da4f539d6948b3e85b1bc8d90695816
- SHA512 961c0958fe7ec5494ac3d7c92cee84b79edca07b6e52e1d5f04664bcdb084bb189049ac05ef907b084a1966b885ed3ba0b5cdd46c2c6b592462326d231d2f7b4
- SSDEEP 192:cH3grJMW4HdvmO2q0+QDUVf9D1EoiuEc3ZwW3TW:/FMWQQ7q0+QDUVf9DOVWZwW3TW
- TLSH T191321905F3504BA9E7776FB029EC7E3703BEB9240F31E1CBA560514EA865D80F864266
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
browseui.pdb
msvcrt
_wcsicmp
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcpy
_except_handler4_common
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DllGetVersion
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
986B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=24, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/bthprops.cpl
- IMPHASH 78b53c954017d5dd18c8ddde20660bb0
- SHA256 9c3c7cac914ad8828c7ea16f9aa9af19714d3e586071f63c366ec12c192a133f
- MD5 edaf647f7552cca5b536b73941ef083a
- SHA1 0b6410f26bcf8fb5368a8496046aa9971cd63111
- SHA512 7c555b9b51c998ce76f99c36d21a1c17acccaeabac102d6ab95daaad8784927e3ecb25573a0d79559aaa4422ba6c4af120e21835e55ae84b81970528809327a1
- SSDEEP 3072:lIqPSRD/5qFwv3Q6FvVSUa8S2gLDDADdfhT8DR0ytYRPsDNgvaD9IuSW:lIfDBqSg61RaF29DT8DR0caPsiMIur
- TLSH T14A24D4C1AEF44071F1B32A7026AB2AB3232E7C195FE5E1D7174036AAE9719C1D93D316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bthprops.pdb
msvcrt
__CxxFrameHandler3
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
memcmp
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
??0exception@@QAE@ABQBD@Z
calloc
?terminate@@YAXXZ
wcstombs
free
swscanf
memmove_s
memcpy_s
_vsnwprintf
_XcptFilter
_get_errno
_set_errno
memcpy
memset
shcore
ord190
SHStrDupW
IsOS
IUnknown_SetSite
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
FreeLibraryAndExitThread
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
CreateMutexW
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
CreateEventW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
CreateThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
GetUserDefaultLocaleName
FormatMessageW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
PropVariantClear
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
oleaut32
SysFreeString
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
rpcrt4
UuidToStringW
RpcStringFreeW
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathParseIconLocationW
PathCombineW
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
ntdll
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
kernel32
CreateEventExW
ResetEvent
SetEvent
shell32
ord168
ord167
ord169
SHCreateItemFromParsingName
ord6
SHCreateItemInKnownFolder
ShellExecuteExW
SHGetIDListFromObject
Shell_NotifyIconW
ord170
SHGetItemFromObject
ShellExecuteW
user32
SetCursor
LoadCursorW
GetKeyState
GetParent
FindWindowW
ShowWindow
PostMessageW
SetWindowTextW
EndDeferWindowPos
SetFocus
IsWindow
DeferWindowPos
GetClientRect
SetWindowPos
LoadMenuW
CreateWindowExW
GetSubMenu
RemoveMenu
DestroyMenu
DialogBoxParamW
BeginDeferWindowPos
GetMenuItemInfoW
GetMenuItemCount
GetDlgItemTextW
DeleteMenu
UnregisterDeviceNotification
EndDialog
EnableWindow
MapWindowPoints
SetDlgItemTextW
GetWindowRect
GetDlgItem
RegisterClassW
SetWindowLongW
SetProcessDPIAware
EnumWindows
SendMessageW
RegisterWindowMessageW
MessageBoxW
DefWindowProcW
InSendMessageEx
RegisterDeviceNotificationW
PostQuitMessage
TrackPopupMenuEx
SetForegroundWindow
GetShellWindow
LoadImageW
GetWindowLongW
SetMenuItemInfoW
EnableMenuItem
GetDoubleClickTime
GetSystemMetrics
SetTimer
DestroyIcon
DestroyWindow
KillTimer
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
devobj
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList
BluetoothAuthenticateDevice
BluetoothAuthenticateDeviceEx
BluetoothAuthenticateMultipleDevices
BluetoothAuthenticationAgent
BluetoothDisconnectDevice
BluetoothDisplayDeviceProperties
BluetoothEnableDiscovery
BluetoothEnableIncomingConnections
BluetoothEnumerateInstalledServices
BluetoothFindBrowseGroupClose
BluetoothFindClassIdClose
BluetoothFindDeviceClose
BluetoothFindFirstBrowseGroup
BluetoothFindFirstClassId
BluetoothFindFirstDevice
BluetoothFindFirstProfileDescriptor
BluetoothFindFirstProtocolDescriptorStack
BluetoothFindFirstProtocolEntry
BluetoothFindFirstRadio
BluetoothFindFirstService
BluetoothFindFirstServiceEx
BluetoothFindNextBrowseGroup
BluetoothFindNextClassId
BluetoothFindNextDevice
BluetoothFindNextProfileDescriptor
BluetoothFindNextProtocolDescriptorStack
BluetoothFindNextProtocolEntry
BluetoothFindNextRadio
BluetoothFindNextService
BluetoothFindProfileDescriptorClose
BluetoothFindProtocolDescriptorStackClose
BluetoothFindProtocolEntryClose
BluetoothFindRadioClose
BluetoothFindServiceClose
BluetoothGetDeviceInfo
BluetoothGetRadioInfo
BluetoothIsConnectable
BluetoothIsDiscoverable
BluetoothIsVersionAvailable
BluetoothMapClassOfDeviceToIconPath
BluetoothMapClassOfDeviceToString
BluetoothRegisterForAuthentication
BluetoothRegisterForAuthenticationEx
BluetoothRemoveDevice
BluetoothSdpEnumAttributes
BluetoothSdpGetAttributeValue
BluetoothSdpGetContainerElementData
BluetoothSdpGetElementData
BluetoothSdpGetString
BluetoothSelectDevices
BluetoothSelectDevicesFree
BluetoothSendAuthenticationResponse
BluetoothSendAuthenticationResponseEx
BluetoothSetLocalServiceInfo
BluetoothSetServiceState
BluetoothUnregisterAuthentication
BluetoothUpdateDeviceRecord
CPlApplet
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=260, version=27412,
count=278, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=8, id=261, version=27412,
count=4, id=259, version=27412,
count=1, id=256, version=27412,
count=32, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/btpanui.dll
- IMPHASH 2fb9817d5a655a55d440c9bd8a1d273b
- SHA256 691bfc01c1fc667e2564b6107621f8858612ba3777523f6b1b2b11958ce5af70
- MD5 ad4b37a9967ba9e146b0c9aa61e603ae
- SHA1 3ccf8d8ced711e11002665454c8b43991b3e54d9
- SHA512 dfab8a5f65b647460c622ce6f572c574ca7ce713f93d94615c502feb59f763780443b96d171d3c56b96878213d4332593edf65bcb86db1cc189fd97d24c9f49f
- SSDEEP 768:bCde3eWw+SsfjWEgQqPmddyVEW6pI1qwdsSt3WmQb:mM3eWrfjpqeuVK6gwd9t
- TLSH T1FCB393C27E7844B7F5B6297062979A77031E6E101FC2058336957B9EEE32598EC3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
btpanui.pdb
msvcrt
__CxxFrameHandler3
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
realloc
free
malloc
memcpy
_XcptFilter
memset
kernel32
FindResourceW
LoadResource
SizeofResource
FreeLibrary
CloseHandle
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
GetCurrentProcess
GetCurrentThread
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryExA
EncodePointer
DecodePointer
InterlockedPushEntrySList
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
VerSetConditionMask
lstrcpynW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
lstrcmpiW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
SetLastError
GetLocalTime
LocalFree
GetLastError
FormatMessageW
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
advapi32
FreeSid
AllocateAndInitializeSid
DuplicateToken
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegDeleteKeyW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient7
ObjectStublessClient3
oleaut32
VarI4FromStr
user32
LoadStringW
MessageBoxW
LoadImageW
SetWindowLongW
GetWindowLongW
GetParent
GetDlgItemTextW
SendDlgItemMessageW
SetDlgItemTextW
EnableWindow
GetDlgItem
CharNextW
shell32
ShellExecuteW
SHGetFolderPathW
SHCreateItemFromParsingName
ShellExecuteExW
SHGetIDListFromObject
rpcrt4
IUnknown_Release_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
ntdll
RtlVerifyVersionInfo
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=24, id=260, version=27412,
count=264, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=29, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/c_GSM7.DLL
- IMPHASH 4ffe53aac89d176977d70900c8b63580
- SHA256 dbaadcfaf9817e8c270bd69cceba60d534adea341cb609c10d7052f5b7ccfa90
- MD5 a01b0bd1568ba53d2967e3df8df02f12
- SHA1 13a86eb99c743b4dda456d11206093d7f42dcd4e
- SHA512 2afc46646c09cc7877a00fa953907f535c2fe61312b6f28b38263344ecb0e07f7fbb0a804bd4a53ad5e7509f3fd8ac829831ce0f0fa12ddc13320524f175cc70
- SSDEEP 192:0ivYqdypXVdGWQs0F5XA2HPt29+hY4EucQAWizW8Oujv:RdKWWQs0F9AQtk++NQAWizW8OE
- TLSH T10942390DB3B5C6EAE5FA1E7514653B36D27FB9201FE3925B8E9013892828463F17031A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c_GSM7.pdb
msvcrt
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcpy
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
ntdll
RtlFreeHeap
RtlAllocateHeap
NlsDllCodePageTranslation
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=24, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=1, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cabapi.dll
- IMPHASH eded28ac5d7febb37caa6664870c9946
- SHA256 531a9d52a32c43e975f8284a830059000b30dbc2ec5e5b71a5e048663f296c43
- MD5 824005a6c9733ec01b79242afc89d33b
- SHA1 55a26a7a7166719850905ae6cd8f20050c95401a
- SHA512 6b646f5043728f739f62391851da2d19fc155d3fdf0173ae15f88182695b2f3f7a8f181a4b75abe6563c169f44e4a94cb9646c4ca894a959a9784b187bb6de5e
- SSDEEP 1536:aqQ4xUPl4wKaoG5Kqdp6K0sxhCm2lB+WXdK3pydzgzhTDDcrBUsN:04xUtSp6p6kQtB+AdDODorBUs
- TLSH T181734A223A5184B6D2B9347C347E6A7992FF45204FE002C34F746BEE7E396D2993065E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
60048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CabAPI.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__crt_atexit
_o__wcsicmp
_o__wcsnicmp
_o__wsplitpath_s
_o_free
_o_malloc
_o_rand
_o_wcscpy_s
_except_handler4_common
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
__CxxFrameHandler3
_o___stdio_common_vsnprintf_s
_o__configure_narrow_argv
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
memset
wcsncmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
cabinet
ord11
ord14
ord22
ord23
ord10
ord12
ord13
ord20
ord21
ntdll
NtClose
RtlRaiseStatus
VerSetConditionMask
DbgPrintEx
RtlDeleteCriticalSection
RtlInitializeCriticalSection
api-ms-win-core-file-l1-1-0
ReadFile
FindFirstFileW
FindNextFileW
WriteFile
SetFilePointer
FindClose
CreateFileW
SetFileTime
SetFileAttributesW
GetFileInformationByHandle
FileTimeToLocalFileTime
CreateDirectoryW
GetFullPathNameW
GetFileAttributesW
DeleteFileW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-kernel32-legacy-l1-1-0
FileTimeToDosDateTime
DosDateTimeToFileTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
Cab_CheckIsCabinet
Cab_CreateCab
Cab_CreateCabSelected
Cab_Extract
Cab_ExtractOne
Cab_ExtractOneToBuffer
Cab_ExtractSelected
Cab_ExtractSelectedToTarget
Cab_FreeBuffer
Cab_FreeFileList
Cab_FreeFileSizeList
Cab_GetFileList
Cab_GetFileSizeList
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=27412,
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1273, id=1, productName=Unmarked objects,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=41, id=265, version=27412,
count=22, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cabinet.dll
- IMPHASH aa8fec983b5950909a9c036f70ca7ead
- SHA256 f845e2da5bd505146dce56546f01dab05dd23c975cbbf50260619817bc4a71dd
- MD5 08b8ca7b31109c4ee55d6ca2e2f11a93
- SHA1 c57fa74d1253bcfad48c462059a9bdb250e247fc
- SHA512 34e0d9ae09bdb9855457c624e68fdf6aaf36f3db4023f3b248afb4569b852e73dabf133f1387fc5d85a5e8df5d84ccc6e1f6a9e11509cf7a9f6f3c9887c15d7c
- SSDEEP 3072:lBdaFH7hmla16QHdVy9JxKDZseF0ro4j8vumo/jfBO26Nn9p:3dawlwDTZseF0roruVJOp
- TLSH T14EC39D81FE0044B5C5D7E978525FAA364ABE47A3030065CB1BA8EDF16D217D2BE3874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ae:3f:f3:31:51:71:dc:54:3c:de:ed:2b:95:68:24:f7:07:91:3c:d1:5a:26:d9:80:58:28:9e:d5:d8:cc:a8:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d2:21:24:31:4a:58:bf:2d:11:00:01:00:00:01:d2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
32448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
cabinet.pdb
api-ms-win-crt-string-l1-1-0
memset
memmove_s
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memmove
_o__seh_filter_dll
_o__wcsicmp
_o_memcpy_s
_except_handler4_common
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-file-l1-1-0
SetFilePointer
ReadFile
SetFileTime
WriteFile
LocalFileTimeToFileTime
CreateFileA
CreateDirectoryA
SetFileAttributesA
DeleteFileA
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiA
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
ntdll
RtlGetCompressionWorkSpaceSize
NtQueryValueKey
RtlComputeCrc32
RtlCompressBuffer
RtlDecompressBufferEx
NtClose
RtlInitUnicodeString
NtOpenKey
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CloseCompressor
CloseDecompressor
Compress
CreateCompressor
CreateDecompressor
Decompress
DeleteExtractedFiles
DllGetVersion
Extract
FCIAddFile
FCICreate
FCIDestroy
FCIFlushCabinet
FCIFlushFolder
FDICopy
FDICreate
FDIDestroy
FDIIsCabinet
FDITruncateCabinet
GetDllVersion
QueryCompressorInformation
QueryDecompressorInformation
ResetCompressor
ResetDecompressor
SetCompressorInformation
SetDecompressorInformation
Name
.text
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1139, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=1, id=256, version=27412,
count=55, id=269, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=10, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cabview.dll
- IMPHASH fe9f2351ea03a4c402575adcf9707584
- SHA256 db2e25c42072e04bb777a21243bd20cb65b468d21d7782ebd227286f01c7888e
- MD5 f3422e229a93e4fcf3023dbae280a425
- SHA1 39897e4ccc7bce1ed86445712b1b05ea558c5a6c
- SHA512 c47a3d4c4637462f792027ae3d172181b1e2de29113dc634b8f6d9cb7660e27e0e009aa40a9f6fce853f8bb12655738e7f9d75c57c98adf09218e1aeea78ee77
- SSDEEP 3072:FkF7JlyaZx2aVKrYfNDnGOb+ahXNqJohealn5Iu:F0yeVs8NDGOb+asE75Iu
- TLSH T1B2E39EE17D0497A9D0AE1430443F4E210575BD224F714DC3A6A8BD6E5EB23C2A93B9BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
46928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cabview.pdb
msvcrt
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
malloc
free
memcpy_s
_except_handler4_common
_vsnwprintf
memmove
memcpy
memset
shell32
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
AssocGetDetailsOfPropKey
ord743
ord701
ord256
ord744
ord27
ord846
ord152
SHBindToParent
SHBindToObject
ord19
SHGetPathFromIDListA
SHBrowseForFolderW
ord155
ord18
shlwapi
ord619
PathSkipRootW
AssocCreate
PathFindExtensionW
PathAppendW
PathIsRelativeW
PathCanonicalizeW
ord158
SHStrDupW
PathIsUNCW
ord199
ord172
ord186
PathFindFileNameW
PathCombineW
PathAddBackslashA
ord216
ord456
PathFindFileNameA
ord217
ord215
StrRetToBufW
ord219
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
SetThreadPriority
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
FindResourceExW
LoadResource
LockResource
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
LoadStringW
GetModuleFileNameW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
AcquireSRWLockExclusive
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalFree
GlobalAlloc
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
PropVariantClear
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
api-ms-win-core-file-l1-1-0
SetFilePointer
ReadFile
LocalFileTimeToFileTime
GetTempFileNameW
CreateFileW
GetShortPathNameW
GetFileSizeEx
api-ms-win-core-file-l1-2-0
GetTempPathW
oleaut32
VariantClear
VariantInit
SysAllocString
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
kernel32
DosDateTimeToFileTime
DeactivateActCtx
ActivateActCtx
_llseek
_lread
_lwrite
ReleaseActCtx
_lclose
CreateActCtxW
lstrlenA
lstrcmpiW
lstrlenW
ole32
OleSetClipboard
propsys
VariantToPropVariant
PSFormatForDisplay
InitVariantFromFileTime
InitVariantFromStrRet
VariantCompare
user32
LoadCursorW
SendMessageW
RegisterClipboardFormatW
MessageBoxW
DestroyMenu
SetCursor
GetMenuItemCount
GetMenuItemInfoW
DeleteMenu
LoadMenuW
GetSubMenu
RemoveMenu
InsertMenuW
CreatePopupMenu
SetMenuDefaultItem
InsertMenuItemW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Uninstall
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=260, version=27412,
count=2, id=259, version=27412,
count=205, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=16, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/capauthz.dll
- IMPHASH b9f288bde2e82ac7db3ae326cdcd836b
- SHA256 da1fe361b7b1109bf6b3dce206a0a32ae86fe3f4bf332542495d2510f646f848
- MD5 12d2745cdcc0f47a47a39abbff08edd8
- SHA1 5425f41a957414ebcdfb5f1a3a6db711269d7823
- SHA512 9f09e719dd62552deaafc65cd91199b4bb43e2c196635b7c4ece78b0a469b18e1718c278aca7c8d8e4ac149b54ec8d907ba06949f55e2fe53a08400c4c4bd3ee
- SSDEEP 6144:C3IMmGoBoinNlWw4w2xWuMSocQpnsMeycF+nkK/B/xEOpcO:C3PoBo8AdWuqsOcF+nkK/DEOpR
- TLSH T195449F23B7808C75FAF72571255A6A79647CA3305BE0CEC76360CA995831BC29E3631F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:51:2d:36:c2:9d:50:0c:98:f4:fa:04:f2:9d:d7:00:e6:81:0a:6b:b8:b2:49:0d:1d:34:da:6a:84:d3:2e:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
197696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
capauthz.pdb
msvcrt
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memmove
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_callnewh
?terminate@@YAXXZ
malloc
wcsncmp
swprintf_s
ldiv
??1type_info@@UAE@XZ
_except_handler4_common
swscanf_s
_wcsicmp
??_V@YAXPAX@Z
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
memcmp
memcpy
__CxxFrameHandler3
free
memset
ntdll
NtYieldExecution
RtlAllocateHeap
RtlUnicodeToUTF8N
RtlFreeHeap
DbgPrintEx
RtlReAllocateHeap
RtlNtStatusToDosError
RtlEqualSid
RtlCopySid
RtlDeriveCapabilitySidsFromName
RtlLengthSid
RtlInitUnicodeString
RtlValidSid
RtlRaiseStatus
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
SizeofResource
GetModuleHandleW
DisableThreadLibraryCalls
LoadResource
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
GetSidSubAuthority
IsValidSid
InitializeAcl
AdjustTokenPrivileges
GetLengthSid
GetSidIdentifierAuthority
CopySid
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegDeleteKeyExW
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegFlushKey
RegDeleteTreeW
RegCreateKeyExW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-file-l1-1-0
DeleteFileW
WriteFile
CreateFileW
oleaut32
VariantInit
SysStringByteLen
SysAllocString
SysFreeString
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
api-ms-win-appmodel-unlock-l1-1-0
IsSideloadingEnabled
IsDeveloperModeEnabled
wintrust
CryptCATAdminAcquireContext2
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle2
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
kernelbase
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DeprovisionApplicationCapabilities
ProvisionApplicationCapabilities
ProvisionApplicationCapabilitiesEx
QueryApplicationCapabilities
QueryApplicationCapabilitiesEx
SCCDFreeParsedElements
SCCDParseFile
SCCDValidateAppxFile
SCCDValidateCatalogFile
Name
.text
Size
202KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGER32C
Size
512B
Virtual Size
165B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=26715,
count=1, id=260, version=26715,
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=5, id=259, version=27412,
count=172, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=41, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/capiprovider.dll
- IMPHASH 581eee0745bfd02789df9f2187cb3a9d
- SHA256 f6685620b23623ab20a5bfd48ba4a9965a77567407b026bbb1233bac259bf739
- MD5 6b06bebdacb767de94ad349f6c5d9a09
- SHA1 d9a23bc5bca73684e382adfed0c48d66e17f1307
- SHA512 ac8ac98964a8924cc56a0f9ebbac8b7f50f9d72d578841f672e572452d414603ac6f488491556586385f12944a874317c77c6f9c87a00be81743e2170ec0442b
- SSDEEP 1536:/1Gmgq2/7kHBHf9m9wCPZPXo+JhJtDEpQNgjZuxhlqPXmfv:/1v2AJ9m9wybHE6WjZEAm3
- TLSH T183331903B38184F2D1D52130195B96BA8A7EED114F8456C7B343376E6C71AD37ABA387
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
34256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
capiprovider.pdb
msvcrt
realloc
_errno
_onexit
wcscpy_s
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_purecall
bsearch_s
qsort_s
_lfind_s
memcpy_s
malloc
memcmp
strnlen
wcsncpy_s
wcscat_s
free
memcpy
_wcsicmp
_lsearch_s
memset
oleaut32
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysAllocString
LoadTypeLi
SysStringLen
UnRegisterTypeLi
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
SizeofResource
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
FindResourceExW
LoadResource
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-localization-l1-2-0
SetThreadLocale
GetThreadLocale
GetACP
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
FindFirstFileW
CompareFileTime
FindClose
SetFileAttributesW
WriteFile
GetFileTime
FindNextFileW
DeleteFileW
SetFilePointer
CreateDirectoryW
ReadFile
FlushFileBuffers
SetEndOfFile
GetFileSize
CreateFileW
crypt32
CryptHashCertificate
CertFindExtension
CertFreeCertificateContext
CertGetCertificateContextProperty
CertAddSerializedElementToStore
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
userenv
GetUserProfileDirectoryW
dsrole
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
advapi32
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptHashData
kernel32
lstrcmpiW
ntdll
EtwTraceMessage
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=14, id=260, version=27412,
count=153, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=8, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/capisp.dll
- IMPHASH 5533cb9574ce75d3ac71fa3b540f95c9
- SHA256 7396e18969490bd0786a48a6f50056c6e0cd42dd7d98d0eefc8eaca10d21c087
- MD5 75a603d846a301bc80db16dd0b5ef187
- SHA1 2cf5c64444d8f21cdb161b79d90c2d3d2fb9bcd1
- SHA512 0b7e6f4537fe606fcae3f81b42dfc91a8268ff1f00a3d590675e2a5d6526e00f9000073495e86c33b3d61725a7f995cb8b53007300d65da69cf7852011775a59
- SSDEEP 384:NfbjK+tBNmwV8J7e+JDla2axkOS3Ch4AV+ZfKySqfTAR0ZZ0WcWghW2:x7ala2axvONHrSeTHZZcT
- TLSH T1A392C505ABD858A9E2FE223839394F3E097EB5301E8156E7861311C97469AF1FE34B17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
capisp.pdb
msvcrt
_wcsicmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
swprintf_s
memset
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegGetValueW
rpcrt4
UuidFromStringW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
userenv
GetProfilesDirectoryW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
SetCurrentDirectoryW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
wdscore
WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW
dpapi
CryptResetMachineCredentials
advapi32
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
kernel32
lstrcmpW
ntdll
RtlInitUnicodeString
NtClose
NtOpenFile
samlib
SamCloseHandle
SamFreeMemory
SamConnect
SamSetInformationUser
SamQueryInformationUser
SamOpenDomain
SamOpenUser
syssetup
WaitForSamService
CAPISysPrep_Generalize
CryptoSysPrep_Clean
CryptoSysPrep_Specialize
CryptoSysPrep_Specialize_Clone
CryptoSysPrep_Specialize_Offline
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=71, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=1, id=256, version=27412,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/catsrv.dll
- IMPHASH 4f5efd20adc8e59bce2ccdfcfaaba07f
- SHA256 50ebc75f69f2abd81fd895752e7145c3445065a2faba1337e6f548bdb9a9fb63
- MD5 345e5f3245d577df85f5ebab352169c1
- SHA1 8f2ad35213bfe08b988cfda3e77ea9914f03b5a7
- SHA512 986ecad48b3ff941062c8fd4339dcb9a6461be9957adbc15da417c833d9d907b2c183660f3e36dfdabb9a3141e081637f29f117bdae8783451a7ecb36b29c8c9
- SSDEEP 6144:g03p189q8vRsVUw44TIPmEJGYY/ve9ta9kyIczdPTcNOjR0HOGA5HdUf6Mu6U4cM:JaFRJsea9k4JT56HOlGZTU4
- TLSH T192842A2BE68FA414FFA30D757C35A11E49A83964572471CB8B11CBDA6C34BD26A3870F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
336224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
catsrv.pdb
msvcrt
_wrename
memcmp
swscanf
_local_unwind4
_vsnwprintf
__dllonexit
memcpy
_unlock
iswdigit
__CxxFrameHandler3
_lock
wcstol
wcschr
_except_handler4_common
wcstok
wcsrchr
_i64tow_s
_itow
memmove
_initterm
wcsspn
?terminate@@YAXXZ
_onexit
free
_errno
_beginthreadex
_wcsicmp
_purecall
wcscpy_s
realloc
wcscat_s
_wcsnicmp
_XcptFilter
_waccess
_vsnprintf
_wcsdup
_wtoi
wcstoul
toupper
malloc
_amsg_exit
memset
clbcatq
DowngradeAPL
ComPlusPartitionsEnabled
SetupOpen
OpenComponentLibraryEx
CreateComponentLibraryEx
GetSimpleTableDispenser
CLSIDFromStringByBitness
SetupSave
ServerGetApplicationType
mfcsubs
??0CString@@QAE@PBG@Z
??0CString@@QAE@GH@Z
??YCString@@QAEABV0@PBG@Z
?Right@CString@@QBE?AV1@H@Z
??H@YG?AVCString@@ABV0@PBG@Z
??H@YG?AVCString@@ABV0@0@Z
??$ConstructElements@VCString@@@@YGXPAVCString@@H@Z
??$DestructElements@VCString@@@@YGXPAVCString@@H@Z
?Left@CString@@QBE?AV1@H@Z
??4CString@@QAEABV0@ABV0@@Z
?ReverseFind@CString@@QBEHG@Z
??0CString@@QAE@XZ
??4CString@@QAEABV0@PBG@Z
??1CString@@QAE@XZ
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
??0CString@@QAE@ABV0@@Z
??0CString@@QAE@PBD@Z
??H@YG?AVCString@@PBGABV0@@Z
?Find@CString@@QBEHPBG@Z
?FreeDataChain@CPlex@@QAEXXZ
?MakeUpper@CString@@QAEXXZ
?Mid@CString@@QBE?AV1@H@Z
ntdll
WinSqmSetDWORD
DbgUserBreakPoint
oleaut32
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
LoadRegTypeLi
LoadTypeLibEx
SysFreeString
VarUI4FromStr
QueryPathOfRegTypeLi
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetEvent
ResetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
CreateEventW
LeaveCriticalSection
DeleteCriticalSection
OpenMutexW
ReleaseMutex
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
GetModuleHandleW
LoadLibraryExW
FindResourceExW
GetModuleFileNameW
LockResource
FreeLibrary
FreeLibraryAndExitThread
LoadResource
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-string-l2-1-0
CharNextW
IsCharAlphaNumericW
CharPrevW
CharLowerW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegEnumValueW
api-ms-win-core-memory-l1-1-0
VirtualProtect
OpenFileMappingW
VirtualQuery
MapViewOfFile
VirtualAlloc
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
CreateProcessAsUserW
OpenProcessToken
GetCurrentProcess
SetThreadToken
OpenThreadToken
CreateProcessW
api-ms-win-core-localization-l1-2-0
IsValidLocale
SetThreadLocale
GetSystemDefaultLCID
FormatMessageW
GetThreadLocale
GetUserDefaultLangID
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l1-1-0
ReadFile
GetShortPathNameW
GetFileSizeEx
FindNextFileW
FindClose
GetFileSize
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW
WriteFile
SetFilePointer
CreateFileW
DeleteFileW
GetLongPathNameW
GetFileType
GetFullPathNameW
SetFileAttributesW
SetFileTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetTempFileNameW
GetFileAttributesW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-security-base-l1-1-0
RevertToSelf
InitializeSecurityDescriptor
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
CreatePrivateObjectSecurityEx
FreeSid
IsWellKnownSid
AllocateAndInitializeSid
CopySid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetSidSubAuthorityCount
GetSidLengthRequired
AddAce
SetSecurityDescriptorDacl
GetSidSubAuthority
GetTokenInformation
GetSecurityDescriptorLength
CheckTokenMembership
GetSecurityDescriptorDacl
DuplicateTokenEx
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-2-0
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcpyW
lstrcpynW
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-privateprofile-l1-1-0
WritePrivateProfileStringW
GetPrivateProfileStringW
kernel32
DosDateTimeToFileTime
FileTimeToDosDateTime
GetComputerNameW
MoveFileW
GetModuleFileNameA
api-ms-win-core-shlwapi-legacy-l1-1-0
PathStripPathW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
?CancelWriteICR@@YGJPAPAUIComponentRecords@@@Z
?GetReadICR@@YGJHPAPAUIComponentRecords@@@Z
?GetWriteICR@@YGJPAPAUIComponentRecords@@@Z
?ReleaseReadICR@@YGXPAPAUIComponentRecords@@@Z
?SaveWriteICR@@YGJPAPAUIComponentRecords@@@Z
CreateComponentLibraryTS
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetAppImport
GetCatalogCRMClerk
OpenComponentLibraryTS
Name
.text
Size
343KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=27412,
count=19, id=260, version=27412,
count=368, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=69, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/catsrvps.dll
- IMPHASH 7ff58563150782e5c1caf342ccecd52a
- SHA256 d895b326e50bd72e0ec7b1b19d4eb9897f5769cc67b635be7465998b4680a6c4
- MD5 57a35d36b33baa28d7b10b87128f5114
- SHA1 b16910faadfa6635546162b5114b946008883f61
- SHA512 644e08ab5f5ff0ff23c907bd03b4c3ec8ce8e1e95cbb489ece4e9a38f7e272d6456c8e48cf718e5ceac5e2d9c52e6887ed30646c9983a3a5b3ddeb6a32f82ff9
- SSDEEP 384:KvbwGoveOQws2+lGzbwOrLIZlWSjWxM2:KvbloGFwRwOIZvwM
- TLSH T1C6B293997B6834B9E16E617F50970B21962D9E202BD10FD70E9037482CB64E1BF3339B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
17360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
catsrvps.pdb
msvcrt
_except_handler4_common
_amsg_exit
_XcptFilter
_initterm
malloc
free
memcmp
oleaut32
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserMarshal
rpcrt4
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
NdrDllCanUnloadNow
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=48, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=11, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/catsrvut.dll
- IMPHASH 21ca59a27bc7671e9186174fc5014f85
- SHA256 1cb1b2f2a7a5b4cc7af72d1cbd6afc8f1aabfce0d3303d4d0d3d2123368e9db5
- MD5 19e1ea6cde56b3505864d292f790a37e
- SHA1 20ed83190b782ecae45177af72ccc6b31fdbeaab
- SHA512 21c291007adc384227fd985677717057c212ba2bce03b78bd642cdef91fc329b1218928e09c4e9146fa5f5eca720fe1ff67e1fa9a74d9f7e2d7c66bd7d2c283e
- SSDEEP 6144:2TrouM4fId/H2jO0nuh0sdlVVI9bM8OlOeriQwkzjePIg7Kml1Voy1HqxWhDiaJM:g4lVVI9485UZWhl1Voy1HDNiCU/T
- TLSH T1DB843862F2AC85E4D3E3347C5068B12799EC7B751B5371DB4720DAAA2DB0AC39E31607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
346528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
catsrvut.pdb
msvcrt
_initterm
__dllonexit
_onexit
memcpy
__CxxFrameHandler3
_lock
_unlock
?terminate@@YAXXZ
__isascii
iswprint
_itow
towupper
wcsncmp
_except_handler4_common
_amsg_exit
_XcptFilter
_wcsnicmp
_ltow
_waccess
_vsnwprintf
_wcsicmp
_purecall
iswspace
wcsrchr
wcschr
wcscpy_s
realloc
memcmp
wcscat_s
malloc
free
_local_unwind4
memset
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateEventW
LeaveCriticalSection
EnterCriticalSection
OpenEventW
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
OpenMutexW
InitializeCriticalSection
SetEvent
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
LockResource
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
FreeLibraryAndExitThread
FindResourceExW
LoadResource
GetModuleHandleExW
LoadStringW
SizeofResource
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetObjectContext
CLSIDFromString
CoCreateInstanceEx
StringFromIID
CoTaskMemAlloc
StringFromGUID2
CoImpersonateClient
CoCreateInstance
CoRevertToSelf
CoInitializeEx
CoGetCallContext
StringFromCLSID
IIDFromString
CoUninitialize
CoTaskMemRealloc
CoCreateGuid
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetErrorMode
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteTreeW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegFlushKey
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
VirtualProtect
UnmapViewOfFile
CreateFileMappingW
VirtualAlloc
VirtualQuery
MapViewOfFile
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetSystemInfo
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
CreateProcessAsUserW
CreateThread
OpenThreadToken
ExitProcess
SetThreadStackGuarantee
GetExitCodeProcess
CreateProcessW
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
SetThreadToken
TerminateProcess
GetCurrentThread
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-file-l1-1-0
GetLongPathNameW
FindFirstFileW
GetShortPathNameW
CreateFileW
CreateDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
DeleteFileW
api-ms-win-service-management-l1-1-0
CreateServiceW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
DeleteService
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-security-base-l1-1-0
GetTokenInformation
AddAccessAllowedAce
DuplicateTokenEx
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
AdjustTokenPrivileges
IsValidSid
IsValidSecurityDescriptor
AddAce
DestroyPrivateObjectSecurity
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
FreeSid
IsWellKnownSid
GetSidLengthRequired
GetSidSubAuthority
AllocateAndInitializeSid
GetSidSubAuthorityCount
GetSecurityDescriptorLength
CheckTokenMembership
AllocateLocallyUniqueId
EqualSid
CreateWellKnownSid
CopySid
SetSecurityDescriptorDacl
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
LocalReAlloc
api-ms-win-service-management-l2-1-0
ChangeServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
kernel32
LocalSize
OpenFile
lstrcpyW
lstrcmpiW
lstrcpynW
GetComputerNameW
advapi32
SaferIdentifyLevel
SaferCloseLevel
SaferCreateLevel
SaferSetLevelInformation
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegConnectRegistryW
LsaLookupNames
BuildTrusteeWithSidW
BuildTrusteeWithNameW
BuildSecurityDescriptorW
RegDeleteKeyW
RegOverridePredefKey
RegCreateKeyW
SaferGetLevelInformation
mfcsubs
??4CString@@QAEABV0@ABV0@@Z
??0CString@@QAE@XZ
??YCString@@QAEABV0@ABV0@@Z
??0CString@@QAE@PBD@Z
??1CString@@QAE@XZ
??H@YG?AVCString@@ABV0@PBG@Z
??0CString@@QAE@PBG@Z
??4CString@@QAEABV0@PBG@Z
??H@YG?AVCString@@PBGABV0@@Z
ntdll
RtlGetVersion
WinSqmSetDWORD
RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-com-private-l1-1-0
UpdateDCOMSettings
CoGetModuleType
api-ms-win-core-shlwapi-legacy-l1-1-0
PathStripPathW
??0CComPlusComponent@@QAE@$$QAV0@@Z
??0CComPlusComponent@@QAE@ABV0@@Z
??0CComPlusInterface@@QAE@$$QAV0@@Z
??0CComPlusInterface@@QAE@ABV0@@Z
??0CComPlusMethod@@QAE@ABV0@@Z
??0CComPlusObject@@QAE@ABV0@@Z
??1CComPlusComponent@@UAE@XZ
??1CComPlusInterface@@UAE@XZ
??4CComPlusComponent@@QAEAAV0@$$QAV0@@Z
??4CComPlusComponent@@QAEAAV0@ABV0@@Z
??4CComPlusInterface@@QAEAAV0@$$QAV0@@Z
??4CComPlusInterface@@QAEAAV0@ABV0@@Z
??4CComPlusMethod@@QAEAAV0@ABV0@@Z
??4CComPlusObject@@QAEAAV0@ABV0@@Z
??4CComPlusTypelib@@QAEAAV0@ABV0@@Z
??_7CComPlusComponent@@6B@
??_7CComPlusInterface@@6B@
??_7CComPlusMethod@@6B@
??_7CComPlusObject@@6B@
?GetITypeLib@CComPlusTypelib@@QAEPAUITypeLib@@XZ
CGMIsAdministrator
COMPlusUninstallActionW
CreateComRegDBWriter
DestroyComRegDBWriter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FindAssemblyModulesW
ManagedRequestW
QueryUserDllW
RegDBBackup
RegDBRestore
RunMTSToCom
StartMTSTOCOM
SysprepComplus
SysprepComplus2
WinlogonHandlePendingInfOperations
Name
.text
Size
353KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=27412,
count=17, id=260, version=27412,
count=5, id=259, version=27412,
count=333, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=99, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cca.dll
- IMPHASH 296ba4145a1371cbe1b6baa9f34a2f8b
- SHA256 c2d51b8aa011cc9f84a5440eb7bafbdb78727c9eecd5d7cbe9485ff9c5e43f02
- MD5 2ffa901cf3472a44c1d695c3db8a2e6c
- SHA1 6e622654ca4dad860fea44d074ab53acd4a4b3a4
- SHA512 2b0f0295f8e0d119b5e06a8fa2d9d9d10df775dfd7c6f8582caf7e06a51e57fc8e8bae815ef1d5a815d54f81f800968d51f6ea5f349daa94c477229ff3496caa
- SSDEEP 1536:pUkRAQZZLiA9gKhXUzF01Si+aIh1aFciFL4tRfrENqG2tZ:PpZZnP5GF018Rh1avLKRfANqG2tZ
- TLSH T18E6319D1769483B1EDD7707C022E233592AFC56057E652C70F348AEAACA46C19F361BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
60064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cca.pdb
msvcrt
_XcptFilter
_CxxThrowException
_callnewh
malloc
free
_vsnwprintf_s
fread
_wfopen
fwrite
_amsg_exit
fclose
_initterm
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
memcpy_s
??1type_info@@UAE@XZ
_except_handler4_common
memcmp
_ftol2_sse
__CxxFrameHandler3
memcpy
fseek
memset
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetProcAddress
GetModuleHandleW
SetThreadPriority
CreateSemaphoreW
ReleaseSemaphore
GetCurrentProcess
GetCurrentThreadId
ResetEvent
lstrcmpW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
CreateThread
GetTickCount
DisableThreadLibraryCalls
GetVersionExW
GetModuleFileNameA
GetLastError
advapi32
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
ole32
CoTaskMemFree
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitializeEx
StringFromGUID2
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=27412,
count=97, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=5, id=261, version=27412,
count=18, id=260, version=27412,
count=1, id=256, version=27412,
count=21, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cdosys.dll
- IMPHASH e31c0d9d59f1a60c9e9241a78eb4ad46
- SHA256 8f83804d3450904f7544c5a0f8ce480dfd125abcad3226766759231b7c2ff9af
- MD5 4e9805339320dc9b851ba9547e19506a
- SHA1 a1efb18591a1611499cf5c5ba59f30f4d2749b24
- SHA512 52bcf8eef71afdc855315e905896fb85fa2ac74df70c9232532f07ff8a1754cbbc254c1aecb893d252355d3ad30021957047e830bc375bb7e599bf16b1ca9a41
- SSDEEP 24576:7LFzfgVJFrizFtZPfOEIm9oQQbz5jDrIBJmrbun/8+:/5gVvrYPfOE0En/B
- TLSH T12E054B60FFC480B6E6630130181A5275D57DBD313B21DCC75AB0B72EEA72AD29A3476B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
611408
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cdosys.pdb
msvcrt
_CxxThrowException
memmove
memcpy
_lock
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
wcsrchr
wcstok
isspace
strtoul
bsearch
qsort
towupper
towlower
toupper
tolower
_strdup
isdigit
atol
_wcslwr
strncmp
memchr
_XcptFilter
_amsg_exit
__CxxFrameHandler3
_initterm
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__dllonexit
_onexit
_unlock
wcsncmp
strchr
_vsnwprintf
wcsstr
_stricmp
_purecall
printf
strspn
sscanf_s
strrchr
strstr
_memicmp
swscanf
strpbrk
strcspn
strcpy_s
realloc
strcat_s
malloc
free
_vsnprintf
_wsplitpath_s
iswspace
wcschr
_wcsnicmp
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_wcsicmp
memcmp
memset
kernel32
GetTimeZoneInformation
CompareFileTime
TlsAlloc
ResetEvent
IsDBCSLeadByteEx
GetFileTime
IsValidCodePage
GetStringTypeW
GlobalUnlock
GlobalHandle
SetUnhandledExceptionFilter
GlobalLock
GlobalAlloc
GlobalReAlloc
GetSystemDefaultLangID
GetCPInfo
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
FormatMessageA
GetLastError
MultiByteToWideChar
FormatMessageW
GetVersionExA
LoadLibraryA
FreeLibrary
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetSystemInfo
TlsFree
TlsGetValue
TlsSetValue
GetCurrentProcess
VirtualQuery
VirtualFree
VirtualAlloc
VirtualProtect
LoadLibraryExA
lstrcmpiA
lstrcpynA
WideCharToMultiByte
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceExA
GetModuleFileNameA
GetUserDefaultLCID
DisableThreadLibraryCalls
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatA
GetTimeFormatA
GetDateFormatW
GetTimeFormatW
lstrlenA
GetCurrentProcessId
GetTickCount
CreateFileA
CloseHandle
GetSystemTimeAsFileTime
lstrlenW
GetACP
GetThreadLocale
GetLocaleInfoW
GetCurrentThreadId
LocalFree
GetTempPathA
GetTempFileNameA
CopyFileA
SetFileAttributesA
CreateFileW
CreateEventA
GetFileSize
ReadFile
GetOverlappedResult
WriteFile
SetFilePointer
SetEndOfFile
FlushFileBuffers
FindFirstFileA
FindNextFileA
FindClose
GetLocaleInfoA
GetCurrentThread
SetEvent
WaitForSingleObject
GetSystemTime
GlobalFree
oleaut32
VariantCopyInd
SetErrorInfo
CreateErrorInfo
SafeArrayPutElement
SafeArrayCreateVector
SystemTimeToVariantTime
LoadRegTypeLi
VariantTimeToSystemTime
SysFreeString
SysAllocString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VariantChangeType
VariantCopy
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoCreateGuid
ProgIDFromCLSID
PropVariantClear
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
urlmon
CopyBindInfo
CoInternetGetSession
CoInternetParseUrl
winhttp
WinHttpCrackUrl
WinHttpSetOption
shlwapi
UrlCombineW
inetcomm
MimeOleSetCompatMode
MimeOleGetPropertySchema
MimeOleGetInternat
MimeOleInetDateToFileTime
MimeOleCreateMessage
advapi32
RegDeleteValueA
RevertToSelf
ImpersonateLoggedOnUser
RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
OpenThreadToken
user32
DispatchMessageA
TranslateMessage
GetMessageA
RegisterWindowMessageA
PostThreadMessageA
CharPrevA
CharNextA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
671KB
Virtual Size
670KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=27412,
count=284, id=1, productName=Unmarked objects,
count=25, id=257, version=27412,
count=8, id=261, version=27412,
count=24, id=260, version=27412,
count=1, id=256, version=27412,
count=82, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cdp.dll
- IMPHASH a2799e1c9ab717e9af5219d853861d35
- SHA256 beceb187a13d3bd92303a4b9da89924c1e3d3bc098ea6142ee085299ca6f135a
- MD5 910d506d3ae8203d7615a91ce796660e
- SHA1 76ba382cee814aa2001495c835e2d6d31006e37c
- SHA512 a644526390c0964ad23b205cfb8a07696f4492664ea8d8948f4a3cb66a161e0beb5969bb410e59673b06d3d12246a439ca73c44e2566e88ec6920e2ee831eeb4
- SSDEEP 98304:I8iChcFokqy9y9J3O6iECZtMHko817vBf2jsRIFF:/PhcakquyOACZtM4fOjsW
- TLSH T179268D236B84DC7DD12F1271E90DF33A92ECC5F00BA944DFAA5557AD1A708C21A3AB47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
1212912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cdp.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime32_s
_o__mkgmtime32
_o__mktime32
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strnicmp
_o__strtoui64
_o__wcsicmp
_o_atoi
memmove
_o_ceil
_o_free
_o_iswspace
_o_malloc
_o_modf
_o_rand
_o_realloc
_o_strcpy_s
_o_strftime
_o_strncpy_s
_o_strtol
_o_strtoul
_o_terminate
_o_tolower
_o_toupper
_o_wcstoul
_o__gmtime32_s
_except_handler4_common
_o__get_errno
strstr
_o__execute_onexit_table
_o__errno
_o__dtest
_o__difftime32
_o__crt_atexit
_o__configure_narrow_argv
_o__CIpow
_o__cexit
__CxxFrameHandler3
__std_terminate
__std_type_info_compare
strchr
wcschr
_CxxThrowException
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strncmp
strpbrk
wcsncmp
combase
CStdStubBuffer_AddRef
ord4
ord12
ord6
ord14
ord17
ord2
CStdStubBuffer_DebugServerQueryInterface
ord10
ord13
ord11
CStdStubBuffer_Invoke
ord154
ord24
ord23
CStdStubBuffer2_Connect
ord16
ord9
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
ord7
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
ord3
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
CStdStubBuffer2_CountRefs
ord21
ord26
ord32
ord27
ord19
ord22
CStdStubBuffer2_Disconnect
ord20
ord25
ord5
ord34
ord33
ord18
CStdStubBuffer_CountRefs
CStdStubBuffer2_QueryInterface
ord8
ord15
rpcrt4
NdrClientCall4
IUnknown_QueryInterface_Proxy
NdrStubCall2
NdrStubForwardingFunction
RpcServerInqCallAttributesW
UuidFromStringW
NdrOleAllocate
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleFree
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
GetModuleHandleW
FindStringOrdinal
GetModuleHandleExW
FreeLibrary
FindResourceExW
GetModuleFileNameA
LockResource
LoadResource
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
TerminateProcess
GetCurrentThreadId
SetThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemTime
GetVersionExW
GetComputerNameExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
shcore
ord190
SHCreateMemStream
IStream_Write
IStream_Reset
IStream_WriteStr
IStream_Read
IStream_Size
IStream_ReadStr
msvcp_win
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_Thrd_sleep
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?setf@ios_base@std@@QAEHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setf@ios_base@std@@QAEHHH@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Thrd_detach
_Cnd_wait
_Cnd_do_broadcast_at_thread_exit
_Cnd_broadcast
_Thrd_hardware_concurrency
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?id@?$collate@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
_Thrd_id
_Strcoll
_Strxfrm
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
_Unlock_shared_ptr_spin_lock
_Lock_shared_ptr_spin_lock
_Thrd_join
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
_Mtx_unlock
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
_Mtx_trylock
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Random_device@std@@YAIXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
_Mtx_init_in_situ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
_Mtx_destroy_in_situ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Xlength_error@std@@YAXPBD@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??7ios_base@std@@QBE_NXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
_Cnd_signal
_Query_perf_counter
_Query_perf_frequency
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_current_owns
_Cnd_register_at_thread_exit
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
_Cnd_unregister_at_thread_exit
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Xtime_get_ticks
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
api-ms-win-crt-time-l1-1-0
clock
_time32
umpdc
Pdcv2ActivationClientRegister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientDeactivate
ntdll
RtlPublishWnfStateData
NtOpenSemaphore
RtlFreeUnicodeString
RtlGetTokenNamedObjectPath
NtCreateSemaphore
RtlInitUnicodeString
RtlSidDominates
RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
NtOpenMutant
RtlNtStatusToDosError
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
NtCreateWnfStateName
NtDeleteWnfStateName
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserFree
HSTRING_UserSize
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserMarshal
HSTRING_UserUnmarshal
WindowsDeleteString
WindowsGetStringRawBuffer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetSystemPreferredUILanguages
FormatMessageW
api-ms-win-core-com-l1-1-0
CoImpersonateClient
CLSIDFromString
CoCreateInstance
PropVariantClear
StringFromCLSID
CoRevertToSelf
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoSwitchCallContext
CoTaskMemRealloc
CoTaskMemAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
RoActivateInstance
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
CreateEventExW
SetEvent
CreateEventW
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateMutexW
OpenMutexW
TryAcquireSRWLockExclusive
ResetEvent
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
SetThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpool
WaitForThreadpoolWaitCallbacks
CloseThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegGetValueW
RegSetValueExW
RegCreateKeyExA
RegCreateKeyExW
RegNotifyChangeKeyValue
RegGetValueA
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
EventProviderEnabled
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageInfo
api-ms-win-appmodel-runtime-l1-1-1
GetApplicationUserModelIdFromToken
GetPackageFamilyNameFromToken
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
api-ms-win-security-base-l1-1-0
RevertToSelf
CreateWellKnownSid
CopySid
GetLengthSid
GetTokenInformation
ImpersonateLoggedOnUser
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-file-l1-1-0
FindNextFileW
GetFullPathNameW
ReadFile
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
CreateFileW
FindFirstFileW
SetFilePointerEx
WriteFile
SetFilePointer
SetEndOfFile
GetFileAttributesW
GetFileSizeEx
CreateDirectoryA
FlushFileBuffers
FindClose
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
MoveFileExW
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchSkipRoot
api-ms-win-core-com-l1-1-1
RoGetAgileReference
crypt32
CertOpenStore
CertCreateCertificateContext
CryptProtectData
CryptUnprotectData
CertGetCertificateContextProperty
CertGetNameStringW
CertDeleteCertificateFromStore
CertCreateSelfSignCertificate
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSaveStore
CertDuplicateCertificateContext
CertCloseStore
CertFindCertificateInStore
CertStrToNameW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-io-l1-1-0
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CancelIoEx
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
DevCreateObjectQuery
propsys
PSPropertyBag_WriteStr
PSCreateMemoryPropertyStore
PSPropertyBag_WriteUnknown
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
kernelbase
BaseFormatObjectAttributes
dsreg
DsrGetJoinInfo
DsrFreeJoinInfo
api-ms-win-security-capability-l1-1-0
CapabilityCheck
RpcClientCapabilityCheck
CDPAccountFromWebAccount
CDPAcquireNetworkingInternal
CDPCreateAFSRegistrationClientInternal
CDPCreateAFSUserSettingsInternal
CDPCreateAccountInternalForUser
CDPCreateAccountInternalWithStableUserId
CDPCreateAccountProviderInternal
CDPCreateActivity
CDPCreateActivityAsset
CDPCreateActivityInternal
CDPCreateActivityStoreInfoInternal
CDPCreateActivityStoreInfoWatcher
CDPCreateActivityStoreInfoWatcherForUser
CDPCreateActivityStoreInfoWatcherInternal
CDPCreateActivityStoreReader
CDPCreateActivityStoreReaderForUser
CDPCreateActivityStoreReaderInternal
CDPCreateAllDevicesQuery
CDPCreateAllDevicesQueryForUser
CDPCreateAnonymousAccount
CDPCreateAnonymousAccountInternal
CDPCreateAppControlClient
CDPCreateAppControlClientInternal
CDPCreateAppId
CDPCreateAppRegistrationManager
CDPCreateAppRegistrationManagerForUser
CDPCreateAppRegistrationManagerInternal
CDPCreateAzureActiveDirectoryAccount
CDPCreateBeaconControl
CDPCreateBeaconControlInternal
CDPCreateBinaryClient
CDPCreateBinaryClientInternal
CDPCreateBinaryHost
CDPCreateBinaryHostInternal
CDPCreateBinaryHostWithSettings
CDPCreateCallbackNotifierInternal
CDPCreateCloudNotification
CDPCreateComObjectInternal
CDPCreateCrossPlatformAppId
CDPCreateCrossPlatformAppIdFromAppId
CDPCreateCurrentCrossPlatformAppId
CDPCreateDedupedDevice
CDPCreateDedupedDeviceQuery
CDPCreateDedupedDeviceQueryForUser
CDPCreateDedupedDeviceQueryInternal
CDPCreateDedupedDeviceQueryParameters
CDPCreateDeviceInternal
CDPCreateDeviceQuery
CDPCreateDeviceQueryForSessionInternal
CDPCreateDeviceQueryForUser
CDPCreateDeviceQueryInternal
CDPCreateDeviceQueryWithIdentity
CDPCreateDirectNotificationHost
CDPCreateEmptyAccountSettings
CDPCreateEnvironmentManagerInternal
CDPCreateHttpRequestInternal
CDPCreateMessagingHost
CDPCreateMessagingHostInternal
CDPCreateMicrosoftAccount
CDPCreateOrGetDdsRegistrationUserObjectInternal
CDPCreatePlatformSettingsInternal
CDPCreateRemoteUserInternal
CDPCreateResource
CDPCreateResourceCollection
CDPCreateSettingsInteropInternal
CDPCreateTask
CDPCreateTaskInternal
CDPCreateTelemetryTask
CDPCreateTelemetryTaskInternal
CDPCreateTestActivityAsset
CDPCreateUserInternal
CDPCreateUserNotificationClientInternal
CDPCreateUserServiceNotificationClient
CDPCreateUserServiceNotificationClientForUser
CDPCreateUuid
CDPFixAccounts
CDPGetAFCInitializer
CDPGetAccountProviderInternal
CDPGetAccountsNeedAttention
CDPGetAccountsSettings
CDPGetActivityStore
CDPGetActivityStoreForAccount
CDPGetActivityStoreForAccountInternal
CDPGetActivityStoreForStoreInfo
CDPGetActivityStoreForStoreInfoAndUser
CDPGetActivityStoreForStoreInfoInternal
CDPGetActivityStoreForUser
CDPGetActivityStoreInternal
CDPGetCloudNotificationProviderInternal
CDPGetCoreInitializer
CDPGetDeviceCache
CDPGetDeviceCacheInternal
CDPGetHost
CDPGetLogger
CDPGetNearShareAuthorizationPolicyOfInteractiveUser
CDPGetRelayInitializer
CDPGetResourceHandler
CDPGetResourceManager
CDPGetSDKAuthorizationPolicyOfInteractiveUser
CDPGetSGSocket
CDPGetSystemAppId
CDPGetUserActivitySettings
CDPGetUserActivitySettingsForUser
CDPGetUserActivitySettingsInternal
CDPGetUserCollectionInternal
CDPInitialize
CDPInitializeForService
CDPInitializeSGPowerOnPacket
CDPInitializeUserService
CDPInitializeUserServicePhase2
CDPIsEnabled
CDPPreShutdown
CDPRegisterActivityConflictResolverInternal
CDPReleaseNetworkingInternal
CDPResume
CDPSetAccountProviderInternal
CDPSetAppControlHostCallback
CDPSetExtendedLocalDeviceStatus
CDPSetResourceConfigProvider
CDPSetServicePid
CDPShutdown
CDPShutdownBluetooth
CDPStartCCSPolling
CDPStopCCSPolling
CDPSuspend
CDPUninitializeUserService
CDPWriteAccountSettings
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
644B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
217KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=259, version=27412,
count=23, id=260, version=27412,
count=1775, id=1, productName=Unmarked objects,
count=16, id=257, version=27412,
count=1, id=256, version=27412,
count=371, id=269, version=27412,
count=31, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cdprt.dll
- IMPHASH 2f95b78da757a631a1a56c9008837606
- SHA256 623062f839a45556864d43a2129da8f1f884675531799563b3777dafff8e7283
- MD5 edededa91c59a416b11ab01c4754a8ef
- SHA1 80a9e0f301055e41224abacd313d2f70c55a2dfe
- SHA512 0c4bce5faa0ab9f1f08a1f4ba4bd1c4d92741929f7612c7c83cf6f9127ebe6bb8836dea8a15355b23c568a12f11ee325a3edd1b0d6542adc595f5ca50a0f4bec
- SSDEEP 24576:Ls4elfk2ywg3v1hv3IYKMsOrq+mx6ow/NIe/Uytn8X1S5FOKIjfmP8nsOtm8vuKV:Q4elfk2ywg3fv3IYKM1lLNfRtn8Xo5F4
- TLSH T1D3557D212BC49B39E6BF3334551E7279A0EDA0A94B2542C77B0482FC6D70BD25A3764F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
285360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cdprt.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__ui64tow_s
_o__wcsicmp
_o__wcstoui64
memmove
_o_atoi
_o_ceil
_o_free
_o_malloc
_o_modf
_o_realloc
_o_strcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
strstr
_except_handler4_common
_o__beginthreadex
_o__dtest
_CxxThrowException
wcsrchr
wcschr
__std_type_info_compare
strchr
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__crt_atexit
_o___std_exception_copy
_o__configure_narrow_argv
_o__execute_onexit_table
_o__errno
__std_terminate
_o__cexit
__CxxFrameHandler3
memcmp
_o__callnewh
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsspn
cdp
CDPCreateAppRegistrationManager
CDPCreateUuid
CDPCreateTelemetryTask
CDPCreateAppRegistrationManagerForUser
CDPCreateActivityStoreReader
CDPCreateDeviceQuery
CDPGetSystemAppId
CDPCreateAppControlClient
CDPGetLogger
CDPCreateResourceCollection
CDPShutdown
CDPCreateBinaryHost
CDPCreateAppId
CDPCreateBinaryClient
CDPCreateBinaryHostInternal
CDPCreateCrossPlatformAppId
CDPCreateActivityStoreInfoInternal
CDPGetActivityStoreForStoreInfoAndUser
CDPGetActivityStore
CDPGetActivityStoreForAccount
CDPGetActivityStoreForStoreInfo
CDPGetActivityStoreForUser
CDPGetUserActivitySettings
CDPAccountFromWebAccount
CDPCreateActivity
CDPCreateDedupedDeviceQueryParameters
CDPCreateDedupedDeviceQueryForUser
CDPCreateDedupedDevice
CDPInitialize
CDPCreateAccountInternalWithStableUserId
CDPCreateAllDevicesQuery
windows.storage
SHCreateItemFromParsingName
kernelbase
GetSystemAppDataKey
LocalAlloc
GetPackageFullName
Sleep
GetPackageFamilyName
GetCurrentPackageFamilyName
GetCurrentPackageFullName
GetApplicationUserModelIdFromToken
CouldMultiUserAppsBehaviorBePossibleForPackage
GetPackageFullNameFromToken
OpenStateExplicit
CloseState
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadStringW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
CreateEventExW
WaitForMultipleObjectsEx
CreateSemaphoreExW
InitializeSRWLock
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDuplicateString
WindowsGetStringLen
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentProcessId
GetProcessId
OpenThreadToken
GetProcessTimes
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoMarshalInterface
CoTaskMemRealloc
CoCreateGuid
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoWaitForMultipleHandles
CoGetCallContext
StringFromGUID2
CreateStreamOnHGlobal
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventSetInformation
EventProviderEnabled
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-security-base-l1-1-0
GetTokenInformation
ws2_32
FreeAddrInfoW
GetAddrInfoW
inet_ntoa
WSAGetLastError
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
SHTaskPoolGetUniqueContext
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegGetValueA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
ntdll
NtQueryInformationToken
RtlInitUnicodeString
RtlFreeHeap
RtlQueryPackageClaims
RtlPublishWnfStateData
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlGetDeviceFamilyInfoEnum
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-rtcore-ntuser-window-l1-1-0
GetActiveWindow
api-ms-win-core-kernel32-legacy-l1-1-1
PowerCreateRequest
PowerSetRequest
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
api-ms-win-security-capability-l1-1-0
RpcClientCapabilityCheck
CapabilityCheck
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
combase
ord90
ord157
msvcp_win
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?uncaught_exception@std@@YA_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?__ExceptionPtrToBool@@YA_NPBX@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
_Cnd_destroy_in_situ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Thrd_detach
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?setf@ios_base@std@@QAEHHH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Cnd_signal
_Mtx_current_owns
_Thrd_yield
_Query_perf_frequency
_Cnd_timedwait
_Query_perf_counter
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?_Syserror_map@std@@YAPBDH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_Cnd_init_in_situ
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_unregister_at_thread_exit
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z
_Cnd_broadcast
_Mtx_unlock
_Cnd_wait
_Cnd_register_at_thread_exit
_Mtx_lock
_Mtx_init_in_situ
?__ExceptionPtrDestroy@@YAXPAX@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setf@ios_base@std@@QAEHH@Z
??7ios_base@std@@QBE_NXZ
_Mtx_destroy_in_situ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=101, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=259, version=27412,
count=16, id=260, version=27412,
count=1506, id=1, productName=Unmarked objects,
count=12, id=257, version=27412,
count=1, id=256, version=27412,
count=127, id=270, version=27412,
count=32, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cemapi.dll
- IMPHASH 3dcd7c33afd7c9edf3ee3ed0eab98d28
- SHA256 e45c46c9fe2e6784716e3affd54e62c69c46b841125e950954588515de8c6b20
- MD5 75eb4a998c120ebdc9d672e8ff999f1b
- SHA1 34d1b1fc85630d45e4cc0a559bac65b21d48b605
- SHA512 5f21a07557e8a7fab38564e919525f11e33dbdfa5ba330f8a4dee0c22af7db3d405b16533acbe356d2e6d2494d51a3cf3fc0ddbcec637b6f5383bf1f15ae0f58
- SSDEEP 6144:cRdsUcchu0fGwaTaeYdPocgB9MMmzhd30sZm:cT0AI8iBBmNJRZm
- TLSH T160146E12394445F5E666327268CFB268F27DF2214BA481C733A0C6FB78915C6DD31BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
170112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cemapi.pdb
msvcrt
wcscspn
_errno
_amsg_exit
_XcptFilter
_vsnwprintf_s
_purecall
_vsnwprintf
_lock
_unlock
_callnewh
iswspace
__dllonexit
_wcsicmp
_onexit
_except_handler4_common
realloc
__CxxFrameHandler3
memcpy
strrchr
strcpy_s
_stricmp
iswdigit
_wcsnicmp
free
malloc
wcsncpy_s
memcpy_s
_initterm
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
LoadStringW
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
SizeofResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
LeaveCriticalSection
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventWrite
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
userdataplatformhelperutil
StartAndWaitForService
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateMAPITableWalker
CreateMAPITableWalkerEx
FlushMailStore
FreeProws
GetEntryIDType
GetMAPIStorePropTags
GetMsgClassEnum
GetMsgClassEnumFromMsg
GetMsgStoreFromMessage
GetNamedPropTag
HrGetOneProp
HrSetOneProp
InitializeServiceProps
IsMessageClassDeviceGenerated
IsMessageClassReadRequest
IsMessageClassSPlusV2
MAPIAllocateBuffer
MAPIAllocateBuffer_dbg
MAPIAllocateMore
MAPIAllocateMore_dbg
MAPIDeleteMessageById
MAPIDupString
MAPIFreeBuffer
MAPIGetContext
MAPIInitialize
MAPILogonEx
MAPIUninitialize
MAPI_CompareEntryIDs
MAPI_GetStoreByName
ReadMailVolumeNameEx
SetConversationId
TranslateSPlusV1MessageClassToV2
USOIDfromCEENTRYID
USOIDtoCEENTRYID
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=134, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=45, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cero.rs
- SHA256 bcf3568ba2fcf2e4c1796a2fb931edbf9ee533521d06706d38acb58e11c230c5
- MD5 b0f5e7e26d646b58ef40dbc912221a0f
- SHA1 eec18c29c93378b62bd836318141d3fb16ac1f48
- SHA512 ac7e2e35779afe7d87e217f3afc8aecdd7e6b504029dd5cbd544f93fea964770816ffa2854247a95717c09b14d563bf5be49c5912f626138e5ddb295a0dd1602
- SSDEEP 768:5EbOTvx6ov8mfymFRHMHnwJw1dcTb1AmRIWKWy8X5JtGmI:ebOTtN9FRsHwW1dcbCmNgp
- TLSH T1A7F29E198BC29146E0FB03324CF68907FDB4579F46528B4DB59C61334F70AAACE67EA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certCredProvider.dll
- IMPHASH 386e4495e267c2b10ad62688f46affd7
- SHA256 f9c098b9d824f6c68c25f33e8ed0d9a659d67a05053811c5d0574444ff6a35b9
- MD5 abc94727613a58296ad37ac5ffedc2b8
- SHA1 423d9046ac212827110ac2917d0a4d303ba6bee9
- SHA512 4fd445325823c246e2e3712b990ef2f369087b5ec3b2f2d1d28c39980bb08c1bf46652f19a68aa1e6f5ce2eaf2b75b314c7ad7dbba3d2a0b59d5b6bc7ab75015
- SSDEEP 384:qwTlcsKmxSW3FD7ReLeFPogBymkmco2aF0W6wTxQWc/Aj25O9vqOxZqg6BVVP1h5:/clU6JpwTxQD/AqMC3+R5h8gZ8IZM
- TLSH T1A5F22A11BB4084F7DB9E5634382D6A3B426E65314FE056C7AB6247EEA8702E1FB34347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CertCredProvider.pdb
msvcrt
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
_callnewh
memmove
??1type_info@@UAE@XZ
_errno
realloc
??3@YAXPAX@Z
_purecall
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
memcpy
memset
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-heap-l1-1-0
HeapSize
HeapFree
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapAlloc
crypt32
CertEnumCertificatesInStore
CertSerializeCertificateStoreElement
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertGetNameStringW
CertCloseStore
CertFreeCertificateContext
CertOpenStore
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
GetFileSize
CreateFileW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
GetDateFormatEx
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
IsWellKnownSid
GetTokenInformation
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=127, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=10, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certCredProvider.dll.mun
- SHA256 44047cefe972ceac09c4410e50b3e3362aad5579af092cd62b628627c386620e
- MD5 6b51c1362ead0236abcbebddc5dd47dd
- SHA1 89df17c16730f1f83215217d98164e5de44105f4
- SHA512 93726553f31e008d15d0345c425b87036cd73c8a546bfacab69ad50e5d71d44a867365b3ef19cc9272c63580ace42e1016289eba35baaf977160fafc533a3ac2
- SSDEEP 384:dW/QWI5HxII+FifsAcNXnjTcXE8M01uE6KLx84hI:6ExII+FifsAcNnjTcXE8M08E6KLW4
- TLSH T1A654FBB9B510CFA6CC2801B2D34600F95D345CEAF61E5DBBA1ABBC94F8BD7660872135
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
277KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certca.dll
- IMPHASH 6a620f3f99ef0447733fe092fef43780
- SHA256 815c7d65257a7916d92f8ed8fe4b439223144a6172f5aabe26fd68991ba3a912
- MD5 b88755d4477797786940aa10b60203da
- SHA1 317ef3d59bb6175e1a5ce5de2d52e35e534a2bab
- SHA512 d12f6c7ce1b75bb261b2da89fb15edf602ca48cc21463e4b51445970e9f87be42a37d3b81135ea07298e3cbc011021eedd41e088eb5e44b8b34ff7c6839138db
- SSDEEP 12288:reOQEyRT0eMQNmDWJXb/T1YiLvHrEJul0e5kZ/WTDzjTAQjTDzj6qaI:resyRT2QN6qXbOiLrdkZ/WTDzjTAQjTv
- TLSH T141D44B007A847BB8F48EA0BA727A5A4250D896145348B67BC1ECFEB23066DC15D34FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
428672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
certca.pdb
msvcrt
??1exception@@UAE@XZ
__iob_func
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
free
_initterm
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
??3@YAXPAX@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strcspn
fprintf
wcscspn
fflush
fclose
fopen
_errno
_wgetenv
fseek
ftell
fwrite
_vsnwprintf
iswalpha
strchr
getenv
_vsnprintf
??_V@YAXPAX@Z
wcschr
_wcsicmp
iswspace
iswxdigit
iswdigit
_wtoi
??0exception@@QAE@ABV0@@Z
__isascii
isxdigit
swscanf
wcsrchr
wcsstr
_wcsnicmp
isdigit
atoi
strncmp
fputws
ferror
_wfopen_s
fwprintf
_swab
vfwprintf
wcstoul
iswupper
towlower
iswlower
towupper
wcsncmp
strrchr
wcstok
_wtol
wcstol
bsearch
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
memcmp
__CxxFrameHandler3
_lock
memset
api-ms-win-core-libraryloader-l1-2-0
LockResource
LoadLibraryExW
LoadResource
LoadStringW
GetProcAddress
FindResourceExW
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
crypt32
CertGetNameStringW
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptEnumOIDInfo
CryptFormatObject
CryptEncodeObject
CertGetCRLContextProperty
CertDeleteCTLFromStore
CertFindCTLInStore
CertAddEncodedCTLToStore
CryptMsgEncodeAndSignCTL
CryptHashPublicKeyInfo
CryptHashCertificate
CryptDecodeObjectEx
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertDuplicateCertificateContext
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CertGetIntendedKeyUsage
CertFreeCertificateChainEngine
CertCloseStore
CertCreateCertificateChainEngine
CertOpenStore
CertGetEnhancedKeyUsage
CryptEncodeObjectEx
CertNameToStrW
CertEnumCertificatesInStore
CryptFindOIDInfo
CryptInitOIDFunctionSet
CryptGetOIDFunctionAddress
CryptFreeOIDFunctionAddress
CertCreateCertificateContext
CertFindExtension
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentProcess
CreateThread
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount
GetComputerNameExW
GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
GetFileSize
CreateFileW
GetFullPathNameW
ReadFile
CompareFileTime
FileTimeToLocalFileTime
GetFileAttributesW
LocalFileTimeToFileTime
WriteFile
GetTempFileNameW
GetFileType
DeleteFileW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCloseKey
RegDeleteKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegGetValueW
api-ms-win-security-base-l1-1-0
AddAccessAllowedObjectAce
AddAccessAllowedAce
GetSecurityDescriptorLength
GetSidSubAuthority
GetLengthSid
AdjustTokenPrivileges
InitializeAcl
AccessCheck
GetSidIdentifierAuthority
InitializeSid
GetSidLengthRequired
GetSidSubAuthorityCount
GetSecurityDescriptorControl
GetAclInformation
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAce
GetSecurityDescriptorGroup
AccessCheckByType
GetSecurityDescriptorDacl
AllocateAndInitializeSid
DuplicateToken
CheckTokenMembership
FreeSid
DeleteAce
RevertToSelf
ImpersonateLoggedOnUser
CreateWellKnownSid
EqualSid
GetTokenInformation
MakeAbsoluteSD
GetAce
MakeSelfRelativeSD
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
CopySid
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
FoldStringW
api-ms-win-core-string-l2-1-0
CharLowerW
rpcrt4
UuidCreate
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
SearchPathW
GetStdHandle
GetEnvironmentVariableW
api-ms-win-core-localization-l1-2-0
IdnToUnicode
GetACP
GetLocaleInfoW
FormatMessageW
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetProcessImageFileNameW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
wldap32
ord147
ord167
ord127
ord12
ord65
ord142
ord155
ord79
ord18
ord210
ord145
ord14
ord73
ord113
ord40
ord21
ord194
ord10
ord133
ord27
ord69
ord41
ord140
ord26
ord16
ord36
ord203
ord13
ord224
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-security-logon-l1-1-0
LogonUserExW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
ntdll
RtlFreeUnicodeString
RtlUTF8StringToUnicodeString
RtlInitUTF8String
RtlNtStatusToDosError
RtlValidRelativeSecurityDescriptor
RtlFindMessage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
CAAccessCheck
CAAccessCheckEx
CAAddCACertificateType
CAAddCACertificateTypeEx
CACertTypeAccessCheck
CACertTypeAccessCheckEx
CACertTypeAuthzAccessCheck
CACertTypeGetSecurity
CACertTypeQuery
CACertTypeRegisterQuery
CACertTypeSetSecurity
CACertTypeUnregisterQuery
CACloneCertType
CACloseCA
CACloseCertType
CACountCAs
CACountCertTypes
CACreateAutoEnrollmentObjectEx
CACreateCertType
CACreateLocalAutoEnrollmentObject
CACreateNewCA
CADCSetCertTypePropertyEx
CADeleteCA
CADeleteCAEx
CADeleteCertType
CADeleteCertTypeEx
CADeleteLocalAutoEnrollmentObject
CAEnumCertTypes
CAEnumCertTypesEx
CAEnumCertTypesEx2
CAEnumCertTypesForCA
CAEnumCertTypesForCAEx
CAEnumFirstCA
CAEnumNextCA
CAEnumNextCertType
CAFindByCertType
CAFindByIssuerDN
CAFindByName
CAFindCertTypeByName
CAFindCertTypeByName2
CAFreeCAProperty
CAFreeCertTypeExtensions
CAFreeCertTypeProperty
CAGetCACertificate
CAGetCAExpiration
CAGetCAFlags
CAGetCAProperty
CAGetCASecurity
CAGetCertTypeExpiration
CAGetCertTypeExtensions
CAGetCertTypeExtensionsEx
CAGetCertTypeFlags
CAGetCertTypeFlagsEx
CAGetCertTypeKeySpec
CAGetCertTypeProperty
CAGetCertTypePropertyEx
CAGetDN
CAInstallDefaultCertType
CAInstallDefaultCertTypeEx
CAIsCertTypeCurrent
CAIsCertTypeCurrentEx
CAOIDAdd
CAOIDAddEx
CAOIDCreateNew
CAOIDCreateNewEx
CAOIDDelete
CAOIDDeleteEx
CAOIDFreeLdapURL
CAOIDFreeProperty
CAOIDGetLdapURL
CAOIDGetProperty
CAOIDGetPropertyEx
CAOIDSetProperty
CAOIDSetPropertyEx
CARemoveCACertificateType
CARemoveCACertificateTypeEx
CASetCACertificate
CASetCAExpiration
CASetCAFlags
CASetCAProperty
CASetCASecurity
CASetCertTypeExpiration
CASetCertTypeExtension
CASetCertTypeFlags
CASetCertTypeFlagsEx
CASetCertTypeKeySpec
CASetCertTypeProperty
CASetCertTypePropertyEx
CAUpdateCA
CAUpdateCAEx
CAUpdateCertType
CAUpdateCertTypeEx
CCFindCertificateBuildFilter
CCFindCertificateFreeFilter
CCFindCertificateFromFilter
CCFreeStringArray
CCGetCertNameList
Name
.text
Size
587KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
236B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=27412,
count=18, id=260, version=27412,
count=517, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=13, id=261, version=27412,
count=1, id=256, version=27412,
count=80, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certcli.dll
- IMPHASH 4581fa4551d38b1424dcd44d70665734
- SHA256 40af883bf1aecec83714d933c46dfa0cbd89471bef398e2739624e6ed94b05b9
- MD5 94959955e081eab094c6a73457f92654
- SHA1 a15a7e540c860401843776a9df657fa736c70257
- SHA512 f84f0d15f87ed813264fc571c8a0b17aaabde6b15e30887e482c74400f76414c218430b359021cfd6ade07332e6503427b6b2f9eb876ebc136a9ddfd7a297af3
- SSDEEP 6144:BN6l/ElQGjhX/z3ftv5TEeyLJukUYjgoMshTSXRf75k:XT2GZ/z3Vv5weyvjgoP
- TLSH T1F7742901B3C098E5F1A3953119F5A629D53EFD728B25C9CBA3C4ABBD2E306C18D35B16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
268048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
certcli.pdb
msvcrt
_purecall
free
wcsncpy_s
malloc
isxdigit
swscanf
iswalpha
memcpy_s
__CxxFrameHandler3
wcschr
_vsnwprintf
??1exception@@UAE@XZ
_vsnprintf
_strnicmp
_CxxThrowException
iswspace
isdigit
??_V@YAXPAX@Z
strchr
memcpy
atoi
_wcsicmp
memmove
_XcptFilter
_amsg_exit
??3@YAXPAX@Z
_initterm
?what@exception@@UBEPBDXZ
wcsstr
?terminate@@YAXXZ
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_lock
_unlock
__dllonexit
_onexit
_wcsnicmp
_except_handler4_common
iswdigit
??1type_info@@UAE@XZ
_errno
realloc
memcmp
wcsrchr
_callnewh
towlower
iswupper
iswlower
towupper
wcsncmp
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
iswxdigit
wcscspn
__isascii
_wtoi
bsearch
memset
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObjectEx
CreateEventW
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LoadResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
LoadStringW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
api-ms-win-core-string-l2-1-0
CharLowerW
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
FoldStringW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
LocalReAlloc
GlobalFree
crypt32
CryptImportPublicKeyInfoEx2
CryptImportPublicKeyInfo
CryptMsgClose
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertNameToStrW
CryptExportPublicKeyInfoEx
CryptEncodeObjectEx
CryptStringToBinaryW
CryptDecodeObjectEx
CryptDecodeObject
CryptSignMessage
CertComparePublicKeyInfo
CertGetNameStringW
CertAddCertificateLinkToStore
CertEnumCertificatesInStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CryptHashPublicKeyInfo
CryptHashCertificate
CertFindExtension
CertGetCertificateContextProperty
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertSetStoreProperty
CertFindCertificateInStore
CertCreateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertOpenStore
CertStrToNameW
api-ms-win-core-file-l1-1-0
CompareFileTime
LocalFileTimeToFileTime
WriteFile
ReadFile
GetFileSize
CreateFileW
SetEndOfFile
FileTimeToLocalFileTime
SetFilePointer
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-localization-l1-2-0
GetACP
GetLocaleInfoW
FormatMessageW
IdnToUnicode
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
rpcrt4
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcNetworkIsProtseqValidW
NdrDllGetClassObject
RpcStringFreeW
RpcCancelThreadEx
CStdStubBuffer_DebugServerQueryInterface
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcExceptionFilter
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
NdrClientCall4
NdrDllCanUnloadNow
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemDirectoryW
GetComputerNameExW
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
EqualSid
GetTokenInformation
RevertToSelf
FreeSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
SearchPathW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
GetComputerNameW
UnregisterWait
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
certca
ord823
ord819
ord450
ord445
ord602
ord435
ord813
ord705
ord818
ord817
ord707
ord601
ord838
ord444
ord840
ord412
ord405
ord841
ord411
ord842
ord404
ord414
ord413
ord839
ord824
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetProcessImageFileNameW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-core-datetime-l1-1-0
GetDateFormatA
GetTimeFormatW
GetDateFormatW
GetTimeFormatA
wldap32
ord147
ord167
ord210
ord12
ord13
ord18
ord16
ord26
ord41
ord127
ord140
ord224
api-ms-win-service-management-l1-1-0
OpenServiceW
CloseServiceHandle
OpenSCManagerW
StartServiceW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
ChangeServiceConfigW
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-security-logon-l1-1-0
LogonUserExW
api-ms-win-core-registry-l2-1-0
RegConnectRegistryW
api-ms-win-eventlog-legacy-l1-1-0
DeregisterEventSource
ReportEventW
RegisterEventSourceW
cryptsp
CryptReleaseContext
CryptDestroyHash
CryptGetProvParam
CryptExportKey
CryptEncrypt
CryptDecrypt
CryptAcquireContextW
CryptCreateHash
CryptSetKeyParam
CryptHashData
CryptSetHashParam
CryptGetHashParam
CryptSetProvParam
CryptGetUserKey
CryptContextAddRef
CryptSignHashW
CryptVerifySignatureW
CryptGetKeyParam
CryptDestroyKey
CryptDuplicateKey
api-ms-win-service-private-l1-1-0
WaitServiceState
ntdll
EtwTraceMessage
AddOrRemoveOCSPISAPIExtension
CAAccessCheck
CAAccessCheckEx
CAAddCACertificateType
CAAddCACertificateTypeEx
CACertTypeAccessCheck
CACertTypeAccessCheckEx
CACertTypeAuthzAccessCheck
CACertTypeGetSecurity
CACertTypeQuery
CACertTypeRegisterQuery
CACertTypeSetSecurity
CACertTypeUnregisterQuery
CACloneCertType
CACloseCA
CACloseCertType
CACountCAs
CACountCertTypes
CACreateAutoEnrollmentObjectEx
CACreateCertType
CACreateLocalAutoEnrollmentObject
CACreateNewCA
CADCSetCertTypePropertyEx
CADeleteCA
CADeleteCAEx
CADeleteCertType
CADeleteCertTypeEx
CADeleteLocalAutoEnrollmentObject
CAEnumCertTypes
CAEnumCertTypesEx
CAEnumCertTypesForCA
CAEnumCertTypesForCAEx
CAEnumFirstCA
CAEnumNextCA
CAEnumNextCertType
CAFindByCertType
CAFindByIssuerDN
CAFindByName
CAFindCertTypeByName
CAFreeCAProperty
CAFreeCertTypeExtensions
CAFreeCertTypeProperty
CAGetAccessRights
CAGetCACertificate
CAGetCAExpiration
CAGetCAFlags
CAGetCAProperty
CAGetCASecurity
CAGetCertTypeAccessRights
CAGetCertTypeExpiration
CAGetCertTypeExtensions
CAGetCertTypeExtensionsEx
CAGetCertTypeFlags
CAGetCertTypeFlagsEx
CAGetCertTypeKeySpec
CAGetCertTypeProperty
CAGetCertTypePropertyEx
CAGetConfigStringFromUIPicker
CAGetDN
CAInstallDefaultCertType
CAInstallDefaultCertTypeEx
CAIsCertTypeCurrent
CAIsCertTypeCurrentEx
CAIsCertTypeValid
CAIsValid
CAOIDAdd
CAOIDAddEx
CAOIDCreateNew
CAOIDCreateNewEx
CAOIDDelete
CAOIDDeleteEx
CAOIDFreeLdapURL
CAOIDFreeProperty
CAOIDGetLdapURL
CAOIDGetProperty
CAOIDGetPropertyEx
CAOIDSetProperty
CAOIDSetPropertyEx
CARemoveCACertificateType
CARemoveCACertificateTypeEx
CASetCACertificate
CASetCAExpiration
CASetCAFlags
CASetCAProperty
CASetCASecurity
CASetCertTypeExpiration
CASetCertTypeExtension
CASetCertTypeFlags
CASetCertTypeFlagsEx
CASetCertTypeKeySpec
CASetCertTypeProperty
CASetCertTypePropertyEx
CAUpdateCA
CAUpdateCAEx
CAUpdateCertType
CAUpdateCertTypeEx
CSPrintAssert
CSPrintError
CSPrintErrorLineFile
CSPrintErrorLineFile2
CSPrintErrorLineFileData
CSPrintErrorLineFileData2
CertcliGetDetailedCertcliVersionString
DbgIsSSActive
DbgLogStringInit
DbgLogStringInit2
DbgPrintf
DbgPrintfInit
DbgPrintfW
DecodeFileW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
EnableASPInIIS
EnableISAPIExtension
EncodeToFileW
IsASPEnabledInIIS
IsASPEnabledInIIS_New
IsISAPIExtensionEnabled
RemoveISAPIExtension
RemoveVDir
SplitConfigString
WszToMultiByteInteger
WszToMultiByteIntegerBuf
caTranslateFileTimePeriodToPeriodUnits
myAddShare
myCAPropGetDisplayName
myCAPropInfoLookup
myCAPropInfoUnmarshal
myCryptBinaryToString
myCryptBinaryToStringA
myCryptStringToBinary
myCryptStringToBinaryA
myDoesDSExist@209
myEnablePrivilege
myFreeColumnDisplayNames
myGenerateGuidSerialNumber
myGenerateGuidString
myGetErrorMessageText
myGetErrorMessageText1
myGetErrorMessageTextEx
myGetHashAlgorithmOIDInfoFromSignatureAlgorithm
myGetSidFromDomain
myGetTargetMachineDomainDnsName
myHExceptionCode
myHExceptionCodePrint
myHGetLastError
myHResultToStringRaw_old
myHResultToString_old
myIsDelayLoadHResult
myJetHResult
myLogExceptionInit
myModifyVirtualRootsAndFileShares
myNetLogonUser
myOIDHashOIDToString
myRevertSanitizeName
myRobustLdapBind
myRobustLdapBindEx
mySanitizeName
mySanitizedNameToDSName
mySanitizedNameToShortName
mylstrcmpiL
Name
.text
Size
298KB
Virtual Size
298KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
464B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=106, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=18, id=260, version=27412,
count=610, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=100, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certenc.dll
- IMPHASH 2ba5dddd7ce260c18017a9f2ee533dbd
- SHA256 0b16e60bff94a24527420aab40320858f3dc4d9f3f66a197350c4ca6ac1308d4
- MD5 b7a20cb367652e64018d25d8af1ffa45
- SHA1 dd0f7425e1520e74065e4d4c2e47caa0d046ec77
- SHA512 b9b03ad425201b2bfcea01668b1c15e15a1a59c113f7da24aa6c3690927f98debbcf246341b5133387436572e9dd7d1e62728b2b46452f53a2ce7218e6b0f293
- SSDEEP 768:Fm9BvoSzd3GDmYLcDNR72RCcirKQMiu2Mz4:U9B73lYLcT7ACcirKQa2Ms
- TLSH T1ED33C50177C59A65D9A522B30D7FA5A5597EFC211F10EACB0304726E2C72BC3EE3436A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
35024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
certenc.pdb
msvcrt
_callnewh
_except_handler4_common
_amsg_exit
_XcptFilter
atoi
memcpy
_initterm
strchr
isdigit
_vsnwprintf
malloc
free
_purecall
memset
atl
ord16
ord21
ord15
ord18
ord22
ord32
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
oleaut32
CreateErrorInfo
SysStringByteLen
GetErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SetErrorInfo
LoadRegTypeLi
SysFreeString
SysAllocStringByteLen
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
GetSystemDirectoryW
GetTickCount
api-ms-win-core-com-l1-1-0
CoTaskMemFree
StringFromCLSID
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=16, id=260, version=27412,
count=149, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=13, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certlm.msc
- SHA256 32d11fe50ee1f6afc85420e260f4cec0759fd7c4cb9265093458fa2f4c3e1420
- MD5 dcca682fea47192106ec4f2001eae182
- SHA1 103c71cb41ba830197e80ed8ec29ec080c42b433
- SHA512 9ba19663e88aa53fce10a8a171b36ff7b7d8c5cefcce893bc391304ba09f4a6a52b6419912d3f78517e1b0c513d136681c877e94a38686df30313b076c2464a8
- SSDEEP 384:Q8e6Zz48hWT/1zWj4DLpPLPHo9dXS79N3xPeMy7L:NeSz9C/1zWj4DLFPI9NMlkH
- TLSH T15C53A5738DC6ABF65324A440065CFF845F8427DB8289A24BF54E714BAFA9870675BC3C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/certmgr.dll
- IMPHASH ca188497e79abc1def20615c73631f36
- SHA256 859519d057e0720ec3b9a743f8869c6354d3d67a2154bba6d6db2b4b9fd5aa18
- MD5 c57abbb736050e8efc24f9a4829cecdf
- SHA1 8d1bff10b4d5c35024ac0022ee819aa0b1d0f92d
- SHA512 ecdcd427351d60923f27e3e1d05442ab0f5648340bdb0686f8256596186c418652eb277b332b9eb2ebeb82c753bd8e551004dfab7ae332a7e4033733bea679af
- SSDEEP 49152:P1fjXbKWda6SyMMMMMMeMMMMMM53uXxU:PdMMMMMMeMMMMMMhuXx
- TLSH T16795DB21F1B1EC73D9236B7038BDF52D91AD79141345858B328AF1FA92F274031EDAA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
598416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
certmgr.pdb
mfc42u
ord3718
ord797
ord2362
ord2291
ord2371
ord3133
ord4294
ord4162
ord6193
ord6375
ord2110
ord3871
ord1197
ord3867
ord2857
ord4215
ord2576
ord3649
ord2430
ord1143
ord1637
ord2858
ord6266
ord3905
ord3288
ord4238
ord2293
ord6211
ord3296
ord1635
ord3084
ord2776
ord941
ord4118
ord5949
ord5852
ord496
ord4616
ord4254
ord4709
ord3695
ord4425
ord2046
ord4433
ord5284
ord1683
ord3870
ord3798
ord4253
ord489
ord768
ord2281
ord2729
ord1258
ord1899
ord491
ord3614
ord2406
ord3621
ord2854
ord1634
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord3733
ord1083
ord5617
ord4399
ord6640
ord2820
ord6279
ord6278
ord925
ord922
ord5568
ord2914
ord1128
ord2717
ord3948
ord561
ord815
ord2821
ord2810
ord538
ord2578
ord6303
ord521
ord602
ord3562
ord3569
ord4390
ord2567
ord616
ord535
ord1001
ord3577
ord4392
ord802
ord542
ord3087
ord6330
ord940
ord825
ord942
ord3281
ord6451
ord6896
ord4219
ord268
ord1560
ord2644
ord2385
ord1662
ord6898
ord2859
ord4970
ord3991
ord795
ord3716
ord693
ord3635
ord3365
ord4396
ord2574
ord823
ord5155
ord5156
ord5154
ord4899
ord4736
ord4942
ord4352
ord5261
ord4371
ord4848
ord4992
ord2506
ord6048
ord1767
ord5283
ord4829
ord4419
ord3694
ord1184
ord6928
ord858
ord6195
ord4155
ord4704
ord2294
ord692
ord3634
ord4395
ord2573
ord4214
ord2016
ord2405
ord6362
ord2570
ord4213
ord2015
ord2403
ord4847
ord1594
ord4272
ord4370
ord5276
ord3592
ord810
ord3728
ord3393
ord686
ord384
ord5947
ord2637
ord3092
ord4229
ord641
ord324
ord6024
ord5798
ord2809
ord3090
ord2634
ord4198
ord927
ord2520
ord1008
ord5855
ord3979
ord1565
ord6868
ord4124
ord2755
ord5706
ord2910
ord5817
ord3657
ord998
ord5977
ord609
ord4199
ord2455
ord1644
ord2756
ord6137
ord543
ord803
ord3579
ord713
ord414
ord3697
ord5436
ord6379
ord5446
ord6390
ord3658
ord501
ord1145
ord5603
ord773
ord5293
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord2606
ord3396
ord1764
ord656
ord567
ord818
ord3605
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3397
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord861
ord1165
ord6466
ord800
ord540
ord771
msvcrt
memset
_purecall
wcslen
wcscmp
_stricmp
memcmp
_wcsicmp
free
wcstok_s
realloc
strlen
mbstowcs
strcmp
??_V@YAXPAX@Z
memcpy
_wcsupr
wcsstr
wcscspn
_vsnwprintf
__CxxFrameHandler3
wcschr
wcscoll
malloc
_wcsnicmp
wcstol
wcsncmp
iswdigit
swprintf_s
_wtol
wcscat_s
wcscpy_s
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
__RTDynamicCast
_itow
wcstoul
wcsrchr
iswspace
_beginthreadex
_endthreadex
memmove
qsort
_wtoi
atl
ord44
ord32
ord16
ord21
ord15
ord30
ord43
ntdll
RtlInitUnicodeString
RtlCompareUnicodeString
RtlNtStatusToDosError
certca
ord416
ord411
ord413
ord414
ord445
ord450
ord451
ord433
ord459
ord405
ord442
ord444
ord446
ord412
ord424
ord455
ord452
ord453
ord460
ord435
ord404
certenroll
ord29
ord16
ord19
ord15
ord18
ord31
ord21
ord23
ord22
ord40
ord33
kernel32
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
FreeLibrary
HeapFree
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
HeapAlloc
CreateFileMappingW
GetUserDefaultLangID
GetFileTime
GetFileSizeEx
ResetEvent
SetEvent
WaitForSingleObject
CreateEventW
GlobalUnlock
GlobalLock
WideCharToMultiByte
ReadFile
GetFileSize
CreateFileW
GetCurrentThreadId
CloseHandle
GetCurrentProcess
GetComputerNameW
GlobalFree
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
CompareStringW
GetSystemWindowsDirectoryW
GetVersionExW
FormatMessageW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCommandLineW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
GetProcAddress
SetLastError
MultiByteToWideChar
GetACP
SystemTimeToFileTime
GetSystemTime
CompareFileTime
RaiseException
lstrcmpiW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetLastError
GetTickCount
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetComputerNameExW
ExpandEnvironmentStringsA
InitOnceExecuteOnce
user32
ScreenToClient
GetWindowRect
GetMenu
EnableMenuItem
SetMenu
LoadMenuW
DestroyWindow
CallWindowProcW
DefWindowProcW
SetFocus
GetKeyState
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsDlgButtonChecked
CheckDlgButton
GetSysColor
GetClientRect
MessageBoxW
SetWindowLongW
GetWindowTextW
ShowWindow
SetWindowTextW
SendDlgItemMessageW
GetWindow
GetDlgItem
GetSystemMetrics
RegisterClipboardFormatW
GetParent
PostMessageW
WinHelpW
GetDlgCtrlID
SendMessageW
EnableWindow
LoadBitmapW
LoadImageW
LoadIconW
DestroyIcon
IsWindowVisible
UpdateWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
FindWindowExW
ChildWindowFromPointEx
GetSubMenu
InvalidateRect
LoadStringW
GetFocus
ReleaseDC
GetDC
GetWindowLongW
SystemParametersInfoW
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysAllocString
SysStringLen
VariantClear
SysAllocStringLen
SysStringByteLen
SafeArrayUnaccessData
BstrFromVector
SafeArrayAccessData
VariantInit
ole32
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
ReleaseStgMedium
CoCreateGuid
CLSIDFromString
CoInitialize
StringFromCLSID
CoTaskMemAlloc
GetHGlobalFromStream
CoTaskMemFree
advapi32
RegOpenKeyExA
GetSecurityDescriptorLength
CopySid
GetLengthSid
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
GetUserNameW
SaferCreateLevel
SaferCloseLevel
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
OpenProcessToken
GetTokenInformation
SaferGetLevelInformation
SaferiPopulateDefaultsInRegistry
SaferGetPolicyInformation
RegQueryValueExA
RegSetValueExA
RegDeleteTreeW
CryptGetProvParam
LookupAccountNameW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
SaferSetPolicyInformation
SaferSetLevelInformation
SaferiChangeRegistryScope
CryptSetProvParam
EnumServicesStatusW
netutils
NetpwNameValidate
NetApiBufferFree
NetpwNameCanonicalize
dsrole
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
srvcli
NetServerGetInfo
shell32
SHGetPathFromIDListW
SHGetMalloc
SHBindToParent
SHBrowseForFolderW
SHGetFileInfoW
cryptui
CryptUIDlgSelectCertificateW
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgAddPolicyServerWithPriority
CryptUIWizBuildCTL
CryptUIWizExport
CryptUIWizImport
CryptUIGetCertificatePropertiesPagesW
CryptUIDlgViewCRLW
CryptUIDlgPropertyPolicy
CryptUIDlgViewCertificateW
CryptUIDlgViewCTLW
crypt32
CryptBinaryToStringW
CryptEncodeObject
CryptMsgGetParam
CryptMsgUpdate
CertAddEncodedCTLToStore
CertAddStoreToCollection
CertGetCRLFromStore
CertAddCRLContextToStore
CertEnumCRLsInStore
CertEnumCTLsInStore
CertGetSubjectCertificateFromStore
CertDeleteCRLFromStore
CertGetStoreProperty
CryptFindLocalizedName
CertFreeCRLContext
CertControlStore
CryptMsgClose
CryptDecodeObject
CertFindExtension
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertSetCertificateContextProperty
CryptDecodeObjectEx
CertNameToStrW
CryptFindOIDInfo
CertGetNameStringW
CryptImportPublicKeyInfoEx2
CertGetCertificateChain
CertFreeCertificateChain
CertCompareCertificate
CryptAcquireCertificatePrivateKey
CertGetCTLContextProperty
CertDeleteCTLFromStore
CertFindCTLInStore
CertVerifyRevocation
CertVerifyTimeValidity
CryptMsgEncodeAndSignCTL
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertEnumSystemStore
CryptFindCertificateKeyProvInfo
CertEnumPhysicalStore
CryptEnumOIDInfo
CertAddCertificateContextToStore
CertAddCTLContextToStore
CertDuplicateCTLContext
CertFreeCTLContext
CertGetIntendedKeyUsage
CertDuplicateCRLContext
CryptMsgOpenToDecode
CertGetPublicKeyLength
CertAddSerializedElementToStore
CryptQueryObject
gdi32
CreateFontIndirectW
GetDeviceCaps
DeleteObject
ntdsapi
DsCrackNamesW
DsFreeNameResultW
DsBindW
DsUnBindW
ncrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
NCryptSetProperty
NCryptGetProperty
NCryptIsKeyHandle
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptGetProperty
shlwapi
SHDeleteKeyW
PathFindExtensionW
StrTrimW
wintrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetFileHash
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
imagehlp
ImageLoad
ImageUnload
secur32
GetUserNameExW
aclui
ord2
iphlpapi
ParseNetworkString
slc
SLGetWindowsInformationDWORD
logoncli
DsGetDcNameW
activeds
ord9
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
648KB
Virtual Size
647KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=18, id=260, version=27412,
count=61, id=257, version=27412,
count=751, id=1, productName=Unmarked objects,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=94, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/certmgr.msc
- SHA256 d79c0d2369818f893074af14404f57848bb1327dfaffde83c82d7d165135fa4f
- MD5 4c7390a1ff613fbbf59141ca0be8ae89
- SHA1 1d33193a30cd686e543f74094f04ba3b11d8f68f
- SHA512 facdf3b7ed11fcc1c953cc3ea6430145e3faad8cfcb729db1e336444bb805df09e43d5f0263f050992ae35ae5ff44a6fff7e7c7bfc3f16c4b4cff9f963a93ebd
- SSDEEP 384:SHe6Zz48hWT/1zWj4DLfPHo9dXS79N3xPeMy7L:SeSz9C/1zWj4DLfPI9NMlkH
- TLSH T18653B5738DC6ABF69324A440065CFF845F8427D78289A24BF54E714BAFA9870675BC3C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/cewmdm.dll
- IMPHASH 43349f50a232c404f5d593fb5bdef6e6
- SHA256 5e826468ab274ca98a20295128d8191cf8bc5a54214c46850297fc6ab97c0437
- MD5 5215361b753b5b34045fa39f777a0954
- SHA1 a59a8680a3439d319f3d04027190ef2983504ab2
- SHA512 5097d374ea757e3807eda3b74e003c6c8e31727353065d77ef6142008b5828261585410f6e548c9d4fde932e843518911e98a773bb62ce6e1d18beb51388f1a6
- SSDEEP 6144:t8xEOYE+xV4w1D+90mN0pzxntCizyKpjZDrbLN4oy:t8xEOYE+xaw1DG0mN0z/CiuKpFLa
- TLSH T108349E53BAD444B6E9F13030632E373144BE9A2547D8E4C777686AE67F322C18D3A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
39600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CEWMDM.pdb
msvcrt
_ftol2_sse
wcspbrk
strnlen
_wtol
memcmp
memcpy_s
memcpy
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_wcsnicmp
wcschr
wcsncmp
wcsrchr
_wtoi
_wcsicmp
_vsnwprintf
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
wcsnlen
memset
kernel32
GlobalFree
GlobalAlloc
SetFilePointer
ReadFile
GetVersionExW
lstrlenA
lstrlenW
LocalFree
HeapAlloc
SizeofResource
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
CloseHandle
RaiseException
FindResourceExW
LoadResource
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
GetFileSize
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
HeapFree
WriteFile
GetTempPathW
CreateFileW
DeleteFileW
GetProcessHeap
GetTempFileNameW
GetSystemTimeAsFileTime
WaitForMultipleObjects
GetExitCodeThread
FileTimeToSystemTime
OutputDebugStringW
DebugBreak
CompareStringW
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
OutputDebugStringA
GlobalUnlock
GetDiskFreeSpaceW
DeviceIoControl
FreeEnvironmentStringsW
GetLocalTime
GlobalMemoryStatusEx
GetEnvironmentStringsW
FreeEnvironmentStringsA
GlobalLock
LoadLibraryExW
LocalAlloc
user32
CharNextW
PostThreadMessageW
DispatchMessageW
GetMessageW
LoadIconW
RegisterWindowMessageA
PostMessageW
UnregisterClassA
advapi32
RegDeleteValueW
UnregisterTraceGuids
RegQueryValueExW
RegCloseKey
RegisterTraceGuidsW
GetTraceEnableLevel
RegSetValueExW
GetTraceEnableFlags
RegEnumKeyExW
GetTraceLoggerHandle
TraceMessage
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
ole32
CoInitializeEx
CLSIDFromString
PropVariantClear
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoInitialize
oleaut32
UnRegisterTypeLi
LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
VarUI4FromStr
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SafeArrayCreateVector
VariantCopy
SafeArrayDestroy
SafeArrayRedim
ntdll
RtlGetPersistedStateLocation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=26715,
count=5, id=259, version=27412,
count=15, id=260, version=27412,
count=187, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=62, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cfgbkend.dll
- IMPHASH 94347d4d5548456b30cd0c9a284e5240
- SHA256 8bd39c0d49733754caa0761766a9e9248976fda2f492d50270c18a295cacc715
- MD5 37bd08d221b8c34524d72c7bbd532594
- SHA1 b9796039b459031de08bfdb36b9fa7d9b64850a4
- SHA512 21fc40ee430b107a2794118587199fed2d4ebdc5fc234b9dfd79bcbf2a76b13019b7efb581e67acec9a067a760a75fb049e5e217d41d2239d6e06cc83ed8e749
- SSDEEP 1536:c2WWsZCuGqJkagMf+ZtdTHX0HRqJm8VW5zP4P3QRP5c81T:kTuPZtdTHX0q3aBc8N
- TLSH T1FC533B762290B27DD1D32270527D25367A3FED754795C9CB93201ABAAC202CCED3936B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
52784
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cfgbkend.pdb
ntdll
memcpy_s
wcsncpy_s
_wcsicmp
wcschr
memmove_s
RtlUnwind
memmove
wcscat_s
wcstok_s
wcscpy_s
_chkstk
memcpy
memset
msvcrt
_initterm
_amsg_exit
_XcptFilter
_callnewh
_purecall
free
_errno
_onexit
__dllonexit
_unlock
malloc
_lock
realloc
regapi
RegCreateMonitorConfigW
RegCreateUserConfigW
RegWinStationQueryW
RegWinStationSetExtendedSettingsW
RegWinStationQueryExtendedSettingsW
RegCdCreateW
RegWinStationDeleteW
RegWinStationCreateW
RegWinStationEnumerateW
RegWinStationQueryExNew
RegPdEnumerateW
RegWdQueryW
RegWdEnumerateW
RegPdQueryW
winsta
_WinStationReadRegistry
WinStationFreeMemory
ServerLicensingOpenW
ServerLicensingGetPolicy
ServerLicensingClose
ServerLicensingGetAvailablePolicyIds
_WinStationUpdateSettings
ServerLicensingSetPolicy
WinStationEnumerateW
kernel32
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
LocalFree
CompareStringW
SetLastError
user32
UnregisterClassA
LoadStringW
CharNextW
oleaut32
VarUI4FromStr
SysAllocString
SysFreeString
advapi32
InitializeAcl
RegQueryInfoKeyW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTrusteeNameW
ConvertSidToStringSidW
LookupAccountSidW
BuildSecurityDescriptorW
GetSecurityDescriptorOwner
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeSelfRelativeSD
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
RegCloseKey
BuildTrusteeWithSidW
EqualSid
CreateWellKnownSid
GetExplicitEntriesFromAclW
LookupAccountNameW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueExW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-shcore-registry-l1-1-0
SHDeleteKeyW
CLSID_CfgComp
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IID_ICfgComp
IID_ISettingsComp
IID_ISettingsComp2
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=261, version=27412,
count=17, id=260, version=27412,
count=3, id=259, version=27412,
count=17, id=257, version=27412,
count=143, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=7, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cfgmgr32.dll
- IMPHASH bcae3553d731beb07a0959d30f946975
- SHA256 8440d611230b121f525033b26d6774ec781ba4339b34ff82bb21f3f54b2c6eb0
- MD5 4c4612ddffa61e711667c526287c9742
- SHA1 42e6482cd663cf805ab4b8e670f510b1f33d8219
- SHA512 5e0910bf59e862b89d2ec2f8813e04c25d8f7f2daedaf1fad9b8876550edf51ab28a7569463e153e259bb091419b80d8b4a25040617610d6754841374c0e3d73
- SSDEEP 6144:t0m4ksgb6gsrSUP8DcJmzSSxkqn5kSh6gCL1k3:Cm4k0QIq5kavS1y
- TLSH T184345B12F244D9AAE6E72070241DA322627DB6309FD188C7F7E1DF6DA8705D35A3528F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cc:99:1c:69:6f:27:a4:8a:97:00:b8:0c:aa:9e:15:53:3f:e6:64:76:cb:3f:bf:06:75:0b:e2:08:cc:17:16:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 19, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d3:1d:32:9a:17:3b:40:30:73:00:01:00:00:01:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
52240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cfgmgr32.pdb
api-ms-win-core-crt-l1-1-0
_vsnwprintf_s
_wcsnicmp
_wtoi
wcstoul
_wcsicmp
memmove
memcpy
memcmp
toupper
wcsrchr
wcschr
_except_handler4_common
memset
api-ms-win-core-crt-l2-1-0
_purecall
_initterm_e
_initterm
ntdll
RtlFreeUnicodeString
RtlGetVersion
NtSetValueKey
NtQueryValueKey
NtCreateKey
NtOpenKey
RtlUpcaseUnicodeString
RtlDllShutdownInProgress
RtlIoDecodeMemIoResource
NtClose
RtlCmDecodeMemIoResource
_vsnprintf
RtlIoEncodeMemIoResource
RtlCmEncodeMemIoResource
RtlIsTextUnicode
RtlGetDaclSecurityDescriptor
RtlFormatCurrentUserKeyPath
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlHashUnicodeString
RtlGUIDFromString
RtlMultiByteToUnicodeN
_vsnwprintf
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlEqualUnicodeString
RtlInitUnicodeStringEx
RtlUnicodeStringToInteger
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtCreateFile
RtlInitUnicodeString
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
LoadStringW
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
ReleaseSRWLockShared
SetEvent
CreateEventW
OpenEventW
ReleaseMutex
WaitForMultipleObjectsEx
AcquireSRWLockShared
EnterCriticalSection
SleepEx
WaitForSingleObject
DeleteCriticalSection
CreateMutexW
WaitForSingleObjectEx
InitializeSRWLock
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
SetErrorMode
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
SetThreadToken
OpenProcessToken
GetCurrentThread
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
WakeConditionVariable
SleepConditionVariableSRW
InitializeConditionVariable
Sleep
InitOnceInitialize
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-core-threadpool-l1-2-0
CallbackMayRunLong
SubmitThreadpoolWork
CloseThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolWork
CancelThreadpoolIo
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
DisassociateCurrentThreadFromCallback
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegGetValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetLocalTime
GetSystemWindowsDirectoryW
api-ms-win-core-string-l1-1-0
CompareStringW
GetStringTypeExW
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetKernelObjectSecurity
AdjustTokenPrivileges
GetSecurityDescriptorLength
GetTokenInformation
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
GetThreadLocale
FormatMessageW
LCMapStringW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister
EventWriteTransfer
EventProviderEnabled
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-file-l1-1-0
CompareFileTime
FindClose
DeleteFileW
WriteFile
GetFullPathNameW
GetFileSize
SetFilePointer
GetFileAttributesW
CreateDirectoryW
FlushFileBuffers
CreateFileW
FindFirstFileW
SetEndOfFile
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CMP_GetBlockedDriverInfo
CMP_GetServerSideDeviceInstallFlags
CMP_Get_Device_ID_List
CMP_Get_Device_ID_List_Size
CMP_Init_Detection
CMP_RegisterServiceNotification
CMP_Register_Notification
CMP_Report_LogOn
CMP_WaitNoPendingInstallEvents
CMP_WaitServicesAvailable
CM_Add_Driver_PackageW
CM_Add_Driver_Package_ExW
CM_Add_Empty_Log_Conf
CM_Add_Empty_Log_Conf_Ex
CM_Add_IDA
CM_Add_IDW
CM_Add_ID_ExA
CM_Add_ID_ExW
CM_Add_Range
CM_Add_Res_Des
CM_Add_Res_Des_Ex
CM_Apply_PowerScheme
CM_Connect_MachineA
CM_Connect_MachineW
CM_Create_DevNodeA
CM_Create_DevNodeW
CM_Create_DevNode_ExA
CM_Create_DevNode_ExW
CM_Create_Range_List
CM_Delete_Class_Key
CM_Delete_Class_Key_Ex
CM_Delete_DevNode_Key
CM_Delete_DevNode_Key_Ex
CM_Delete_Device_Interface_KeyA
CM_Delete_Device_Interface_KeyW
CM_Delete_Device_Interface_Key_ExA
CM_Delete_Device_Interface_Key_ExW
CM_Delete_Driver_PackageW
CM_Delete_Driver_Package_ExW
CM_Delete_PowerScheme
CM_Delete_Range
CM_Detect_Resource_Conflict
CM_Detect_Resource_Conflict_Ex
CM_Disable_DevNode
CM_Disable_DevNode_Ex
CM_Disconnect_Machine
CM_Dup_Range_List
CM_Duplicate_PowerScheme
CM_Enable_DevNode
CM_Enable_DevNode_Ex
CM_Enumerate_Classes
CM_Enumerate_Classes_Ex
CM_Enumerate_EnumeratorsA
CM_Enumerate_EnumeratorsW
CM_Enumerate_Enumerators_ExA
CM_Enumerate_Enumerators_ExW
CM_Find_Range
CM_First_Range
CM_Free_Log_Conf
CM_Free_Log_Conf_Ex
CM_Free_Log_Conf_Handle
CM_Free_Range_List
CM_Free_Res_Des
CM_Free_Res_Des_Ex
CM_Free_Res_Des_Handle
CM_Free_Resource_Conflict_Handle
CM_Get_Child
CM_Get_Child_Ex
CM_Get_Class_Key_NameA
CM_Get_Class_Key_NameW
CM_Get_Class_Key_Name_ExA
CM_Get_Class_Key_Name_ExW
CM_Get_Class_NameA
CM_Get_Class_NameW
CM_Get_Class_Name_ExA
CM_Get_Class_Name_ExW
CM_Get_Class_PropertyW
CM_Get_Class_Property_ExW
CM_Get_Class_Property_Keys
CM_Get_Class_Property_Keys_Ex
CM_Get_Class_Registry_PropertyA
CM_Get_Class_Registry_PropertyW
CM_Get_Depth
CM_Get_Depth_Ex
CM_Get_DevNode_Custom_PropertyA
CM_Get_DevNode_Custom_PropertyW
CM_Get_DevNode_Custom_Property_ExA
CM_Get_DevNode_Custom_Property_ExW
CM_Get_DevNode_PropertyW
CM_Get_DevNode_Property_ExW
CM_Get_DevNode_Property_Keys
CM_Get_DevNode_Property_Keys_Ex
CM_Get_DevNode_Registry_PropertyA
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_Property_ExA
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Status
CM_Get_DevNode_Status_Ex
CM_Get_Device_IDA
CM_Get_Device_IDW
CM_Get_Device_ID_ExA
CM_Get_Device_ID_ExW
CM_Get_Device_ID_ListA
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_ExA
CM_Get_Device_ID_List_ExW
CM_Get_Device_ID_List_SizeA
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_List_Size_ExA
CM_Get_Device_ID_List_Size_ExW
CM_Get_Device_ID_Size
CM_Get_Device_ID_Size_Ex
CM_Get_Device_Interface_AliasA
CM_Get_Device_Interface_AliasW
CM_Get_Device_Interface_Alias_ExA
CM_Get_Device_Interface_Alias_ExW
CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_ExA
CM_Get_Device_Interface_List_ExW
CM_Get_Device_Interface_List_SizeA
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_List_Size_ExA
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_Property_ExW
CM_Get_Device_Interface_Property_KeysW
CM_Get_Device_Interface_Property_Keys_ExW
CM_Get_First_Log_Conf
CM_Get_First_Log_Conf_Ex
CM_Get_Global_State
CM_Get_Global_State_Ex
CM_Get_HW_Prof_FlagsA
CM_Get_HW_Prof_FlagsW
CM_Get_HW_Prof_Flags_ExA
CM_Get_HW_Prof_Flags_ExW
CM_Get_Hardware_Profile_InfoA
CM_Get_Hardware_Profile_InfoW
CM_Get_Hardware_Profile_Info_ExA
CM_Get_Hardware_Profile_Info_ExW
CM_Get_Log_Conf_Priority
CM_Get_Log_Conf_Priority_Ex
CM_Get_Next_Log_Conf
CM_Get_Next_Log_Conf_Ex
CM_Get_Next_Res_Des
CM_Get_Next_Res_Des_Ex
CM_Get_Parent
CM_Get_Parent_Ex
CM_Get_Res_Des_Data
CM_Get_Res_Des_Data_Ex
CM_Get_Res_Des_Data_Size
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Resource_Conflict_Count
CM_Get_Resource_Conflict_DetailsA
CM_Get_Resource_Conflict_DetailsW
CM_Get_Sibling
CM_Get_Sibling_Ex
CM_Get_Version
CM_Get_Version_Ex
CM_Import_PowerScheme
CM_Install_DevNodeW
CM_Install_DevNode_ExW
CM_Install_DriverW
CM_Intersect_Range_List
CM_Invert_Range_List
CM_Is_Dock_Station_Present
CM_Is_Dock_Station_Present_Ex
CM_Is_Version_Available
CM_Is_Version_Available_Ex
CM_Locate_DevNodeA
CM_Locate_DevNodeW
CM_Locate_DevNode_ExA
CM_Locate_DevNode_ExW
CM_MapCrToSpErr
CM_MapCrToWin32Err
CM_Merge_Range_List
CM_Modify_Res_Des
CM_Modify_Res_Des_Ex
CM_Move_DevNode
CM_Move_DevNode_Ex
CM_Next_Range
CM_Open_Class_KeyA
CM_Open_Class_KeyW
CM_Open_Class_Key_ExA
CM_Open_Class_Key_ExW
CM_Open_DevNode_Key
CM_Open_DevNode_Key_Ex
CM_Open_Device_Interface_KeyA
CM_Open_Device_Interface_KeyW
CM_Open_Device_Interface_Key_ExA
CM_Open_Device_Interface_Key_ExW
CM_Query_And_Remove_SubTreeA
CM_Query_And_Remove_SubTreeW
CM_Query_And_Remove_SubTree_ExA
CM_Query_And_Remove_SubTree_ExW
CM_Query_Arbitrator_Free_Data
CM_Query_Arbitrator_Free_Data_Ex
CM_Query_Arbitrator_Free_Size
CM_Query_Arbitrator_Free_Size_Ex
CM_Query_Remove_SubTree
CM_Query_Remove_SubTree_Ex
CM_Query_Resource_Conflict_List
CM_Reenumerate_DevNode
CM_Reenumerate_DevNode_Ex
CM_Register_Device_Driver
CM_Register_Device_Driver_Ex
CM_Register_Device_InterfaceA
CM_Register_Device_InterfaceW
CM_Register_Device_Interface_ExA
CM_Register_Device_Interface_ExW
CM_Register_Notification
CM_Remove_SubTree
CM_Remove_SubTree_Ex
CM_Request_Device_EjectA
CM_Request_Device_EjectW
CM_Request_Device_Eject_ExA
CM_Request_Device_Eject_ExW
CM_Request_Eject_PC
CM_Request_Eject_PC_Ex
CM_RestoreAll_DefaultPowerSchemes
CM_Restore_DefaultPowerScheme
CM_Run_Detection
CM_Run_Detection_Ex
CM_Set_ActiveScheme
CM_Set_Class_PropertyW
CM_Set_Class_Property_ExW
CM_Set_Class_Registry_PropertyA
CM_Set_Class_Registry_PropertyW
CM_Set_DevNode_Problem
CM_Set_DevNode_Problem_Ex
CM_Set_DevNode_PropertyW
CM_Set_DevNode_Property_ExW
CM_Set_DevNode_Registry_PropertyA
CM_Set_DevNode_Registry_PropertyW
CM_Set_DevNode_Registry_Property_ExA
CM_Set_DevNode_Registry_Property_ExW
CM_Set_Device_Interface_PropertyW
CM_Set_Device_Interface_Property_ExW
CM_Set_HW_Prof
CM_Set_HW_Prof_Ex
CM_Set_HW_Prof_FlagsA
CM_Set_HW_Prof_FlagsW
CM_Set_HW_Prof_Flags_ExA
CM_Set_HW_Prof_Flags_ExW
CM_Setup_DevNode
CM_Setup_DevNode_Ex
CM_Test_Range_Available
CM_Uninstall_DevNode
CM_Uninstall_DevNode_Ex
CM_Uninstall_DriverW
CM_Unregister_Device_InterfaceA
CM_Unregister_Device_InterfaceW
CM_Unregister_Device_Interface_ExA
CM_Unregister_Device_Interface_ExW
CM_Unregister_Notification
CM_Write_UserPowerKey
DevCloseObjectQuery
DevCreateObjectQuery
DevCreateObjectQueryEx
DevCreateObjectQueryFromId
DevCreateObjectQueryFromIdEx
DevCreateObjectQueryFromIds
DevCreateObjectQueryFromIdsEx
DevFindProperty
DevFreeObjectProperties
DevFreeObjects
DevGetObjectProperties
DevGetObjectPropertiesEx
DevGetObjects
DevGetObjectsEx
DevSetObjectProperties
SwDeviceClose
SwDeviceCreate
SwDeviceGetLifetime
SwDeviceInterfacePropertySet
SwDeviceInterfaceRegister
SwDeviceInterfaceSetState
SwDevicePropertySet
SwDeviceSetLifetime
SwMemFree
Name
.text
Size
203KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=7, id=260, version=27412,
count=3, id=259, version=27412,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=246, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=79, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cfmifs.dll
- IMPHASH d383ccb73ba4a63bb762c243fc58e9ea
- SHA256 6d4a64193fba46c758079f160d90bfc483dcf75e91f62f2497f898fcdb4cb488
- MD5 8bdba39c05134cf78a0398a1cbfaa39c
- SHA1 f1ae68c1f8f5e83173798f54362cd7bffdefdc66
- SHA512 5d1befc9bf6ae43b6378621944afde3495573c7cd2df21293b84d6ba51bb3914cf5b85fda512826d88229aae3435b4ef3ee20fb02f066780aad303bee83f159d
- SSDEEP 768:72F52fJdYmpHYLEvVLTFbbFjL2TF5h1Phi9zgm:KedYmigtFbhjL2TF5XPh+zP
- TLSH T1F9F24B51B7648091E6E67630255CFD362F3D73A20FD040D7B67BA2792FA13C1AA3825E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
55:7e:41:81:e8:30:af:ee:5d:99:64:bc:f4:74:49:e2:8e:44:53:dc:ba:c2:7b:67:75:28:b4:57:1e:1a:bd:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cfmifs.pdb
msvcrt
_amsg_exit
_XcptFilter
_initterm
wcscat_s
realloc
memcpy
free
_except_handler4_common
malloc
memset
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
TlsGetValue
TlsAlloc
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
oleaut32
VarUI4FromStr
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
FreeLibrary
LoadResource
FindResourceExW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
SizeofResource
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualAlloc
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcpynW
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlFreeHeap
RtlAllocateHeap
ulib
?Initialize@WSTRING@@QAEEPBGK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
??1DSTRING@@UAE@XZ
??0DSTRING@@QAE@XZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=260, version=27412,
count=4, id=259, version=27412,
count=83, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cfmifsproxy.dll
- IMPHASH ac450919f43a843f9090d70dca9c7f45
- SHA256 373fbe4bacfa206579fbffcb1a3b2db97a92c004d22b53b1fe1543bebf4ed5a0
- MD5 d8830ac04d2e8e137fd7e1ac58d8760c
- SHA1 dd1d4af0e50ee7f244c4dd4418a90ebe01d99ff9
- SHA512 7cbeeb5f1ff0c99df904385629ae356addb5f4978d34125f2080f7635e31320a2de1a7f788856380d04019356636fa46143bdc58e3c298701cd579dfc9afcb48
- SSDEEP 192:fM0iD8/5sDGBFH+YIVtGAWCXCnh/frjEcCZVWt6vWG:fxiVMFH+YIVtJynxrAZVWt6vW
- TLSH T1ED32D945BF644C75EAAE1B3A14F41A26233DBE200FF152D71ED2591D38B98C2DD3471A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cfmifsproxy.pdb
msvcrt
malloc
_except_handler4_common
free
_amsg_exit
_initterm
_XcptFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
ObjectStublessClient4
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=42, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/chartv.dll
- IMPHASH 0bf17fa685fd8c29793529b13eba4682
- SHA256 55139f288ec9e98301c8355e9fc2eec50df93437334e8198eb1987ccb17cb33e
- MD5 8af0659591332d2de07c1e716ee3c4de
- SHA1 92fbc6a3d99e42d6b90394b3625f1ce439bebc8e
- SHA512 38936942b4ce7d8001f2259cc8c0335f5dc298434177ba9f835e46fc2790f40f36e53801dd277d9436a9e82f23cb309a6707ea410502cb98b77581d31bc70550
- SSDEEP 1536:pMuNXAnFh2TP/AngN2Jxo/QeTTjSCsYyomllAJkYfXrixkA1Y0Pz2niicBrftNmS:KIKFhmAgsIaY/OlAJffX2xZYa2jctmS
- TLSH T1B4A32811764C81B5D2FF567C180EBB7686AFEAB88FE806DB3F30479A9D601D05D3805A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
84464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
chartv.pdb
msvcrt
_vsnwprintf
wcsncmp
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UAE@XZ
memmove
ceil
_ftol2_sse
_ftol2
_CIsin
memset
_CIatan2
_CIcos
_except_handler4_common
_purecall
?name@type_info@@QBEPBDXZ
ntdll
EtwEventUnregister
EtwEventWrite
EtwEventRegister
user32
ord2707
DefWindowProcW
TrackMouseEvent
ReleaseCapture
SetCapture
GetParent
SendMessageW
InvalidateRect
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetKeyState
EndPaint
BeginPaint
RegisterClassExW
SetWindowLongW
DrawTextW
FillRect
SetRect
ReleaseDC
GetDC
IsRectEmpty
CopyRect
GetWindowLongW
EqualRect
SetCursor
GetClientRect
LoadCursorW
PtInRect
GetSysColor
IntersectRect
kernel32
GetCurrentProcess
ResolveDelayLoadedAPI
TerminateProcess
DelayLoadFailureHook
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
InitializeCriticalSection
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetUserDefaultLocaleName
GetLastError
MulDiv
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ole32
GetHGlobalFromStream
OleDuplicateData
CreateStreamOnHGlobal
gdi32
Rectangle
SelectObject
BitBlt
GetTextExtentPoint32W
SetLayout
SetTextColor
GetDeviceCaps
CreateFontW
CreatePen
SetBkMode
CreateHatchBrush
GetStockObject
CreateSolidBrush
Ellipse
Pie
DeleteObject
Polygon
Polyline
LineTo
MoveToEx
SelectClipRgn
CreateRectRgn
GetLayout
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC
CreateDCW
gdiplus
GdipDrawRectangleI
GdiplusStartup
GdiplusShutdown
GdipFillRectangleI
GdipDrawLinesI
GdipDrawPolygonI
GdipFillPolygonI
GdipDrawPieI
GdipFillPieI
GdipCreateFont
GdipCreateFontFamilyFromName
GdipSetSolidFillColor
GdipDeletePen
GdipSetPenDashCap197819
GdipSetPenDashStyle
GdipSetPenWidth
GdipSetPenColor
GdipResetClip
GdipSetClipRectI
GdipSetSmoothingMode
GdipCreateFromHDC
GdipDeleteFont
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipFree
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteGraphics
GdipDeleteFontFamily
CvCloseDataSource
CvCreateDataSource
CvGetData
CvGetDataSourceName
CvInitialize
CvSetData
CvSetDataSourceName
CvUninitialize
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=12, id=260, version=27412,
count=156, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=3, id=261, version=27412,
count=1, id=256, version=27412,
count=30, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/chs_singlechar_pinyin.dat
- SHA256 aabd121681efcd52127119f985515d72747db4726c3060a07b941f549ea79e03
- MD5 cceaefaa4df2f399e9a179d942feb23c
- SHA1 17cbfbd8eeac52ad6b8b418bed2900c1af75ca94
- SHA512 77ae58668202534672254751e5f8fa7ec57919a98f4d28f4fbd373c2802d4f632c0dd0e1bcc67e36e3c7fe813ddcec4b8d564ab8cf171d87d1b760296d2be7a7
- SSDEEP 3072:DA/aRMnA0qAsWf1IPG8UcFSl5Dnx58fk7xR/mT/ULj48KWWYyUb2enSx/0QhXPgk:E/DnDqTq1IG87WxbgY+x/Xh4k
- TLSH T1DCF3ECD23A0D0EF1F3AB5C7CC612656EC2D4F663A1B2A4489FF524850B2CBD4A515F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/cic.dll
- IMPHASH b2bd5ad8a2b11d4c8a30ea916f462c54
- SHA256 af6704a3db15e903cf15c3355a02b72b8f35df8d0238eb29a755a83f3f70b26e
- MD5 7d1f996492ecba7bca086ac0eaeaae3d
- SHA1 c552608e3a89b5d3e80dce9cac8948b3405a3777
- SHA512 ab464be7d9e62f0b95fc938c06705b59ef16ef63f5000f3d94cc08afa63eb716b4a0e6735a2620003fa0420849f678e9c0b24aeb38af974c70bf87d8d0a02904
- SSDEEP 3072:9a1zY+yTdTCA2I2fASaY0Fxmwuf3cwZI30jqnvJzRspNxslxH5Mmu8Aebzg6:9UYXTdTCA2I2fASp0Fx9uf3HNqvvspNk
- TLSH T122F31920760AE9B1C9A322780A8FB3A9B2AFB5B09F5043C3331497BE59756C50D7535F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
108928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cic.pdb
mmcbase
?GetSnapinName@BookKeeping@@SGPBGH@Z
?InvalidInterface@BookKeeping@@SGXHPBG0@Z
?InterfaceMethodException@BookKeeping@@SGXHPBG0KPAU_EXCEPTION_POINTERS@@@Z
?MMCNullInterface@BookKeeping@@SGXHPBG0@Z
?AddSnapinInterface@BookKeeping@@SG_NPAUIUnknown@@PBGAAH@Z
?InterfaceMethodActivationContextException@BookKeeping@@SGXHPBG0KPAU_EXCEPTION_POINTERS@@@Z
MMCUpdateRegistry
?ReleaseSnapinInterface@BookKeeping@@SGJPAUIUnknown@@H@Z
?FromLastError@SC@mmcerror@@QAEAAV12@XZ
?ToHr@SC@mmcerror@@QBEJXZ
??0SC@mmcerror@@QAE@ABV01@@Z
??4SC@mmcerror@@QAEAAV01@ABV01@@Z
?SetFunctionName@SC@mmcerror@@QAEXPBG@Z
??BSC@mmcerror@@QBE_NXZ
??1SC@mmcerror@@QAE@XZ
?s_CallDepth@SC@mmcerror@@0IA
msvcrt
memcmp
_callnewh
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
_purecall
_wcsnicmp
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memset
wcsrchr
wcschr
_wcslwr
_wtol
_wcsupr
_wcsdup
realloc
malloc
wcscpy_s
_wcsicmp
free
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
user32
BeginPaint
GetFocus
IsChild
DestroyWindow
SendMessageW
TranslateMessage
DispatchMessageW
SetFocus
SetWindowPos
CharNextW
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
DestroyAcceleratorTable
IsWindow
UnionRect
PtInRect
InvalidateRect
GetClientRect
GetParent
RegisterClassExW
GetClassInfoExW
wsprintfW
ReleaseDC
DefWindowProcW
SetWindowLongW
GetWindowLongW
CreateWindowExW
CallWindowProcW
WindowFromDC
PostMessageW
GetSysColor
GetDlgItem
GetClassNameW
EndPaint
ShowWindow
GetDC
LoadCursorW
gdi32
DeleteDC
GetDeviceCaps
SetViewportOrgEx
RestoreDC
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCW
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileW
CreateRectRgnIndirect
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
GetVersionExW
GetSystemDirectoryW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
HeapDestroy
GetModuleHandleW
GetProcAddress
GetLastError
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetCurrentProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetLongPathNameW
ReleaseSRWLockExclusive
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
HeapFree
HeapCreate
LocalFree
RaiseException
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpyW
LeaveCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=27412,
count=22, id=260, version=27412,
count=9, id=261, version=27412,
count=13, id=257, version=27412,
count=235, id=1, productName=Unmarked objects,
count=1, id=256, version=27412,
count=26, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/clb.dll
- IMPHASH 37d6aae4f31bdc0e65915c176a2cec37
- SHA256 32d3b0b328ae730a883d94c8017587529220f95ad8a0d66cb3f9729d4298e7b1
- MD5 93e39919ef5159c2bfd595b5b8cd65dd
- SHA1 68cb42949651015111fa48897b9e9953f9f57fa0
- SHA512 73f1b02b080a5845961f2e495501bf8cb8940323cd229f15e2e4e04d4299342a7038744f008afb1cac59cae41e55f18076cb1d9e47941d18d97bffeeac611ff7
- SSDEEP 384:dS/VycM7ZNwRWGdg7+6I0WMSqXuWxeWp:dSd1MXodj7A
- TLSH T1EA624A48B79648E5FBFA227038A70F36523DB1245BE512C7EA03925E3D645C1F83930B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
clb.pdb
msvcrt
_initterm
_except_handler4_common
_wcsdup
malloc
_amsg_exit
_XcptFilter
free
wcstok
kernel32
MulDiv
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc
LocalFree
GetACP
LocalReAlloc
comctl32
ord17
gdi32
GetStockObject
Polyline
GetDeviceCaps
GetTextMetricsW
CreatePen
SelectObject
DeleteObject
SetROP2
CreateFontIndirectW
SetTextAlign
ExtTextOutW
TranslateCharsetInfo
SetBkColor
SetTextColor
user32
SendMessageW
CreateWindowExW
SetWindowPos
GetDC
DefWindowProcW
GetSystemMetrics
LoadStringW
GetWindowLongW
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
EndDialog
DeferWindowPos
EndPaint
BeginPaint
ReleaseDC
GetParent
SetRect
GetDlgItem
GetClientRect
SetWindowLongW
EndDeferWindowPos
LoadCursorW
SetFocus
GetSysColor
DrawFocusRect
RegisterClassW
GetDlgCtrlID
RedrawWindow
BeginDeferWindowPos
UnregisterClassW
ClbAddData
ClbSetColumnWidths
ClbStyleW
ClbWndProc
CustomControlInfoW
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=73, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/clbcatq.dll
- IMPHASH 72e996bd66db98942d19f8d0d6f7e897
- SHA256 d9322320330ebf3fa3d4608ad81e98adab63f53df0693e9c97af7fa19191d71a
- MD5 c3c9ec3c7ffad50357de152607e855d9
- SHA1 e5764b46d8a8f27a5f9c290a24df26161455b53d
- SHA512 a6dbd9faa5cd91fafce3699058645b26f03c0317573e845ac31158b99fb12fcb0ed771dfce23a4d0bced5fbc03c36761861025d0d1b4406f384ac3b982350d11
- SSDEEP 12288:vJXZnWbE5B27HakvMaq1sCVgKlPPZJbJ3:rWbE5Utq17lPPHV
- TLSH T1CBB45B23668D9274C2EB50B20ADFB265DBAFA559479089DB1220D7FD2D73FD20E3410E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0a:cb:f6:0a:13:a7:dc:3c:a9:b1:76:fd:c9:75:45:95:40:5a:b2:db:0d:c3:c5:a2:a6:7f:84:88:17:91:05:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d9:9c:5c:05:92:b0:83:6b:3e:00:01:00:00:01:d9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 1, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
441760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
CLBCatQ.pdb
msvcrt
memcpy
?terminate@@YAXXZ
memcmp
_initterm
_amsg_exit
??1type_info@@UAE@XZ
_XcptFilter
_vsnprintf
_wmakepath_s
_stricmp
malloc
_lock
_local_unwind4
memmove
_CxxThrowException
_onexit
_unlock
_waccess
_wtol
_ltow
wcschr
wcstombs
mbstowcs
towupper
wcsstr
realloc
_wcslwr
_wsplitpath_s
_wcsnicmp
wcsncmp
free
wcstol
_i64tow_s
_purecall
__CxxFrameHandler3
qsort
wcsrchr
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_wcsicmp
memcpy_s
__dllonexit
_vsnwprintf
_except_handler4_common
memset
ntdll
NtQueryEvent
RtlImageNtHeader
NtOpenEvent
RtlInitUnicodeString
RtlAllocateHeap
RtlGetLastNtStatus
RtlWow64IsWowGuestMachineSupported
NtQueryInformationProcess
WinSqmSetDWORD
RtlFreeHeap
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegDeleteTreeW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyExW
RegEnumValueW
RegFlushKey
RegCloseKey
RegDeleteValueW
RegQueryValueExW
api-ms-win-core-com-l1-1-0
CoRevertToSelf
StringFromCLSID
CLSIDFromString
CoImpersonateClient
CreateStreamOnHGlobal
CoGetMalloc
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
CoGetCallContext
CoCreateInstanceEx
CoTaskMemFree
CoTaskMemRealloc
CoGetObjectContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadLibraryExW
LoadStringW
LockResource
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
LoadResource
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
FindResourceExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeSRWLock
SleepEx
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
api-ms-win-security-base-l1-1-0
InitializeAcl
AddAccessDeniedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetLengthSid
AddAccessAllowedAce
GetTokenInformation
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
GetSecurityDescriptorLength
DuplicateTokenEx
GetAclInformation
GetSecurityDescriptorDacl
api-ms-win-core-processthreads-l1-1-0
CreateProcessAsUserW
OpenThreadToken
GetCurrentThreadId
SetThreadStackGuarantee
GetCurrentProcess
GetCurrentThread
CreateProcessW
GetExitCodeProcess
TerminateProcess
OpenProcessToken
GetCurrentProcessId
SetThreadToken
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GlobalMemoryStatusEx
GetTickCount
GetSystemInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetSystemDefaultLCID
IsDBCSLeadByte
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
VirtualFree
MapViewOfFile
OpenFileMappingW
VirtualProtect
UnmapViewOfFile
VirtualQuery
VirtualAlloc
api-ms-win-core-file-l2-1-0
MoveFileWithProgressW
MoveFileExW
api-ms-win-core-file-l1-1-0
GetFileType
GetFileSizeEx
DeleteFileW
WriteFile
SetFilePointer
CreateFileW
CreateDirectoryW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
SetEndOfFile
GetLongPathNameW
ReadFile
FlushFileBuffers
GetTempFileNameW
GetFileAttributesW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-security-base-private-l1-1-0
MakeAbsoluteSD2
api-ms-win-core-com-private-l1-1-0
CoGetModuleType
CLSIDFromOle1Class
rpcrt4
UuidFromStringW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
kernel32
GetComputerNameW
ActivatorUpdateForIsRouterChanges
CLSIDFromStringByBitness
CheckMemoryGates
CoRegCleanup
ComPlusEnablePartitions
ComPlusEnableRemoteAccess
ComPlusMigrate
ComPlusPartitionsEnabled
ComPlusRemoteAccessEnabled
CreateComponentLibraryEx
DeleteAllActivatorsForClsid
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DowngradeAPL
GetCatalogObject
GetCatalogObject2
GetComputerObject
GetGlobalBabyJITEnabled
GetSimpleTableDispenser
InprocServer32FromString
OpenComponentLibraryEx
OpenComponentLibraryOnMemEx
OpenComponentLibraryOnStreamEx
ServerGetApplicationType
SetSetupOpen
SetSetupSave
SetupOpen
SetupSave
UpdateFromAppChange
UpdateFromComponentChange
Name
.text
Size
439KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=27412,
count=17, id=260, version=27412,
count=8, id=259, version=27412,
count=265, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=126, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cldapi.dll
- IMPHASH 76c915ff62f4c12eedf855a3f6e73e5b
- SHA256 7b07c8bf1dbb7ef0b445e6005f3e867391d855cce4a110a962ac8bb37abf597c
- MD5 de7bc4d496d54dc80c6569e33fe3b025
- SHA1 20a913115e8cd106ce7fb6f3deebc4cbf5f6be4e
- SHA512 5621a376c21d5c09a06601fb9e33f4b8ad7a79e454543ec7559474aeed806a0e58bea5ca62f2957cf29f5ae49c626533f9626a9d28fa14eda58247be3413d64b
- SSDEEP 1536:BRawKOcJo0yfJcMYunLTOjF6rnzr3x+Jn8tXvZ7nyZUTTDcEjy:BRawKOcefJNYF6XMJnGv1nyCTTD3j
- TLSH T12EA35CA7F14D449EE2F561FC222D7B715A7B62B0AB2088C3D7300EEC69119D19E3529F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
84096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cldapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_toupper
_o_wcscpy_s
_except_handler4_common
_o___std_type_info_destroy_list
_o__cexit
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcsnlen
ntdll
RtlComputeCrc32
RtlAcquireSRWLockShared
RtlIsPartialPlaceholder
RtlExtendCorrelationVector
RtlIncrementCorrelationVector
NtSetInformationFile
RtlInitUnicodeString
RtlSetThreadPlaceholderCompatibilityMode
NtCreateFile
RtlValidateCorrelationVector
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlDeleteElementGenericTableAvl
NtClose
NtQueryDirectoryFile
RtlInitializeSRWLock
RtlInitializeGenericTableAvl
RtlDosLongPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosError
NtQuerySystemTime
RtlPrefixUnicodeString
RtlNumberGenericTableElementsAvl
RtlReleaseSRWLockShared
RtlEnumerateGenericTableAvl
RtlLookupElementGenericTableAvl
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThread
OpenThread
TerminateThread
CreateThread
SetThreadPriority
GetCurrentProcessId
ResumeThread
GetCurrentThreadId
GetExitCodeThread
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
DeleteCriticalSection
SetWaitableTimer
InitializeSRWLock
TryAcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockShared
OpenEventW
ReleaseSRWLockExclusive
AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-io-l1-1-0
GetQueuedCompletionStatus
DeviceIoControl
CreateIoCompletionPort
GetOverlappedResult
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
GetVolumeInformationW
CreateFileW
GetVolumePathNameW
GetFileSizeEx
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
bcrypt
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventProviderEnabled
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-1
CreateWaitableTimerW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-string-l2-1-0
CharLowerW
fltlib
FilterConnectCommunicationPort
FilterSendMessage
FilterGetMessage
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CfAbortOperation
CfCloseAppPolicy
CfCloseHandle
CfConnectSyncRoot
CfConvertToPlaceholder
CfCreatePlaceholders
CfDehydratePlaceholder
CfDehydratePlaceholderEx
CfDisconnectSyncRoot
CfEnumAppPolicy
CfExecute
CfGetCorrelationVector
CfGetLastSyncStatus
CfGetPlaceholderInfo
CfGetPlaceholderRangeInfo
CfGetPlaceholderStateFromAttributeTag
CfGetPlaceholderStateFromFileInfo
CfGetPlaceholderStateFromFindData
CfGetPlatformInfo
CfGetSyncRootInfoByHandle
CfGetSyncRootInfoByPath
CfGetTransferKey
CfGetWin32HandleFromProtectedHandle
CfHydratePlaceholder
CfLockProperties
CfOpenAppPolicy
CfOpenFileWithOplock
CfOpenProgressEvent
CfQueryProgress
CfQuerySyncProviderStatus
CfReferenceProtectedHandle
CfRegisterSyncRoot
CfReleaseProtectedHandle
CfReleaseTransferKey
CfReportProviderProgress
CfReportProviderProgress2
CfReportSyncStatus
CfRetrieveProperties
CfRevertPlaceholder
CfSetAppPolicy
CfSetCorrelationVector
CfSetInSyncState
CfSetPinState
CfStoreProperties
CfUnlockProperties
CfUnregisterSyncRoot
CfUpdatePlaceholder
CfUpdateSyncProviderStatus
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=27412,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1227, id=1, productName=Unmarked objects,
count=4, id=259, version=27412,
count=10, id=260, version=27412,
count=1, id=256, version=27412,
count=16, id=264, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/clfsw32.dll
- IMPHASH ab68f7978da9d552520f1c31bf449794
- SHA256 cfaa414c7dfa942739c6b4d0e539ec313372b785935cca8713044d170777da5a
- MD5 fef9a1f49a8985c99332b78edf7c3493
- SHA1 2dc17b58cc5ef1b4b6bc8d99be9db43df54dbdc3
- SHA512 1840857ec435e42d017abd5a835a395fde7d215e3a609e5b63fe87a0f856a8a76db56cfb8b9d58fefadb08729c3bf825b69d66b5c2efb98591e798c2acfeef2b
- SSDEEP 1536:eo+1jglOk19RErILfeSNsrAgjv+MtyEr4z:t+SlOS9RErIKSNsrAgjvftZ4z
- TLSH T1CD537C51FBD080B6E1DBA43D281DF2250A7FBAB05FE145CB7B500AAD34786E1A5B9307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
52608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
clfsw32.pdb
msvcrt
_purecall
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
_callnewh
__iob_func
??_V@YAXPAX@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
??0exception@@QAE@ABV0@@Z
_local_unwind4
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
fwprintf
wcsncmp
fflush
??1type_info@@UAE@XZ
memset
ntdll
NtQueryInformationFile
RtlEnterCriticalSection
NtCreateFile
RtlNtStatusToDosError
RtlFreeHeap
EtwUnregisterTraceGuids
NtClose
RtlPrefixUnicodeString
EtwGetTraceEnableFlags
RtlLeaveCriticalSection
RtlInitUnicodeString
EtwTraceMessage
RtlInitializeCriticalSectionAndSpinCount
RtlDosPathNameToRelativeNtPathName_U
EtwGetTraceLoggerHandle
RtlAppendUnicodeStringToString
RtlDeleteCriticalSection
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
NtSetInformationFile
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-heap-l1-1-0
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0
CreateEventA
LeaveCriticalSection
WaitForSingleObject
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
IsValidSecurityDescriptor
InitializeSecurityDescriptor
AddLogContainer
AddLogContainerSet
AdvanceLogBase
AlignReservedLog
AllocReservedLog
CLFS_LSN_INVALID
CLFS_LSN_NULL
CloseAndResetLogFile
CreateLogContainerScanContext
CreateLogFile
CreateLogMarshallingArea
DeleteLogByHandle
DeleteLogFile
DeleteLogMarshallingArea
DeregisterManageableLogClient
DumpLogRecords
FlushLogBuffers
FlushLogToLsn
FreeReservedLog
GetLogContainerName
GetLogFileInformation
GetLogIoStatistics
GetLogReservationInfo
GetNextLogArchiveExtent
HandleLogFull
InstallLogPolicy
LogTailAdvanceFailure
LsnBlockOffset
LsnContainer
LsnCreate
LsnDecrement
LsnEqual
LsnGreater
LsnIncrement
LsnInvalid
LsnLess
LsnNull
LsnRecordSequence
PrepareLogArchive
QueryLogPolicy
ReadLogArchiveMetadata
ReadLogNotification
ReadLogRecord
ReadLogRestartArea
ReadNextLogRecord
ReadPreviousLogRestartArea
RegisterForLogWriteNotification
RegisterManageableLogClient
RemoveLogContainer
RemoveLogContainerSet
RemoveLogPolicy
ReserveAndAppendLog
ReserveAndAppendLogAligned
ScanLogContainers
SetEndOfLog
SetLogArchiveMode
SetLogArchiveTail
SetLogFileSizeWithPolicy
TerminateLogArchive
TerminateReadLog
TruncateLog
ValidateLog
WriteLogRestartArea
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=13, id=260, version=27412,
count=83, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=2, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cliconfg.dll
- IMPHASH 53f65086939c218e4b0724487d136a40
- SHA256 bb1c2bd6e5bf047077c0ee742cdac75bc89f212c47610cf1b2f2f1755f0a4f8b
- MD5 5ae732c0cbd2de4157ba6273579db241
- SHA1 77724558f2b36644d9dbb228d5a6000bb26d6666
- SHA512 46243ce749a2db2d1965cc7ad783a84aa317b0e129b894ae2baec652ae18d7d4d7fd193f86610e9021db979c9993c0958b60275ec05a0540bbb8973e4d79c536
- SSDEEP 768:NrVe9TYPg/NGXIQgD78A5A/33EcLl3Je8yu9SDWCZ3PrIfd+8Ec:NBDgwXIFD78A5O3EchtC3PrIfd+f
- TLSH T13C73E542F059E06CD2E1493C249E7B73DD6FFE309BA874C3F6B14E8468645C6AD242D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
51888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cliconfg.pdb
msvcrt
_except_handler4_common
_initterm
_amsg_exit
_wtol
_wtoi
wcschr
_wcsicmp
_wcsupr
malloc
_XcptFilter
_vsnwprintf
free
iswctype
wcsstr
memmove
memcpy
memset
kernel32
ExpandEnvironmentStringsA
LoadLibraryExA
GetTickCount
GetSystemTimeAsFileTime
GetLastError
MultiByteToWideChar
GetOEMCP
GlobalUnlock
GlobalFree
GlobalLock
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GlobalAlloc
WideCharToMultiByte
GetSystemDirectoryW
CreateFileW
GetFileTime
FileTimeToSystemTime
GetDateFormatW
GetFileSize
GetNumberFormatA
CloseHandle
LoadLibraryExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
CompareStringW
lstrlenW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
user32
MoveWindow
LoadImageW
GetWindowRect
GetDesktopWindow
SendMessageW
GetDlgItem
EnableWindow
SetWindowLongW
SetWindowTextW
LoadStringW
SetPropW
SetFocus
IsDlgButtonChecked
GetWindowTextW
EndDialog
RemovePropW
CheckRadioButton
ShowWindow
GetPropW
CheckDlgButton
GetWindowLongW
MessageBoxW
CharUpperW
MessageBeep
CallWindowProcW
PostMessageW
SetDlgItemTextW
DialogBoxIndirectParamW
GetParent
SendDlgItemMessageW
SetClassLongW
LoadIconW
GetWindowTextLengthW
advapi32
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegDeleteValueW
RegEnumValueW
RegOpenKeyW
comctl32
PropertySheetW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
CPlApplet
ClientConfigureAddEdit
OnInitDialogMain
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=27412,
count=2, id=259, version=27412,
count=110, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=12, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cliconfg.rll
- SHA256 16a366399cb36a1d1cda22a60c86c27ad8347593d7b52efb578b98ca55aa8d49
- MD5 939426df9b6569871b3874c9d496246f
- SHA1 f43564d4b9f3414db68efed6f4e5a8e8e2cc34ec
- SHA512 ce3aaa484e17e1a0c4902fd2be28250313687741adbf85da9e40b405542a81d24c098e334e310cb88169f6789e89d7bcc54d39753f834a4f46a2698f096f7d08
- SSDEEP 384:0qyYPXuNvBQAMYJQ2JQSkdowyoq3stLojgWoCMlxWz25KBhWHpwUfWvKW:08uI30lJBkvTqH0WoCMlxO25KBhWHpA
- TLSH T1A0F2294E72A19169D8DD02B1DC978AF85D786C20FD090627B6F5B71F3CB1370B6129E8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/clrhost.dll
- IMPHASH be7822d9decd5416eb481f754de0b60d
- SHA256 af2df32c528d59c999958d8a4020c24c48e363ed175c0f66c684ecc746608508
- MD5 794f2e8d0e5027a34a837ba4f03507e3
- SHA1 b8a00910ee80136b82a50ce193744210280661ee
- SHA512 6400f7f897a4d75b6f54273b3ce70439fa592c643e53af5aaf884ad00284f4419df6b2eae7ca304b60a3baff5b36f4f4259d47a6e6dc811f010c21a2a147f028
- SSDEEP 192:VmZ0O4nfIDbHrKRx64uQDlinXZFz+YIyjXJc4jsNOeDakE7eipW2NPUVWdcWNnjf:p7ZsXZ5+YIIXJcrGpvpW2NPUVWdcWx
- TLSH T18D52F801FB6448F5D79A167A04A87A3A016EFE340FF047D72AC29E092C685C3AD3875E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
clrhost.pdb
msvcrt
_initterm
_lock
_amsg_exit
_XcptFilter
free
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
_except_handler4_common
_purecall
malloc
_callnewh
mscoree
CLRCreateInstance
kernel32
AcquireSRWLockShared
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetLastError
ExpandEnvironmentStringsW
DecodePointer
ReleaseSRWLockShared
InitOnceExecuteOnce
EncodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer
WindowsPreallocateStringBuffer
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=38, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=3, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/clusapi.dll
- IMPHASH c1b46f736191132309b4ab35f29707d7
- SHA256 cd4faed96f8107f27f6ba0304a0084bcdd8c14bed83617a9cdda7ccad3e35538
- MD5 8e434da7d395238265d4c8c849b9f23f
- SHA1 e5c2b949f94a1b7d5e85a093a466b14de8b079f2
- SHA512 a19b35ac386693b28e34083d65f5cede6f6130eb4f9c5feaa35d1eb399fc7588b935c2ce953893baeb235f1a2f6303c0b11c597d3e20369b3e03dabe0db869dd
- SSDEEP 24576:oeZZ/eULi59Zx6/QEvnmYsJMk55a3JocsV3HMDg/MtH:oeZZRi59Zx6/QEvnmYs6k54Jo5ZHMDgQ
- TLSH T1C6052712A3E84064F5F32A785979766949BFFCB10F31C6CF531086AE5A31AC0EA35727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
673136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClusApi.pdb
rpcrt4
UuidFromStringW
UuidCreate
RpcAsyncInitializeHandle
RpcMgmtSetComTimeout
RpcAsyncCancelCall
NdrAsyncClientCall2
NdrClientCall4
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcErrorGetNextRecord
RpcErrorStartEnumeration
RpcErrorEndEnumeration
RpcBindingReset
RpcSmDestroyClientContext
RpcStringFreeW
RpcAsyncCompleteCall
RpcBindingFree
RpcBindingSetAuthInfoExW
ntdll
RtlLengthSecurityDescriptor
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
EtwEventRegister
EtwEventWrite
RtlAllocateHeap
RtlIpv4StringToAddressW
RtlValidSecurityDescriptor
RtlInitString
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
EtwEventWriteString
EtwEventUnregister
RtlIpv4StringToAddressExW
RtlIpv6AddressToStringExW
NtQuerySystemInformation
RtlUnwind
RtlFreeHeap
RtlNtStatusToDosError
RtlMakeSelfRelativeSD
EtwEventEnabled
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLCID
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
LCMapStringW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
TlsSetValue
GetCurrentThread
TlsGetValue
TlsAlloc
ExitProcess
GetStartupInfoW
SetThreadToken
CreateThread
TerminateProcess
GetCurrentProcess
ExitThread
GetCurrentProcessId
GetExitCodeThread
TlsFree
GetCurrentThreadId
OpenThreadToken
api-ms-win-core-heap-l1-1-0
HeapSize
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadStringW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
FreeLibraryAndExitThread
FreeLibrary
GetProcAddress
GetModuleHandleW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
InitializeSRWLock
AcquireSRWLockShared
ResetEvent
CreateMutexExW
SetEvent
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseMutex
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetComputerNameExW
api-ms-win-security-base-l1-1-0
GetLengthSid
InitializeAcl
FreeSid
GetAce
IsValidAcl
IsValidSid
AreAnyAccessesGranted
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
MapGenericMask
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
GetTokenInformation
CreateWellKnownSid
AdjustTokenPrivileges
ImpersonateSelf
AddAccessAllowedAce
InitializeSecurityDescriptor
MakeAbsoluteSD
MakeSelfRelativeSD
GetSecurityDescriptorDacl
GetSecurityDescriptorLength
SetSecurityDescriptorDacl
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
GetStringTypeW
api-ms-win-core-file-l1-1-0
SetFilePointerEx
WriteFile
GetFileSizeEx
CreateFileW
GetVolumePathNameW
GetFileType
FindClose
FindNextFileW
FindFirstFileExW
FlushFileBuffers
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-registry-l1-1-0
RegGetKeySecurity
RegNotifyChangeKeyValue
RegQueryValueExW
RegRestoreKeyW
RegSaveKeyExW
RegCloseKey
RegFlushKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW
bcrypt
BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptDestroyHash
api-ms-win-core-realtime-l1-1-1
QueryInterruptTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
api-ms-win-core-console-l1-1-0
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsGetValue
FlsFree
FlsAlloc
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
RegisterWaitForSingleObject
UnregisterWait
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-security-lsapolicy-l1-1-0
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
LsaFreeMemory
api-ms-win-security-activedirectoryclient-l1-1-0
DsFreeNameResultW
DsUnBindW
DsMakePasswordCredentialsW
DsCrackNamesW
DsFreePasswordCredentials
kernelbase
ResolveDelayLoadedAPI
dnsapi
DnsValidateName_W
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddClusterGroupDependency
AddClusterGroupSetDependency
AddClusterGroupToGroupSetDependency
AddClusterNode
AddClusterResourceDependency
AddClusterResourceNode
AddClusterStorageNode
AddCrossClusterGroupSetDependency
AddResourceToClusterSharedVolumes
AddResourceToClusterSharedVolumesEx
BackupClusterDatabase
CCHlpAddNodeUpdateCluster
CCHlpConfigureNode
CCHlpCreateClusterNameCOIfNotExists
CCHlpCreateClusterNameInAD
CCHlpGetClusterServiceSecret
CCHlpGetDNSHostLabel
CCHlpRestoreClusterVirtualObjectToInitialState
CanResourceBeDependent
CancelClusterGroupOperation
ChangeClusterResourceGroup
ChangeClusterResourceGroupEx
CloseCluster
CloseClusterGroup
CloseClusterGroupSet
CloseClusterNetInterface
CloseClusterNetwork
CloseClusterNode
CloseClusterNotifyPort
CloseClusterResource
CluFreeFaultDomainInfo
CluFreeGuidArrayPtr
CluFreeStr
CluGetDriveInfo
CluGetFaultDomainObject
CluGetFaultDomainObjects
CluRemoveFaultDomainObject
ClusterAddGroupToAffinityRule
ClusterAddGroupToGroupSet
ClusterAddGroupToGroupSetWithDomains
ClusterAffinityRuleControl
ClusterCaptureLiveDump
ClusterChangeVMSettings
ClusterCloseEnum
ClusterCloseEnumEx
ClusterControl
ClusterCreateAffinityRule
ClusterCreateClusterStorageEnclosure
ClusterCreateFaultDomain
ClusterCreateFaultDomainFromXML
ClusterCreateVMReservation
ClusterCreateVMReservationWithDomains
ClusterEnum
ClusterEnumEx
ClusterFreeMemory
ClusterFreeMrrResponse
ClusterFreeVMReservation
ClusterGetClusterStorageEnclosureObject
ClusterGetClusterStorageEnclosureObjects
ClusterGetDriveInfo
ClusterGetEnumCount
ClusterGetEnumCountEx
ClusterGetFaultDomainObject
ClusterGetFaultDomainObjects
ClusterGetFaultDomainState
ClusterGetFaultDomainXML
ClusterGetPlacementScore
ClusterGroupCloseEnum
ClusterGroupCloseEnumEx
ClusterGroupControl
ClusterGroupEnum
ClusterGroupEnumEx
ClusterGroupGetEnumCount
ClusterGroupGetEnumCountEx
ClusterGroupOpenEnum
ClusterGroupOpenEnumEx
ClusterGroupSetCloseEnum
ClusterGroupSetControl
ClusterGroupSetEnum
ClusterGroupSetGetEnumCount
ClusterGroupSetOpenEnum
ClusterNetInterfaceCloseEnum
ClusterNetInterfaceControl
ClusterNetInterfaceEnum
ClusterNetInterfaceOpenEnum
ClusterNetworkCloseEnum
ClusterNetworkControl
ClusterNetworkEnum
ClusterNetworkGetEnumCount
ClusterNetworkHealthFreeInterfaceConnections
ClusterNetworkHealthFreeNodeConnections
ClusterNetworkHealthGetInterfaceConnections
ClusterNetworkHealthGetNodeConnections
ClusterNetworkOpenEnum
ClusterNodeCloseEnum
ClusterNodeCloseEnumEx
ClusterNodeControl
ClusterNodeEnum
ClusterNodeEnumEx
ClusterNodeGetEnumCount
ClusterNodeGetEnumCountEx
ClusterNodeOpenEnum
ClusterNodeOpenEnumEx
ClusterNodeReplacement
ClusterOpenEnum
ClusterOpenEnumEx
ClusterRegBatchAddCommand
ClusterRegBatchCloseNotification
ClusterRegBatchReadCommand
ClusterRegCloseBatch
ClusterRegCloseBatchEx
ClusterRegCloseBatchNotifyPort
ClusterRegCloseKey
ClusterRegCloseReadBatch
ClusterRegCloseReadBatchEx
ClusterRegCloseReadBatchReply
ClusterRegCreateBatch
ClusterRegCreateBatchNotifyPort
ClusterRegCreateKey
ClusterRegCreateKeyForceSync
ClusterRegCreateReadBatch
ClusterRegDeleteKey
ClusterRegDeleteKeyForceSync
ClusterRegDeleteValue
ClusterRegDeleteValueForceSync
ClusterRegEnumKey
ClusterRegEnumValue
ClusterRegGetBatchNotification
ClusterRegGetKeySecurity
ClusterRegOpenKey
ClusterRegQueryAllValues
ClusterRegQueryInfoKey
ClusterRegQueryValue
ClusterRegReadBatchAddCommand
ClusterRegReadBatchReplyNextCommand
ClusterRegSetKeySecurity
ClusterRegSetValue
ClusterRegSetValueForceSync
ClusterRegSyncDatabase
ClusterRemoveAffinityRule
ClusterRemoveClusterStorageEnclosure
ClusterRemoveFaultDomain
ClusterRemoveGroupFromAffinityRule
ClusterRemoveGroupFromGroupSet
ClusterResourceCloseEnum
ClusterResourceCloseEnumEx
ClusterResourceControl
ClusterResourceControlAsUser
ClusterResourceEnum
ClusterResourceEnumEx
ClusterResourceGetEnumCount
ClusterResourceGetEnumCountEx
ClusterResourceOpenEnum
ClusterResourceOpenEnumEx
ClusterResourceTypeCloseEnum
ClusterResourceTypeControl
ClusterResourceTypeControlAsUser
ClusterResourceTypeEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeOpenEnum
ClusterSendReceiveMrr
ClusterSendReceiveMrrAsUser
ClusterSetAccountAccess
ClusterSetClusterStorageEnclosure
ClusterSetFaultDomain
ClusterSetNodeFaultDomain
ClusterSharedVolumeClearBackupState
ClusterSharedVolumeSetSnapshotState
ClusterStmFindDisk
ClusterUpgradeFunctionalLevel
ClusterUpgradeFunctionalLevelEx
CreateCluster
CreateClusterAvailabilitySet
CreateClusterGroup
CreateClusterGroupEx
CreateClusterGroupSet
CreateClusterManagementPoint
CreateClusterNameAccount
CreateClusterNotifyPort
CreateClusterNotifyPortV2
CreateClusterResource
CreateClusterResourceType
CreateClusterResourceWithId
DeleteClusterGroup
DeleteClusterGroupSet
DeleteClusterResource
DeleteClusterResourceType
DestroyCluster
DestroyClusterGroup
DetermineCNOResTypeFromCluster
DetermineCNOResTypeFromNodelist
DetermineClusterCloudTypeFromCluster
DetermineClusterCloudTypeFromNodelist
EvictClusterNode
EvictClusterNodeEx
FailClusterResource
FreeClusFaultDomainInfo
FreeClusFaultDomainInfoArray
FreeClusFaultDomainXML
FreeClusStorageEnclosureInfo
FreeClusStorageEnclosureInfoArray
GetClusterFromGroup
GetClusterFromNetInterface
GetClusterFromNetwork
GetClusterFromNode
GetClusterFromResource
GetClusterGroupKey
GetClusterGroupState
GetClusterInformation
GetClusterKey
GetClusterNetInterface
GetClusterNetInterfaceKey
GetClusterNetInterfaceState
GetClusterNetworkId
GetClusterNetworkKey
GetClusterNetworkState
GetClusterNodeId
GetClusterNodeKey
GetClusterNodeState
GetClusterNotify
GetClusterNotifyV2
GetClusterQuorumResource
GetClusterResourceDependencyExpression
GetClusterResourceKey
GetClusterResourceNetworkName
GetClusterResourceState
GetClusterResourceTypeKey
GetClusterSharedVolumeNameForFile
GetNodeCloudTypeDW
GetNodeClusterState
GetNotifyEventHandle
InitializeClusFaultDomainInfo
InitializeClusFaultDomainInfoArray
InitializeClusStorageEnclosureInfo
InitializeClusStorageEnclosureInfoArray
IsFileOnClusterSharedVolume
MoveClusterGroup
MoveClusterGroupEx
OfflineClusterGroup
OfflineClusterGroupEx
OfflineClusterResource
OfflineClusterResourceEx
OnlineClusterGroup
OnlineClusterGroupEx
OnlineClusterResource
OnlineClusterResourceEx
OpenCluster
OpenClusterEx
OpenClusterEx2
OpenClusterGroup
OpenClusterGroupEx
OpenClusterGroupSet
OpenClusterNetInterface
OpenClusterNetInterfaceEx
OpenClusterNetwork
OpenClusterNetworkEx
OpenClusterNode
OpenClusterNodeById
OpenClusterNodeEx
OpenClusterResource
OpenClusterResourceEx
PauseClusterNode
PauseClusterNodeEx
RegisterClusterNotify
RegisterClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
RemoveClusterGroupDependency
RemoveClusterGroupSetDependency
RemoveClusterGroupToGroupSetDependency
RemoveClusterNameAccount
RemoveClusterResourceDependency
RemoveClusterResourceNode
RemoveClusterStorageNode
RemoveCrossClusterGroupSetDependency
RemoveResourceFromClusterSharedVolumes
RestartClusterResource
RestoreClusterDatabase
ResumeClusterNode
ResumeClusterNodeEx
SetClusterGroupName
SetClusterGroupNodeList
SetClusterGroupSetDependencyExpression
SetClusterName
SetClusterNetworkName
SetClusterNetworkPriorityOrder
SetClusterQuorumResource
SetClusterResourceDependencyExpression
SetClusterResourceName
SetClusterServiceAccountPassword
SetGroupDependencyExpression
Name
.text
Size
741KB
Virtual Size
740KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=27412,
count=435, id=1, productName=Unmarked objects,
count=36, id=260, version=27412,
count=33, id=259, version=27412,
count=1, id=256, version=27412,
count=194, id=261, version=27412,
count=105, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmcfg32.dll
- IMPHASH 585caa2520cfec8aed5a0d3c17a327c1
- SHA256 9b0d3d16bba88622e1a32ca6e94060ae9565690177fad685bd86d7ee5995e365
- MD5 daf668f028578322031fa3196ba5031f
- SHA1 ce80dd945cb0e1f129efcbc0fe5e1bb03aecf434
- SHA512 e60abb3e5c12424b1be4675d5e18f1753e31d380a67ac84d3ad639e3824a82560b17d445d885099e9f35e337992775dcab16d204445c15d1720c5be8023c19a3
- SSDEEP 768:m8Kh0JnKsmzgPYAK/pkNt9vL1NpHy61Nuw:m8i0pKsGcK/K9xN1x1Nu
- TLSH T101E23A827B4440B7D6E45730756E9E3956FCA8750B3A1293D3FB489DB8A86C1B83C70B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
25808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmcfg32.pdb
msvcrt
_except_handler4_common
_initterm
_stricmp
malloc
_amsg_exit
free
_XcptFilter
_vsnprintf
memset
cmutil
WzToSzWithAlloc
CmStrrchrA
SzToWzWithAlloc
CmFmtMsgA
GetOSMajorVersion
GetOSVersion
CmFree
CmMalloc
advapi32
SetEntriesInAclA
AdjustTokenPrivileges
GetSecurityDescriptorDacl
RegCloseKey
RegQueryValueExA
SetNamedSecurityInfoA
AllocateAndInitializeSid
LookupPrivilegeValueA
GetNamedSecurityInfoA
GetSecurityDescriptorOwner
OpenProcessToken
FreeSid
BuildTrusteeWithSidA
RegOpenKeyExA
RegEnumValueA
ConvertStringSidToSidA
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetPrivateProfileStringA
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
CreateDirectoryA
GetFileType
GetVersionExA
GetSystemInfo
HeapFree
HeapAlloc
GetProcessHeap
Sleep
GetLastError
SetLastError
DisableThreadLibraryCalls
GetModuleFileNameA
MoveFileA
FindFirstFileA
GetCurrentProcess
LoadLibraryExA
FindNextFileA
lstrlenA
FindClose
GetVolumeInformationA
GetCurrentDirectoryA
GetModuleHandleA
SetCurrentDirectoryA
MultiByteToWideChar
GetTempPathA
CopyFileA
GetPrivateProfileIntA
CreateFileA
GetSystemDirectoryA
CloseHandle
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
LocalFree
RemoveDirectoryA
FreeLibrary
lstrcmpiA
FormatMessageA
ole32
CoCreateGuid
StringFromGUID2
shell32
SHGetMalloc
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
user32
MessageBoxExA
MessageBoxA
LoadStringA
CharPrevA
CharNextA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
CMConfig
CMConfigEx
CmstpExtensionProc
CmstpExtensionProc2
_CMConfig@8
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=27412,
count=2, id=259, version=27412,
count=108, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=1, id=256, version=27412,
count=10, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmdext.dll
- IMPHASH 98d721c1ccb004b6181de7b87331b3d4
- SHA256 a9c5eb6c43fb1cec987ac240544cd5a6faca0d3dc1eddac453d8bef79f8f9975
- MD5 e4bc0e809591215499f24326939c4faf
- SHA1 df0eff5c274bde2ff84a64eb33e508e9a41ccb02
- SHA512 0e27fc41f454791ad2f87b745c4a0495ba839d2aa98eb94f4471723e628914b06d48c17a6c85d540f248dac6192fe79299be3ea8ae110bab4a6a414baa74ec46
- SSDEEP 384:SY1WUklDipcR73tFj9I10EVoiCcNVG1cLpWN2jeWK:SYMhJrFjU5Ccfe2jK
- TLSH T161923A51A74489F2D3AE36B4286F233619BE6D304FB106E756275AF62F340D1F13931A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmdext.pdb
msvcrt
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_onexit
free
_amsg_exit
_XcptFilter
memcpy_s
malloc
_vsnwprintf
memset
kernel32
GetModuleHandleExW
ResolveDelayLoadedAPI
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetConsoleWindow
GetBinaryTypeW
CmdBatNotification
GetVDMCurrentDirectories
QueryFullProcessImageNameW
FindFirstStreamW
FindNextStreamW
CloseHandle
GetLastError
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetCurrentProcessId
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
GetProcAddress
CreateMutexExW
DelayLoadFailureHook
CmdBatNotificationStub
DoSHChangeNotify
FindFirstStreamWStub
FindNextStreamWStub
GetBinaryTypeWStub
GetVDMCurrentDirectoriesStub
LookupAccountSidWStub
MessageBeepStub
QueryFullProcessImageNameWStub
SaferWorker
ShellExecuteWorker
WNetAddConnection2WStub
WNetCancelConnection2WStub
WNetGetConnectionWStub
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=13, id=260, version=27412,
count=68, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=4, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmdial32.dll
- IMPHASH add83bfb508cf8ce35c47281137141ce
- SHA256 893b59ca00d240ab802fcd0b0eaebb908868a5199c66f545ee56aab1ce02fb3f
- MD5 302b3fa57d973c89bb2946135e9906ae
- SHA1 768d459e75aa6a4a72d961e0aa455379a6891bd9
- SHA512 60cb34b4645756a9c32d17ddbfbfc117b5acb5a56e0fea47130eed9ca69c1fd051afc76936eec25fc42f1ef6e59df0b3f84fb8d6fbfdf3ceb100f41b7ac7a5f9
- SSDEEP 6144:nYzpumCB01d9bEDPOVBD89AFy++NyLZWd37CjWiE4qboQi1f/A3aOHM:4uAbE6VBUA0LNyYTow
- TLSH T14CA4290273E95056F2F22A38757AA6315DBA7D325EF1C4CF6100B99E1971B81CD28B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
249664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmdial32.pdb
msvcrt
_XcptFilter
_amsg_exit
malloc
_initterm
memcpy
memset
wcsrchr
free
iswalpha
wcspbrk
_vsnwprintf
_vsnprintf
wcsstr
cmpbk32
PhoneBookGetPhoneNonCanonicalA
PhoneBookGetCurrentCountryId
PhoneBookUnload
PhoneBookGetPhoneDispA
PhoneBookFreeFilter
PhoneBookGetCountryId
PhoneBookGetPhoneType
PhoneBookLoad
PhoneBookGetCountryNameW
PhoneBookHasPhoneType
PhoneBookEnumCountries
PhoneBookGetPhoneCanonicalA
PhoneBookGetPhoneDUNA
PhoneBookEnumNumbers
PhoneBookParseInfoA
PhoneBookEnumNumbersWithRegionsZero
PhoneBookGetCountryNameA
PhoneBookEnumRegions
PhoneBookMatchFilter
PhoneBookGetPhoneDescA
PhoneBookCopyFilter
PhoneBookGetRegionNameA
cmutil
CmEndOfStrW
?Clear@CIniW@@QAEXXZ
CmStripFileNameW
SzToWzWithAlloc
CmStrCatAllocA
CmIsSpaceW
CmConvertStrToIPv6AddrW
WzToSz
CmStrCpyAllocA
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
CmMalloc
CmStrStrW
GetOSVersion
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
CmCompareStringW
CmStrchrW
?SetEntry@CIniW@@QAEXPBG@Z
CmMoveMemory
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?GetFile@CIniW@@QBEPBGXZ
IsLogonAsSystem
WzToSzWithAlloc
CmStrrchrW
CmFree
CmStrCpyAllocW
CmStrCatAllocW
CmStrTrimW
GetOSMajorVersion
CmConvertRelativePathW
CmFmtMsgW
CmLoadStringW
GetOSBuildNumber
CmLoadIconW
CmParsePathW
?DeInit@CmLogFile@@QAEJXZ
?GetSection@CIniW@@QBEPBGXZ
?LoadSection@CIniW@@QBEPAGPBG@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniW@@QAEXPBG00@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GetRegPath@CIniW@@QBEPBGXZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?SetWriteICSData@CIniW@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
??1CIniW@@QAE@XZ
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
CmLoadSmallIconW
CmBuildFullPathFromRelativeW
CmRealloc
CmAtolW
CmIsDigitW
?Clear@CmLogFile@@QAEXH@Z
?Stop@CmLogFile@@QAEJXZ
?Start@CmLogFile@@QAEJH@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
CmStrCharStuffingW
CmLoadImageW
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
CmStripPathAndExtW
?SetPrimaryFile@CIniW@@QAEXPBG@Z
CmStrtokW
?SetFile@CIniW@@QAEXPBG@Z
advapi32
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenProcessToken
RegCreateKeyExW
AdjustTokenPrivileges
InitiateSystemShutdownW
LookupPrivilegeValueW
FreeSid
RegEnumKeyExW
AllocateAndInitializeSid
RegDeleteKeyW
OpenThreadToken
CreateProcessAsUserW
RegDeleteValueW
GetTokenInformation
DuplicateTokenEx
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
InitializeAcl
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
OpenServiceA
StartServiceA
OpenSCManagerA
CloseServiceHandle
QueryServiceStatus
RegOpenKeyW
TraceMessage
gdi32
UnrealizeObject
DeleteObject
GetDeviceCaps
GetObjectA
SetStretchBltMode
CreatePalette
SelectPalette
DeleteDC
GetDIBits
RealizePalette
CreateDIBitmap
StretchBlt
SelectObject
CreateCompatibleDC
kernel32
Beep
CreateFileW
WideCharToMultiByte
GetTickCount
lstrcmpiW
GetCurrentProcessId
WritePrivateProfileStringA
Sleep
GetPrivateProfileStringW
CreateEventW
OpenProcess
GetModuleHandleA
DuplicateHandle
WaitForSingleObject
MulDiv
LoadLibraryExA
GetPrivateProfileIntW
SetLastError
GetCurrentProcess
LoadLibraryExW
FreeLibrary
CreateProcessW
GetProcAddress
CloseHandle
GetLastError
GetCurrentThreadId
ExpandEnvironmentStringsW
lstrlenW
lstrcmpW
CreateDirectoryW
GetSystemDirectoryW
CompareFileTime
FindFirstFileW
WritePrivateProfileStringW
FindNextFileW
SetFileTime
FindClose
SetFileAttributesW
FormatMessageW
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
SystemTimeToFileTime
CopyFileW
GetSystemTime
GetFileTime
DisableThreadLibraryCalls
GetCurrentThread
CreateMutexW
ReleaseMutex
lstrcmpA
MultiByteToWideChar
lstrlenA
LocalAlloc
GetPrivateProfileStringA
GetWindowsDirectoryW
GetFileType
GlobalHandle
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GlobalReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
RtlUnwind
QueryPerformanceCounter
GetSystemTimeAsFileTime
OpenEventW
OpenFileMappingW
UnmapViewOfFile
SetEvent
CreateFileMappingW
MapViewOfFile
HeapFree
GetVolumeInformationA
HeapAlloc
GetProcessHeap
FormatMessageA
CompareStringW
GetModuleFileNameW
user32
IsWindow
DispatchMessageW
SetTimer
PeekMessageW
MapWindowPoints
GetDlgItemTextW
SendDlgItemMessageW
IsWindowEnabled
MoveWindow
TranslateMessage
LoadCursorW
SetCursor
KillTimer
CheckDlgButton
EnableMenuItem
SystemParametersInfoW
DialogBoxParamW
UpdateWindow
SetForegroundWindow
ShowCursor
GetWindowTextW
GetFocus
MessageBoxExW
SetFocus
EnableWindow
GetWindowLongW
GetWindowRect
SetWindowPos
EndDialog
SetWindowTextW
GetThreadDesktop
OffsetRect
CopyRect
CharPrevW
SetDlgItemTextW
IsDlgButtonChecked
MsgWaitForMultipleObjects
GetUserObjectInformationW
SetWindowLongW
GetDlgItem
GetDesktopWindow
GetParent
EndPaint
BeginPaint
GetClientRect
SetDlgItemInt
GetDlgItemInt
MessageBoxW
CallWindowProcW
ReleaseDC
GetDC
InvalidateRect
DefWindowProcW
RegisterClassExW
UnregisterClassW
SendMessageA
SendDlgItemMessageA
DestroyWindow
GetClassInfoExW
FindWindowExW
CharLowerW
CharUpperW
FindWindowA
SetDlgItemTextA
GetWindowLongA
SetWindowLongA
DialogBoxParamA
GetSystemMetrics
PostMessageA
MessageBoxA
LoadStringA
GetCursor
SendMessageW
DeleteMenu
CreateWindowExW
IsWindowVisible
PostMessageW
ShowWindow
GetSystemMenu
CharNextW
GetWindowThreadProcessId
GetWindowTextLengthW
ole32
StringFromGUID2
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromIID
setupapi
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
shell32
ShellExecuteW
SHFileOperationW
ord258
eappcfg
EapHostPeerGetMethods
EapHostPeerFreeMemory
EapHostPeerQueryCredentialInputFields
EapHostPeerFreeErrorMemory
userenv
ExpandEnvironmentStringsForUserW
rasapi32
RasGetEntryHrasconnW
RasSetCredentialsW
RasSetEapUserDataW
RasGetConnectStatusW
RasGetCredentialsW
setnetworklocation
ord3
ord4
ord1
AutoDialFunc
CmCustomDialDlg
CmCustomHangUp
CmReConnect
GetCustomProperty
InetDialHandler
RasCustomDeleteEntryNotify
RasCustomDial
RasCustomDialDlg
RasCustomEntryDlg
RasCustomHangUp
_AutoDialFunc@16
_InetDialHandler@16
Name
.text
Size
243KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=27412,
count=413, id=1, productName=Unmarked objects,
count=31, id=257, version=27412,
count=14, id=261, version=27412,
count=1, id=256, version=27412,
count=40, id=265, version=27412,
count=75, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmgrcspps.dll
- IMPHASH af3aa9f88edaa1cfb19eef6714707963
- SHA256 989963c51daf816e61d91bf0dc5bc6b977edb830c69547ebb8a4d94921885c21
- MD5 6ffccdc7955738bb8556526ceb0e10c3
- SHA1 44b56cd5a585673de519bb65f36bd5e5a5834ae6
- SHA512 3b0de84eb42f52649e9606e98852ba351b96ed8b02e54d1973bdd46174dae18307794b7cf55d1fb5961887d103c929bfa71e0e63986c18fa23626e4eaea88ef8
- SSDEEP 384:3B8OxjEWU7pebvct1ZaHzPPHjuVAvqFIaMR2LeUV3EvD6+ZflkC7/m0rfYZiWPRW:WevcLkzPNqFtVw/tDLsZbP
- TLSH T1C6D241C5B72868B6C46E233A11474F75EA2C5D207BC506CB1E846A4878736E1FF32787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
23536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmgrcspps.pdb
msvcrt
malloc
_initterm
free
_amsg_exit
_except_handler4_common
_XcptFilter
memcmp
oleaut32
VARIANT_UserSize
VARIANT_UserFree
BSTR_UserUnmarshal
VARIANT_UserMarshal
BSTR_UserMarshal
BSTR_UserFree
VARIANT_UserUnmarshal
BSTR_UserSize
rpcrt4
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrOleFree
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient19
ObjectStublessClient13
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient6
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient23
ObjectStublessClient12
ObjectStublessClient26
ObjectStublessClient16
ObjectStublessClient24
ObjectStublessClient21
ObjectStublessClient25
ObjectStublessClient5
ObjectStublessClient7
ObjectStublessClient4
ObjectStublessClient22
ObjectStublessClient27
ObjectStublessClient28
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=75, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=11, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmifw.dll
- IMPHASH c07e5087ff9681b5cb16c6d850e12b6d
- SHA256 4a4454b98597d755315bcf446ec0fcaeeaae3379b2ed1e3b250f17eefc888141
- MD5 907bb545ce74a0e4065846c21a7a64a0
- SHA1 3fa7df1537a1b6bf107e1a2cce6ad180f4c09086
- SHA512 724b68639b0d99888d696a2a027d5bc1dc759447b061bb573b319ef6e93897cd5608753f0f2e931dd4ca0a4a91d56c5e0997a151e527e9dc5ee91c45378005e1
- SSDEEP 1536:OegTg0/VTAu92udPA/XP2enu4IZ00sG8+PVPzJ:Y2uh6eenu7Z00sGTNN
- TLSH T19E830902BB8910E0E1D262BDA6DEB735D63F7B241B5811D346E1FC58F8846C36A3529F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
da:72:f5:e0:3d:2e:7c:bf:b4:e2:62:17:5c:af:dc:a8:63:46:4b:04:0e:68:fe:df:a6:c5:62:ad:43:55:65:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ce:0f:18:f7:45:97:e7:c6:ff:00:01:00:00:01:ce
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
64320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmifw.pdb
msvcrt
_amsg_exit
_initterm
_callnewh
memcpy
_CxxThrowException
_vsnprintf
wcschr
iswspace
wcsstr
_wtol
wcstok_s
wcstok
_XcptFilter
wcstol
__CxxFrameHandler3
_wcsicmp
wcsrchr
??1type_info@@UAE@XZ
_purecall
_except_handler4_common
memcpy_s
_errno
realloc
_lock
_unlock
__dllonexit
_vsnwprintf
_onexit
memmove
free
malloc
wcsncpy_s
memset
api-ms-win-core-libraryloader-l1-1-0
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameW
LoadLibraryExA
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExW
GetModuleHandleW
FindResourceExW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
ntdll
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
EtwTraceMessage
oleaut32
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
api-ms-win-core-shlwapi-obsolete-l1-1-0
SHLoadIndirectString
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
EnableGroupW
unattendW
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=13, id=260, version=27412,
count=134, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=15, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmintegrator.dll
- IMPHASH 9e4cae561be87265849e257ac59f9845
- SHA256 f3de5c95dc6c27b7fcb81af298434741858e8d062cc83450c9c4e701b2215eb2
- MD5 da4d8df1ad5b632931d9f4a3ae9d506b
- SHA1 2a1590278f8491904fb11c18f2ce9efb8f960974
- SHA512 1ea0fef74e60ca6365017e7aa4b795be9a113a2f1ad3629fb3f7c0b78f0c3bd683097ef7c122eb4b3d8b011fae7a6fb49159b88d63469b1c0385c7d9fd07d1a2
- SSDEEP 384:lvBDMYKDew5S8UX2hH2biUJtv+8OLTmGkuSBzwQ/CWQ8WFoZFjZ:ZBHwaXBPL1OTRkIQ/0KF
- TLSH T1B0D21A9572C144F3CFF5E772519BA73A627FA8AA4E8210D310B2564878379907F3360B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmintegrator.pdb
msvcrt
_wcsicmp
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset
api-ms-win-core-misc-l1-1-0
Sleep
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
iphlpapi
ConvertInterfaceGuidToLuid
ConvertInterfaceLuidToIndex
GetBestRoute2
InternalGetIPPhysicalInterfaceForDestination
CloseGetIPPhysicalInterfaceForDestination
ntdll
EtwTraceMessage
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
ws2_32
FreeAddrInfoW
GetAddrInfoW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
WaitForSingleObject
CreateEventW
AcquireSRWLockShared
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
LeaveCriticalSection
ReleaseSRWLockExclusive
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall4
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateThread
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
VpnCmOracleCheckVpnAvailability
VpnCmOracleInitialize
VpnCmOracleShutdown
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=14, id=260, version=27412,
count=146, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=12, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmlua.dll
- IMPHASH 3a0a431dab919a456d2102d837d6d274
- SHA256 84d354b08008323dadce6a62746db4d08ed09670a2a69636e452eeb87c0c8289
- MD5 982150ae441158cd3226e4bff758f320
- SHA1 536f60da7db4eb0ee19863405be59a10f73913a4
- SHA512 92c517f7ba4fecf1cb68e092f8ac6f63d8721d186d5195701deb7a1a6029fee4e54b54a026fec618937f376f302029309f42fc77fe0c5d1741b594f4dec344fd
- SSDEEP 384:Q3Oq518hQpkEqBl8494q8LgrQiI6Nfuym1T8BjZW+drNKIOqrpqr8X/8rAtWgYWI:Q1518WFi9NJfuRyBV0qFqwUinqZ
- TLSH T1DEF21A81A3C494B1F6F22A31297A5A71477D78249BF1C2CB570384DE3C789E1EA3476B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
26416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmlua.pdb
msvcrt
malloc
_initterm
_except_handler4_common
?terminate@@YAXXZ
free
memcmp
_vsnwprintf
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_vsnprintf
memset
cmutil
CmStrrchrW
WzToSzWithAlloc
CmMalloc
CmFree
advapi32
LookupPrivilegeValueW
InitiateSystemShutdownW
AdjustTokenPrivileges
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
AllocateAndInitializeSid
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
FreeSid
CheckTokenMembership
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
kernel32
CloseHandle
GetCurrentDirectoryW
CreateFileW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LoadLibraryExW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
LocalAlloc
GetLastError
GetCurrentThreadId
DisableThreadLibraryCalls
FormatMessageW
LocalFree
CreateDirectoryW
FindFirstFileW
FindNextFileW
GetCurrentProcess
lstrlenW
LoadLibraryExA
lstrlenA
FindClose
WaitForSingleObject
shell32
SHGetFolderPathW
SHFileOperationW
ShellExecuteExW
SHGetStockIconInfo
user32
MessageBoxW
CharNextW
CharPrevW
DestroyIcon
SendMessageW
rpcrt4
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer_Release
ole32
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient5
ObjectStublessClient19
ObjectStublessClient11
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient4
StringFromGUID2
CoGetObject
ObjectStublessClient6
ObjectStublessClient12
ObjectStublessClient14
DllAddRef
DllCanUnloadNow
DllGetClassObject
DllMain
DllRelease
_GetCoCreateInstanceAsAdminHandle
_RemoveShieldIcon
_SetShieldButton
_SetShieldIcon
_ThrowErrorBox
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=1, id=259, version=27412,
count=14, id=260, version=27412,
count=116, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=1, id=256, version=27412,
count=8, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmpbk32.dll
- IMPHASH 636806e63bb436e216362eafce8def77
- SHA256 a710718720d40b8116e44d78e1b9c8a2f078d27a0bd941e8aa34863e5ee409f7
- MD5 14521767867b91944d71a2c2aa4067a5
- SHA1 1562ab8915a44920e51ec02fbc5e75f04eece0e6
- SHA512 fcd05d302be8cb957d6f9fe39e92a77ec1d143d5ff6de68024245c6b2d2d460113d97d2f352944129795daa68c18ce6e7dc8768c4369d4e8df6d32c830f335df
- SSDEEP 384:ohJyZJoqn89P07SEuUstS/C41KcRF7XYvWq+nll64H+c0fnyNVmxFebFCIDWF14W:orYqVcEltS/FD7XYvWq+nz65vFeVw
- TLSH T1ECB23860E7C041F1D3EE323172686D3722BE59206FB911C76277A66529622D1BA3D327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmpbk32.pdb
msvcrt
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf
memset
cmutil
CmMalloc
GetOSMajorVersion
CmRealloc
GetOSVersion
GetOSBuildNumber
??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??1CIniA@@QAE@XZ
?SetFile@CIniA@@QAEXPBD@Z
?SetEntry@CIniA@@QAEXPBD@Z
?GetFile@CIniA@@QBEPBDXZ
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPI@CIniA@@QBEKPBD0K@Z
CmStrtokA
CmStrrchrA
CmStrCpyAllocA
CmMoveMemory
CmFree
kernel32
CreateFileA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetPrivateProfileStringA
DeleteFileA
GetLastError
GetModuleHandleA
WriteFile
MoveFileA
CompareStringA
CompareStringW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
SearchPathA
LoadLibraryExA
lstrlenW
SetLastError
CloseHandle
ReadFile
lstrlenA
PhoneBookCopyFilter
PhoneBookEnumCountries
PhoneBookEnumNumbers
PhoneBookEnumNumbersWithRegionsZero
PhoneBookEnumRegions
PhoneBookFreeFilter
PhoneBookGetCountryId
PhoneBookGetCountryNameA
PhoneBookGetCountryNameW
PhoneBookGetCurrentCountryId
PhoneBookGetPhoneCanonicalA
PhoneBookGetPhoneDUNA
PhoneBookGetPhoneDescA
PhoneBookGetPhoneDispA
PhoneBookGetPhoneNonCanonicalA
PhoneBookGetPhoneType
PhoneBookGetRegionNameA
PhoneBookHasPhoneType
PhoneBookLoad
PhoneBookMatchFilter
PhoneBookMergeChanges
PhoneBookParseInfoA
PhoneBookUnload
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=62, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=9, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmstplua.dll
- IMPHASH ddfb56ce590e8ae0344067255805d2ae
- SHA256 e4391961f6dcc51ffdce417fbc710ea676359de024749486bbe238557fe812b3
- MD5 c450e5a11ea7c8628477706c6ec97915
- SHA1 9906ec6c32173fc45bf325158cb3c1b32b371486
- SHA512 ec724693e750daadee84e6513cdcae1da23b0884fad0aceaffbc9c476ae9b00b860a9b9196a495201b4b9e92d08e5a4cf71abbb05d362d102410b16eedb445dc
- SSDEEP 384:Uo5eO+U4A/ivNXnK+ZCWQ+a3GwtlXvr1cWXHfWaKK:X5eDNXjItVLOK
- TLSH T14F721A45BB854CE0F1FA2635657A0E31167EB4200FF142CB9A13432A2C78AD2ED3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10784
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmstplua.pdb
msvcrt
malloc
__CxxFrameHandler3
_initterm
?terminate@@YAXXZ
free
memcmp
_amsg_exit
_XcptFilter
_except_handler4_common
_vsnprintf
memset
cmutil
CmMalloc
CmFree
advapi32
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
kernel32
lstrlenA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
LoadLibraryExW
LocalFree
WideCharToMultiByte
GetTickCount
DisableThreadLibraryCalls
SetFileAttributesW
GetLastError
GetProcAddress
FreeLibrary
shell32
SHFileOperationW
rpcrt4
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
ole32
CoCreateInstance
ObjectStublessClient3
ObjectStublessClient4
ObjectStublessClient5
DllAddRef
DllCanUnloadNow
DllGetClassObject
DllMain
DllRelease
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=1, id=259, version=27412,
count=14, id=260, version=27412,
count=65, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=6, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cmutil.dll
- IMPHASH 07edf7788b7811fee77a38102ce915ab
- SHA256 e16093f0d634a36c04a5bcebb4faf8ef4703c4059f58e51f4177adebc7dd1584
- MD5 9cfc5c7e355d292dbecc269f50dcae24
- SHA1 f2da685c314a9cc07e0058514face8ac0edeeaac
- SHA512 c65eaa532b12cb8b94e406e4bf5683f1c67b63768e8186799f4fa3f09e83476fa4849db5f053573c231976ea5befb67a02da7d9331d01232d8692c2919fadc55
- SSDEEP 768:UDGClK8IMVD+oDbma9sqt5XVs/4YUSrBK1U4umg+kiNIPjJDCf91a:U1lK8IMVKcbma9sgrYuQYU4jg+kiNIPl
- TLSH T109232A80B6D508A6E5E26271293D767231BEFC62177483CF830B1ADD78607C19D3976B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
34624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cmutil.pdb
msvcrt
_XcptFilter
_amsg_exit
free
malloc
_initterm
_except_handler4_common
_vsnwprintf
_vsnprintf
memset
advapi32
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
RegDeleteValueW
gdi32
CreateFontIndirectW
DeleteObject
GetObjectA
kernel32
TlsGetValue
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetVersionExW
GetTickCount
lstrlenA
GetLastError
CreateFileA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
CreateFileW
GetPrivateProfileStringW
CreateDirectoryW
HeapFree
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
SetEndOfFile
GetTempPathW
GetFileAttributesW
IsDBCSLeadByte
GetSystemDirectoryW
HeapAlloc
GetFileSize
GetProcessHeap
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetCurrentProcess
GetProcAddress
GetTimeFormatW
FreeLibrary
GetDateFormatW
LoadLibraryExW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
HeapReAlloc
CompareStringW
TlsSetValue
SetLastError
GetStringTypeExW
MultiByteToWideChar
CompareStringA
GetStringTypeExA
user32
SendMessageW
LoadImageW
GetSystemMetrics
CharPrevW
CharNextA
CharUpperW
LoadStringA
LoadStringW
LoadImageA
CharNextW
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@$$QAV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=12, id=260, version=27412,
count=105, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=14, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cngcredui.dll
- IMPHASH 41d00822ddadd64f2d7977f4a14bf05e
- SHA256 aa12c068b53dd81e552453500aa9e4dfbed8c1be7f87934b3fbd49373fbabeba
- MD5 abcb368cf1365f76746200a7ceaf75e6
- SHA1 3d2679ed3ababfaecf10b7e8ae5723d09013e2c4
- SHA512 799ddc1839bc35e88cddc5adc8fb545525b45dc082ef4ddb456cfe56b82a8aeb131120d37d160d48c7602907f59534873fd9773bb00a6285b440c330d5948032
- SSDEEP 3072:6d+vJtW7MFLmPl3PRMFn2AjCuOIaqh3A2e3/w7mG02VTF1pyA:6Udtw2e3/w7g2VTF1py
- TLSH T1E9A3D4FDEE5046E4D96405B24396432E29789DE8378E25FB06B3F09DE9711C74C3322A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cngcredui.pdb
msvcrt
malloc
memcpy
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
memset
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
GetTokenInformation
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
LoadStringW
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
TerminateProcess
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
ntdll
RtlAllocateHeap
EtwTraceMessage
RtlFreeHeap
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=27412,
count=16, id=260, version=27412,
count=55, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=2, id=261, version=27412,
count=1, id=256, version=27412,
count=8, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cngprovider.dll
- IMPHASH 4a43b62be4d9d28cc1c7dba8af18688e
- SHA256 cc7afe5c5f295efdc65aff2dc15c8d8de109eca47fc3a16e73a9e54f35ecc5b6
- MD5 ded6733f5ec75968f19e2f3d1af7ecdf
- SHA1 cab25cc720c29f07ce251f8a1f74e4e1f277572b
- SHA512 128ad41c83c1a1f3435f381eee61a4bd3bc0a941211815ff07bfda13b90eefa1c54e4a0d7beba7a354e55e342b305a261a79be27a2539137809228a112eef88c
- SSDEEP 1536:5VivEBsIWqjJnMdvYK/br6RaGSi0oseIIJBjPlqPPY4:ivW5ivHGa3eDJpiY4
- TLSH T10C432903739194F2D2D66130186A9A7A8A3EFD111F8456D7B343339E6C71AC3B9B6387
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
36816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cngprovider.pdb
msvcrt
_onexit
_lsearch_s
__dllonexit
memcmp
memset
memcpy
_unlock
_lock
realloc
_errno
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
bsearch_s
qsort_s
_lfind_s
wcscat_s
wcscpy_s
wcsncpy_s
_wcsicmp
malloc
free
_purecall
memcpy_s
oleaut32
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysAllocString
LoadTypeLi
SysFreeString
SysStringLen
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
LoadResource
SizeofResource
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
ncrypt
NCryptEnumKeys
NCryptFreeObject
NCryptDeleteKey
NCryptImportKey
NCryptExportKey
NCryptFreeBuffer
NCryptOpenStorageProvider
NCryptOpenKey
NCryptGetProperty
api-ms-win-core-file-l1-1-0
SetFileAttributesW
FindFirstFileW
DeleteFileW
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFileSize
CreateFileW
FindNextFileW
CompareFileTime
CreateDirectoryW
GetFileTime
ReadFile
FindClose
WriteFile
crypt32
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindExtension
CertAddSerializedElementToStore
CryptHashCertificate
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
userenv
GetUserProfileDirectoryW
dsrole
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
advapi32
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
kernel32
lstrcmpiW
ntdll
EtwTraceMessage
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=14, id=260, version=27412,
count=162, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=9, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cnvfat.dll
- IMPHASH 706a2b1f59b2644df8fbccfe40aa2047
- SHA256 e09bc7d6317872b27ff2fbe4d5a592b67d257c9bd0a0ab5228ebdd988fc0d4b8
- MD5 24b17da75c5340a2347c2133a6183d8e
- SHA1 20489170fd1b3c4317ead5ce215ba595e406cf1c
- SHA512 e5454b457925d60bef563fa7af661cbee472c569445b3e951a951cfbf8c4fd199a7822f1cd67ec9544f4ee5ce0c2188431580db0ecdf0d2705a82f9fbb4267cd
- SSDEEP 384:IsOQ1xXoT+ZuuMjTsCBi9StTFcWRAdA7vv/08sO0zx8Csw+pfx0idky9EB9WifHz:IsrXXoRfjdBSSDcWRA0vv/WDU0872XB
- TLSH T127F22921A40601F3C5B35DFCC39EDF768EADB6022E55DB43B521B4152A386C6B7272D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
cnvfat.pdb
msvcrt
malloc
_initterm
_except_handler4_common
free
_XcptFilter
memcpy
memcmp
_amsg_exit
memset
ntdll
RtlAllocateHeap
RtlInitUnicodeString
NtQueryAttributesFile
NtQuerySystemInformation
NtSetThreadExecutionState
RtlLocalTimeToSystemTime
RtlFreeHeap
kernel32
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
ulib
?SetBit@BITVECTOR@@QAEXKK@Z
?ResetBit@BITVECTOR@@QAEXKK@Z
??0OBJECT@@IAE@XZ
??1OBJECT@@UAE@XZ
?ComputeCountSet@BITVECTOR@@ABEKXZ
?Initialize@CLASS_DESCRIPTOR@@QAEEPBD@Z
??0CLASS_DESCRIPTOR@@QAE@XZ
?Stricmp@WSTRING@@SGHPAG0@Z
??1HMEM@@UAE@XZ
?QueryWSTR@WSTRING@@QBEPAGKKPAGKE@Z
?FreeLibraryHandle@SYSTEM@@SGXPAX@Z
?QueryLibraryEntryPoint@SYSTEM@@SGP6GHXZPBVWSTRING@@0PAPAX@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Initialize@WSTRING@@QAEEPBDK@Z
??1DSTRING@@UAE@XZ
??0DSTRING@@QAE@XZ
?Display@MESSAGE@@QAAEPBDZZ
??0HMEM@@QAE@XZ
?QuerySTR@WSTRING@@QBEPADKKPADKE@Z
?Initialize@HMEM@@QAEEXZ
??0FSTRING@@QAE@XZ
?DebugDump@OBJECT@@UBEXE@Z
?Compare@OBJECT@@UBEJPBV1@@Z
??1FSTRING@@UAE@XZ
?Stricmp@WSTRING@@QBEJPBV1@@Z
ufat
??0EA_SET@@QAE@XZ
??1EA_SET@@UAE@XZ
?QueryNthCluster@FAT@@QBEKKK@Z
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?Read@EA_SET@@UAEEXZ
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
??0CLUSTER_CHAIN@@QAE@XZ
??1CLUSTER_CHAIN@@UAE@XZ
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@FAT_DIRENT@@QAEEPAX@Z
?Initialize@EA_HEADER@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@FILEDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@K@Z
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
?QueryCreationTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
?QueryLastWriteTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
??1FILEDIR@@UAE@XZ
??0FILEDIR@@QAE@XZ
?QueryCensusAndRelocate@FAT_SA@@QAEEPAU_CENSUS_REPORT@@PAVINTSTACK@@PAE@Z
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
?SearchForDirEntry@FATDIR@@QAEPAXPBVWSTRING@@@Z
?Initialize@FAT_DIRENT@@QAEEPAXE@Z
??1FAT_DIRENT@@UAE@XZ
??0FAT_DIRENT@@QAE@XZ
??1EA_HEADER@@UAE@XZ
??0EA_HEADER@@QAE@XZ
?Read@CLUSTER_CHAIN@@UAEEXZ
??0REAL_FAT_SA@@QAE@XZ
??1REAL_FAT_SA@@UAE@XZ
?Initialize@REAL_FAT_SA@@UAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@E@Z
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?Index12@FAT@@ABEKK@Z
untfs
??1NTFS_UPCASE_FILE@@UAE@XZ
??0NTFS_LOG_FILE@@QAE@XZ
??1NTFS_LOG_FILE@@UAE@XZ
?CreateElementaryStructures@NTFS_SA@@QAEEPAVNTFS_BITMAP@@KKKKPBVNUMBER_SET@@EEEEEKPAVMESSAGE@@PAUBIOS_PARAMETER_BLOCK@@PBVWSTRING@@E@Z
?Initialize@NTFS_MFT_FILE@@QAEEW4FIX_LEVEL@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK2PAVNTFS_BITMAP@@PAVNTFS_UPCASE_TABLE@@PAVNTFS_ATTRIBUTE@@@Z
?Initialize@NTFS_UPCASE_FILE@@QAEEW4FIX_LEVEL@@PAVNTFS_MASTER_FILE_TABLE@@@Z
?QueryAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKPBVWSTRING@@@Z
?Initialize@NTFS_UPCASE_TABLE@@QAEEPAVNTFS_ATTRIBUTE@@PA_K@Z
?Flush@NTFS_MFT_FILE@@QAEEXZ
?Initialize@NTFS_LOG_FILE@@QAEEW4FIX_LEVEL@@PAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_BITMAP_FILE@@QAE@XZ
??1NTFS_BITMAP_FILE@@UAE@XZ
?IsFree@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEW4FIX_LEVEL@@PAVNTFS_MASTER_FILE_TABLE@@@Z
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
?QuerySectorsInElementaryStructures@NTFS_SA@@SGKPAVDP_DRIVE@@KKKKE@Z
?WriteRemainingBootCode@NTFS_SA@@QAEEXZ
?Initialize@NTFS_ATTRIBUTE@@QAEEPAVLOG_IO_DP_DRIVE@@KPBVNTFS_EXTENT_LIST@@VBIG_INT@@2KPBVWSTRING@@G@Z
?AddExtent@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@00@Z
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
??1NTFS_EXTENT_LIST@@UAE@XZ
??0NTFS_EXTENT_LIST@@QAE@XZ
?MakeNonresident@NTFS_ATTRIBUTE@@UAEEPAVNTFS_BITMAP@@@Z
?InsertEntry@NTFS_INDEX_TREE@@QAEEKPAXU_MFT_SEGMENT_REFERENCE@@E@Z
?AddFileNameAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_FILE_NAME@@@Z
?QueryDuplicatedInformation@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_DUPLICATED_INFORMATION@@@Z
?AddSecurityDescriptor@NTFS_FILE_RECORD_SEGMENT@@QAEEW4_CANNED_SECURITY_TYPE@@PAVNTFS_BITMAP@@@Z
?Create@NTFS_FILE_RECORD_SEGMENT@@QAEEPBU_STANDARD_INFORMATION@@G@Z
NtfsUpcaseCompare
?Initialize@NTFS_INDEX_TREE@@QAEEKPAVLOG_IO_DP_DRIVE@@KPAVNTFS_BITMAP@@PAVNTFS_UPCASE_TABLE@@KKKPBVWSTRING@@@Z
??0NTFS_UPCASE_FILE@@QAE@XZ
??0NTFS_BITMAP@@QAE@XZ
??1NTFS_BITMAP@@UAE@XZ
??0NTFS_ATTRIBUTE@@QAE@XZ
??1NTFS_ATTRIBUTE@@UAE@XZ
?Initialize@NTFS_ATTRIBUTE@@QAEEPAVLOG_IO_DP_DRIVE@@KPBXKKPBVWSTRING@@G@Z
?InsertIntoFile@NTFS_ATTRIBUTE@@UAEEPAVNTFS_FILE_RECORD_SEGMENT@@PAVNTFS_BITMAP@@@Z
?IsAttributePresent@NTFS_FILE_RECORD_SEGMENT@@QAEEKPBVWSTRING@@E@Z
?AllocateFileRecordSegment@NTFS_MASTER_FILE_TABLE@@QAEEPAVBIG_INT@@E@Z
?Extend@NTFS_MASTER_FILE_TABLE@@QAEEK@Z
??0NTFS_SA@@QAE@XZ
??1NTFS_SA@@UAE@XZ
??0NTFS_UPCASE_TABLE@@QAE@XZ
??1NTFS_UPCASE_TABLE@@UAE@XZ
??0NTFS_MFT_FILE@@QAE@XZ
??1NTFS_MFT_FILE@@UAE@XZ
?QueryDefaultClustersPerIndexBuffer@NTFS_SA@@SGKPBVDP_DRIVE@@K@Z
?Initialize@NTFS_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@VBIG_INT@@2KE@Z
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
??1NTFS_FILE_RECORD_SEGMENT@@UAE@XZ
??0NTFS_INDEX_TREE@@QAE@XZ
??1NTFS_INDEX_TREE@@UAE@XZ
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEW4FIX_LEVEL@@VBIG_INT@@PAVNTFS_MFT_FILE@@@Z
?Read@NTFS_FRS_STRUCTURE@@UAEEXZ
?Initialize@NTFS_INDEX_TREE@@QAEEPAVLOG_IO_DP_DRIVE@@KPAVNTFS_BITMAP@@PAVNTFS_UPCASE_TABLE@@KPAVNTFS_FILE_RECORD_SEGMENT@@PBVWSTRING@@@Z
?Save@NTFS_INDEX_TREE@@QAEEPAVNTFS_FILE_RECORD_SEGMENT@@@Z
?Flush@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_BITMAP@@PAVNTFS_INDEX_TREE@@E@Z
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@KE@Z
ifsutil
??0READ_WRITE_CACHE@@QAE@XZ
?Initialize@READ_WRITE_CACHE@@QAEEPAVIO_DP_DRIVE@@KE@Z
?SetCache@IO_DP_DRIVE@@QAEXPAVDRIVE_CACHE@@@Z
RestoreThreadExecutionState
??0LOG_IO_DP_DRIVE@@QAE@XZ
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@E@Z
?Lock@IO_DP_DRIVE@@QAEEXZ
?DismountVolume@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?Remove@NUMBER_SET@@QAEEVBIG_INT@@0@Z
?Add@NUMBER_SET@@QAEEVBIG_INT@@0@Z
??0NUMBER_SET@@QAE@XZ
??1NUMBER_SET@@UAE@XZ
??0INTSTACK@@QAE@XZ
?Write@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?Push@INTSTACK@@QAEEVBIG_INT@@@Z
?Initialize@INTSTACK@@QAEEXZ
??1INTSTACK@@UAE@XZ
?Initialize@NUMBER_SET@@QAEEXZ
ConvertFAT
IsConversionAvailable
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=27412,
count=6, id=259, version=27412,
count=172, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=1, id=256, version=27412,
count=4, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cob-au.rs
- SHA256 638a7997f123ec11a2b10af62b2e104a9215f2fd2e9736dc0a305acbd512695a
- MD5 ab7366428ea208af566bf3cf91f42631
- SHA1 b3ecd68450ee81d1bf37474d2cd855599ceee464
- SHA512 b65ae9e38d7d79ac1dffd6a5d3af4dddf6786dfaf843896e103f605d671c0925115744195295ad31d59ffbef331daf8f9e44abf4459f6229358a95c8f00217cd
- SSDEEP 768:Eh2eITZVSR54dRARKt6tC0ebg20hW0lzx0GjQux37Zv:Eh2eAdRAa6w0YL042x0G1
- TLSH T153D2C042C7E54233D0F70271489B9619FD31E6CDA2929B8CF69C413F4F2097179A3AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/colbact.dll
- IMPHASH 8f94f81611dc3779b846132c63009a90
- SHA256 ced17c7c15a2e6a46ebea121e1eec0ceadbf48b7e374b6f3715e78819357c8bc
- MD5 21684de4bab5d7490b7e1973e384810b
- SHA1 72f986c686ff2966466dbd970e8605bb68f36436
- SHA512 bf08a8c27c05115d77e4897d8ebb3e024e9bf7493942ac3d8cc2a75861fe54d4e5a1476a9ef284401a27fe9e4283ce535df01387aabc7715da44942fe738c3cd
- SSDEEP 1536:h26fKPsPw2j1xlgsTuakRkVpg7T8a5OcYVWtJhYOKSm8ztZZdfof:pTC3RkPg7TTELEJhYOrm8ztHdfI
- TLSH T174633B4272D851ABEBE7943C66797235872BB8B05B5006CB1320465F1EAABE3DE34347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
54672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
colbact.pdb
msvcrt
_ftol2
_local_unwind4
floor
memcmp
?terminate@@YAXXZ
time
rand
srand
wcsrchr
_waccess
_vsnwprintf
__CxxFrameHandler3
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
_CIfmod
memset
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
api-ms-win-core-com-l1-1-0
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoGetObjectContext
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadLibraryExW
LockResource
LoadResource
FreeLibrary
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
LoadStringW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
SetEvent
DeleteCriticalSection
ReleaseSemaphore
OpenMutexW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
WaitForSingleObject
CreateSemaphoreExW
rpcrt4
RpcStringFreeW
RpcRevertToSelf
RpcImpersonateClient
UuidToStringW
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
GetCurrentProcess
TlsFree
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenThreadToken
SetThreadToken
TlsGetValue
TlsAlloc
CreateProcessW
GetCurrentThread
CreateThread
TlsSetValue
SetThreadStackGuarantee
OpenProcessToken
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
DuplicateToken
FreeSid
GetLengthSid
GetTokenInformation
GetSidLengthRequired
AllocateAndInitializeSid
CopySid
EqualSid
IsValidSid
InitializeSid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
api-ms-win-core-file-l1-1-0
FindClose
CreateDirectoryW
FindFirstFileW
SetFileAttributesW
DeleteFileW
CompareFileTime
FindNextFileW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
MapViewOfFile
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=261, version=27412,
count=16, id=260, version=27412,
count=5, id=259, version=27412,
count=178, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=26, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/coloradapterclient.dll
- IMPHASH 43094c06bc51f6ab32a33cb880e59ff0
- SHA256 9f5abb003e6745cfb46ace724f4711d9e755bbd3d0cca172cd62c81aab9a4849
- MD5 66368068aaa7765c1e9ba864b802af4c
- SHA1 4dbece62051f2d56e046ab0a2cb0a540265722dd
- SHA512 86223dc2cb871d64e66efc30f23db9b75751f6fa9afb242c169e46cd084e58fb13f3f4f57e68ef167394b4d93f7924d81df37edefe601d403d927e601c22d914
- SSDEEP 768:PIIoj3Img1R7BY3g1/0h0Pi2gd8iUTYWhEaSDKadXL9w/Iy4D78mM1PWmFT9zl/:PI7ImkSqHiZ8VTYWhEaoK2b9wgpVsPxt
- TLSH T15B237D42F74040B2D7EE2430141AEB396A78F6719FE051C3BB559B6E2D653D2EA3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:8d:34:f7:2c:db:35:67:71:10:bc:ee:e1:2c:65:d4:9e:60:0d:76:da:1e:dc:70:77:46:a3:b0:99:78:1c:d3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 2, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
23392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ColorAdapterClient.pdb
msvcp_win
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
memmove
_o__seh_filter_dll
_o_free
_o_iswspace
_o_malloc
_o_terminate
_except_handler4_common
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
api-ms-win-dx-d3dkmt-l1-1-0
D3DKMTOpenAdapterFromHdc
api-ms-win-ntuser-sysparams-l1-1-0
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysStringLen
SysFreeString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-synch-l1-1-0
CreateEventW
SetEvent
WaitForSingleObject
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
ModernColorGetGDILutFromHDC
ModernColorSetGDILut
ModernColorSetGDILutFromHDC
ModernColorSetLut
ModernColorSetMatrix
ModernColorSetMatrixFromHDC
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=1149, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=265, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/colorui.dll
- IMPHASH ecb66fb2d36b9bf8603a14c6df2cf739
- SHA256 6f8790fc74cb4c93d8b69d91cb90c03c341f4c8560328db91b1971f3342d1242
- MD5 9ab7b23accebd1ffef312a024c232e32
- SHA1 3dc40b037be951bdf5a73cdb99cca3e8b7636e1b
- SHA512 bbd8536a5ed939dae450a3f0ed1ad45ff7d6ad59fc8fdc576ab9b280da8e97a61282e7b1cf881af89d8a53506c0c9cf3b4366753b8127347f8214360bf90b6fc
- SSDEEP 1536:soGTApW69aWCjJMKFN2MfgowFuglTrSDPHOoTHW0nSopU:hdUtN2JuglTuDPHNW0J
- TLSH T19B633A41F78410F1E2F3283C192DE7B5857BBA709BD00AE3A7254A6E2E751C15A3E74B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
56640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
colorui.pdb
msvcrt
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_ltow_s
_vsnwprintf
_wcsicmp
wcsncpy_s
malloc
free
_purecall
memcpy_s
memset
kernel32
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
WaitForSingleObject
ReleaseMutex
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
CloseHandle
RaiseException
FindResourceExW
LoadResource
GetCommandLineW
LocalFree
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
lstrlenW
GetFileAttributesW
SetFileAttributesW
lstrcmpW
GetCurrentProcessId
SetLastError
GetCurrentProcess
FormatMessageW
GetDateFormatW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
EnterCriticalSection
SizeofResource
GetModuleFileNameW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetProcAddress
shell32
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ord258
winspool.drv
ClosePrinter
EnumPrintersW
OpenPrinterW
user32
RedrawWindow
TrackPopupMenuEx
RemoveMenu
GetClientRect
GetParent
UpdateWindow
ReleaseDC
BeginPaint
EnableWindow
GetWindowTextW
GetWindowLongW
OpenIcon
CallWindowProcW
SetWindowPos
GetWindowPlacement
CharPrevW
SetDlgItemTextW
SetWindowPlacement
ChangeWindowMessageFilterEx
SetWindowLongW
GetDlgItem
SetForegroundWindow
GetWindowThreadProcessId
EnumDisplayDevicesW
SendMessageTimeoutW
LoadStringW
CharNextW
FindWindowW
RegisterWindowMessageW
SetWindowTextW
DefWindowProcW
LoadMenuW
GetWindowRect
UnregisterClassA
EndDialog
PostQuitMessage
RegisterClipboardFormatW
DestroyWindow
GetDC
SetWindowRgn
EnumDisplayMonitors
SendMessageW
GetSubMenu
SetTimer
GetMonitorInfoW
PostMessageW
DialogBoxParamW
GetSystemMetrics
AllowSetForegroundWindow
SetFocus
RegisterClassW
LoadIconW
ShowWindow
LoadCursorW
CreateWindowExW
EndPaint
ole32
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient3
HWND_UserUnmarshal
ReleaseStgMedium
CoGetObject
StringFromGUID2
CoInitializeEx
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
ObjectStublessClient4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
HWND_UserMarshal
ObjectStublessClient5
ObjectStublessClient13
HWND_UserSize
HWND_UserFree
ObjectStublessClient7
ObjectStublessClient12
gdi32
CreatePen
DeleteObject
CreateFontIndirectW
BeginPath
PathToRegion
StrokePath
TextOutW
EndPath
GetTextExtentPointW
SelectObject
PatBlt
SetBkMode
SetTextColor
advapi32
GetFileSecurityW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
GetTokenInformation
RegQueryValueExW
AccessCheck
OpenProcessToken
RegDeleteValueW
DuplicateToken
shlwapi
StrRetToStrW
PathFindFileNameW
mscms
WcsGetUsePerUserProfiles
ColorCplOverwritePerUserAssociationList
ColorCplSetUsePerUserProfiles
ColorCplGetProfileProperties
ColorCplGetDefaultProfileScope
ColorCplGetDefaultRenderingIntentScope
InternalGetDeviceConfig
WcsSetDefaultColorProfile
WcsSetCalibrationManagementState
InternalSetDeviceConfig
InstallColorProfileW
WcsSetDefaultRenderingIntent
WcsEnumColorProfiles
ColorCplLoadAssociationList
InternalWcsDisassociateColorProfileWithDevice
InternalWcsAssociateColorProfileWithDevice
WcsGetDefaultColorProfile
ColorCplReleaseProfileProperties
ColorCplSaveAssociationList
ColorCplHasSystemWideAssociationListChanged
WcsGetCalibrationManagementState
InternalRefreshCalibration
WcsGetDefaultRenderingIntent
WcsGpCanInstallOrUninstallProfiles
ColorCplInitialize
ColorCplUninitialize
ColorCplMergeAssociationLists
GetColorDirectoryW
WcsEnumColorProfilesSize
UninstallColorProfileW
ColorCplResetSystemWideAssociationListChangedWarning
oleaut32
SysStringLen
SysAllocString
SysFreeString
VarUI4FromStr
rpcrt4
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
setupapi
SetupDiGetClassDevsW
SetupDiGetDevicePropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
ntdll
WinSqmAddToStream
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
LaunchColorCpl
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=13, id=260, version=27412,
count=270, id=1, productName=Unmarked objects,
count=29, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=25, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/colorui.dll.mun
- SHA256 26d5a9ec4838a69c3c22db54c0473bfce689ba3b0b7b15e3348ef15c09f16906
- MD5 6785fcc6ed3dbb713d597ef74314db16
- SHA1 10599b3d1f735bd021db260e525079e3654eb96d
- SHA512 f7a37ccd79d0138d644742569c111f1f03e8feea63784d9516af3d5d72a361ac2d9c6712ca76b57fff56e8e5932a00ce33f4905d587639ec5d15628302c8b2d7
- SSDEEP 12288:IGO8GOrflZJ20yTgX71V2pXC+BcHUZq6K:hIMlZsJW72XC+BzZ/
- TLSH T108B4AEE0F280E495D46CC170957389786B63EC2868790B3A219DF65F6D71387317ACBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
519KB
Virtual Size
518KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/combase.dll
- IMPHASH 0e7dbcdd9169f88354984e1c8b8310bd
- SHA256 cb8f23c034c8da560b4e6774e83824bdb69d5aba35965f5da13290335cea7dff
- MD5 a138dd82aec26637d9d5bca325535f54
- SHA1 367233a4c526a9b39b114f2f708ec594f2b25a72
- SHA512 042abdae2cb470bd0199c4a9a461c84b8abc070ccaccfa04b6001190cf85a48d8cceec6372c9c2b1dd1d1ba4046614784c1fdc78e47a684403f0b648c81ca66a
- SSDEEP 49152:OqiuVCgogIZqhjxSvSFO2SKBttWiqlSrpZTSYDjoFy:rELZQjxSKIKQArpZLoE
- TLSH T181C57C13B78D2490D5BB3D34466E3B39636E76602B9086CB5340FAA66C717C1CA3739B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:42:78:cc:ae:b5:b5:b7:2a:48:5b:ec:f3:f1:0f:bf:4d:f4:ba:ca:a0:c9:9d:d1:f5:70:e7:84:f4:7f:c8:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 4, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f8:a3:a1:26:0c:0c:40:48:fe:00:01:00:00:01:f8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
1293744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
combase.pdb
api-ms-win-crt-string-l1-1-0
memset
strnlen
wcsncmp
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
_o__ui64tow_s
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o__wtol
memmove
_o_free
_o_malloc
_o_qsort
_o_rand_s
_o_realloc
_o_toupper
_o_wcsncpy_s
_o_wcstok
_o_wcstoul
_o_wmemcpy_s
wcsstr
wcsrchr
__CxxFrameHandler3
_except_handler4_common
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
__std_terminate
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_local_unwind4
memcmp
memcpy
rpcrt4
RpcErrorEndEnumeration
RpcBindingInqObject
RpcRaiseException
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus
RpcServerTestCancel
RpcAsyncCancelCall
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcMgmtSetCancelTimeout
RpcCancelThreadEx
I_RpcFreeBuffer
I_RpcGetBufferWithObject
I_RpcGetBuffer
I_RpcSendReceive
I_RpcAsyncSetHandle
I_RpcSend
I_RpcReceive
I_RpcAsyncAbortCall
RpcStringBindingParseW
RpcServerInqBindingHandle
RpcBindingToStringBindingW
RpcServerInqCallAttributesW
RpcBindingInqAuthInfoExW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcRevertToSelfEx
RpcImpersonateClient
I_RpcBindingInqCurrentModifiedId
I_RpcSetDCOMAppId
RpcBindingInqAuthClientW
I_RpcOpenClientProcess
RpcCertGeneratePrincipalNameW
RpcServerRegisterAuthInfoW
RpcImpersonateClient2
RpcServerRegisterIf3
RpcServerUnregisterIf
I_RpcExceptionFilter
UuidFromStringW
RpcServerUseProtseqEpW
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcServerUseProtseqW
RpcAsyncCompleteCall
I_RpcMgmtEnableDedicatedThreadPool
I_RpcSystemHandleTypeSpecificWork
I_RpcServerGetAssociationID
I_RpcServerSubscribeForDisconnectNotification2
I_RpcServerUnsubscribeForDisconnectNotification
RpcBindingFromStringBindingW
RpcErrorStartEnumeration
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
MesEncodeFixedBufferHandleCreate
MesHandleFree
I_RpcSetSystemHandle
MesBufferHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
NdrGetUserMarshalInfo
NdrDllGetClassObject
NdrOleFree
NdrClientCall4
NdrOleAllocate
NdrDcomAsyncClientCall2
NdrStubCall2
RpcBindingServerFromClient
NdrStubCall
NdrServerInitialize
I_RpcRequestMutex
I_RpcFree
I_RpcAllocate
I_RpcClearMutex
NdrClientInitializeNew
I_RpcBCacheAllocate
NdrGetTypeFlags
SimpleTypeAlignment
NdrClearOutParameters
NdrFullPointerXlatFree
NdrFullPointerXlatInit
NdrCorrelationFree
NdrCorrelationInitialize
SimpleTypeMemorySize
I_RpcBCacheFree
SimpleTypeBufferSize
NdrConvert2
NdrClientCall2
NdrClientCall
NdrAsyncServerCall
NdrServerCall2
RpcExceptionFilter
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
I_RpcGetSystemHandle
RpcBindingBind
RpcBindingCreateW
I_RpcFreeSystemHandleCollection
I_RpcFreeSystemHandle
RpcErrorGetNextRecord
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
I_RpcMgmtQueryDedicatedThreadPool
I_RpcBindingSetPrivateOption
RpcBindingFree
RpcBindingSetOption
RpcBindingUnbind
RpcBindingCopy
RpcSmDestroyClientContext
UuidCreate
RpcErrorAddRecord
MesDecodeBufferHandleCreate
ord1000
ntdll
RtlImageDirectoryEntryToData
RtlGetDeviceFamilyInfoEnum
RtlUpcaseUnicodeChar
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlWow64IsWowGuestMachineSupported
RtlWow64GetEquivalentMachineCHPE
RtlSetThreadSubProcessTag
RtlDelete
RtlApplicationVerifierStop
RtlRealSuccessor
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
NtSetInformationObject
NtQueryObject
NtQueryVolumeInformationFile
RtlCaptureStackBackTrace
EtwEventWrite
EtwEventActivityIdControl
RtlInitializeCriticalSectionAndSpinCount
NtApphelpCacheControl
RtlSetThreadWorkOnBehalfTicket
RtlInitUnicodeStringEx
RtlGetAppContainerNamedObjectPath
NtQueryTimerResolution
NtTerminateProcess
RtlReportException
RtlInitializeConditionVariable
RtlCompareMemory
EtwEventSetInformation
RtlIsMultiSessionSku
EvtIntReportEventAndSourceAsync
NtQuerySystemInformation
RtlQueryPackageClaims
DbgPrint
EtwEventRegister
EtwEventUnregister
RtlCheckTokenCapability
RtlInitializeCriticalSection
RtlInitializeSidEx
RtlImageNtHeader
WinSqmSetDWORD
RtlIsCriticalSectionLockedByThread
RtlPcToFileHeader
RtlDllShutdownInProgress
EtwEventWriteTransfer
NtQueryValueKey
NtOpenKey
RtlEqualUnicodeString
NtQueryKey
RtlNtStatusToDosError
NtCreateKey
NtLoadKeyEx
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlAdjustPrivilege
NtUnloadKey2
RtlInitUnicodeString
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAppendUnicodeToString
RtlLoadString
NtQueryInformationProcess
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwTraceMessage
RtlGetAppContainerSidType
RtlSidDominates
RtlWakeAllConditionVariable
RtlSleepConditionVariableCS
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlDeleteCriticalSection
NtDeleteKey
RtlRealPredecessor
RtlCaptureContext
NtQuerySecurityAttributesToken
LdrStandardizeSystemPath
RtlDeleteNoSplay
RtlIsStateSeparationEnabled
RtlValidRelativeSecurityDescriptor
RtlSplay
RtlFreeHeap
RtlQueryPackageIdentity
wcschr
RtlGetThreadWorkOnBehalfTicket
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsAlloc
FlsSetValue
api-ms-win-core-fibers-l1-1-1
IsThreadAFiber
api-ms-win-core-file-l1-1-0
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
GetFinalPathNameByHandleW
FindClose
FindFirstFileW
CreateDirectoryW
GetFileSizeEx
GetFileType
DeleteFileW
GetFileAttributesW
CreateFileW
SetFileInformationByHandle
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
SetHandleInformation
api-ms-win-core-heap-l1-1-0
HeapValidate
HeapCompact
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalAlloc
GlobalFree
LocalAlloc
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
QueryDepthSList
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
FreeLibraryAndExitThread
GetModuleHandleA
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-memory-l1-1-0
VirtualQuery
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualProtect
VirtualFree
VirtualAlloc
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
FreeEnvironmentStringsW
ExpandEnvironmentStringsW
GetCommandLineW
GetEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenProcessToken
GetCurrentThread
GetCurrentThreadId
SwitchToThread
GetThreadPriority
GetProcessId
SetThreadToken
SetThreadStackGuarantee
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
ProcessIdToSessionId
CreateThread
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetProcessMitigationPolicy
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegGetValueA
RegCreateKeyExA
RegDeleteKeyExA
RegSetValueExA
RegOpenUserClassesRoot
RegLoadMUIStringW
RegOpenCurrentUser
RegDeleteTreeW
RegQueryValueExA
RegOpenKeyExW
RegSaveKeyExW
RegSetKeySecurity
RegCloseKey
RegLoadAppKeyW
RegQueryValueExW
RegEnumValueW
RegGetValueW
RegSetValueExW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateSemaphoreExW
SetWaitableTimerEx
OpenEventW
CreateEventW
SetEvent
ResetEvent
OpenEventA
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
SleepEx
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
InitOnceExecuteOnce
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetTickCount
GetComputerNameExW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
SetEventWhenCallbackReturns
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-wow64-l1-1-1
GetSystemWow64Directory2W
Wow64SetThreadDefaultGuestMachine
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
AccessCheckByType
ImpersonateAnonymousToken
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
DuplicateToken
GetSidSubAuthorityCount
EqualSid
InitializeAcl
GetSecurityDescriptorSacl
RevertToSelf
InitializeSid
AddAccessAllowedAce
ImpersonateLoggedOnUser
CheckTokenMembership
IsValidSid
AccessCheck
GetAce
MapGenericMask
GetKernelObjectSecurity
PrivilegeCheck
SetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSidSubAuthority
CreateWellKnownSid
ImpersonateSelf
IsValidSecurityDescriptor
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorRMControl
SetSecurityDescriptorSacl
AddAce
SetSecurityDescriptorGroup
GetSidLengthRequired
GetTokenInformation
api-ms-win-security-base-l1-2-0
GetAppContainerAce
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteEx
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled
api-ms-win-core-heap-obsolete-l1-1-0
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalSize
api-ms-win-core-privateprofile-l1-1-0
GetProfileStringW
api-ms-win-core-sidebyside-l1-1-0
FindActCtxSectionGuid
AddRefActCtx
ActivateActCtx
ReleaseActCtx
DeactivateActCtx
CreateActCtxW
GetCurrentActCtx
FindActCtxSectionStringW
api-ms-win-core-windowserrorreporting-l1-1-0
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
QuirkIsEnabledForProcess
kernelbase
ParseApplicationUserModelId
VerifyPackageFullName
OpenPackageInfoByFullNameForUser
GetStagedPackagePathByFullName2
OpenPackageInfoByFullNameForMachine
FindPackagesByPackageFamily
IsDeveloperModeEnabled
GetCurrentPackageInfo3
GetApplicationUserModelId
GetCurrentApplicationUserModelId
GetCurrentPackageFamilyName
GetSystemMetadataPathForPackage
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
api-ms-win-core-processsnapshot-l1-1-0
PssCaptureSnapshot
PssFreeSnapshot
PssQuerySnapshot
PssDuplicateSnapshot
api-ms-win-core-string-l2-1-0
CharPrevW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CStdAsyncStubBuffer2_Connect
CStdAsyncStubBuffer2_Disconnect
CStdAsyncStubBuffer2_Release
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Release
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
CleanupComl2StateInAllTls
CleanupOleStateInAllTls
CleanupTlsComl2State
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFileTimeNow
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleArchitecture
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterConsoleHandles
CoRegisterDeviceCatalog
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterRacActivationToken
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeConsoleHandles
CoRevokeDeviceCatalog
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoRevokeRacActivationToken
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserFree
HBRUSH_UserMarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HMONITOR_UserFree
HMONITOR_UserMarshal
HMONITOR_UserSize
HMONITOR_UserUnmarshal
HPALETTE_UserFree
HPALETTE_UserMarshal
HPALETTE_UserSize
HPALETTE_UserUnmarshal
HRGN_UserFree
HRGN_UserMarshal
HRGN_UserSize
HRGN_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCAggIdRelease
InternalCAggIdSetHandler
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCMLSendReceive2
InternalCStdIdentityGetIProxyManager
InternalCStdIdentityGetInternalUnk
InternalCStdIdentityUpdateFlags
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCanMakeOutCall2
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalGetWindowPropInterface2
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalRegisterWindowPropInterface2
InternalReleaseMarshalObjRef
InternalRevokeWindowPropInterface
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsInspectString2
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.proxy
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=27412,
count=103, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1776, id=1, productName=Unmarked objects,
count=12, id=259, version=27412,
count=1, id=256, version=27412,
count=288, id=270, version=27412,
count=20, id=261, version=27412,
count=1, id=253, version=27412,
count=43, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/comcat.dll
- IMPHASH e0bd3263fd5ea99b1d0c2f6f5194cc24
- SHA256 116a50cc0f4255dbb83455df87b79e0fb9a2cbbeef296df0e792eb718af5bb44
- MD5 ace4330c7c46d2f9317760cbb3f51383
- SHA1 8b94784af96c54e97765bf0097a86f346538c149
- SHA512 c29cdb1bc4226602166c8964293742c1a9b275df7f472666eaef6bc28ad8cb2fafe94564155cac343e094b5d798aaf5e8d89faf2c6c571b96b17db50328eaf2f
- SSDEEP 96:Nx0z1KBQIQkoeNPY8nGKT8Kav3VAXAzWXEWPT0lF+WwULNu:NxeqQqoU1FAVAXAzpW7a+Wl
- TLSH T1F0F1E845BBA84DEAFAEF0A7418BE9B371A3EB8300F6107C75450151939B4CC2FA70726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
comcat.pdb
msvcrt
_except_handler4_common
_XcptFilter
_initterm
malloc
free
_amsg_exit
kernel32
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=20, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/comctl32.dll
- IMPHASH 8b84204d8411bbf33f3f1e9c08db779b
- SHA256 aa4e8b47b082d41c363555f490b631405d71513c92aba9a41abf848340247d4a
- MD5 a2f1a6e8954a566579501b60cb8094e1
- SHA1 7bdfc6c9a8dea40eec89295fb84ab687fa7c962f
- SHA512 90f5f0a47675629e0da3f10ef5e4e6560761f90efff4dba315a599262d6fa5f956f5df6a20bded2d30cc39cc03d108370318159711c996c4205bbd00c003485f
- SSDEEP 12288:87aUcPyjDZ0lCcu4eaN2t8Eejj8W8sVqm8fdnqz04ofwIRNN:87HiyjDulCc6aN2t8EejjqsVH8fdnqY1
- TLSH T117C46C15B640C172C46238305A59ABB9A5BDFE204B1409CF7391FBEEBA347D1993C39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
58:5c:34:b3:7c:56:8c:62:18:1a:60:5a:83:6f:46:92:f3:a2:a3:d9:91:ab:83:93:71:fc:0a:cd:02:c1:71:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 13, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:99:99:95:f1:dc:e3:20:eb:00:01:00:00:01:e2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
422720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
comctl32v582.pdb
ntdll
NtQueryInformationProcess
RtlUnwind
advapi32
CheckTokenMembership
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
OpenProcessToken
AllocateAndInitializeSid
RegCreateKeyW
FreeSid
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueW
gdi32
SetDIBits
SetBkColor
GetDIBits
GetTextExtentPointW
CreateCompatibleDC
CreateDIBSection
CreateCompatibleBitmap
SelectObject
StretchDIBits
BitBlt
DeleteObject
GetStockObject
CreateRectRgn
OffsetWindowOrgEx
SetWindowOrgEx
GetObjectW
CreateFontIndirectW
TranslateCharsetInfo
GetDeviceCaps
SetLayout
DeleteDC
ExtTextOutW
GetTextMetricsW
GetDIBColorTable
CreatePalette
CreateHalftonePalette
GetTextExtentPoint32W
CreatePatternBrush
SelectPalette
RealizePalette
UnrealizeObject
StretchBlt
SetBkMode
SetPixelV
SetTextColor
GetDCOrgEx
SetBrushOrgEx
EnumFontFamiliesExW
RectVisible
SaveDC
IntersectClipRect
RestoreDC
GetTextAlign
SetTextAlign
GetNearestColor
CreateSolidBrush
PatBlt
GetLayout
CreatePen
Polyline
CreateBitmapIndirect
CreateBitmap
CreateFontW
TextOutW
GetClipBox
Arc
MoveToEx
LineTo
Ellipse
Rectangle
SelectClipRgn
GetBitmapBits
GetCurrentObject
CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
FillRgn
FrameRgn
CreateRectRgnIndirect
OffsetRgn
GetPixel
GetClipRgn
ExcludeClipRect
GetTextColor
GetBkColor
GetCharWidthW
GetPaletteEntries
SetPixel
SetDIBColorTable
kernel32
FlushFileBuffers
GetCPInfo
WriteConsoleW
HeapFree
LoadLibraryW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiA
lstrcmpiW
LocalFree
lstrlenW
LocalAlloc
WideCharToMultiByte
LocalReAlloc
LocalSize
HeapReAlloc
FindResourceW
LoadResource
LockResource
GlobalAlloc
GlobalFree
FreeResource
GetCurrentProcess
CloseHandle
GetTickCount
lstrlenA
MulDiv
CheckForReadOnlyResource
SizeofResource
lstrcmpW
EnumResourceLanguagesW
FindResourceExW
GetLocaleInfoW
GetThreadLocale
FindResourceExA
MultiByteToWideChar
GetNumberFormatW
GetCurrentProcessId
GlobalAddAtomW
GetCurrentThreadId
GetACP
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
QueryActCtxW
ActivateActCtx
DeactivateActCtx
EnterCriticalSection
LeaveCriticalSection
lstrcmpA
CompareStringW
GetSystemDefaultLCID
Sleep
GetUserDefaultLangID
GetDateFormatW
GetLocalTime
EnumCalendarInfoW
GetUserDefaultLCID
GetStringTypeExW
GetTimeFormatW
GetLastError
SetEvent
WaitForSingleObject
CreateEventW
CreateThread
GlobalReAlloc
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
GetCommandLineA
GetVersionExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
LoadLibraryExW
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
SetStdHandle
OutputDebugStringA
VirtualProtect
HeapSize
WriteFile
VirtualAlloc
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointer
GetSystemInfo
VirtualQuery
user32
DrawEdge
CharLowerW
GetWindowRect
GetClientRect
GetWindowLongW
ClientToScreen
GetParent
SetWindowPos
GetSysColor
GetDC
ReleaseDC
GetSystemMetrics
SetRect
MapWindowPoints
SetCapture
PeekMessageW
CallMsgFilterW
ReleaseCapture
IsWindow
PtInRect
TranslateMessage
DispatchMessageW
WaitMessage
GetCapture
RegisterWindowMessageW
SystemParametersInfoW
GetSysColorBrush
SendMessageW
GetMessageTime
MessageBeep
SetRectEmpty
GetDoubleClickTime
ScrollWindowEx
RedrawWindow
UnionRect
GetMessagePos
ScreenToClient
GetDlgItem
SetWindowLongW
CopyRect
DeferWindowPos
LoadImageW
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DestroyWindow
LoadStringW
SetWindowTextW
DrawTextW
ShowWindow
IsWindowVisible
MapDialogRect
DestroyIcon
CreateWindowExW
MonitorFromWindow
GetMonitorInfoW
EnableWindow
CopyImage
SetForegroundWindow
GetNextDlgTabItem
GetDlgCtrlID
IsChild
SetFocus
SendDlgItemMessageW
GetFocus
InvalidateRect
SetCursor
LoadCursorW
SetDlgItemTextW
IsWindowEnabled
BeginDeferWindowPos
EndDeferWindowPos
GetClassNameW
GetKeyState
IsDialogMessageW
FillRect
BeginPaint
EndPaint
SetWindowTextA
DefWindowProcW
GetDesktopWindow
GetMessageW
PostQuitMessage
GetActiveWindow
SetActiveWindow
SetLastErrorEx
IsZoomed
InflateRect
DrawFrameControl
UpdateWindow
GetIconInfo
RegisterClassW
CreateWindowExA
GetProcessDefaultLayout
DrawIconEx
IntersectRect
EqualRect
GetUpdateRect
GetWindowDC
PostMessageW
GetAsyncKeyState
EnumChildWindows
GetWindow
MoveWindow
GetWindowTextW
GetCaretBlinkTime
SetTimer
GetCursorPos
KillTimer
GetPropW
GetWindowThreadProcessId
RemovePropW
SetPropW
CallWindowProcW
SendNotifyMessageW
SetCursorPos
LoadIconW
DrawIcon
SetScrollInfo
EnableScrollBar
GetScrollInfo
IsRectEmpty
InvertRect
GetScrollPos
GetScrollRange
ShowScrollBar
SetScrollPos
SetScrollRange
GetMenuItemID
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
SetMenu
CheckMenuItem
GetSubMenu
GetSystemMenu
SubtractRect
UnregisterClassW
CreateIconIndirect
DrawFocusRect
CharPrevW
WindowFromPoint
OffsetRect
SetParent
DestroyMenu
CreatePopupMenu
AppendMenuW
AdjustWindowRect
TrackPopupMenu
MonitorFromRect
FrameRect
ChildWindowFromPoint
EndDialog
DialogBoxIndirectParamW
GetCursor
GetForegroundWindow
MonitorFromPoint
AdjustWindowRectEx
GetMenu
SetWindowRgn
GetWindowRgn
InvalidateRgn
GetShellWindow
GetKeyboardLayout
GetKeyboardState
SetKeyboardState
DestroyCursor
GetUpdateRgn
LockWindowUpdate
GetDCEx
ValidateRect
DrawTextExW
MapVirtualKeyW
GetKeyNameTextW
HideCaret
GrayStringW
SetCaretPos
ShowCaret
CreateCaret
DestroyCaret
GetWindowTextLengthW
CopyIcon
AddMRUStringW
CreateMRUListW
CreateMappedBitmap
CreatePropertySheetPage
CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
CreateStatusWindowA
CreateStatusWindowW
CreateToolbar
CreateToolbarEx
CreateUpDownControl
DPA_Clone
DPA_Create
DPA_CreateEx
DPA_DeleteAllPtrs
DPA_DeletePtr
DPA_Destroy
DPA_DestroyCallback
DPA_EnumCallback
DPA_GetPtr
DPA_GetPtrIndex
DPA_Grow
DPA_InsertPtr
DPA_LoadStream
DPA_Merge
DPA_SaveStream
DPA_Search
DPA_SetPtr
DPA_Sort
DSA_Create
DSA_DeleteAllItems
DSA_DeleteItem
DSA_Destroy
DSA_DestroyCallback
DSA_EnumCallback
DSA_GetItem
DSA_GetItemPtr
DSA_InsertItem
DSA_SetItem
DefSubclassProc
DestroyPropertySheetPage
DllGetVersion
DrawInsert
DrawStatusText
DrawStatusTextA
DrawStatusTextW
EnumMRUListW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FreeMRUList
GetEffectiveClientRect
GetMUILanguage
ImageList_Add
ImageList_AddIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_DrawIndirect
ImageList_Duplicate
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetFlags
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_GetImageRect
ImageList_LoadImage
ImageList_LoadImageA
ImageList_LoadImageW
ImageList_Merge
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetFilter
ImageList_SetFlags
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_SetOverlayImage
ImageList_Write
InitCommonControls
InitCommonControlsEx
InitMUILanguage
InitializeFlatSB
LBItemFromPt
MakeDragList
MenuHelp
PropertySheet
PropertySheetA
PropertySheetW
RegisterClassNameW
RemoveWindowSubclass
SetWindowSubclass
ShowHideMenuCtl
Str_SetPtrW
UninitializeFlatSB
_TrackMouseEvent
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=257, version=27412,
count=415, id=1, productName=Unmarked objects,
count=16, id=259, version=27412,
count=29, id=261, version=27412,
count=102, id=260, version=27412,
count=1, id=256, version=27412,
count=60, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/comdlg32.dll
- IMPHASH bb3768c81a9de6f6377ba23076d55dbe
- SHA256 212b0745089ccab3ca71fb8b38b178469c6afcae1ecc52ca3ec2c8405202dd80
- MD5 8ab7601ee33794963efe1f3c42d9bb50
- SHA1 760bc7c639f4988611e0ff679e36ce8de896fccc
- SHA512 a1664e75ca378f41d58c6c0962e8e7aae89b0bd1ca7ba003197ce6edf18d35aacd999bf33c3aa2ce91fafb837e1414e75565b0f9e6e1ababeee860cb9a423bf0
- SSDEEP 12288:gMygwHVa9jn9zns9bHiIb2deoEwrHKTjAllSPVO+IViQdb:BygWVa9D97IT95wrHK3AllyVZIVNdb
- TLSH T154E45A219764D262CAA32070067E7735703E9E71431899F7D7449AB6AE206D38F39FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
269792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
comdlg32.pdb
msvcrt
_unlock
_lock
__CxxFrameHandler3
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
realloc
free
malloc
memcpy
_wcsicmp
strncpy_s
__dllonexit
strchr
sprintf_s
_set_errno
wcsncmp
memmove_s
memcpy_s
_vsnprintf_s
wcstok_s
_vsnwprintf
wcsstr
wcsrchr
wcschr
memcmp
memmove
_ftol2_sse
wcstok
_get_errno
_ftol2
towlower
_onexit
memset
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalAlloc
LocalFree
GlobalFree
LocalReAlloc
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetModuleFileNameA
GetModuleHandleExW
LoadStringW
SizeofResource
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
FreeResource
LockResource
FindResourceExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibraryAndExitThread
api-ms-win-core-processthreads-l1-1-0
GetProcessVersion
TlsGetValue
TlsSetValue
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
CreateThread
TlsAlloc
GetCurrentProcessId
TlsFree
OpenProcessToken
OpenThreadToken
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetErrorMode
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
SetThreadPreferredUILanguages
FindNLSStringEx
SetThreadUILanguage
GetThreadPreferredUILanguages
FormatMessageW
GetLocaleInfoW
GetACP
GetThreadUILanguage
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-string-l2-1-0
CharLowerW
CharNextW
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetVolumeInformationW
CreateFileW
FindClose
GetDriveTypeW
DeleteFileW
FindNextFileW
GetFileAttributesW
FindFirstFileW
GetShortPathNameW
GetVolumePathNameW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateEventExW
LeaveCriticalSection
CreateMutexExW
InitializeSRWLock
OpenEventW
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSemaphore
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegGetValueW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CLSIDFromString
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoGetMalloc
CoCreateInstance
PropVariantClear
CoTaskMemRealloc
CoUninitialize
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoWaitForMultipleHandles
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
InitOnceExecuteOnce
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-path-l1-1-0
PathCchRemoveBackslash
PathCchAppendEx
PathCchAppend
PathAllocCombine
PathAllocCanonicalize
PathCchSkipRoot
PathCchRemoveFileSpec
PathCchAddExtension
PathCchStripToRoot
PathCchIsRoot
PathIsUNCEx
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64
GetVersionExW
GetTickCount
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
rpcrt4
UuidCreate
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
NtFsControlFile
RtlNtStatusToDosError
RtlQueryWnfStateData
WinSqmIncrementDWORD
NtQueryWnfStateData
EtwCheckCoverage
NtSetInformationProcess
EtwEventWrite
EtwEventEnabled
NtQueryInformationFile
EtwEventActivityIdControl
EtwEventSetInformation
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
EtwEventUnregister
EtwEventWriteTransfer
EtwEventRegister
RtlUnicodeToMultiByteSize
RtlIsNameLegalDOS8Dot3
RtlInitUnicodeStringEx
WinSqmAddToStream
api-ms-win-shcore-scaling-l1-1-1
GetProcessDpiAwareness
user32
GetClassNameW
CreateDialogIndirectParamA
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
SetMenuDefaultItem
ClientToScreen
RegisterClassW
GetComboBoxInfo
DestroyMenu
TrackPopupMenuEx
CreatePopupMenu
InsertMenuItemW
KillTimer
GetMenuItemCount
GetWindowTextLengthW
CreateDialogIndirectParamW
SetParent
RedrawWindow
IsWindowVisible
SetForegroundWindow
ChangeWindowMessageFilterEx
EnableMenuItem
TranslateAcceleratorW
CallNextHookEx
GetNextDlgTabItem
GetMessageTime
GetMessagePos
DestroyIcon
PeekMessageW
MapDialogRect
GetWindow
DestroyAcceleratorTable
UnhookWindowsHookEx
SetWindowsHookExW
LoadAcceleratorsW
GetSystemMenu
MonitorFromWindow
DeferWindowPos
EnumChildWindows
GetDlgCtrlID
CopyIcon
GetClassLongW
SendMessageTimeoutW
GetAncestor
OffsetRect
DialogBoxIndirectParamAorW
GetWindowLongW
GetPropW
SetPropW
PtInRect
GetDC
ReleaseDC
SetCapture
CopyRect
MapWindowPoints
ClipCursor
ValidateRect
ChildWindowFromPoint
GetDlgItem
GetFocus
SetFocus
ReleaseCapture
InvalidateRect
RemovePropW
EndDialog
SendMessageW
GetDlgItemInt
SetDlgItemInt
UpdateWindow
GetDlgItemTextW
SendDlgItemMessageW
EnableWindow
GetWindowRect
SetWindowPos
BeginPaint
EndPaint
GetSysColor
FrameRect
InflateRect
DrawFocusRect
DrawEdge
FillRect
SetWindowLongW
GetClientRect
ShowWindow
AdjustWindowRect
MoveWindow
GetParent
CallWindowProcW
GetSysColorBrush
IntersectRect
EqualRect
ShowCursor
SetCursor
LoadCursorW
GetDialogBaseUnits
GetSystemMetrics
ScreenToClient
CreateWindowExW
GetWindowLongA
SetWindowTextW
SetDlgItemTextW
CheckDlgButton
PostMessageW
DlgDirListW
MessageBeep
IsDlgButtonChecked
DefWindowProcW
GrayStringW
CreateDialogIndirectParamAorW
IsWindow
RegisterWindowMessageA
RegisterWindowMessageW
DestroyWindow
SetDlgItemTextA
SendDlgItemMessageA
CheckRadioButton
GetDlgItemTextA
NotifyWinEvent
DialogBoxIndirectParamW
GetWindowTextW
MessageBoxW
IsWindowEnabled
GetKeyboardLayout
DrawTextW
LoadIconW
LoadImageW
GetKeyState
DrawIcon
GetWindowPlacement
SetWindowPlacement
RegisterClipboardFormatW
SystemParametersInfoW
SetTimer
ord2707
GetForegroundWindow
DeleteMenu
BeginDeferWindowPos
EndDeferWindowPos
GetMonitorInfoW
MonitorFromRect
EnumDisplayMonitors
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrlenW
lstrlenA
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-shcore-unicodeansi-l1-1-0
SHAnsiToUnicode
SHUnicodeToAnsi
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrPBrkW
StrCmpICW
StrStrIW
QISearch
StrRChrW
StrStrW
StrCmpIW
StrChrW
StrIsIntlEqualW
StrCmpNIW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsRelativeW
PathIsValidCharW
PathIsRootW
PathGetDriveNumberW
PathRemoveBlanksW
PathFindNextComponentW
PathMatchSpecExW
PathIsFileSpecW
PathFindFileNameW
PathCombineW
PathRemoveExtensionW
PathSkipRootW
PathFileExistsW
PathIsUNCServerW
PathIsUNCW
PathRemoveBackslashW
PathAddBackslashW
PathFindExtensionW
PathMatchSpecW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalReAlloc
LocalSize
GlobalLock
GlobalUnlock
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
FindResourceA
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
IStream_Read
IStream_Write
SHCreateMemStream
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
api-ms-win-shell-shellcom-l1-1-0
SHCoCreateInstance
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-shcore-registry-l1-1-0
SHRegGetValueW
api-ms-win-shcore-path-l1-1-0
ord170
ord172
api-ms-win-core-url-l1-1-0
UrlIsW
PathIsURLW
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
shlwapi
ord388
ord168
ord271
ord197
ord355
ord225
ord266
ord630
ord163
ord178
ord638
ord478
ord481
ord479
AssocGetPerceivedType
ord204
ord514
ord164
ord24
StrRetToStrW
ord540
ord476
StrRetToBufW
ord270
ord618
ord175
ord172
ord619
gdi32
SetTextColor
SetBkMode
GetTextExtentPointW
GetTextCharset
GetGlyphIndicesW
CreateFontIndirectW
GetDeviceCaps
TranslateCharsetInfo
EnumFontFamiliesExW
TextOutW
GetTextCharsetInfo
GetTextMetricsW
CreateRectRgnIndirect
SelectClipRgn
CreateICW
CreateDCW
GetCharWidth32W
CreateRectRgn
CreateDiscardableBitmap
SetRectRgn
CombineRgn
EqualRgn
ExcludeClipRect
GetTextExtentPoint32W
OffsetWindowOrgEx
SetWindowOrgEx
CreateDIBSection
GetLayout
ExtTextOutW
GetObjectW
CreateDIBitmap
CreateCompatibleBitmap
LineTo
MoveToEx
BitBlt
PatBlt
GetNearestColor
CreateCompatibleDC
Rectangle
SetBkColor
SelectObject
GetStockObject
CreatePen
CreateSolidBrush
RealizePalette
SelectPalette
DeleteDC
DeleteObject
CreateFontW
comctl32
ord329
ord386
ord334
CreatePropertySheetPageW
PropertySheetW
ord412
ord413
ord410
ord326
ord323
ord322
ord320
ord388
ImageList_GetIconSize
ImageList_Draw
CreateToolbarEx
ord339
ord236
ord331
ord336
ord385
ord328
ord332
ord335
ord324
ord16
InitCommonControlsEx
ImageList_Destroy
ord341
ord338
shell32
SHGetFileInfoW
ord100
SHGetSpecialFolderPathW
ord714
SheChangeDirExW
ord25
SHParseDisplayName
ord155
ord19
SHGetIDListFromObject
SHGetSpecialFolderLocation
ord18
SHBindToParent
SHCreateItemFromIDList
ord16
ord17
SHBindToObject
SHCreateShellItemArrayFromShellItem
SHCreateItemFromParsingName
SHCreateShellItemArrayFromDataObject
SHGetDesktopFolder
SHCreateItemWithParent
ord21
SHGetKnownFolderItem
ord850
SHBindToFolderIDListParentEx
SHGetKnownFolderPath
SHGetKnownFolderIDList
ord23
SHBindToFolderIDListParent
SHCreateShellItemArrayFromIDLists
SHCreateShellItemArray
ord64
ord853
ord654
SHChangeNotifyRegisterThread
ord778
SHAddDefaultPropertiesByExt
ord68
ord644
ord645
ord903
ord28
ord71
ord4
ord2
ShellExecuteExW
ord89
ShellExecuteW
ord152
SHCreateItemInKnownFolder
ord2000
ord921
ord787
ord195
ord761
SHGetFolderLocation
ord77
ord24
ord153
kernel32
CreateActCtxW
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ChooseColorA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
DllCanUnloadNow
DllGetClassObject
FindTextA
FindTextW
GetFileTitleA
GetFileTitleW
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
LoadAlterBitmap
PageSetupDlgA
PageSetupDlgW
PrintDlgA
PrintDlgExA
PrintDlgExW
PrintDlgW
ReplaceTextA
ReplaceTextW
Ssync_ANSI_UNICODE_Struct_For_WOW
WantArrows
dwLBSubclass
dwOKSubclass
Name
.text
Size
609KB
Virtual Size
609KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=118, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=260, version=27412,
count=816, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=4, id=261, version=27412,
count=6, id=259, version=27412,
count=1, id=256, version=27412,
count=77, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/comdlg32.dll.mun
- SHA256 286607bdde80dc57e729ad7922e6369e6517c8b4c68817c82036ed027ac5e403
- MD5 f0b6bb3903d9fdbb88fb518901d79477
- SHA1 34318392581ce14e37440fdc8a06e4435205a12c
- SHA512 65a49a10b509583a447f31a548b46805818aa8a8a7dbb2f2e97c1e9b48adb2909d45f75db83a064753efd0ad88e5ebba13467f20bbcd92e3aceb8cfcf4d24371
- SSDEEP 1536:HYQBNmgSWv6VIPd4n+lbeRZIbSQPPA78oIlEecLxoL0RoUoFJifVo:4QBNmaPRyZ2pPoGlj2Mw2
- TLSH T1D7747320B240D05ED5545A70ADB2CBB52E613DDAAD2818173EF6FF4F293518BF421A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
343KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/compstui.dll.mun
- SHA256 0cb780b837f7e3bab8108fea1ba422c70588803a722a32707b71cd9bff56d142
- MD5 97d11b6f9f981e3dd866e5d62ee6535b
- SHA1 26eb8f0abe8d30202a03abfba2b8fa8cf7b9a9bd
- SHA512 eb109652dcbc72663934ccf1bbc1fb24d65201ac19e3462e8dac8045f233a9a003061fd63d34bfc0f290d30b089e887b858ed3a6d8142495c210a8611d71393f
- SSDEEP 768:V+GISF2QrwYjrwo1SS5DnOvEblH1lfgbZfpg/aR+U2pdWdOdmdm85LI+yul3z9tN:RISFlrwKwiTxdXfga8OPHTDfDk1tf1
- TLSH T1F914551A722AEAA5C85F14358817CAF42C21BC227D058E3776B0BF9FFD703547D0696A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/comres.dll.mun
- SHA256 944b692381aef357f9e159a41e426a1af45c9c6dd50b1963fa5783f896fcb909
- MD5 ee26d21933febcb66225f428aeb6377f
- SHA1 3b9f2644975af96f6aaa440513abec5cf8c1ba18
- SHA512 8b7be710ecb64fe2af8812e1e717f18bd804710ca9188b1bebc48c4d5dee083c73964300802d2d9ba2755427b93544826d692ecaf8cc10b78f5e3590f9933d57
- SSDEEP 12288:0xRaoF24tPGvEn1uqzGd+Zv++XPM7UUU4tyXeSnmhnm+:0FHtPGvEnEqzG8J++XPEtpz
- TLSH T14B55299276F8C8A3F43757312C6DF6A8661EBE974641C50F3156FEBC98F27001C8A668
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/connect.dll.mun
- SHA256 e1e617f44ecd55a811c3d98f2fa3faa3f501371fd2b84b9f61952771f89874ab
- MD5 6ff7dfe90bdc2779336d5721c644362e
- SHA1 e660733b0f10569d04b15715c4c68d962f1eeacc
- SHA512 49fa4143b8a9984fce6624939b57ba72a2021a3d91f463c918d84e0d341624ee7bb128aa58fe2c1b2f47d9d5e97fe2f8025a2a618d57827ac182b52092c880a1
- SSDEEP 12288:vhePireQtC/S2dgpUdV5dtRsYu2MRpPrvPZ/Yrjnly1q4dNt0YxeGcg:vx2Jdzp3MR1pyAq4dNx
- TLSH T1F435E0553740E495CC9C4631CC63C7F52E60BCA5EE8186B732B6FF2F28B1212B91A66D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/crypt32.dll.mun
- SHA256 cef8b7cce0e502025962687e042851188ec2241fb7b02a83deaabf1491619427
- MD5 e397bce280583909a18141f7f1618dc8
- SHA1 17783a99d37348d87f999885a05775d090b8de36
- SHA512 36f4a3e1081b799dedb20836dbeb8570153a7058561021959d6c2da05d30991750c27ff46f59c33b77025e357e53a1f704f5e87cb11869181f1f02cb7aad0d78
- SSDEEP 12288:FWnmxqxrWSIqmcxzQZ4RY7YpopQpfpxWPG2cB7wFr3ru6:wmxqIL5cim0/apfpAPG2C7w5C6
- TLSH T182054B8A0F6425C3EE935E7099C4F52B2D73A78827609CBE901B50BADCD57A2374D21F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
801KB
Virtual Size
800KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cryptui.dll.mun
- SHA256 f69d14578c5f115af985d435f3bd62adeac0877dee3a6e15bfe7e6a7e0310641
- MD5 df42db460566084649ddc8244e856821
- SHA1 d22a2e34524949bcb13f5910f880a23c355e7afd
- SHA512 a5904430e2a56a1d88e1aa06746c86a8f667a90f365f52c09df6fb2e6326a9cab6c8b5e33ee9b3fe20dc4fb6278d1d4b13cf5104d694a6eb649ac6f4bf505be5
- SSDEEP 6144:caTlyRmodxGPDmwGbdooZE+QP3lj5zXH5ns:cw6mOxGPDbodiljh
- TLSH T1726439C0F6088998E95D0930F8278FB15E637C595CA4261621FAFD6F3EB7351211F62B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cryptuiwizard.dll.mun
- SHA256 4df48856304686e568518d752944e473c80511c2f29f7af7a9a848abca430095
- MD5 b2f8fd39b56d74b64d202b678183b560
- SHA1 a87c26f7a4194bd492cfee0a886c5e420e6a3506
- SHA512 ca50668c6719fe8645748330ee97e0327e39a6683ceaf7cfd283fd637393a75d1c273321407d34cb615e27fcdbcd25e442e28052fdcd4b66cfd5a73ef18f42d6
- SSDEEP 768:Q95b3wv25+LzhzKln8N+b2RQEWXK5Q7U:Q9mv25+Lz5sn8N+Aj5Q7U
- TLSH T1744492B5B1F498A3F6235F312CECB959B8AEB65402C2C65E7453B1F095D230121ADBBC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/APHostRes.dll.mui
- SHA256 7a99f5b7754414ce094a1754ca912097f4a205cd0f5357a2c6a74dab91d78245
- MD5 6d7762339a13837f9110a947c5f24353
- SHA1 4340c1102e15085ba5811527b52c72a745b50038
- SHA512 7c85364eedf89f8b163b3ba94d596983f2c424ea5e874c0527313cadb172a2103bfd75aeadf99fffa6c6655c1ae090afc0688b961d217bc046a24d81b4e2f96f
- SSDEEP 384:D4l8qk0PqUeXY31G6C2b+fWnRbf8Z78WJ7:D4s5UeX9b7
- TLSH T1D862D80526FD4545F5F7AF36A9B207B11A7B3CC5AA3DC10ED690D21D2CE06809DA1BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/SyncRes.dll.mui
- SHA256 4a8929839337108c3bea83b8cb465f9d8b6d58627524e5aeeca35cde86758fd1
- MD5 8b9972047d574a088818f218690cb801
- SHA1 7c574cb82a9177c7f84ac8abf33dcd5dc50736d4
- SHA512 395935d5de2849d3d9c939229558c326cfb9d243d8ad58317fdc84bbda7125957c63b2c3b9822b6c8b82c6932978b7c5227a40b687c1228088f1f366a990c3c5
- SSDEEP 384:AnPDzEDorztl/r5ke4OrpwLD3e9u9DRJuJ9FGNekV/097Wfs8ei3FTV7o5W47:AHoFekV/HK17
- TLSH T108D2074162FC0685F2FB7F7169B506710E3B3CA6BE39C20F8551429E1960AD4EAB4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/cdosys.dll.mui
- SHA256 68de5fa1e0224dfb1f150e2a52ee70fbcdd23f710323f7d79a081436a82bc49e
- MD5 36bfbad2a954024b60d7e3c7ba5ee850
- SHA1 d887cb4a63dd07a95949d83ee6c7881dcf403559
- SHA512 a6cb7aa0039c727fe750d8186b2da9c326f97d8bdc1c83b4d2defc8ec99f9c2ba574614506041d19fe85d38e002a77524a662c0478fac19aecf412faac1173a4
- SSDEEP 768:Y4aJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfQNjeUBe8BVYhIAAInmVLHH:Y5J6ivyUcEsx7fNXjTV8PszW7yYsznPs
- TLSH T11F23BE1253FE4608F1F77B3968B616B62E367C92F938C29C12A0925D1DB1F819C61B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/comctl32.dll.mui
- SHA256 0bfdf8d0947cef07a646bd43c91b712e42e85f4b01ba0ce0df9c7503c60f9a38
- MD5 03e72d5fb3a05dd5cd18ec1aae4a02d1
- SHA1 a1bd834dda07957ab5c46a3cf14846e253bef56f
- SHA512 bec98f0a49e6868f4d13b0877ec769266711a0f570e665edc76319b7d590386a147324300e28cbcf298404efd249015c04b06f95c09ffa36eacf2db004b3c25f
- SSDEEP 48:y/5zOeu+sfGogiAE+fdncS9psp2o0phusS6QSGNMtfs68mmoO4LZWsu1AOJwbxYC:yWzAEyaS9pspULz2eSx4NWBA0Pq
- TLSH T187C14305A7BE4916F0B61F75AAB60AA26B7FBC537B36931FCB40015D6460244EDA0F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/quickassist.exe.mui
- SHA256 479b8ad50298f031b8f11bdeb69942e9bc53fd37179453880c013b7051a0cb87
- MD5 26eb521dcb651c105117c7b1a1146946
- SHA1 220a0c770366423458e255611702481e6e094d5f
- SHA512 2a6d61d71b519c835e08c534655b0304c99f4a5cf13df2cd20901465ccf7de949d3cdfe3a0a85105a1ad4c58cdbf1b33ff4e9bf7cc168ac8eaec7b1df1ed2058
- TLSH T1BA818C4456FA0655F4FB1F71AAF106A65EBF7C63BA72921FCA40021D28A0944E9F0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cs-CZ/windows.ui.xaml.dll.mui
- SHA256 2f82796079ad06006341a9e8a23cd8806c33d95fbe1afba238a72f115aa97098
- MD5 e2349be47c52caf141e46d7b6b289573
- SHA1 a645e26e8fe526c5e3a36f4ecf1d29f2f338fb12
- SHA512 fa465fb310cad52e6337c040a737f4796f074417d1d69e323fa0c9fda3943051a69d76b8f75d17e7f8c6b5fd098c1ee2ceb24b766d2f59412078ffaac0c80451
- SSDEEP 384:E+F/ux4nvB+utxmuhfIw0z+r/sp+7YmHuMEWyw:9FWSp+utxmuqw0yK692w
- TLSH T11872470262FC1655F1F75FB67EB60AA16A3B7CD66A35C20F4150624E1CA0BC0ECA1777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/cttune.exe.mun
- SHA256 5adcf04d2ae996654416b2db3b2d2749f67033f16fecb427a8a4fc19a0f83fd6
- MD5 ab606fab5228a858ebe03d01956d587e
- SHA1 9dc3c47f7845d3524a9840c7eeff7b48a72318a3
- SHA512 91b92a6ed36c2630118c6a02aaae37aa769ae0a1c912e8f6003c671943aa9bbdbae10fddd1b6d6cee2c8cd85bf2fec490f1e112b2d286a79ebea9a1750c06eeb
- SSDEEP 3072:WvJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgCAWUM+:WvoxEvTEPp/F
- TLSH T14B340B156FB91DB6D116793B0C2E485207336827146B83F3A897EEFC4EF66ACD046872
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
235KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/APHostRes.dll.mui
- SHA256 f2b200093977395131dd81fd5bba7b1929a9159df9e33acc8d737c4d1ba8ee1a
- MD5 d7bb19024540030a7ae111752b6b270a
- SHA1 f741f4d528c01367a4ab108cf50e803245f182f1
- SHA512 eb04e0704b1b782e8ea2b41175cc3a2386757e7c221058c04a7f409e793af602b67d6f66c4ac0714f9a63daf1c4d27f1dbb0c9c3fc3bea775bf3a85cafc94cb4
- SSDEEP 192:P82rDfUwR1K/CZozRAsX/Q69Vj06PZSDvzntf2tTEtTJbCjYlRHNR0RnRe6mHyp8:0IKA1zA2xNR0RnRe6mHypWGiBWA
- TLSH T156720E9113E9560DF9F62B357DB202A42B75BCE5B939D20D2280A16D6CF2295CDB0F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/SyncRes.dll.mui
- SHA256 86173a65ba3e84d9b7b06b0d97e99b353b20444bf262738820575358529e519d
- MD5 db8661e4b606dce7aa1511b5f14ec19e
- SHA1 5defa848eecebc1c5d5ced8e116008cb95e88084
- SHA512 3de076b9257a9b21a9276ac68521933ee40e85cc78134586fa0c62ce5a8bc590ddbb230ffbfb18acddb930cfba89e80c94e1fdcb4e85fc5ce496fce37ab9f343
- SSDEEP 384:vnt51599w7Ofwc7XsbrowF6CbwNmtmb2wNa+NmN6TWDOW3wPWB:vFpa5Bv+zlu
- TLSH T17AD276A163F98609F1FA3B706CB906945ABABCE6FE39C20D1254508D1CB57D4D6B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/cdosys.dll.mui
- SHA256 ef0e992edff15ec6b56c647bedc7c4d8792b1ec1e2d845daa87bb7ff4c2f95a7
- MD5 91e82abfb34fe6e2a299e39dea4a107c
- SHA1 a409343416a9b4e5bf71dd6b885c9b163e981519
- SHA512 6b7cbf5f4b36e76ba6e49713e34487a18c80a710f04d4877d82a6a08edacf285a725f59fdb6ec433ef6f9e46504baa7443ba438b96ea0f13aa8cfa930b43f476
- SSDEEP 768:Kss3J6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfWFVUe8BVYhIAAInmVLHPr:3kJ6ivyUcEsx7fNXjTV8PszW7yYsznPZ
- TLSH T12123BF1253FA4608F1F77B3968B612B56E36BC92F93CD29C12A0915D1CB2F918D60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/comctl32.dll.mui
- SHA256 98b2f080f7902ba4d6381af4aa8b17be0b3c3251f60936c271a8b84dda919a2d
- MD5 406af107391602421cf3780ea6d9dbd6
- SHA1 de578fba562c0d387ef903e49c6b9285192f9252
- SHA512 7ba0a63cdeb663b4cb19bb9fb6b0521e1bb8737f867f522de68e0f75bcc4dc80a9fd217ba1436b090053970c37ba3b0387b4f12d69a64cb340415c09a9f1ad9d
- SSDEEP 96:4FEPW9/VGpspQNQAeuXAvAe9B9cp7WVc5HWwa:BW9/VG+AqYy9c1WG5HWt
- TLSH T1AAC1992593FA4916F0F65B706EF707C12B7EBC537A36D31F8A40182E687125899A1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/quickassist.exe.mui
- SHA256 0a9d16a9b5e13073be43b8a7c9af44741504dfffbbecdff71acf95d49c5e8b9c
- MD5 1b16b855d07b73f88e55aacc241a052a
- SHA1 e8974a800f1de2625bb6f5f566b81e30290d8ea2
- SHA512 f11962a043e3e1dcbae0e7c7f2c0eff891c15a6a2216a1c3711b5b844d6c43a93f8a730a012a8097da565e08b279ac526357a5e3d81c7790671411bc8c909cb1
- TLSH T12381241567EB131AF0F60F706AF606D55ABDBC63B97AE22FCB00115C28B065894B0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/da-DK/windows.ui.xaml.dll.mui
- SHA256 7809cae31b043d4c187e2585faf612a4aa37d1122cdef2209fde61da4f6a21e3
- MD5 37b70f3f5584c05a0e7413ad926b0955
- SHA1 a4b42a7e3609eabf82b7a842aa6970e85e244cf5
- SHA512 f3a46fe896687ab2a702efc9f5d899cef0541ae3e93686a2d4363165f7b51c6c1d78799a68797f21f365f0ff56bb7fb3dbe07aeee1386d1f8d68679a9da4bc89
- SSDEEP 192:46X333NiSOI4o368TQRlrN6zKFnZIwkf1f7wubhV+4gfJ1cxqGUXaNSKJ3UQK56n:HHXxMLCNj+4UQoUKRwHuMgW54fWV
- TLSH T1BA724F61A3F9160EF2F35B743EF602901A7AFC97AE36D21E1240611E1CB1B95D9A0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dccw.exe.mun
- SHA256 533b4ad13eca4e00cb44f803616d8d14c1591b7bc76af35a2a17ed3a3695ff3e
- MD5 4f239710f677fb74a1ac8b3cd2d82e8d
- SHA1 d6b2756aa9144748efca13e4ff570725d5a8051a
- SHA512 907ae72f92e8b46e18ffa35b429cd913abd2ffd9effd47f8a733d4592c22cba5a9dab29863f8d70a730d169d4dfb3e3068a6de412561fe145e9fb78e5392a174
- SSDEEP 6144:cveN4prbprgzX/IgQImqgQrbAlsO2r3I7+t2DOzT0F/d1Y/lxdBDGGMAg:cGOhS/IzJqrraq/t2qXy6xdRhMA
- TLSH T1DCC4CF15BB55FD43E0DA12357CF3D319732BAEA5A2432686788C292B3F307411C69A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
548KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/APHostRes.dll.mui
- SHA256 990b23aef06d8cf1a1046b9d26185590ce75d2e6461dbacabe4bfef35de70d75
- MD5 c8f9cad2fc165e6f991bc719f48f7cf4
- SHA1 965adf32cb0cf9a3db99f604311745da06535731
- SHA512 e7d262aaab56c650448e41aff790da6db0dd19ee92e34bb725d1b019620697323861af8cf2387fbc140851c55530bdc3efcd235666fab6dc9ffd94627682ead0
- SSDEEP 96:21NKo19xPURuJMdkUNdZdj7aaST2i7841qe29M+2B/1PDMJHS0nVh4Ig+4glSQU6:gr2Rux87/DJ6xvn6AQJYgAO3WcfyC
- TLSH T1EA82BE2157EA0B1CF6F32B396E7522646F76BCD6E87DE54D2644A06C1CB1B008E60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/SyncRes.dll.mui
- SHA256 e08498ec9af650b8c91105d696721095436e886cc75adf46ff5879a23309b115
- MD5 42daee2b4878dada48e27bd428434247
- SHA1 23ac84c8405a4bae58306f4e62924f46477c8fe2
- SHA512 009d2412d4277de6ecff5be4a30ab1990786d3c977727dc0d1fd808d650b8bf5ce215634fc0f70a16651179c541f09fe18c416a27024215e4741480743a225da
- SSDEEP 384:ofuwpc7yecO2uxJdcT/GfIPsOsexbTTnPYuvWG5z:wuuc7yXO2uxjOQIPsOsexbTbPYkz
- TLSH T12AF2A71153E98A18F2F62F712DB913945F72BCD2BD7AE20E1750659D18B0B40EA78B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/cdosys.dll.mui
- SHA256 2c153084613ad5630a6749124a8334d57a89134eaecf7626895511d40baa2b7a
- MD5 7ad758f2fc351b745e5fc4a01ddd32ae
- SHA1 1d1c431d74e18db021c9ea32826152cb6f07cd86
- SHA512 5d1ddaac0151e43045922ec232fd3daecd67db1ac9e4481a129016b858750dd16be01d344fa9861fea1962cc18d6dbc676603a471676aecb29934bea596cc5fa
- SSDEEP 1536:wxTRmOivyUcEsx7fNXjTVBpszWiSDsznZMLmbjufzT5ajLklr452D2OmsF9+BVG8:WlmOivyUcEsx7fNXfVBpszWiSDsznZM4
- TLSH T1F033BC1253FA8708F2F37B3969B912656E72BDE2E938D29D12A0915C1CB1F41DD20B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
50KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/comctl32.dll.mui
- SHA256 16a35d91a991f6f4dbf998d6f476b660e4870e50d36ad99eef0bc21901e9fe55
- MD5 a82cb424906a24b4b8917c10891c886d
- SHA1 dd2deb06fa74dec818a91725bd6871852db86c1c
- SHA512 0d45b3e2ad6a9aa44712eb7c4706a4d4c0fbb514c429241739e34344c4d3797d3ef98bb0251b3a31b3a4ea29b6334fb4a89e8dc64bda5858445369929780660c
- SSDEEP 48:yc5t/0/E/CACoGJc/pkb1reWDipspAyHDp9KPpSavlXlKn+EBCBSrFqj5vqpZWXb:5D0iCIWDipspHDKblXl2lBZr0q3W0wAK
- TLSH T18CC1561597E6461AF0F66B7429B707906F37BCA1AF32D71F8A80559D6431B00ED21B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/quickassist.exe.mui
- SHA256 3597cd02481f01b29c9c26d7cb942ed1c75b2213e17e05bff5cf3a3cc29a0760
- MD5 bced057703e0f02b01ecf87cb67075ba
- SHA1 a87d2b32a2182e5f69642d733d6d56f45bb7ba97
- SHA512 7ac96d08a8781ef72dd9de7f8957d354a537621d3236c553997c16f2749e438b88318e43a877ad039ced24ba6b9314f0014fa27885c14da802f0096fc9a23317
- TLSH T18481580153FA0329F1F62FB12DF607515E7ABCA2BA76E21E4A00515D2C70711DE70B32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/de-DE/windows.ui.xaml.dll.mui
- SHA256 71749512116f92334d7d6ef0a2889e282bb59ac77de69a934bea526a9bb4f454
- MD5 1592d005fb72a1cd94d4cd92756a94ef
- SHA1 e51fb16f61f9fd42514c75d5d2e6777539234ddc
- SHA512 3b7e31dc03dbfc296c53e26dc6f277cb01081ba3d5259c7a10729a4fe3c1ad3d9913d26c0883493cbcc995126373a7df685df887d364f4f9e178999630804fe8
- SSDEEP 384:Cj0Cqr2ydPjvJh9rr15j7+43itI8O29iFVG/tmHuMmWJhb:CICqr20PrFrr15JitI8O29iFVGGBb
- TLSH T1F5826551A3E91618F2F35F747EB622946A37BCE36E32C21E1640605E5C71A84DDA0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dfrgui.exe.mun
- SHA256 5a1013f0c78c19610e9944e74388fc9986fe36cb1cbdcc612c862990d82d733b
- MD5 b735f582e683fe0503c30683fd92becb
- SHA1 4e1744ab7268c7a7812981c3d7267a19429197c4
- SHA512 c47c4eae47b4eb7bc4c53768dfb81c430a653c03b46a8309b0a940bddb3db2a14f1130039fd92e0ea9317bc70e6f8b30aad8e4e32285d5acdd577125e718b902
- SSDEEP 12288:O8Xo3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:OWo3/kRc4l6g6gtPbcHn7q
- TLSH T1E7A4DFC57780ED46C8681D30C993CFB50A357CB8EE005967B6E4BF5F3AB2182352666B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
461KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/directml.dll.mun
- SHA256 6ed2b5340500f8414df6a6f37a14f4bbe0231d3c2a4b3d04d1623837794fc9a8
- MD5 4c7e18973b7726d13b5db9d430bf1a36
- SHA1 c2daacee8ee90ac44d3a17565284a5029d506f4d
- SHA512 84bb8a3482209309d89fcbcf3000e13d6a9f64027af6416087ad7ea7571ec0d904d02b70288eecccab5bf97061723642f5344aa8144824b9c1a5751a7b5b1f87
- SSDEEP 98304:1Oto5MRkhlLYbi8LlP8NIPpdAxLS3BOX8:1pMmEmIPpdAxL288
- TLSH T1BC16237BC5CD4AF2E450CC32FC628A6513A795C9339052D037BB8ABDAD0A51F6B3611B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dmdskres.dll.mun
- SHA256 0682c161d31bb9a8684aeaa71b34c9e3e157ea50b32dea25ce7a09576ccf15a2
- MD5 24d0628d6d2b2eda54158959170e5ebc
- SHA1 499c758e28eeb01bb6c587abf08898d6fc19f1d3
- SHA512 fbefa7c996f46936e33e838e61810d91b81cc6fdbb2e915bc1d7bad5bc3a81bb333058d7e60aa95303df1d39b94a7895914e10d20caf0baf31a89e6689988bd4
- SSDEEP 6144:fEfbewt8iLnLRx96gWVoEmsV8khl9UPptWL24EeqSP9qYUg:M8ALpQKszhlq09qYT
- TLSH T1533571F93980D8A3DDD4CABDEE7EA6FC4A212C72DF9068076D427B0A64304DD2754C5A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll
- SHA256 05059c531aaf893747d0954fede004cf2c59d391f4c789ad71193a726d48f6e4
- MD5 e1d6fd44df4b887743d49ac13536ffa6
- SHA1 adf79250c01e1a656a7f96c4f66cded25864cbea
- SHA512 cd9c42ec340d4e523c08ffdeb9152d940a5fd29c40dc989e20f0ca9140d4e3d3bd841cb223985db4d728c89728d93de0558cd54a280d6483830882bec20a3c64
- SSDEEP 192:lcWphWqD1S8f4DBQABJtmIht6ArNc4qnajr7P1:6WphWqD1IDBRJtmIhQ4lrP1
- TLSH T1E6322BC687F85503FAA6BE702256C5933C3D67CA1E35816A049AF2992CD73D5DB00B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:31:81:90:26:60:aa:9e:e3:b0:29:7d:61:5c:32:8b:7e:ab:c6:fa:8d:ca:3d:83:98:85:e1:06:86:40:a9:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-heap-obsolete-l1-1-0.pdb
GlobalAlloc
GlobalFlags
GlobalFree
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
LocalAlloc
LocalFlags
LocalFree
LocalLock
LocalReAlloc
LocalSize
LocalUnlock
Name
.text
Size
1024B
Virtual Size
1002B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Core-Kernel32-Private-L1-1-0.dll
- SHA256 306b37aa39dfa79620ef4dca608c269b16ed11a91a6bdaa15a1f79be23d6c563
- MD5 c51796f3cad2e21d0ea1c9f58d7baa3e
- SHA1 45680a3eb45c7a5f56dd35a30eca627a6392c17f
- SHA512 98143a2ab9b05f9613d641750b4acfb2fe932de8779a3526aff03a4f821f3baad97a86d6063be641ddc89219a24434ebf0421995d4146f04b5fb3ee924290c56
- SSDEEP 192:yxUEtdfWphWMD1S8f4DBQABJt9vOV5uE7MqnajchS:+PWphWMD1IDBRJtRGuOMlAw
- TLSH T15E323BC2CBA49203F6BA7EB0539AD5437C3D27C6182046AA15D9F3D53C973C5EB04A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b4:64:d5:74:5d:d4:3f:ff:94:da:85:73:63:e4:37:6e:28:49:16:09:b9:38:b3:28:a6:3c:a9:76:92:91:72:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-Kernel32-Private-L1-1-0.pdb
BaseSetLastNTError
CheckElevation
CheckElevationEnabled
CompareCalendarDates
DosPathToSessionPathW
EnumerateLocalComputerNamesW
GetCalendarMonthsInYear
RegisterWaitForInputIdle
RemoveLocalAlternateComputerNameW
SetLocalPrimaryComputerNameW
Wow64EnableWow64FsRedirection
_lclose
_lcreat
_llseek
_lopen
_lread
_lwrite
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Core-Kernel32-Private-L1-1-1.dll
- SHA256 a6402d070fd3a0014ab124f5b8bd8df07b79301bf4afbd59aee8499738c276a7
- MD5 d932602a860574d73d9b179f7b2c57a1
- SHA1 5b4e74b852daa48a741b81de32a9163337fed186
- SHA512 dc14cc4611d275c26e34b60e440a6477a9ed223491a84bcbbc94fc3a4e95bfb8626fa7e4aea3f32881f1771e3adb52eea6e3a93c627f9158778d3c1bd0ae76db
- SSDEEP 192:eWphW4D1S8f4DBQABJt74W6ArNc4qnajr7P5:eWphW4D1IDBRJt8f4lrP5
- TLSH T13A223BD28BB85507FAA7BE302399D6533D3D67D61820815A0485F2A92C833C6DF0462F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:df:a1:05:be:24:ef:e4:24:3d:85:09:9b:dd:c9:44:42:16:86:7c:d8:df:2f:bb:e0:61:5a:3f:75:c7:7f:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-Kernel32-Private-L1-1-1.pdb
PrivCopyFileExW
Name
.text
Size
512B
Virtual Size
423B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-EventLog-Legacy-L1-1-0.dll
- SHA256 f59e0990ce98640211464cc1429526ab79e338e6e8709aceb3c3a75a1b712f99
- MD5 cc9b9eb0f961bac36dba07347628b84a
- SHA1 bd3cad212183a035e6878f856117fac9db385d0e
- SHA512 92c94ed313ba879c9d81ef3f7104925e6c78c98d4d4e61a26b03b0d9a728d98a020b012d25fab2f252287dbfee0df3b2281973d9b27d181b4e64f94123658f07
- SSDEEP 192:PQd3IiSFWphW2D1S8f4DBQABJtzhYL5M8xOSqnaj3yV:u0WphW2D1IDBRJtzhYiCTluV
- TLSH T17D320892CB685407FAA77E7003AAD5573D3D63CB1D20826A4486F6D92C933D2EF0476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:c4:c4:5f:06:d3:9f:06:49:28:54:35:2f:75:2e:db:42:a5:31:a2:28:b9:6b:f0:db:79:3d:2e:a2:15:8f:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-EventLog-Legacy-L1-1-0.pdb
DeregisterEventSource
GetEventLogInformation
RegisterEventSourceA
RegisterEventSourceW
ReportEventA
ReportEventW
Name
.text
Size
1024B
Virtual Size
706B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll
- SHA256 971557839e843888e0dca7e116259f0f3c331bc52ca13cfe50ca743c22865244
- MD5 949f5105db9cda071269068005e0e78b
- SHA1 1299f7a6784e5068e20c6b28882cac44f1ca9e8e
- SHA512 1fb8536c1bfe82aa3adb7255dae5fa0d833307e0cf2beba5840159927620a08a0dfe9bf1d858006fc0abcf3a760d0d13834557cbb80308864f003f9885d66c13
- SSDEEP 192:nI+GoVmoWphWA7D1S8f4DBQABJJb6AoAOT2XNfqnajVAilG83SSK:DWphWKD1IDBRJJb6dk9flx6QK
- TLSH T18D321AC28BF89447EAA67B701355EB43BC3C67DA1D204169046AF1A92C833D2DB04B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:1e:f8:9f:99:f8:69:2c:33:7d:57:1f:0c:63:1c:50:52:f9:79:95:f9:17:4c:c5:2b:d0:8a:bb:fc:e0:62:40
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:02:91:63:5c:c5:b4:59:b9:3c:00:00:00:00:01:02
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Eventing-ClassicProvider-L1-1-0.pdb
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceEvent
TraceMessage
TraceMessageVa
UnregisterTraceGuids
Name
.text
Size
1024B
Virtual Size
825B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Controller-L1-1-0.dll
- SHA256 b04da778ddeeed4e4c9e2884692208072eb4e71965ce282fac9f1d943612ee7d
- MD5 6605309e609f0b9034d0d935c9951f2a
- SHA1 38cc1259c5627879e8bfc49d84dfb6cae32da325
- SHA512 c2d15e8b02f0542485ecbd5b247421f526dd12e7e10a6924ffdb342cf2e047df8e402138c87b573d61f39a84b398a7f17de9943bda048c6988e02139fde14094
- SSDEEP 192:ADcpV/WphWfD1S8f4DBQABJtlcKQRW52fqnaj7zdcThR:ADcpV/WphWfD1IDBRJtljifl/zdcr
- TLSH T1D2322BC28BB45503FEEA7F305368DA533C3D67D62920829A045AF5992C833C5EF0576E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:d6:7e:be:23:02:d7:e9:51:2c:01:66:0b:41:31:37:00:a9:66:7f:4b:b7:0b:87:78:aa:ab:0c:07:21:cb:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Eventing-Controller-L1-1-0.pdb
ControlTraceW
EnableTraceEx2
EnumerateTraceGuidsEx
EventAccessControl
EventAccessQuery
EventAccessRemove
QueryAllTracesW
StartTraceW
StopTraceW
TraceQueryInformation
TraceSetInformation
Name
.text
Size
1024B
Virtual Size
951B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Legacy-L1-1-0.dll
- SHA256 4ebe19471e50b54e3d200890aee6b59ce9b2e9b97bcbf965199cf8341cdc2e6a
- MD5 f62c5d811514e80eeb0ca0d4e047aca8
- SHA1 718f8af4a9a61d6cacb4fa88e3292d3af74981e3
- SHA512 a10f846e791bc48a89af5c5cabbcbe47b3ee3be671cd4d298e65c2047aa1c5d643a83ff14cb3583f374cf531909063427f6283ca4ab1a6d8f37b2083add5c184
- SSDEEP 192:aOTeA3IWphWeD1S8f4DBQABJtGc67lqnajX8Qri:JTeA3IWphWeD1IDBRJtHolz8D
- TLSH T146321A8187A45543FEF67F7002A8DA577D3D6FCA1D20C25904A9E1A92C933D0EB00B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
32:87:45:c8:94:6a:65:43:d2:45:6e:83:ee:1f:38:30:e6:2c:c0:7d:84:42:5e:db:f7:21:c9:02:d0:61:ff:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8E9E-4BD0-2ED0,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:10:2f:dd:ee:dd:67:1a:cc:96:00:00:00:00:01:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Eventing-Legacy-L1-1-0.pdb
ControlTraceA
EnableTrace
EnableTraceEx
EnumerateTraceGuids
FlushTraceA
FlushTraceW
OpenTraceA
QueryAllTracesA
QueryTraceA
QueryTraceW
StartTraceA
StopTraceA
UpdateTraceA
UpdateTraceW
Name
.text
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Eventing-Provider-L1-1-0.dll
- SHA256 cf03057e32a0340708d8b6a626587d244af52b5ffa78e48355296e9610476ae7
- MD5 224db5bc72abf46a3578406a958aeb76
- SHA1 2fedab5840dcb6f84c3c932c3a19e00df6e5391d
- SHA512 5539cf6d07279825157688d1d2e4dee50c19fda61d022a00d93bb69bda061b385f2a7bcb0c788bd101a3f5b506d2ee371099fa7db25386e073455c8b36b324fb
- SSDEEP 192:R/k+sF1SGs/nWphWVD1S8f4DBQABJteYXknS4kOqnaj2NL7ymmDq:RM++CWphWVD1IDBRJteJlgPyDu
- TLSH T15C321A928B681407FAE67E305398DD473C3E67D72D21826A0499F66D2C933C6DF0076E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5f:57:78:fb:1e:be:7b:4a:b5:71:4e:65:39:a8:e3:45:d6:b2:d6:a9:c4:e3:bb:2a:bf:23:94:2c:8f:00:f9:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Eventing-Provider-L1-1-0.pdb
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEx
EventWriteString
EventWriteTransfer
Name
.text
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Security-Lsalookup-L2-1-0.dll
- SHA256 1f700edc722e4d950f4b54a4423da08dbcf81e421bed5548485065a150c0d21f
- MD5 91c349f12f8464d7cf10cf539cf71810
- SHA1 718cc86096946cc64f1fa16ba2affb4e30bd8506
- SHA512 6fcaf473b240af2ece3ca8ba57521532fe60a87dc4c4dfcb63cd88e3cc4da417ad97fd4547d32a52927ef9b244640a0813e70b58dc06687abf83b921d5456f5c
- SSDEEP 192:7WphWoD1S8f4DBQABJtMl5qAAqnaj/INN:7WphWoD1IDBRJtMSlDG
- TLSH T1B9322AC28BA85403FAA67F7012AAE9577C3D77C71D2086595099F6A92C837C1FF0066E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
28:bc:a6:a0:77:a1:ec:03:aa:41:52:3c:84:ac:3e:aa:86:45:bc:a0:18:f5:1d:70:ee:fd:5f:b4:82:30:bc:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-lsalookup-l2-1-0.pdb
LookupAccountNameW
LookupAccountSidW
LookupPrivilegeDisplayNameW
LookupPrivilegeNameW
LookupPrivilegeValueW
LsaEnumerateTrustedDomains
Name
.text
Size
1024B
Virtual Size
753B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-Security-Lsalookup-L2-1-1.dll
- SHA256 37f541ebbe9d54c20f811b63f056d5b1e1d927aa92c7a118a6d7c9b2f0d93557
- MD5 bf1b45d23c03f528245b44234892264d
- SHA1 faa191ed695bc32a621b904a5615ca6880cd8e9f
- SHA512 51b1799d31b2e5055176026740858f64319f3ea4fbf1ec8474e0507cd69e06b3b1125cb2377d5ec61d4a0177ff63994dd8c6b3d122105bd39761cff8cba9b7bb
- SSDEEP 192:AWphWsD1S8f4DBQABJttVv5uE7MqnajcRxL0:AWphWsD1IDBRJttVxuOMlA7Q
- TLSH T1ED221BC24B781543FBA63E701298D9973D3D67CB2920825E15D5F2992CC33C1EF00A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
32:0d:5b:09:44:7a:4b:44:c0:f0:1d:7f:d3:f4:b9:46:9d:48:be:85:6d:0d:e6:76:a5:c1:28:65:34:d6:d4:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-lsalookup-l2-1-1.pdb
LsaManageSidNameMapping
Name
.text
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-file-l2-1-0.dll
- SHA256 f8f32a9a8d8d2c367d32253d50f02144f56a3374110cb22c82a6223cdb0de266
- MD5 fbbf4919089436cad4d4a7a219f419da
- SHA1 4ec5f79b9cabbad5a12ae74be727603e545c6d1a
- SHA512 1485fc10000166dc1815624349b0954cf5d97222493d35876a521003dff09d86aa9aceb61c43ea050faeecf6af06da9639acf25e79a3ff4dc374062b6b1b7cb1
- SSDEEP 192:aWphWJD1S8f4DBQABJt+Qaw50884LfqnajJNNrk:aWphWJD1IDBRJtYuJllNNrk
- TLSH T1B4322AC18BA8A407F6A77E701399C5937D3E27C7195081AA0999F6A93C833D1DB047AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
27:ba:1e:81:98:40:e3:53:51:07:b3:d3:75:4c:2c:38:b2:58:aa:44:e2:59:67:30:68:c2:eb:85:a2:e6:6f:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l2-1-0.pdb
CopyFile2
CopyFileExW
CreateDirectoryExW
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
MoveFileExW
MoveFileWithProgressW
ReOpenFile
ReadDirectoryChangesW
ReplaceFileW
Name
.text
Size
1024B
Virtual Size
941B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-file-l2-1-1.dll
- SHA256 e04667f6aa9d0f7bbc6235018ab61c1bf98f7663af1bbfaed73ccd14b8719623
- MD5 0c859f6f10199a156fb9a139cf28507d
- SHA1 80d989285c7678c4118b7d09ec07e952048cc7d1
- SHA512 6d29dd9ecb9dd854e40bc78e407c3ed3e09c72b92e48c22ea3f80e68809413d2267e0ed517d5278c31b4192dfa651bae00903234b2c39015a3ad45d45c778ffe
- SSDEEP 192:UJZ8H5lWphWAkD1S8f4DBQABJJDy9blDJ5iqnajVss1xifZF:LWphWlD1IDBRJJe95DKlxT1xmZ
- TLSH T109221BC28BB84547EBA67E7003A9E5477C3D77C358208666049AF2A92C873C2DB0477E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:4e:40:a9:f2:2c:77:be:f8:59:5f:10:6c:01:d3:a7:9f:5b:a8:25:54:d8:69:8f:59:b9:3e:78:7b:b8:25:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ff:2f:9e:6b:05:11:d3:6b:97:00:00:00:00:00:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l2-1-1.pdb
OpenFileById
Name
.text
Size
512B
Virtual Size
405B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-localization-obsolete-l1-2-0.dll
- SHA256 8c05863aa0e05fb14d6ae26d26ef9bfded4ac10aab069615c10e7dc7dd8c2125
- MD5 c8181700e1fc42bea7b6c1a41509f09d
- SHA1 2a6aed8c7de2424e8334826f0517857ec688ebeb
- SHA512 0c9888fe6769b0d85a9dec2c8ff7b1b93533468306575b156ade4b2e6012eda7cd074f90ade238e284f9ff5b2a3f9c91bf853d72e233842eb3646eb3bdff91a5
- SSDEEP 192:mWFZa/BWWphWAcD1S8f4DBQABJJyMUqKqnajH2oWb5lP0kh:mWFZa/BWWphW5D1IDBRJJ35KlNqb0K
- TLSH T1A6324CC68BB88407E9A57E702369D6537C3D63CA1811816A04A7F7A92CC37D6EF0477E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
02:ed:d2:35:aa:df:fd:75:d4:f6:cf:67:93:5d:da:70:36:28:e3:46:64:d3:2f:8b:08:af:88:3e:1d:53:e5:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:00:20:f7:5c:93:56:d5:77:d0:00:00:00:00:01:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-localization-obsolete-l1-2-0.pdb
CompareStringA
EnumLanguageGroupLocalesW
EnumSystemLanguageGroupsW
EnumUILanguagesW
GetNumberFormatW
GetStringTypeA
GetSystemDefaultLocaleName
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
LCIDToLocaleName
Name
.text
Size
1024B
Virtual Size
1007B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-string-l2-1-0.dll
- SHA256 8cf87f6e7f846be89e7ddd5f27dbce496d8297873e656531f78f16d804482775
- MD5 00175361322b453b1e3ec3c5401c091a
- SHA1 476f92106ba1da1818beb624fe4416c5f757e6d2
- SHA512 a1ef761e28890231cef662dea63595de67ca810291e3205a8623be6156d3551676df8dee992c6bd935740f7abc44ddbd98183030de397c5951ba734add5890b8
- SSDEEP 192:XEORpt6WphWMD1S8f4DBQABJRb0884LfqnajJNxaRb:gWphWMD1IDBRJRvJllNxaRb
- TLSH T1DC320AC2C7B86003EEA37E701256E6D37C3E63DA2C54826504AAF5A52C933D5EB04B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:59:1e:8c:5e:3e:19:4f:89:6b:6b:3b:fc:29:3b:c8:c4:c8:56:41:d0:e8:61:48:48:e3:32:02:30:f8:5d:8a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-String-L2-1-0.pdb
CharLowerBuffW
CharLowerW
CharNextW
CharPrevW
CharUpperBuffW
CharUpperW
IsCharAlphaNumericW
IsCharAlphaW
IsCharLowerW
IsCharUpperW
Name
.text
Size
1024B
Virtual Size
794B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-string-obsolete-l1-1-0.dll
- SHA256 160fcaeb789e3b267781d242be8a3b61c150869958f160fd053b72342cfe2ac5
- MD5 5ec18d0b5eebcca550cbc1d15523596e
- SHA1 44deb0a38cdbc356863239f401fb3cf8720e9e39
- SHA512 10a9c48bbd50ca95ddce56c8a20cee04761fa112a7282075e1ef225983771a087a4a9bbccf04f391d7bd942580938fcb7cde68bb029499c1f198c410b0628832
- SSDEEP 192:KWphWaD1S8f4DBQABJtPS4kOqnaj2NLtZmP:KWphWaD1IDBRJtJlg5Zg
- TLSH T10F321AC28BB85602FAA67E701255D5833D3EA7C71D208569059AF2A92C933C6DF1076F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9b:43:c1:1a:b4:0b:51:35:c0:c8:88:c0:61:21:92:f4:3a:54:d4:4a:a7:b6:62:31:aa:e0:77:2e:ff:3e:ca:5a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-string-obsolete-l1-1-0.pdb
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
Name
.text
Size
1024B
Virtual Size
749B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-core-xstate-l2-1-0.dll
- SHA256 b40597f50fdb5cf6e557dc619f187f8830caaa34fdcdd1a65f85a19345f31b08
- MD5 bbbf3ec15c02d9be7fe945a2a88b49a1
- SHA1 5d5faf914c94dfb698bb38256d9e6eb6b78c187d
- SHA512 a817a486f8cea4c51d80b3df58951e2647ae2ab9cf22d04bc0f76135ba17c7566526b5be9375b5c1b055575950799432426ab26bc7d6ffc5f52ad16290658542
- SSDEEP 192:Gf5baWphWSD1S8f4DBQABJtEgQRW52fqnaj7zdCT49:Gf5baWphWSD1IDBRJtfifl/zdCs
- TLSH T119323B828BB46503FAAA7F700299DA833D3D63EA1D50C169459AF1692CD33C5EF0477E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
04:4c:83:b4:e8:0d:5d:2e:03:3c:4d:b1:57:ed:de:14:9c:4c:d6:9b:d3:11:85:31:12:e6:4f:80:3a:86:3d:51
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-xstate-l2-1-0.pdb
CopyContext
GetEnabledXStateFeatures
GetXStateFeaturesMask
InitializeContext
LocateXStateFeature
SetXStateFeaturesMask
Name
.text
Size
1024B
Virtual Size
714B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-devices-config-L1-1-0.dll
- SHA256 3b346f246e085bf8ea710191851e12a7eb23750dac5d01eaf38dc8915ebca4d4
- MD5 1431b7850ca2a977ad247940e7bc8371
- SHA1 696ceebc9ef566086ec216cf6e297e7e0afe1b6c
- SHA512 c208f0fea264b10d43a1c03b9916c8cb7fdfcba91e1cfa6a4306a9976ce13d7dde613ad263c497c1d6d0696ce1c5e72f2003cdc49eae53243616f58232df0c2c
- SSDEEP 384:kXPXamByV7eOlgOXDWphWVD1IDBRJRTHRolz8q:Ivc7eOlgOXygI1Pted
- TLSH T15942EA828758BA0BFAAA3F700186E973FD3767D99C3254AD0798A55578933C18F1432F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a5:73:9b:e6:23:19:ad:11:ab:db:9c:b0:81:e5:7a:ef:2d:30:1d:21:2e:8b:b8:86:26:28:a1:e8:ea:b2:bf:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8E9E-4BD0-2ED0,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:10:2f:dd:ee:dd:67:1a:cc:96:00:00:00:00:01:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-devices-config-L1-1-0.pdb
CM_Delete_Class_Key
CM_Delete_DevNode_Key
CM_Delete_Device_Interface_KeyW
CM_Disable_DevNode
CM_Enable_DevNode
CM_Get_Child
CM_Get_Class_PropertyW
CM_Get_Class_Property_Keys
CM_Get_Class_Registry_PropertyW
CM_Get_Depth
CM_Get_DevNode_PropertyW
CM_Get_DevNode_Property_Keys
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_Size
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_Property_KeysW
CM_Get_Parent
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_Class_KeyW
CM_Open_DevNode_Key
CM_Open_Device_Interface_KeyW
CM_Query_And_Remove_SubTreeW
CM_Register_Notification
CM_Set_Class_PropertyW
CM_Set_Class_Registry_PropertyW
CM_Set_DevNode_PropertyW
CM_Set_DevNode_Registry_PropertyW
CM_Set_Device_Interface_PropertyW
CM_Setup_DevNode
CM_Uninstall_DevNode
CM_Unregister_Notification
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-devices-config-L1-1-1.dll
- SHA256 0a8d514f1419a0b556c64ec5c493590bcebcc13367351fd32410ab4b79068d88
- MD5 8129e66e5b74b2b62f49f17fc85170bc
- SHA1 d9ead8888cc9e90b4b28d0a57dfeb62b19817c79
- SHA512 18953c2c772e2b83711edddd797d8c7d5cdbd519328bee0c072a5a9fb3544532c40130d6bd3b83a3e0712ad3724ae43a110ebb8ffd666b0e5d3fd53a510bd96c
- SSDEEP 384:XXPXamByV7eOlgLxX5WphWTD1IDBRJtflgTS2Q:nvc7eOlgVXk2I1PwrQ
- TLSH T1B742F9828B58B90AFAAA3E704145E433FD376BD9DC3254AD06A8A5056C933C18F1472F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bd:ec:d2:3b:40:6b:00:a2:dc:bb:4d:67:2f:20:8a:7d:b7:0d:24:ab:78:b8:b7:ee:8e:55:b3:85:43:d8:38:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-devices-config-L1-1-1.pdb
CM_Delete_Class_Key
CM_Delete_DevNode_Key
CM_Delete_Device_Interface_KeyW
CM_Disable_DevNode
CM_Enable_DevNode
CM_Get_Child
CM_Get_Class_PropertyW
CM_Get_Class_Property_Keys
CM_Get_Class_Registry_PropertyW
CM_Get_Depth
CM_Get_DevNode_PropertyW
CM_Get_DevNode_Property_Keys
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_Size
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_Property_KeysW
CM_Get_Parent
CM_Get_Sibling
CM_Locate_DevNodeW
CM_MapCrToWin32Err
CM_Open_Class_KeyW
CM_Open_DevNode_Key
CM_Open_Device_Interface_KeyW
CM_Query_And_Remove_SubTreeW
CM_Register_Notification
CM_Set_Class_PropertyW
CM_Set_Class_Registry_PropertyW
CM_Set_DevNode_PropertyW
CM_Set_DevNode_Registry_PropertyW
CM_Set_Device_Interface_PropertyW
CM_Setup_DevNode
CM_Uninstall_DevNode
CM_Unregister_Notification
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-security-lsapolicy-l1-1-0.dll
- SHA256 34b875fe7fa84a83a1e4c3ea22dd5a55048272aa70ca22922cf69433c55f7e18
- MD5 6fafab34c3dff69d596720189b998850
- SHA1 7d9f29c3a2f9ed25010f47d3bcbe989d651e1874
- SHA512 45f8ad0b85ddc131ff4d47a9217d618fb61c71cb8d2c6d035b7a782be8fe3247b043eb2ded931f6bbb11e7d938616f4f9b1be2721902b52cec68b2a08f938bda
- SSDEEP 192:G1ULWphW6D1S8f4DBQABJtV9L0884LfqnajJNMu79:HWphW6D1IDBRJtV9/JllNMu79
- TLSH T17A422BC397784042FBFA7E3452A5C6977C3D27CB2D50865A1496E3AD2C433D0EB0869E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:8c:fa:97:7a:11:db:33:77:67:8d:bb:59:44:5a:7e:7a:20:a1:14:b2:10:4c:c3:6f:20:33:a9:aa:84:78:9c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Security-LsaPolicy-L1-1-0.pdb
LsaAddAccountRights
LsaClose
LsaCreateSecret
LsaEnumerateAccountRights
LsaEnumerateAccountsWithUserRight
LsaFreeMemory
LsaICLookupNames
LsaICLookupNamesWithCreds
LsaICLookupSids
LsaICLookupSidsWithCreds
LsaLookupNames2
LsaLookupSids
LsaLookupSids2
LsaOpenPolicy
LsaOpenSecret
LsaQueryInformationPolicy
LsaQuerySecret
LsaRemoveAccountRights
LsaRetrievePrivateData
LsaSetInformationPolicy
LsaSetSecret
LsaStorePrivateData
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/API-MS-Win-security-provider-L1-1-0.dll
- SHA256 3e6859b1d470ce1db78b7d6f0b6852fb09db6aa2ffa4609037d459d57ade1f02
- MD5 ffc2f089dad0976973472a53f96957f7
- SHA1 0c9592732114131e68b4197e0bf21bfb428d1e4f
- SHA512 c7bfa5750ee6723f0ade96ebdc448916e50254c3ea6bd7a37992c3342c3cad99209bf94daa38dba537468aec84217a689d17d9c6dd5706e5624fd17d7c10f6da
- SSDEEP 192:qWphW9D1S8f4DBQABJt7VA7J5M8xOSqnaj3ynMX:qWphW9D1IDBRJt7e7MCTluMX
- TLSH T17E322A828B6C5503FAA67E3012A5D6573D3D23CA1C2182694996F2A83C973D5EF0476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1c:c7:81:ab:be:2b:92:f4:a8:f5:b0:ef:9d:85:37:f9:89:77:7b:5d:35:13:e2:e5:d1:f7:d2:7c:79:c2:0c:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-provider-l1-1-0.pdb
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
GetSecurityInfo
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
Name
.text
Size
1024B
Virtual Size
722B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-base-util-l1-1-0.dll
- SHA256 0cf818d4fff8ec7eb38fcf0de67cf6d1eb69ea6cb90fba92f8c51ba55cb6fbbf
- MD5 31d74cb87741c8aa9e81b2c4385bc80f
- SHA1 6f7c20d5411fde639ddffeea0fa9529c8348ef93
- SHA512 f0a5d09e0f0809bd78197fe3c5c64b9fc839f9b8c68ee250203e38337e3bcaaae8e7ec8c26cc4eac489b91eb6f9894e58f59365cbef9e3e4a64c71def7729dd2
- SSDEEP 192:oWphW4D1S8f4DBQABJdazD1usUDR0qnajVXj9PKY:oWphW4D1IDBRJdazD1uQlxzFKY
- TLSH T161223AC38BB84447EEA77E701265E653BD3D63C61920816D046BF2A92C873C5DF0466D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5b:38:d3:36:8a:b5:9f:7c:b3:35:15:3f:8b:18:56:54:7a:0c:4d:18:58:ec:be:8b:f3:7c:44:65:0f:41:50:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Base-Util-L1-1-0.pdb
IsTextUnicode
Name
.text
Size
512B
Virtual Size
407B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-com-l1-1-0.dll
- SHA256 eab8e5e7add074380a52227cbd6cc7f8e42b7026c90f587e7cc5287ea66a5ea3
- MD5 748d395c49e7c8b31306eba605b58b4a
- SHA1 5995ad1a715d383a24dbffafb6f42cb3c436f1cc
- SHA512 068270eea4939f603e19c54bcb65414704946b3cced4311c55a0337d24e4ae5b9966647c979d7f61cabbf892aeb09cc6f030662a73466275b83c6d06465965a2
- SSDEEP 192:8DRpog5hLYXTAdBEV5TlOX/SUf0WphWjD1S8f4DBQABJtsHjg0884LfqnajJNrgO:Q4XBOf0WphWjD1IDBRJtsDoJllN8PN8
- TLSH T161621AC2C6F4344EFDAA5BF00E60C7B36E7A16C5592184791841E3C939F73E19606B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:f7:61:20:51:e4:94:6d:cf:5e:a8:8b:26:43:22:ea:19:27:93:95:fe:06:d5:9d:22:9c:91:6a:ab:66:ed:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-com-l1-1-0.pdb
CLSIDFromProgID
CLSIDFromString
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetApartmentType
CoGetCallContext
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetObjectContext
CoGetPSClsid
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoRegisterClassObject
CoRegisterPSClsid
CoRegisterSurrogate
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRevertToSelf
CoRevokeClassObject
CoSetCancelObject
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnmarshalHresult
CoUnmarshalInterface
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateStreamOnHGlobal
FreePropVariantArray
GetHGlobalFromStream
IIDFromString
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
StringFromCLSID
StringFromGUID2
StringFromIID
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-comm-l1-1-0.dll
- SHA256 6fd90f40c01418319a9cff23e3284f093817149ea3f58dcb17f25e2d251bb5e9
- MD5 06410691570b83472f463bc9a1302607
- SHA1 111984e6e7a984b4c899dbde835d648289f29358
- SHA512 85a7f5dcbbbd2effd8172a164165b543c78cba782c55b10ba7b2978df2eaf3f2edfc2c9f6da14ae09060626e562d8f7063f8b3f08df2344282bdae8bcc765c0c
- SSDEEP 192:XXFGVWphWVWD1S8f4DBQABJRnfC85qAAqnaj/I+/z:YVWphWVWD1IDBRJRnfCFlDhr
- TLSH T175322B8187A85203F9A67E70139BD9933D3D67C61820416D15E9FB993CE73C5EB0462E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1c:23:34:5b:de:aa:8d:fa:80:09:bb:f5:d1:71:d3:33:3e:da:87:ad:e8:ed:45:36:6d:4a:8b:ea:67:a7:13:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-comm-l1-1-0.pdb
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
PurgeComm
SetCommBreak
SetCommConfig
SetCommMask
SetCommState
SetCommTimeouts
SetupComm
TransmitCommChar
WaitCommEvent
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-console-l1-1-0.dll
- SHA256 a32d4a8d635c5ae36de130be4b5f95fdf55ee0a66fdb0a8b7ab3e28e9acc6159
- MD5 81b6d00e8b1cdf89fb70a223a8882dc7
- SHA1 e6d39376a13441a25be7c281a2375d51a2bed191
- SHA512 f69bffb037fb00e0dd05d15dd463a3e0962a4fee1283fdbb880e14593cda77f5315461fae030a31b70d3e138529e1d5d0a7305ad9f9552ae34102194276561ce
- SSDEEP 192:lsWphWpD1S8f4DBQABJtIh6ArNc4qnajr7PGZ:mWphWpD1IDBRJtI04lrPc
- TLSH T143323B838FF85943FAA26E706699D5533C3D77C6192091192196F26D2CC33D6DF0472E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
73:5c:5e:98:b1:81:63:76:71:77:f0:dd:dc:e3:fb:f5:72:ae:8f:d8:bb:db:11:b3:b9:0c:62:4d:1e:8d:20:b9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-console-l1-1-0.pdb
AllocConsole
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
WriteConsoleW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-datetime-l1-1-0.dll
- SHA256 12b8212d1262e9110fbd13d8f5532d5acc0fdc4014a0a04c95e1c51a38413812
- MD5 fe19ff9ca6b04109f2eac1c79c58ca4c
- SHA1 35cc3164f3ad9618e4a53091f574748a9181ac7d
- SHA512 bf48f3b1db0f10841349718198ed7bf2d30c9ef82d0e51a0f091e65fcc59d4548f297b66b3beaec35df5e84344d9d606010d72c5f7f18224c0892cf26547ec28
- SSDEEP 192:c0WphWTD1S8f4DBQABJtsvc67lqnajX8Q8On2:c0WphWTD1IDBRJtskolz8n3
- TLSH T15B322B828BA81103FAA73F7002A9DD877D3D77DB2920816A0595F1952C837C5DF0476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:fe:8c:cc:ee:33:4f:90:ca:0e:0a:1d:4c:6e:72:ff:ef:25:08:e2:1f:3d:1c:e2:3b:3d:4f:65:d6:f5:bd:9f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8E9E-4BD0-2ED0,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:10:2f:dd:ee:dd:67:1a:cc:96:00:00:00:00:01:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-datetime-l1-1-0.pdb
GetDateFormatA
GetDateFormatW
GetTimeFormatA
GetTimeFormatW
Name
.text
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-datetime-l1-1-1.dll
- SHA256 c04e4b2196df660cf81bdf61b271ed71494d4f891037dab132c1a6a8925dcb83
- MD5 20a8f015cd1688313953840362f50d6c
- SHA1 055eccfd3a0dc0439b6d2f1611518288ed7f1f30
- SHA512 be48dabd56916059d69e96fbe1b6770761f5ec63c4adabeeae22d22ee7747b47a1ae9e0a5ad62fb379dca5e0f370b26da99aa1ae0321a2bcc495f207e88db92c
- SSDEEP 192:ua2SWphWiPD1S8f4DBQABJtezw5uE7Mqnajc9tF:NRWphWiPD1IDBRJtFuOMlAV
- TLSH T1C5221BC28B785503FAAA3F70129DD9933D3D67CB1920826E1895F2992C977C5DF04A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:e7:fc:1d:a4:76:76:a4:9c:15:48:eb:df:1c:d9:04:fe:58:fb:38:ad:31:9f:34:5b:71:14:55:c1:b1:78:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-datetime-l1-1-1.pdb
GetDateFormatEx
GetTimeFormatEx
Name
.text
Size
512B
Virtual Size
466B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-debug-l1-1-0.dll
- SHA256 53ed36c720072bc798cdbb0aab61d1dbda26f38e05412174a7f91ad6d0a2750b
- MD5 718e539edb5bdb3ec80548530c3aaf77
- SHA1 8f6ab19c006a0177fdc0e900fd1549acba3d14d0
- SHA512 d74638d30c628126b42e93a376e828b453f78364a8197ba86f63c4b80f31f405c7c9d8a07f99491199d6ce35a4fc6118f5ef17865aaf4a3a6cc39fa7227764f0
- SSDEEP 192:eWphWID1S8f4DBQABJdR51usUDR0qnajVXj9s9l:eWphWID1IDBRJdR51uQlxz2H
- TLSH T17D325CC24BB85543EAA7BE701369EA537C3CA3C61930856D046AF1A92C937D1EF04B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bf:ab:9f:2c:91:e2:4d:ee:de:a4:0e:da:0c:65:cd:72:1a:d0:0e:77:a3:72:b5:50:3c:4d:3f:88:68:63:de:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-debug-l1-1-0.pdb
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
Name
.text
Size
1024B
Virtual Size
571B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-debug-l1-1-1.dll
- SHA256 3e2c3e4c4f521a3072e1741017faac83b07121a6e038df490ca8160f6bd179d1
- MD5 ecaff8e19ceb7a31962d402cc45a3dac
- SHA1 9cc4d2e19a9092c1434a0b2cdd2ed170d9d23ad9
- SHA512 4053b4c3724b62c19efc513f01cfea43a68ad009f4afb9629c5b307bdf5606305ec7e83f9e33f12c8f1037c83d1c2529969047f6434f13e1e3aff763bc9b2e42
- SSDEEP 192:rzWphWlD1S8f4DBQABJty7RAUfd5qAAqnaj/In:fWphWlD1IDBRJty7RAUilDG
- TLSH T19B321C828BA85507F6F67E705399D9933C3D77C71D2085AA1499F6A82C833C5EF0066F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b4:ca:30:e7:78:be:b5:33:e7:83:9c:0a:cd:49:a5:82:5e:91:7d:23:aa:83:15:e6:e6:b9:43:6d:ac:e5:2e:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-debug-l1-1-1.pdb
CheckRemoteDebuggerPresent
ContinueDebugEvent
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
Name
.text
Size
1024B
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-delayload-l1-1-0.dll
- SHA256 7fd24a5eff1ea19b6163423a621887b3287b826940f87ca6b4d5a99f43a6c78d
- MD5 e4a997a788a2e02bce3068eedc524c7b
- SHA1 cd10f47ef4cdb267fa120f4806170f93fe23c341
- SHA512 4d9ac6033764a05fb37437a13e892e584cd2c6aa3407fb315edd2b36c5ba9bae2e7d30af38e31eaa133d87fc118ae04a621fd40b8e7d6c0656a625c005960ae6
- SSDEEP 192:SWphWmD1S8f4DBQABJtMP3St3pPqs7IwdY+kqnajHaqxgmQ:SWphWmD1IDBRJtjbzIwS+klTxs
- TLSH T108220AD18BB85407EAA67E705299D9573C3D63D72C20C16A0599F5AA3C833C6EF007AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:b6:cd:f5:45:df:ab:52:bd:9a:0f:83:ae:34:af:22:55:fc:01:9d:9c:3e:b9:77:0e:a3:09:f7:08:4a:f3:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-delayload-l1-1-0.pdb
DelayLoadFailureHook
Name
.text
Size
512B
Virtual Size
426B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-errorhandling-l1-1-0.dll
- SHA256 ae923983f39a7e993581aa11c27b6526b3b52fb04810f74f49c9d055cb2c6b49
- MD5 02f03f1de5a93b2caa52bfe55e9e0cfe
- SHA1 3ea12b75a0e7a17f06fc0a0d7012ced0a88225ed
- SHA512 ba9bd1c1fcc0542edc74076a73a71eee574a9362be3b31850e1d5eec1008f22b1ee75c6adbf23df2eb595d7c879cc211c4556eee808f2d156ae5559847eebd8c
- SSDEEP 192:zamxD3PWphWlD1S8f4DBQABJtD56ArNc4qnajr7PuY:zaUWphWlD1IDBRJt44lrPj
- TLSH T1D6321AC28BB85543FBA2BE702265D9833C3D77D6192085590599F6A52CC33C6DF00B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b1:9c:19:b1:27:40:6f:ec:2b:56:36:c5:70:15:74:74:e7:67:f8:a4:bd:09:ca:d1:23:ca:af:29:9e:e1:9c:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-errorhandling-l1-1-0.pdb
GetErrorMode
GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Name
.text
Size
1024B
Virtual Size
742B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-errorhandling-l1-1-1.dll
- SHA256 a0955d9c85331203168d28b3f6137a4a28fdd8ffde2ee2ee8d507aa5d3c9669a
- MD5 5c830c39113b2adb50ff42926239e055
- SHA1 2a6ed4a1af7ccceec8088698fc01a531825ab27f
- SHA512 d30d39ccb744869b4ccdcd612ce73a4d2b9549d9f02f23c1524930ca39993911c5be4bcc9b68e585e5b6be244f91652aa361805666d58fcd5cc1be739c550af1
- SSDEEP 192:5asAi9b1XWphW4D1S8f4DBQABJtBrcpeLirKqnaj/Xj:5/A4XWphW4D1IDBRJtbLIKlzXj
- TLSH T1B7321AC28BA86543F6A67E701396D9877C3D67C7592086AA049AF3A53C873C1DF0076E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e0:08:d7:a1:47:52:8c:aa:5b:6f:46:c1:b5:cc:2e:7c:d2:f9:ac:88:3e:f4:db:2b:0c:0a:62:d1:d2:e4:b0:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-errorhandling-l1-1-1.pdb
AddVectoredContinueHandler
AddVectoredExceptionHandler
RemoveVectoredContinueHandler
RemoveVectoredExceptionHandler
RestoreLastError
Name
.text
Size
1024B
Virtual Size
730B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-fibers-l1-1-0.dll
- SHA256 4bfcb89c131e44a767fafe4679aa70d81e2fa268f9b353c860413673c5de1e9d
- MD5 e753527497940ebe608f3ae3261ee819
- SHA1 1dda4b95ef8c271091da0195ac0f03e906cf360a
- SHA512 160bd81ab7756f497c9748b44333f49268f0f7ad741a3073109d759a6b8eb2ffc916a97130b5bbe7630a9d99bee0f5fd5aae024fe81237ba2bd01822062fd90b
- SSDEEP 192:YWphWoD1S8f4DBQABJtQMK5uE7MqnajcLu8K:YWphWoD1IDBRJtQNuOMlA67
- TLSH T1DA322BC18B785507F6A63F701299D9977D3D67CB182082AE1586F2993C873C5DF01E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
18:78:fe:64:04:90:9c:18:3a:c0:1c:aa:56:ff:22:1b:54:e3:c9:8c:24:ff:32:95:e6:2e:9e:f1:82:a8:c5:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-fibers-l1-1-0.pdb
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
Name
.text
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-fibers-l1-1-1.dll
- SHA256 97dec2b3631ac463b848fd5ced79d78a8203ca709d781b032fa93c2e76b04cde
- MD5 c49938b5d4a709984c8fa33bf2c18046
- SHA1 ddb4610044ad3d024fa565aa6c118a7e629b3410
- SHA512 745cd153934f26743aa0989b0e530d14f7800a169dad31a64c31829a1675dff6561982f754e7ec636501d6279bda34f6e6c5cf54ea10c5145eaba13aeb958e49
- SSDEEP 192:TWphWAD1S8f4DBQABJt1oy13pPqs7IwdY+kqnajHaqxgmyv:TWphWAD1IDBRJt1zzIwS+klTxM
- TLSH T183221BC28BB85403EAE67F701399D5573D3E67C71D30866A0495F1A92C873D5EF006AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ce:98:3d:c9:b3:07:4f:3b:f8:b4:71:53:f9:17:6e:44:1d:b1:9a:84:0f:24:a9:59:c9:28:5c:0c:e8:af:a0:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-fibers-l1-1-1.pdb
IsThreadAFiber
Name
.text
Size
512B
Virtual Size
411B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-1-0.dll
- SHA256 f0e9931f227bac406e262d97d98f256006b590589e3636cd260e1448352f3bce
- MD5 9ae760c9bfab73b0aae4d58d58e09bd7
- SHA1 31a43ffe38bfe22a393dcaedcc47ef4eb26b3527
- SHA512 2011cbe1b07d368348f8cacb7bb170010a100ca4bb35a9385122aca4f6e844d24931bd56abdd6f5622ab9e8fb5f805ebdf0cff8e46ad7656bbeacdb9f8e9003d
- SSDEEP 192:+CYYPvVX8rFTsFWphWFD1S8f4DBQABJt/0884LfqnajJN4EHXw:+C7PvVXXWphWFD1IDBRJtzJllN4EHA
- TLSH T1CF62E883CAB4F70BF99FAF711197C84368394386042141DA1BD597AD3CE7386E788A9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
26:4d:d4:34:e5:b5:09:da:57:80:60:5e:7b:35:65:12:92:7d:f7:bd:13:70:94:50:fc:c9:08:7e:d0:d1:33:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l1-1-0.pdb
CompareFileTime
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DefineDosDeviceW
DeleteFileA
DeleteFileW
DeleteVolumeMountPointW
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLogicalDriveStringsW
GetLogicalDrives
GetLongPathNameA
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-2-0.dll
- SHA256 20fd502d2e56efbd537997cd2304036ac01f33102b166c5e35a5908d616308f8
- MD5 0e39085e743fe241985d51dfe635a577
- SHA1 f9b07a021ec510adee3a2a6bdd41b670b479d355
- SHA512 63f8f7a77330279ea37418601d0068ce967bc2bcf90c6f682f21325cf8313195d6b5a205273466e968e1d2045f8c9a3a51f312640601608895d53e96613dc3a0
- SSDEEP 192:naH1WphWOD1S8f4DBQABJtu0hi6ArNc4qnajr7PA+v:C1WphWOD1IDBRJtu0h4lrPF
- TLSH T1E4321AC28B785547E7A67E7023A9D5933C3D63D6192081A91495F2A92CC77C5EF00B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f8:14:8b:c6:7e:5f:17:b5:b4:2e:cf:8b:f9:b3:10:c4:7d:95:26:28:39:a6:fd:df:61:ae:c3:a7:6c:31:58:ad
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l1-2-0.pdb
CreateFile2
GetTempPathW
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
Name
.text
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-file-l1-2-1.dll
- SHA256 20ecf17eb37be33eb93a2b414820e0c7b1f82759fda9c6fc464ef13944141b5f
- MD5 0593abe17094761b2b01acddecf2b57c
- SHA1 b23ef088211a9a1a75dd75dc3e7e5a3467360114
- SHA512 721595b202f29686956416d65e70cc493552b546e5788147f549e6d7ce6bef576300f40433fc72265ddcd2697f1b73912e60bed636492469c58aa59b89ca62c6
- SSDEEP 192:VutWphWSD1S8f4DBQABJtfu6ArNc4qnajr7PSJ+:VutWphWSD1IDBRJt/4lrPT
- TLSH T125323BC28BB85943FAA77E705369D9933C3D67C6192181690095F6A92CC73C6EF0066F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:95:f0:38:35:16:aa:73:2a:a2:32:3d:27:5e:ce:7b:d8:17:ac:80:a9:4a:31:41:e1:30:3a:34:a5:89:6d:9f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l1-2-1.pdb
GetCompressedFileSizeA
GetCompressedFileSizeW
SetFileIoOverlappedRange
Name
.text
Size
1024B
Virtual Size
559B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-handle-l1-1-0.dll
- SHA256 301ba3e34eb767202f9ccbfe532d394fba1f70d6a0e35506a093a2dfa51b235c
- MD5 7f691e0b6b1341133394608a0c9e00b0
- SHA1 4a7b2cd53baef409624e3a00ac9d34451494e30e
- SHA512 159425912514e21b13467e962667ee7b0af02d3d5fee5f2e6347c864b97ea8a41800a00ef45b4ccdf2126e521ed32e4a866fbdaa45dcf6518ea632771f7ed591
- SSDEEP 192:iWphWtD1S8f4DBQABJtzG5qAAqnaj/IwMh:iWphWtD1IDBRJtLlDbQ
- TLSH T1A63219C28B6C6007FAB77E301399DA937D3D67C61920859A1499F6A82C873C5EF0462E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:24:91:b4:2e:54:2c:38:23:02:b3:c1:03:78:f9:e3:46:21:68:e0:df:9d:a2:7f:f9:0e:2a:33:41:97:f6:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-handle-l1-1-0.pdb
CloseHandle
CompareObjectHandles
DuplicateHandle
GetHandleInformation
SetHandleInformation
Name
.text
Size
1024B
Virtual Size
639B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-heap-l1-1-0.dll
- SHA256 f77f70e79bdb238164fb25ad644798bd6526ad1aae82addaad4095a4b25bcb0d
- MD5 378b68e38537632fb3337b2cf38eb4e1
- SHA1 eef51e46f6370c83676ecd8c5cd214c753cd894b
- SHA512 20a7f54d3d0944ad7840556bbb4297dfdbef7b6f69a03c52d83730bc560b9975b8770e50cb3afef84e97940ca106d18767716f3623c3a4450f901d17611aa4ce
- SSDEEP 192:wLcl6WphWAMD1S8f4DBQABJJWGw4ZLqnajVxo+twmYq:wwl6WphWVD1IDBRJJWGw6lx2+tO
- TLSH T143322BC98BA85903FABA7F700399D5533D3D63C61820456908A9F2A93C837D2DF25B6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:7e:7e:5a:6f:ea:f9:5d:d2:37:6a:37:96:2b:a2:ee:08:2a:cf:fa:3c:46:36:6d:11:be:5c:33:82:b2:f6:d3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:04:09:01:75:08:58:87:2d:29:00:00:00:00:01:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-heap-l1-1-0.pdb
GetProcessHeap
GetProcessHeaps
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapSize
HeapSummary
HeapUnlock
HeapValidate
HeapWalk
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-interlocked-l1-1-0.dll
- SHA256 9ae7004f2870197c1fdaf8e6ad212b46a8a7fc2a6ddd7b507d8630e614ff25f8
- MD5 18ef1b9d7b4fe454c8c3d423408bfab8
- SHA1 5bec469e947de1190a152a746955d98e4ecb26bf
- SHA512 48796843039b8af13d942511c6444593a501b36dfe6f34a1e3b1f66b2f23f0bd6d47d092bcf06a6c09f77efeb04323391af003df37a6313295a74f81825d0be0
- SSDEEP 192:YXxDYsFYWphWL0D1S8f4DBQABJdLU1usUDR0qnajVXj9yelz:YXxDYsFYWphW4D1IDBRJdLU1uQlxzcet
- TLSH T19C323AC24BFC660BFAFA6E700665D6937C3D63C614204129066BE5AD2CCB7C5DB0476D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7e:1e:67:29:c1:5c:a6:dc:99:1d:3f:20:da:d1:df:99:c7:fe:b8:83:eb:47:9d:e3:f4:c6:ff:b9:1d:a0:e2:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-interlocked-l1-1-0.pdb
InitializeSListHead
InterlockedCompareExchange
InterlockedCompareExchange64
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedFlushSList
InterlockedIncrement
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedPushListSList
QueryDepthSList
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-io-l1-1-0.dll
- SHA256 89e8654827d32341ca8c66a96b11cd3b7dad2f6a38b2eacbd7c32338a6c963d4
- MD5 80f702953a95d7d7b03f60757cc93cdb
- SHA1 24c54d4e68543f7b6852f8053dce8cbdba860886
- SHA512 941154feb508f392ad4d5f3accd93791a5e2b270c7a214f44cb66dc1ce82f3a79a52bd8ea4c45778ed6c1a60f9ef4f21eeae04df7f22a5d3ebbde20f612794b1
- SSDEEP 192:5x9WphWID1S8f4DBQABJtalQRW52fqnaj7zd3TmW:JWphWID1IDBRJt4ifl/zd33
- TLSH T1A1324B8187B89503FEAB6F7013A9D5933D3D67C62961C16A0899F2952C833C5EF04B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:52:4a:36:e2:58:60:4c:ee:fb:6e:05:f0:f8:0c:66:2d:27:9a:4e:6c:32:5d:16:6e:db:c1:b3:cb:77:d3:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-io-l1-1-0.pdb
CancelIoEx
CreateIoCompletionPort
DeviceIoControl
GetOverlappedResult
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
Name
.text
Size
1024B
Virtual Size
793B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-io-l1-1-1.dll
- SHA256 71409e2fb217d160e3d11d43bceef7efb8a333ac6783136daaf5cbb4e6fc0806
- MD5 ec3fb657f85776a1aa666873221bccdc
- SHA1 55aadd14cabe1efa68f443e769bc1b4cefbba2cc
- SHA512 c6eeb49744098ac5a4a11aceeb890af72a2eef400e3cf8a5e642a514f551482e57b8b2f2f67deafb12f15313072792e2e2fd6c0584b4e7bcbf1a8cd4d8d23166
- SSDEEP 192:zWphWjD1S8f4DBQABJRcUSH56wQRW52fqnaj7zdM7Tn:zWphWjD1IDBRJR3m5Xifl/zdoj
- TLSH T1E7323BC18BBC5502FEA77F7012A9D9433D3D27C72860C1A91489F6A82C873C6EF0065E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a8:cf:c4:6a:21:a8:93:8f:8a:4e:41:fc:7c:0b:ae:08:c7:eb:43:ec:4f:21:10:56:1c:01:4c:66:b3:21:70:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-io-l1-1-1.pdb
CancelIo
CancelSynchronousIo
GetOverlappedResultEx
Name
.text
Size
1024B
Virtual Size
517B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-kernel32-legacy-l1-1-0.dll
- SHA256 626ee7c0ce460b7b4552ca2dad70626893c71eb1f98e824bf6d7bd4fd83e22fe
- MD5 3d23f6b15dd43fd78e9c3893aa159070
- SHA1 0f6b819ec6e48439a0812337f646c72efc4ba4a6
- SHA512 b88f8caa6539178823e8b318f919a067df73422423f178cd7ea1307df0541c23a8019b0ca1cfad15a621c06a0bcd16eb5876d63d928b4c70c1109cc563762717
- SSDEEP 192:E600YGQVMMNhoWphWa/D1S8f4DBQABJFN1MHpVwyqnajlAVy:EN0YG/WphWa/D1IDBRJFNCJvlmVy
- TLSH T12F521993CBA4B707F99EAAB0026AC1037C3953C71832D45556D6E3A93CE33C5D718A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:da:fb:31:47:c2:9f:3b:44:e8:d6:ba:2d:86:c9:54:03:ed:b1:d2:d6:90:27:f3:f9:8a:cf:34:09:f2:14:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-kernel32-legacy-l1-1-0.pdb
AddLocalAlternateComputerNameW
BackupRead
BackupWrite
BindIoCompletionCallback
CopyFileA
CopyFileW
CreateFileMappingA
CreateFileTransactedW
CreateMailslotA
CreateNamedPipeA
CreateSemaphoreW
DnsHostnameToComputerNameW
DosDateTimeToFileTime
FatalAppExitA
FatalAppExitW
FileTimeToDosDateTime
FindResourceA
FindResourceExA
FindResourceW
GetComputerNameA
GetComputerNameW
GetConsoleWindow
GetDurationFormatEx
GetMaximumProcessorGroupCount
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
GetShortPathNameA
GetStartupInfoA
GetStringTypeExA
GetSystemPowerStatus
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTapeParameters
GetTempPathA
GetThreadSelectorEntry
GlobalMemoryStatus
LoadLibraryA
LoadLibraryW
MoveFileA
MoveFileExA
MoveFileW
MulDiv
OpenFile
PulseEvent
RaiseFailFastException
RegisterWaitForSingleObject
SetConsoleTitleA
SetFileCompletionNotificationModes
SetHandleCount
SetMailslotInfo
SetVolumeLabelW
UnregisterWait
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-kernel32-legacy-l1-1-1.dll
- SHA256 f911c401f71878177c4aaca1d96253fe0030aa0b2f1a18594262639f529f38ee
- MD5 6418925674ebfea9e0be555e1fd157af
- SHA1 c942c7b48a783426a78ba9324e8f82898fb29174
- SHA512 9e06b286e6da89551b6564cfa2eec8b089595d5e1cdc56abd0ae8a99af8148e1e3b1dac35fe419e977887c9bf76249a0dbfa872687579ca6dbb8c828a954af24
- SSDEEP 192:PxYl/WphW3D1S8f4DBQABJFIapVwyqnajlAFtoaD:pOWphW3D1IDBRJFDvlmFtoaD
- TLSH T137323A928BB89643F6697E7012DAD5437C3E63C7183081B91599F6D92C933CADF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
40:61:50:a8:2c:0f:d8:6b:8b:b9:8f:68:86:33:83:c8:fb:bc:aa:51:ed:6f:96:fd:70:d2:bf:2c:68:8e:99:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-kernel32-legacy-l1-1-1.pdb
FindFirstVolumeMountPointW
FindNextVolumeMountPointW
FindVolumeMountPointClose
GetFileAttributesTransactedW
GetFirmwareType
GetNumaAvailableMemoryNodeEx
GetNumaNodeProcessorMask
GetNumaProcessorNodeEx
PowerClearRequest
PowerCreateRequest
PowerSetRequest
SetDllDirectoryW
SetThreadIdealProcessor
SetVolumeMountPointW
VerifyVersionInfoW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-libraryloader-l1-1-0.dll
- SHA256 5feb5f8e78f3b72b4e80f505d588967704c6e0636955483ddd1d2a13ef33a7a5
- MD5 4a4d91db29cca8aeb04adc93bbc57dc8
- SHA1 6c4f49e6cd8b62a907a73883c44da22e5bbd49d9
- SHA512 5a060c4411421ea6786e3b291046f3f942ea04e3fcef144de5821212694f06f20691112ca63a089f1b1932c7f98fa3da852a20f93b8b25103c8ca1ca5f7a76e0
- SSDEEP 192:fvuBL3B5LgWphWAD1S8f4DBQABJt7ept5qAAqnaj/I4E:fvuBL3BSWphWAD1IDBRJt7yqlDxE
- TLSH T1054209C2CB986502F5AABE305255D9873C3963C75921C9AE05DDE7A92CD33C1EF00A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:c7:d9:3f:8b:ae:31:cf:29:78:b0:cb:ba:11:94:6e:c5:14:0a:07:97:02:8a:64:e8:b1:d1:8c:c3:53:5b:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-libraryloader-l1-1-0.pdb
AddDllDirectory
DisableThreadLibraryCalls
FindResourceExW
FindStringOrdinal
FreeLibrary
FreeLibraryAndExitThread
FreeResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
LoadResource
LoadStringA
LoadStringW
LockResource
RemoveDllDirectory
SetDefaultDllDirectories
SizeofResource
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-libraryloader-l1-1-1.dll
- SHA256 55062f6d42becc036e5e7a5301ed40d0e517415f3966b73cfc721ee88e9dc9bf
- MD5 5547aaa8cf4e5fc2529831548643bd97
- SHA1 46e62ea37e1591a9c5783f4fb332287f1c737b75
- SHA512 c759d34dd3247c54736d88c07b0a3ff71a401f6391f22343566953a8741b5b4b183b38bf5a7107b21c48a8f28c2665bbd260d0f427c1bad7a863d32315ce90e4
- SSDEEP 192:0jbhWphWADD1S8f4DBQABJJVQm77T0q11qnajVtPxQv:AWphWGD1IDBRJJf7TplxbQ
- TLSH T1DC320AC247A85443FAA67F7013A9DA537C3CA3CA28705259459EF3D929C33D1AB00B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
27:48:1d:96:85:1e:09:1e:67:ce:b8:a2:89:d8:88:17:b0:1c:40:77:6c:87:5b:c5:3e:c4:9a:01:c9:e1:3f:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-libraryloader-l1-1-1.pdb
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceTypesExA
EnumResourceTypesExW
Name
.text
Size
1024B
Virtual Size
751B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-localization-l1-2-0.dll
- SHA256 bf85a20c2392e5a000c98b079ebae06aaa0b577f435ee4eb51e2818ca1cd7d31
- MD5 0158e025060528295e9df5c03502050e
- SHA1 3411cc152cba8516c267dc89e6cbeaf64e4414ee
- SHA512 d02e00452f89e8cbc1345a4d70d45310783ff1a3fec709d3ca84674fb363afb61a0d4e01f47eca9f5f14842dfb667338800e33d005937234d473164baa56816c
- SSDEEP 384:eHOMw3zdp3bwjGfue9/0jCRrndb9WphWXD1IDBRJtMgHJllNgui:wOMwBprwjGfue9/0jCRrndb4aI1PBvgH
- TLSH T119521B82C794E60BF95DEA703157D5437C3D638A0822859606E2EF6839E33C9E75436D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9f:45:ed:68:b7:b9:8d:90:5a:9e:d6:76:fd:a7:91:70:39:26:5b:a8:1b:bf:a0:05:b6:29:07:91:50:02:d9:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-localization-l1-2-0.pdb
ConvertDefaultLocale
EnumSystemGeoID
EnumSystemLocalesA
EnumSystemLocalesW
FindNLSString
FindNLSStringEx
FormatMessageA
FormatMessageW
GetACP
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetCalendarInfoW
GetFileMUIInfo
GetFileMUIPath
GetGeoInfoW
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetNLSVersion
GetNLSVersionEx
GetOEMCP
GetProcessPreferredUILanguages
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemPreferredUILanguages
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadUILanguage
GetUILanguageInfo
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetUserGeoID
GetUserPreferredUILanguages
IdnToAscii
IdnToUnicode
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
IsValidNLSVersion
LCMapStringA
LCMapStringEx
LCMapStringW
LocaleNameToLCID
ResolveLocaleName
SetCalendarInfoW
SetLocaleInfoW
SetProcessPreferredUILanguages
SetThreadLocale
SetThreadPreferredUILanguages
SetThreadUILanguage
SetUserGeoID
VerLanguageNameA
VerLanguageNameW
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-localization-l1-2-1.dll
- SHA256 074be9816f0f8607cda80c5d37a95822bc0142e67ca8a18dc74ddf3d2248b2f2
- MD5 3b9f18d1b1a3935cac47a77664676173
- SHA1 d0e89847dd11de1f0ca69e12dca249142db1d484
- SHA512 5c4650fab7e4ccf6e37569eb4f46fb52de0ba068d6afddc956fcb6c40d641b8b157c49d010c0797eba4f98d56148b2b8fed9da803111af01ed1a5c50289fe89a
- SSDEEP 192:6WphWjfD1S8f4DBQABJthc5M8xOSqnaj3ywfO:6WphWbD1IDBRJtnCTluwfO
- TLSH T14F223BC28B686403FAA67F3042A9D5977C3D73CB1C61866A0585F1AD2C837D5EF04B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:0f:8e:92:0d:2c:c0:47:fa:98:cf:af:c6:a7:86:b9:e9:b0:db:4c:87:91:49:bd:11:b0:71:bb:42:17:25:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-localization-l1-2-1.pdb
EnumSystemLocalesEx
Name
.text
Size
512B
Virtual Size
427B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-0.dll
- SHA256 186c2a5b27afa1ecbeead7254a7f965a222cbad1f365c7bc89bdb7bde343581f
- MD5 f2e43c0df143f232cda027af8f59fa1c
- SHA1 f0611cbe58974c566f19b030dcab661b1d565512
- SHA512 dc4dab375496c72e94be62f858cebd56f83850bb3c700c41e2ef111c96e6aa9417cc9d7b9fd8a3d8754ad9d09ecb8fb360ac538fd32904199ccd36c26355e2ec
- SSDEEP 192:CTKhWphWeD1S8f4DBQABJtcIDNQRW52fqnaj7zdZTU:NhWphWeD1IDBRJtDNifl/zdZA
- TLSH T18A322B854BB89903FAEA6E301395CA5B7D3E57C61C7085AA04B5F1562CC33D6DB00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:7d:f5:15:7a:d6:48:3a:b3:55:47:7b:97:49:f2:bc:e5:52:d2:fa:75:ea:9b:c2:fb:00:68:58:f5:26:b8:d3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-memory-l1-1-0.pdb
CreateFileMappingW
FlushViewOfFile
MapViewOfFile
MapViewOfFileEx
OpenFileMappingW
ReadProcessMemory
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WriteProcessMemory
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-1.dll
- SHA256 f0864f7c035cfd0db14c0e1e0fe34bd77a067a9c74bb85747501ae8748b69c4e
- MD5 9e8610a4b88376efb55cbc4c9a460985
- SHA1 06f83102e12da8dd6932fdc34d2dbc6ef7a45e0b
- SHA512 67f48d049eb9035f3265f6dba3bc14c006f63d92099fa34a3dfb271c2a68fd91522894585991a034419ec0e4d452c0300484e118df11ec09553ec4d393059cb9
- SSDEEP 192:WTRa69qWphWgD1S8f4DBQABJtecbQRW52fqnaj7zdxT+M:kRa69qWphWgD1IDBRJtrbifl/zdxCM
- TLSH T19B320B868BB89903FAEE6F301399CA473D3E17C61870C16A0596F6593CD33D9DB10A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9a:87:f7:79:4d:05:cf:fa:0b:f7:f6:81:12:e4:f7:f0:7a:ac:28:af:52:88:ab:cd:ba:ae:f2:84:55:fd:cc:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-memory-l1-1-1.pdb
CreateFileMappingFromApp
CreateFileMappingNumaW
CreateMemoryResourceNotification
GetLargePageMinimum
GetProcessWorkingSetSizeEx
GetSystemFileCacheSize
GetWriteWatch
MapViewOfFileFromApp
PrefetchVirtualMemory
QueryMemoryResourceNotification
ResetWriteWatch
SetProcessWorkingSetSizeEx
SetSystemFileCacheSize
UnmapViewOfFileEx
VirtualLock
VirtualUnlock
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-memory-l1-1-2.dll
- SHA256 f1dace18ee3ff0d28f7561bb4ccaa5d82ebb6589f84884650975836e6b767432
- MD5 6eb5e839da812686f4582871fe8d4165
- SHA1 b4f449860e844bb62298b28d5f66e3aa9abb05a3
- SHA512 46773cd3351abcfe371131a47e8d45e0f0fc3e0131961a4186b3f9d4488df509bc1c6d6ae49c6e6885aef9ebd87aed98fe11fa5b32411586bbc92bbe3efad265
- SSDEEP 192:I7W6oWphWLD1S8f4DBQABJFEqapVwyqnajlAqTALrPl:nWphWLD1IDBRJFEqwvlmOALzl
- TLSH T1D5323B8187785903F6E67E700399D5977C3E63CB1C30866914AAF6A62C933D5EF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f5:ab:c5:44:30:87:6c:e5:89:c1:d6:aa:17:ba:40:00:5c:e5:96:07:f4:37:48:d8:11:ab:79:79:94:37:05:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-memory-l1-1-2.pdb
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
DiscardVirtualMemory
FreeUserPhysicalPages
GetMemoryErrorHandlingCapabilities
MapUserPhysicalPages
OfferVirtualMemory
ReclaimVirtualMemory
RegisterBadMemoryNotification
UnregisterBadMemoryNotification
VirtualAllocExNuma
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-namedpipe-l1-1-0.dll
- SHA256 0711219faefdea843a1236e575dfe370d94780789b3690afa40e78293884b3ba
- MD5 21566e1ada1296025d7e5f63234d35de
- SHA1 dda0a54f5ace23dc5bee913dabb9bfa5944c20dd
- SHA512 d509b4a194d34a705056543b5e95e3c8588ee917d16e628f5b2d5b5ae1b7ac4c1670746f4aa30dc77d540f19d35abc628d804999233f532ffd728c1e8d7bf8fa
- SSDEEP 192:3WphWAID1S8f4DBQABJJEiL7T0q11qnajVtPx:3WphWBD1IDBRJJEiL7Tplxb
- TLSH T105323CC547689983EAAB7FB003E9D9437C3DA3CE18208155159AFAD92CC33D1DB2476D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a9:c7:62:b2:1d:90:3b:09:7b:11:77:b5:0d:ac:92:2f:80:c6:8f:df:08:80:4c:f3:a7:88:34:4c:c3:81:11:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-namedpipe-l1-1-0.pdb
ConnectNamedPipe
CreateNamedPipeW
CreatePipe
DisconnectNamedPipe
GetNamedPipeClientComputerNameW
ImpersonateNamedPipeClient
PeekNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
Name
.text
Size
1024B
Virtual Size
949B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-privateprofile-l1-1-0.dll
- SHA256 8fd42479e0c1f1bb41f1950132d323ccf10e7e0d1f9602da5546665489ca3305
- MD5 9f8d6297cf90b48bd35f85b022461396
- SHA1 a7c74ad1ec74ddcbcb1cd77e3704cdc94996e9cf
- SHA512 1665047a5d322d3752b2e91a0217bfff45deb508f72f91baeeb4ade56963c7068607ea4e63e870c2dcfa0305a7384c83623acd31d55704da030099df16e68a26
- SSDEEP 192:htNfWphWaD1S8f4DBQABJdR1usUDR0qnajVXj9P:htNWphWaD1IDBRJdR1uQlxz5
- TLSH T1AF3228C347E89443EABABF70A216D6637D3D63C909308558016AF29D2D933C9DB8973D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:56:83:a3:5e:0c:4e:73:8c:9b:60:14:55:9a:95:7f:2e:a2:56:20:08:5e:97:26:8e:bd:e7:cf:8c:fd:64:6f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-PrivateProfile-L1-1-0.pdb
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProfileIntA
GetProfileIntW
GetProfileSectionA
GetProfileSectionW
GetProfileStringA
GetProfileStringW
WritePrivateProfileSectionA
WritePrivateProfileStringA
WritePrivateProfileStringW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-privateprofile-l1-1-1.dll
- SHA256 3936826d95f8f15b02dc6ce303047884db3b7fe55e9aad1e30d5977fd6cbac5f
- MD5 32ec6fd28416d4c7df444d1989f848c3
- SHA1 7f4ff12c61aee6ee4d4a452df209df261c74b699
- SHA512 5ad5b6e4c957ccab3466ed89f0b0fcbcc70083e7e835ef85de6d5d76dc455ba42e08cd848328a54bd57ea97d14cbfce3b5afa2053f01ebe402f0d4bf38d8e3c7
- SSDEEP 192:uaSWphWuD1S8f4DBQABJt9s0884LfqnajJNtJIxL:NSWphWuD1IDBRJt90JllNP4L
- TLSH T169322AC28B686403FAA67F305399D6937C3E23DB2D6085A60495F6E92C933C5DF0475E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a5:06:8e:ae:f6:be:b4:6f:55:63:49:db:c0:df:28:71:7b:9d:88:06:fa:06:1f:4c:4d:68:ec:d7:10:e5:f5:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-privateprofile-l1-1-1.pdb
GetPrivateProfileSectionA
WritePrivateProfileSectionW
Name
.text
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processenvironment-l1-1-0.dll
- SHA256 94db9f63501074b46a488d133784dc057f438b6ff57327dd10227101737a15a1
- MD5 26e6b45be5422947f9b5e6db9355f676
- SHA1 8ea82bf6df62bc583367fe6b689da4c48da8ed0b
- SHA512 f43b43f6dcfb5d97d71954cd532a5b505d179aa2157e1d10b742e2db8795b35ca2e3f10c5ad3d5b853f799338e02c145b0f1c517667ba02aa098d2af2626e089
- SSDEEP 192:0Z7WphWjD1S8f4DBQABJtzAq3pPqs7IwdY+kqnajHaqxgmr:0Z7WphWjD1IDBRJtM4zIwS+klTxv
- TLSH T1AA4219C28AB86106FA967E30029AE5673C3D53E72C2080B91595E7693CD7392EF0079F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:f7:5b:2a:be:aa:49:76:53:cb:d1:fe:ae:c2:55:65:81:3a:f7:4e:1c:dd:da:92:83:12:b4:c8:7d:9c:3a:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processenvironment-l1-1-0.pdb
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStdHandle
SearchPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetStdHandleEx
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processenvironment-l1-2-0.dll
- SHA256 b2e533058eca456500c1dba9f313f88a4f983838219f2bdd5c882844b2f39041
- MD5 724535871bba7e8d882cd386451dcb58
- SHA1 e1bcbd0c914840d672aac5bdec76308e3b569f75
- SHA512 037b1f6d6a06a1c4b8f83d650986e61dc64570449ba4f037bf3522a76b58f09182b08748f246c0a18ee56a723e738d2864deb4a82bee34ceed8810075bcfb6b0
- SSDEEP 192:CJWphWAqLD1S8f4DBQABJJSJLKqnajH2oWb5lP0kBW:aWphWzD1IDBRJJSRKlNqb0s
- TLSH T18C321BC18BBC4543EA967B705368E9537C3DA3C62911826A0566F2A92CC77C2DF0477E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dd:32:fd:1c:0a:fd:4e:1b:30:b7:87:41:9f:38:a2:a0:b7:20:dc:d3:35:e0:35:26:4a:c0:6a:b9:f3:d6:8a:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:00:20:f7:5c:93:56:d5:77:d0:00:00:00:00:01:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processenvironment-l1-2-0.pdb
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
SearchPathA
Name
.text
Size
1024B
Virtual Size
599B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-0.dll
- SHA256 9f9921dcb4b4e2fa90f610d76ad9c12cd8bdcdbb740c5e7962dff2b899a351f9
- MD5 b10132f3c160ef8195e6ef37474768b0
- SHA1 2f22b76016c88ed7ec3bb31ecf771de2aedde29f
- SHA512 9ab24c3a3f199777fe32aa027016c5b4d850615a2476dcb59a52ec66a75ba79b34d1f6138cbbd096f76d3c157b3cecf009438cdb1f22974a495e7d1d3935eee8
- SSDEEP 192:VhHk1Jzb9cKcIpWphWfD1S8f4DBQABJRdJ5qAAqnaj/IQc:3Hk1JzBcKcIpWphWfD1IDBRJRd2lDA
- TLSH T1D4521AD58AAC9283F899A9303246E9533D3B93850D36817506D9F3E93EEB3C2D71413D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:79:9a:ed:f0:7f:45:a0:c8:d5:d8:72:bc:17:e9:48:66:79:56:dc:40:31:89:d4:fe:67:86:0b:9a:5b:1f:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processthreads-l1-1-0.pdb
CreateProcessA
CreateProcessAsUserW
CreateProcessW
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
DeleteProcThreadAttributeList
ExitProcess
ExitThread
FlushProcessWriteBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetPriorityClass
GetProcessId
GetProcessIdOfThread
GetProcessTimes
GetProcessVersion
GetStartupInfoW
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
InitializeProcThreadAttributeList
OpenProcessToken
OpenThread
OpenThreadToken
ProcessIdToSessionId
QueryProcessAffinityUpdateMode
QueueUserAPC
ResumeThread
SetPriorityClass
SetProcessAffinityUpdateMode
SetProcessShutdownParameters
SetThreadPriority
SetThreadPriorityBoost
SetThreadStackGuarantee
SetThreadToken
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UpdateProcThreadAttribute
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-1.dll
- SHA256 59f5310f1a43676a7e0427692b8276b52c54c9d430a305638e0bd890c97b27cb
- MD5 99f9fd9030d9f30628ca1fe6ac20803f
- SHA1 54f3491474f14e580daa32aa159c40a2ace037a6
- SHA512 f1e019fe59a1a621b8d2d45c4539ef7e649e23db03e72cb6a3e6283eff973fab389d900225272ca3419a87a8a71fe506f7e2fe8b8ac1f133cb0175d951d4c096
- SSDEEP 192:l/DiDfIeBWphW7D1S8f4DBQABJtJQQRW52fqnaj7zdoTX:oDfIeBWphW7D1IDBRJtGifl/zdor
- TLSH T142322AC18BBC5142FAEA6F70629AD9433D3E67C6193180790495F2A92CD73C2DB0476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
36:64:6a:a2:88:c9:c1:e9:d7:df:94:a3:bc:17:1f:82:13:10:74:01:6d:bc:33:e9:fb:14:03:41:bb:10:6c:38
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processthreads-l1-1-1.pdb
FlushInstructionCache
GetCurrentProcessorNumber
GetCurrentProcessorNumberEx
GetCurrentThreadStackLimits
GetProcessHandleCount
GetProcessMitigationPolicy
GetThreadContext
GetThreadIdealProcessorEx
GetThreadTimes
IsProcessorFeaturePresent
OpenProcess
SetProcessMitigationPolicy
SetThreadContext
SetThreadIdealProcessorEx
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processthreads-l1-1-2.dll
- SHA256 fa13f5197089bb2c858b36cef7a8d8b6dda5fe6440cbbd5146e051cc76c8a54e
- MD5 772565fe014dd88cca23aae72d2d63ad
- SHA1 c17059891667c24ab1515397936a1cd5a0f6c9fb
- SHA512 9aa26bd7fe4282242ea605480a47318e24e7eb64408960d8c114ecafa5b6da30064af9019f545777d8c3cca148493a41fa10b0aa193df6db9064129755f40023
- SSDEEP 192:vqH5bXlWphWjD1S8f4DBQABJtupqrS4kOqnaj2NLehmfZ:c5bXlWphWjD1IDBRJtupqFlgyAZ
- TLSH T1BE3218C2CBB89507F6E67EB02299D9837D3E67C61C30816514D9F2A92C873C5EF0466E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:af:57:cd:91:89:56:98:a4:5b:29:a0:66:ba:52:8c:8d:bd:54:cd:60:fb:a0:4d:4f:c7:a2:9a:20:09:43:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processthreads-l1-1-2.pdb
GetProcessPriorityBoost
GetSystemTimes
GetThreadIOPendingFlag
GetThreadInformation
IsProcessCritical
QueryProtectedPolicy
SetProcessPriorityBoost
SetProtectedPolicy
SetThreadInformation
Name
.text
Size
1024B
Virtual Size
913B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-processtopology-obsolete-l1-1-0.dll
- SHA256 f89bc4c480ba0dfb97613480bc6280202d21a4c33d8c79b7c3657ee15662b8aa
- MD5 7afa65849998efdc9a2ed79b319f89b7
- SHA1 62381d78b6ffec1b3e70c99f8445fafc993582e8
- SHA512 a1b295ab7b6286b48a212309cf98a44578c97711854ddb40ecaf9306d8ba4d323cee1ff786a9b51add8afb589e1a82e5b5f06213b7a12e8ed9039a42e8529e74
- SSDEEP 192:A5fIT1WphWLD1S8f4DBQABJtq0884LfqnajJNBVcSS:A5fIT1WphWLD1IDBRJtSJllNBVcV
- TLSH T197324AC28B785007EAE67E701399D9937C3E27CA2D3182B90495E6A92C933C5DF0466E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:8d:15:cc:57:5c:e1:61:e0:00:fd:b7:f8:87:fc:46:a7:4a:3b:67:60:e0:c1:57:ba:f4:bf:d5:b3:37:0b:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-ProcessTopology-Obsolete-L1-1-0.pdb
GetActiveProcessorCount
GetProcessAffinityMask
GetProcessIoCounters
SetProcessAffinityMask
SetThreadAffinityMask
Name
.text
Size
1024B
Virtual Size
717B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-profile-l1-1-0.dll
- SHA256 45637c5be03debcfbd1e6f0e4cd0d8875f1096b53ecc928ab1791f8cfc11a647
- MD5 88ad9bae3c07b21ba7d8482e095bf348
- SHA1 e59b1f8a7ba6faf191a0931453490d30dc7d8fd0
- SHA512 455f6ed010164744f49611d6c913807c31b901231f3d6c1988e521e3c80f325f4c9e0cdec163409c9fb7693e091d442ca9a3dba9a09ccc96862ea62745b11bda
- SSDEEP 192:FBfaYWphWsD1S8f4DBQABJt/Gd5M8xOSqnaj3ya:DCYWphWsD1IDBRJtu4CTlua
- TLSH T1B92229C2CB685507FAA6BE3092A5D5937C3D73C71D60826A1496F69C2C833C5EF04B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
28:c5:47:ee:23:48:60:3a:37:1e:83:c0:e4:cf:a9:01:16:79:80:5a:67:fc:f0:05:bf:76:98:16:cd:ca:e0:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-profile-l1-1-0.pdb
QueryPerformanceCounter
QueryPerformanceFrequency
Name
.text
Size
512B
Virtual Size
501B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-realtime-l1-1-0.dll
- SHA256 3ef3329e6c7560f2b4c591ab372f7f69292164c5ee2f2dea51ece843b22c09e8
- MD5 581779b9812e301268cd3f8fcd26e897
- SHA1 8246b09811b15f889a63a1c596f2905371a69b2a
- SHA512 6180e1d2220f77982d0288ad6d91d5a36aa3d5c329271359e0254fbf724d07632c0ab131f7f7e7403de38bbfffd3b5e1d24f9cd6dd94ec71c7b9faeb6760dcf8
- SSDEEP 192:iZVWphWwD1S8f4DBQABJtuBb0Bhr3pPqs7IwdY+kqnajHaqxgmg:iZVWphWwD1IDBRJtEchJzIwS+klTxM
- TLSH T1D1322AC28BB85443E9B67F7052A5D6533C3D77C7287482791496F2AA2C833D5EF00A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:a3:47:16:cb:88:f5:fc:07:06:9c:1b:15:69:39:1c:c9:ee:17:5d:8d:f6:9e:39:6c:6d:1c:0b:2a:04:76:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-realtime-l1-1-0.pdb
QueryIdleProcessorCycleTime
QueryIdleProcessorCycleTimeEx
QueryProcessCycleTime
QueryThreadCycleTime
QueryUnbiasedInterruptTime
Name
.text
Size
1024B
Virtual Size
735B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-registry-l1-1-0.dll
- SHA256 4fe5f2be8dba04fe9f2abcc4bd5a57b8344462e1d34e6c620eea07f27c790c5a
- MD5 6a7624f0d0e1e271a6cdccad52c7d941
- SHA1 a37def967f42b353f85856dbd6c7e86fdcbcaf44
- SHA512 2a0d8fcf434ac4c56091c5e7be71eb08ae1d219b1805189b30c216c2e5f813b53cfc7f9892280a32ef79cada3dd939068f3ff9cc59b3872771e216dd2bc2617a
- SSDEEP 192:i3lxG9MSCdWphWDD1S8f4DBQABJtFWTd5M8xOSqnaj3yg2:i3n2MSCdWphWDD1IDBRJtF3CTluF
- TLSH T13542E88BEB680427E9EA3D7141A4C2AB3D3A2FCD0C10C79B4555F1982C627D29B1C6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:96:f1:b2:2e:a5:9f:a4:0d:01:11:39:fe:a2:67:c4:fd:ab:8d:59:8d:5c:e6:2c:00:83:08:9c:9b:ce:22:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-registry-l1-1-0.pdb
RegCloseKey
RegCopyTreeW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteTreeA
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegDisablePredefinedCacheEx
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegGetKeySecurity
RegGetValueA
RegGetValueW
RegLoadAppKeyA
RegLoadAppKeyW
RegLoadKeyA
RegLoadKeyW
RegLoadMUIStringA
RegLoadMUIStringW
RegNotifyChangeKeyValue
RegOpenCurrentUser
RegOpenKeyExA
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegRestoreKeyA
RegRestoreKeyW
RegSaveKeyExA
RegSaveKeyExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RegUnLoadKeyA
RegUnLoadKeyW
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-registry-l2-1-0.dll
- SHA256 5ce56f2c615ceead1f3050cc8fc12176709ca29c55fed0beeeb455d70ac6dfb2
- MD5 0f1a244e3c31bd2376ca313d3dab2c1e
- SHA1 55e12638def2e6fb2d877fbf2d2bd47e483c588c
- SHA512 abfc9c7ea481a60af126315db1bc3859d3f20c8cd6680828491b83dbbd299f71d5bc213c0691ed9d26bac9d90d14a44fcb28112e2b9b9e18a14f5fafc696fc3c
- SSDEEP 384:G4hxGM0sJx3SWphWBD1IDBRJtGLIKlzIM:phxGM0sJx3dkI1PMLGM
- TLSH T131424C8BAA744013FAE62D705194C6AB3D3B1FCD0C1082AB456AF1942D977C6DB2C56D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
91:9b:95:04:68:a9:08:a0:52:20:e1:e5:4a:ef:3c:43:1f:f2:72:83:8b:69:45:53:7d:b4:f5:3b:3f:2f:c5:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-registry-l2-1-0.pdb
RegConnectRegistryA
RegConnectRegistryW
RegCopyTreeA
RegCreateKeyA
RegCreateKeyTransactedA
RegCreateKeyTransactedW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyTransactedA
RegDeleteKeyTransactedW
RegDeleteKeyValueA
RegDeleteKeyValueW
RegDeleteKeyW
RegDisablePredefinedCache
RegEnumKeyA
RegEnumKeyW
RegOpenKeyA
RegOpenKeyTransactedA
RegOpenKeyTransactedW
RegOpenKeyW
RegOverridePredefKey
RegQueryMultipleValuesA
RegQueryMultipleValuesW
RegQueryValueA
RegQueryValueW
RegReplaceKeyA
RegReplaceKeyW
RegSaveKeyA
RegSaveKeyW
RegSetKeyValueA
RegSetKeyValueW
RegSetValueA
RegSetValueW
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-rtlsupport-l1-1-0.dll
- SHA256 dcddf6d1282a5967073aa702a2768ef1ddd7d44cf1f18f0bf5e463dd2892163b
- MD5 c85cea0c79264aa4aa35bda4e67fdf6d
- SHA1 74483957e33e7b683b9584a8cb65f0bf950fdfd3
- SHA512 181d1eaa5b167c385de9e57a9300b33a531f2c567ccb665de54818087df0fb46eddc1c071d802c39de78f29bfea68de1fa30dd771f7417b8760b0ae489a20b0b
- SSDEEP 192:yG9WphWkD1S8f4DBQABJtr0e35M8xOSqnaj3yr3:yG9WphWkD1IDBRJtr0emCTluz
- TLSH T141322BC28B786903FAA67E3013A5D5937D3D77C71960866A0495F2AC2C973D1EF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
06:7e:c8:27:24:d3:8e:8c:04:fe:c3:9e:ae:ba:54:0c:dd:df:10:91:57:bf:2e:bb:98:f5:bc:7b:5f:3b:3a:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:13:b3:70:87:3d:fa:f0:c8:24:00:00:00:00:01:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-rtlsupport-l1-1-0.pdb
RtlCaptureContext
RtlCaptureStackBackTrace
RtlUnwind
Name
.text
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-shlwapi-legacy-l1-1-0.dll
- SHA256 1f02c12857964b730718d577d4af25448ec12909aa2cb9855e1f166d1e850186
- MD5 7063382666d5c98a49b9b8fd2d5e95c7
- SHA1 3a75db483d9febb10027df91ceda415a7009ec32
- SHA512 8dfbd6fb38bcb19c82a2cb17adac4f5d6de281a04c19e35e3d9e1de9a37b49d9650527d45200dcabee5bd06d98480d95c33d18e2c8603f40059dfc2a38d86d8d
- SSDEEP 384:o7cDsr6qI8CJ5nPWphWJD1IDBRJJDt2lxnor:o7Tr6qI8CJ5neUI1P3
- TLSH T1786208E24D28944FE5AD7BB0CEA5E4D7A83E7B452E1143520E0DBC592C8BBD14B207EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:fb:aa:d8:66:70:9d:32:01:84:40:52:3c:70:0b:1c:64:12:41:c3:f0:63:06:d3:e2:ff:4e:a4:82:e3:cb:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:05:07:39:ea:59:f3:55:bf:2a:00:00:00:00:01:05
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-shlwapi-legacy-l1-1-0.pdb
IsCharBlankW
IsCharCntrlW
IsCharDigitW
IsCharPunctW
IsCharSpaceA
IsCharSpaceW
IsCharXDigitW
PathAddBackslashA
PathAddBackslashW
PathAddExtensionA
PathAddExtensionW
PathAppendA
PathAppendW
PathCanonicalizeA
PathCanonicalizeW
PathCombineA
PathCombineW
PathCommonPrefixA
PathCommonPrefixW
PathFileExistsA
PathFileExistsW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
PathFindFileNameW
PathFindNextComponentA
PathFindNextComponentW
PathGetArgsA
PathGetArgsW
PathGetCharTypeA
PathGetCharTypeW
PathGetDriveNumberA
PathGetDriveNumberW
PathIsFileSpecA
PathIsFileSpecW
PathIsLFNFileSpecA
PathIsLFNFileSpecW
PathIsPrefixA
PathIsPrefixW
PathIsRelativeA
PathIsRelativeW
PathIsRootA
PathIsRootW
PathIsSameRootA
PathIsSameRootW
PathIsUNCA
PathIsUNCServerA
PathIsUNCServerShareA
PathIsUNCServerShareW
PathIsUNCServerW
PathIsUNCW
PathIsValidCharA
PathIsValidCharW
PathMatchSpecA
PathMatchSpecExA
PathMatchSpecExW
PathMatchSpecW
PathParseIconLocationA
PathParseIconLocationW
PathQuoteSpacesA
PathQuoteSpacesW
PathRelativePathToA
PathRelativePathToW
PathRemoveBackslashA
PathRemoveBackslashW
PathRemoveBlanksA
PathRemoveBlanksW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathRenameExtensionA
PathRenameExtensionW
PathSearchAndQualifyA
PathSearchAndQualifyW
PathSkipRootA
PathSkipRootW
PathStripPathA
PathStripPathW
PathStripToRootA
PathStripToRootW
PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathUnquoteSpacesA
PathUnquoteSpacesW
SHExpandEnvironmentStringsA
SHExpandEnvironmentStringsW
SHTruncateString
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
- SHA256 00dd027d69d5a88d5a707d278a478ebbae7944e8c5daf3ec2b2434bcf9c21db8
- MD5 0b6acf7c99867fa7f574d57fc9b25285
- SHA1 9f8e2f6e77f1fb4924c5cab9390dc67c535f39dd
- SHA512 a0b86ab5be7da415a4a526c1be463021b072d69ec421515569c323888e8e0901878d98a7657a038d92ddb777d58aaa293f88bc0a3d4dc7905dedb1fff454794d
- SSDEEP 192:whXg7kjdGgqx+t3QbOWphWaD1S8f4DBQABJtFoycS4kOqnaj2NLNms:cXg0o+t3QbOWphWaD1IDBRJteJlgJH
- TLSH T16442E98796A4040FE9B969708E48E6D3383D3B867F2087251E56FD752C833F5CA2071E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
48:65:5f:27:2d:b0:a9:a5:3e:41:56:fc:0e:9c:4c:aa:60:b3:66:2d:e8:8d:5f:63:39:4c:e3:a2:5d:c3:e8:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-shlwapi-obsolete-l1-1-0.pdb
QISearch
SHLoadIndirectString
StrCSpnA
StrCSpnIA
StrCSpnIW
StrCSpnW
StrCatBuffA
StrCatBuffW
StrCatChainW
StrChrA
StrChrIA
StrChrIW
StrChrNIW
StrChrNW
StrChrW
StrCmpCA
StrCmpCW
StrCmpICA
StrCmpICW
StrCmpIW
StrCmpLogicalW
StrCmpNA
StrCmpNCA
StrCmpNCW
StrCmpNIA
StrCmpNICA
StrCmpNICW
StrCmpNIW
StrCmpNW
StrCmpW
StrCpyNW
StrCpyNXA
StrCpyNXW
StrDupA
StrDupW
StrIsIntlEqualA
StrIsIntlEqualW
StrPBrkA
StrPBrkW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrIA
StrRStrIW
StrSpnA
StrSpnW
StrStrA
StrStrIA
StrStrIW
StrStrNIW
StrStrNW
StrStrW
StrToInt64ExA
StrToInt64ExW
StrToIntA
StrToIntExA
StrToIntExW
StrToIntW
StrTrimA
StrTrimW
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-shutdown-l1-1-0.dll
- SHA256 a6060fa177a0fcd98dffe7cca8466da1bf5957cd3b8e2baae1b4603342ecf940
- MD5 e3828c7fe27238ec6bfbbf305d20d358
- SHA1 249df6b2a7199d25fa495f1dac52543f33da7130
- SHA512 1adcb7304d693bbd732bcc72cf88c99bdaeec27a0355f578141412689855fc064aa84b30f06e79eaba3f81e05dcba43ba3cc8822e47f01f43c8c6a71159a416a
- SSDEEP 192:r4OtRuSYauWphWAvD1S8f4DBQABJJnkCM2XSoaqnajVMSLadjc1:ZjuWphWaD1IDBRJJnkCZalxb
- TLSH T1A7224DC18BB88647EAE77E700269E5477C3D77CA2821826904A9F5A92CD73C1DF04B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:55:84:1f:0e:dc:92:d5:e4:52:4a:e1:d1:b9:df:ae:44:05:9e:69:cb:12:05:79:6a:4b:77:9c:53:df:59:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:ea:4e:2b:78:b6:2a:27:93:00:00:00:00:01:03
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-shutdown-l1-1-0.pdb
AbortSystemShutdownW
InitiateSystemShutdownExW
Name
.text
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-string-l1-1-0.dll
- SHA256 11b9deb19da8b8dc2c980581458f75f9e17cbcc241510aa64a716bb527085e47
- MD5 fe743d4af2d79506fc34eb52001c0d7e
- SHA1 39a09b94b62f595ac399b5e743ca755062c2337e
- SHA512 7208ef0869518dfa69dc6612fc282ed1fdd5bed130eb3d61b41d581f9bc0c8ea42d6c5ad6c0f25e9547a091db362935df5e14b6986eccaf3e2ca98bdd1a33db8
- SSDEEP 192:mGyMvBWphW5SD1S8f4DBQABJt+S4kOqnaj2NLsm/TfoS:mGyMvBWphW5SD1IDBRJtalgoI8S
- TLSH T119322AD2DBA85506FAB66E701396E9937C3D63C71C3086B90585F2A92C833D5DF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f6:49:47:78:af:21:5d:6c:4c:a0:44:79:d8:ab:a8:05:45:eb:6a:b2:00:20:17:d8:08:c3:47:7e:5c:19:42:b2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-string-l1-1-0.pdb
CompareStringEx
CompareStringOrdinal
CompareStringW
FoldStringW
GetStringTypeExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
Name
.text
Size
1024B
Virtual Size
786B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-stringansi-l1-1-0.dll
- SHA256 d7c37687c50d0fc36654ccbf146f6a956dfab148c464c6c30b8747671ca51056
- MD5 24bb1073a318b87aa7f72683ffe1ab71
- SHA1 e77ac00897a06eef8eabf9e0e548808f1a31d102
- SHA512 172d9c9c03df7644cfee10d4fc8a7824988b30a7466789035541e3a71f25b5aeea17a23c983e0cd7c16484b2479b55681a029f5a536085fc0e65cc792bb159c4
- SSDEEP 192:QCf3akXoWphWARD1S8f4DBQABJJqbKM2XSoaqnajVMSLadjUIy:6WphW0D1IDBRJJnZalxbDX
- TLSH T186324CD0C7F85047EEE27A7002A6EA437D3DA3C66821866800AEF9991CD73D5AF0477D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:1b:38:02:5c:42:2b:31:6f:49:de:63:66:3c:59:eb:70:87:60:b3:d1:ef:56:a5:b6:ef:60:4c:93:77:db:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:ea:4e:2b:78:b6:2a:27:93:00:00:00:00:01:03
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Core-StringAnsi-L1-1-0.pdb
CharLowerA
CharLowerBuffA
CharNextA
CharNextExA
CharPrevA
CharPrevExA
CharUpperA
CharUpperBuffA
IsCharAlphaA
IsCharAlphaNumericA
IsCharLowerA
IsCharUpperA
Name
.text
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-stringloader-l1-1-1.dll
- SHA256 d5a4e53219511f7faf1248f98cfd0a0b83ae82cecf8e90542b9b6563c3da9b0f
- MD5 77e020486666f286a57169e113144a83
- SHA1 97e99fcd83c9c949e8b26dfce6322a47b11984ae
- SHA512 044ab75d73c49d8305586faf1de807db1b44adac18d87dbb961637d82b1f6d49376fa9509533fda529e9cdf9785cbfe33d6d7a473d7e6136548f2d4544566cd0
- SSDEEP 192:NQEaAWphW7D1S8f4DBQABJtQBh6ArNc4qnajr7PgBP:AAWphW7D1IDBRJtk04lrPWP
- TLSH T137222BC18BB85503FAA27E702399D9973C3D77DA2920856A5495F2A82CC33C6DF0063F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:3f:c6:40:8d:81:0e:ef:e7:28:28:0a:83:e6:5b:de:26:d1:93:e3:bb:60:8e:94:a8:db:71:a1:32:fb:5d:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-stringloader-l1-1-1.pdb
LoadStringA
LoadStringW
Name
.text
Size
512B
Virtual Size
450B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-synch-l1-1-0.dll
- SHA256 c3fd578926badfa4fad771972c17a5ef92b2ea8c4c5253e94052fbcbebb2617c
- MD5 801e3af3595f7eff456d535a2fd99992
- SHA1 c232c86399c11a62cfb26e43411bcfa683d14985
- SHA512 d265810354f413643ca0c4b5952d19a49b392cd1fb48fabe772a012bd94b6722c500adfe68707843249801e959ba3cab52558e72f7b71afb1726704f925c8267
- SSDEEP 384:ldv3V0dfpkXc0vVaXWphW7D1IDBRJJ3MKlNqb03:ldv3VqpkXc0vVaWGI1Ppl3
- TLSH T1FB521982D3E4A987F55AEE7102DAC153BC3863C6092085760596E7BA3CE33C1DB1462E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
70:7e:c7:2d:7d:6d:d0:94:1e:3a:7d:c8:d7:b5:32:1c:de:05:00:c0:57:ee:d3:48:24:d2:9a:a2:22:5a:eb:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:00:20:f7:5c:93:56:d5:77:d0:00:00:00:00:01:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-synch-l1-1-0.pdb
AcquireSRWLockExclusive
AcquireSRWLockShared
CancelWaitableTimer
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateSemaphoreExW
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetCriticalSectionSpinCount
SetEvent
SetWaitableTimer
SetWaitableTimerEx
SleepEx
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-synch-l1-2-0.dll
- SHA256 781acb1374c15e27b723bc538c4f8eba0a28e6497f4cdf1f323f91d8dc82c121
- MD5 4a6707c8d7984d469aa52ed17f79ac52
- SHA1 e12d3045d40246ec3129bf891ac332fd5d5ed464
- SHA512 e2361cc3a4b78bec0c458214bfa0a7c395a1b73923ca5eb30cbf4cabeaa1f3ee5eae15bde8d99d732ff418e2675387ec3b6d6e71dce5f71a3baad99954a456dc
- SSDEEP 192:TqY3ZDQtZ3IWphWpD1S8f4DBQABJtCpQRW52fqnaj7zdByTv+c:TqY3ZDQtZ3IWphWpD1IDBRJt4ifl/zdC
- TLSH T186323CC2CBA86603FA9ABE7007D6D4933C3D27C61C608569145AF2652CD33D6DF04B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9f:70:8c:4f:3e:2a:92:0e:ab:15:62:1e:20:3c:9e:be:f7:f0:c6:cd:c6:ad:91:db:86:44:06:ab:db:40:03:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-synch-l1-2-0.pdb
DeleteSynchronizationBarrier
EnterSynchronizationBarrier
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitOnceInitialize
InitializeConditionVariable
InitializeSynchronizationBarrier
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WaitOnAddress
WakeAllConditionVariable
WakeByAddressAll
WakeByAddressSingle
WakeConditionVariable
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-1-0.dll
- SHA256 5a61358311f3bd82eb2186aaa3641a96aefe10e8f6b93b4b405f1432b5000e42
- MD5 f52ee25938537a9f25a597e6a267a258
- SHA1 f6b8a08087308f15c6c5546016d68e4d71342a63
- SHA512 694ac27af4cd09368b6ece19ce49b480b27ebccc89190d1d71d70ba5f01c984f584b657110d1aab7c5c7561af2cdcfa94f24b48d7e56050fee40c22717ca7c13
- SSDEEP 192:M7QzKIMFMWphWED1S8f4DBQABJtcHn6aS4kOqnaj2NLfm6S:M8zZWphWED1IDBRJtcaGlgja
- TLSH T1FF420993DBB8A102F5A66F302299D5433D3C93C61835C52D01D5E36D6CA33CADB2467E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b0:91:4d:2b:a3:e9:4a:46:9c:f3:b2:5c:58:3d:5e:65:4a:ca:17:00:bf:9c:56:b4:97:fb:7c:cf:d0:e7:a3:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-sysinfo-l1-1-0.pdb
GetComputerNameExA
GetComputerNameExW
GetLocalTime
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetTickCount
GetTickCount64
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalMemoryStatusEx
SetLocalTime
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-2-0.dll
- SHA256 b881fd5e599d985f63b5d58a3258cc165491b88343b9a7ea1b8fbe3bf4a8fb3a
- MD5 925e6683cb365bab0bede5d0e201fd92
- SHA1 d0bfc5375054b390abb83c6161d9cb6580bf1963
- SHA512 016ddd79085fbe19003f39651567c91c812bf514f42997455da2bba35ff02a0252718b6653e0a1023eeb04815a18c7ce1ff124e3b41ea88bd29959f98f0eb74f
- SSDEEP 192:wyB4WphWBD1S8f4DBQABJtP/H5qAAqnaj/ID2:wyB4WphWBD1IDBRJtP/clDT
- TLSH T186322BD28B689103F9A67F70139ADA473D3D63C71920C6691599F7A92C933C5EF00A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:4a:87:7b:f4:2b:f7:81:b7:be:45:61:d7:99:bb:7f:60:e7:fd:13:7a:e7:c7:87:ee:50:de:15:ad:77:d6:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-sysinfo-l1-2-0.pdb
EnumSystemFirmwareTables
GetNativeSystemInfo
GetOsSafeBootMode
GetProductInfo
GetSystemFirmwareTable
GetSystemTimePreciseAsFileTime
SetComputerNameExW
SetSystemTime
VerSetConditionMask
Name
.text
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-sysinfo-l1-2-1.dll
- SHA256 45d63058d2595f0d61ab5730e6993ec9e5b7b9b36ea3fdfb7c8b3af5c9538269
- MD5 b9059ffea418144ccb8cff3c9ee018c5
- SHA1 4d183437e6e5276b9826557db557fe0cd9c95305
- SHA512 27d99a693111ec3bd51e099946f3264fb977fcd8406983513abf06ea3736d372f0987357812f34dbf49ba03606051926346c73464811627351460da7a4486c89
- SSDEEP 192:ZH4c1WphWRtD1S8f4DBQABJtHOcc67lqnajX8Qq/IcP:ZR1WphWRtD1IDBRJtHQolz81
- TLSH T1983219818BB81507F6A77F700399D9837C3DA3C72921C159159AE2A92C933D5AB00A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8a:4b:5d:4c:5f:f9:67:6f:84:eb:da:a2:a8:19:fa:27:ea:9e:77:91:ad:5e:8a:be:cb:5a:d7:29:6f:20:f0:23
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8E9E-4BD0-2ED0,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:10:2f:dd:ee:dd:67:1a:cc:96:00:00:00:00:01:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-sysinfo-l1-2-1.pdb
DnsHostnameToComputerNameExW
GetPhysicallyInstalledSystemMemory
InstallELAMCertificateInfo
SetComputerNameEx2W
SetSystemTimeAdjustment
Name
.text
Size
1024B
Virtual Size
728B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-l1-2-0.dll
- SHA256 b2b823a34506b5c1fa979356ae7252743bc5ba229f880145c6e36b57ecec337c
- MD5 3103999e690c42b89c90afbb4f074d74
- SHA1 18482e02486f37e13e70402750bb8715dc358859
- SHA512 cc5aa18f3f551b259e7dbc88a6ac2f11a9a566ef9acd333be28f1a78a19266cd63c29b1ac525abc2a43bf4e81f2acc076ca7372fc91b6abd6ed0d9ec1ecc8f6a
- SSDEEP 384:1R2Atv+mdBAKu4Y5XcWphW6D1IDBRJJPGKlNqb0X:11dBAKu4gZI1PJj
- TLSH T1DD52F68282AC9283FCA6F6710255C5537D3EA389192E47790596E2A83CDFBC1D71432F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
51:c4:59:44:99:c1:27:3a:33:5c:8e:e3:d5:c8:57:e4:98:64:a0:69:a1:50:4d:8d:fa:c4:b0:35:09:33:75:e8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:00:20:f7:5c:93:56:d5:77:d0:00:00:00:00:01:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-threadpool-l1-2-0.pdb
CallbackMayRunLong
CancelThreadpoolIo
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DisassociateCurrentThreadFromCallback
FreeLibraryWhenCallbackReturns
IsThreadpoolTimerSet
LeaveCriticalSectionWhenCallbackReturns
QueryThreadpoolStackInformation
ReleaseMutexWhenCallbackReturns
ReleaseSemaphoreWhenCallbackReturns
SetEventWhenCallbackReturns
SetThreadpoolStackInformation
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SetThreadpoolTimer
SetThreadpoolTimerEx
SetThreadpoolWait
SetThreadpoolWaitEx
StartThreadpoolIo
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
WaitForThreadpoolIoCallbacks
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolWorkCallbacks
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-legacy-l1-1-0.dll
- SHA256 94b58427f3530eba3ae8dfe96140ad81daa988d7a7e75c03b97b216cc3c4e172
- MD5 3a68a61a683b3f8616cd3bf5cc576234
- SHA1 94094ccb08cb284115659289a0bf9d10064f2340
- SHA512 cac20652c05f2385366f8b838d9aa900c4a8bfa3effb7a5add5cac87eb026679803e55941c8404bb316b19ec95957303caf9ede1f698ce5b2035d2e78d02e6a0
- SSDEEP 192:zH33WphWArD1S8f4DBQABJJeqGw4ZLqnajVxo+tw5bo:zHWphW+D1IDBRJJeqGw6lx2+t2E
- TLSH T180321AC647A85507E9E6BE700399DA937D3D53C7282041B908AAF1ED2C937C2EB14B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:3e:38:d9:8a:f8:0d:2e:2b:65:f2:57:73:a3:24:b4:42:d3:3f:5b:64:e7:17:9e:dd:8c:5d:53:d3:b2:01:83
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:04:09:01:75:08:58:87:2d:29:00:00:00:00:01:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-threadpool-legacy-l1-1-0.pdb
ChangeTimerQueueTimer
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
Name
.text
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-threadpool-private-l1-1-0.dll
- SHA256 1475274dfaa5cbf5294ff7fe785e7dbae9748e0f548b9dfc3a884dac26547ee2
- MD5 139611af19dddbffea7fa58f71496bf7
- SHA1 7e952d76b21dcd029512eb824afc295b7624d183
- SHA512 9c52e35e3e6a816252894474d08522826a62054918671aec8e1cd0360c087eda9d783028adccc4041fa8c3b7e0fc5d046afd3cf58de266e72617a1ce267202d9
- SSDEEP 192:GGhWphWBD1S8f4DBQABJFkRpVwyqnajlAkOoe6:LWphWBD1IDBRJFkXvlmkl
- TLSH T1DF223BC28BB46543FAA67F7043A9D5537C3E63C71D20C2A91446F6A52C873D5DF00A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:44:c3:13:01:7e:18:26:6b:81:fa:f1:e6:c7:e4:81:3e:61:63:42:30:44:1b:8c:ef:fb:cc:ce:16:14:66:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-threadpool-private-l1-1-0.pdb
RegisterWaitForSingleObjectEx
Name
.text
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-timezone-l1-1-0.dll
- SHA256 7565dc828bb26844ad8ba872e227fba719195a37b06610205788f5956e3a8c88
- MD5 4e94d7ad4fbbe1cabe46bf5ca314e69d
- SHA1 5b51482fa8be9fb692e8143bd5789f27f8226070
- SHA512 5fb190464e088461a0fc59e2c8b75235e49c4cbb9bc4d0137d80c81942db3471b7268d0489cb867604cd5d1ed4bf739c9071a023d1463335734ce35b75693d3e
- SSDEEP 192:YPWphWAnD1S8f4DBQABJJd7T0q11qnajVtPxAk:YPWphWKD1IDBRJJd7Tplxb
- TLSH T13E321AD2CB684447FDEE3B7007AAD9537D38A39A1860829A04DBF69938C73C59B1076C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bf:47:78:54:64:14:c0:6e:30:a2:85:74:db:a6:2e:62:30:5f:a9:af:6b:d7:c5:45:74:d9:d4:6f:14:b2:70:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-timezone-l1-1-0.pdb
EnumDynamicTimeZoneInformation
FileTimeToSystemTime
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetTimeZoneInformation
GetTimeZoneInformationForYear
SetDynamicTimeZoneInformation
SetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
SystemTimeToTzSpecificLocalTimeEx
TzSpecificLocalTimeToSystemTime
TzSpecificLocalTimeToSystemTimeEx
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-url-l1-1-0.dll
- SHA256 e0308983cb78af351cad8519d8a6c5cc7875ca1aea41265974b0f153e28d9344
- MD5 325ea756244c858fc7238f21540c47d2
- SHA1 3d998b5f01a8b11d2e53ea2c97cd009223df22af
- SHA512 ad19e0f04d617f76cca51e765eef8d352e59123bd1932a7413a6cb745518b3070cc42e43f7efa45180a2d668b1a65c1b7abd307e3ab3511a67617983b3551dd8
- SSDEEP 192:aQ9xcR9AoWphWDD1S8f4DBQABJtb5uE7MqnajcxpU:aR9AoWphWDD1IDBRJttuOMlAxy
- TLSH T1EC422A834B28544BE6693E70DA65D9D37E3D37CA3D10435A0899FA892C837D0DF2CA5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:5b:df:cb:2b:59:c7:5c:12:dc:9f:a3:0d:c4:b3:c5:7e:3b:af:6b:a7:a2:8b:43:ff:b8:f4:fe:19:42:c9:70
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-url-l1-1-0.pdb
GetAcceptLanguagesA
GetAcceptLanguagesW
HashData
IsInternetESCEnabled
ParseURLA
ParseURLW
PathCreateFromUrlA
PathCreateFromUrlAlloc
PathCreateFromUrlW
PathIsURLA
PathIsURLW
UrlApplySchemeA
UrlApplySchemeW
UrlCanonicalizeA
UrlCanonicalizeW
UrlCombineA
UrlCombineW
UrlCompareA
UrlCompareW
UrlCreateFromPathA
UrlCreateFromPathW
UrlEscapeA
UrlEscapeW
UrlFixupW
UrlGetLocationA
UrlGetLocationW
UrlGetPartA
UrlGetPartW
UrlHashA
UrlHashW
UrlIsA
UrlIsNoHistoryA
UrlIsNoHistoryW
UrlIsOpaqueA
UrlIsOpaqueW
UrlIsW
UrlUnescapeA
UrlUnescapeW
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-util-l1-1-0.dll
- SHA256 e7ff028741bdea70f69586c0e9546b272e71de1abfa24a6a50d0cbac422bb81a
- MD5 20d16ed77eb9c994cf1c5b673ad189b3
- SHA1 713226c9fbd8d5fe4e7b7e7b9c72742a392bd805
- SHA512 930574688102c812b04c8a38ac6a169e7489098cfd3fa4c3aee346c95474040618d3a6767e3118fe9c96789d5e23cea87fde2dfe3b0ed32670ee2a2f0dc5db9d
- SSDEEP 192:DKWphW4ID1S8f4DBQABJtKvWS50884LfqnajJNLBn2:DKWphW4ID1IDBRJtKlVJllNLBn2
- TLSH T164320AC28BA89407EAA77F701399D9837C3D57CB297081A90895F6A53C833D1DF04B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
94:67:d0:8d:af:8c:89:27:b9:99:b5:fa:24:55:7d:24:6d:ac:cd:b3:ae:38:c7:ff:39:46:27:54:c0:b1:65:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-util-l1-1-0.pdb
Beep
DecodePointer
DecodeSystemPointer
EncodePointer
EncodeSystemPointer
Name
.text
Size
1024B
Virtual Size
601B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-version-l1-1-0.dll
- SHA256 aecfbdc5106b09d548482a477b8f9ea338ca707813738f7ad2e6ad935383e34c
- MD5 60c3aa0275ab401269fcc5343cd24942
- SHA1 f234c2d16d477e9c6fdbfdc266db72c91e689673
- SHA512 cb24393a8ce04ef2c06a7b58438e4a9e55b63900cbb9e2ce0ea58bd9a34c2c4837dd25d23f54222a805f4920698a98797b1d75985003b4d1e3da0082c5d8edaf
- SSDEEP 192:8QmBPsVWphWtD1S8f4DBQABJtOo3pPqs7IwdY+kqnajHaqxgmL8sEz:VmBPsVWphWtD1IDBRJtRzIwS+klTxCz
- TLSH T18D322BC28BB84403EAA67F7012A8DA973D3D63CB1D70C1691595F6A92C873D5DF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
55:88:45:de:06:96:22:e7:bf:74:6f:cc:3b:4e:49:86:62:ab:3e:ff:21:3a:25:d2:85:9b:e6:d2:69:c4:ff:8a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-version-l1-1-0.pdb
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerFindFileW
VerQueryValueW
Name
.text
Size
1024B
Virtual Size
587B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-wow64-l1-1-0.dll
- SHA256 dcb7bbac458b4645e53b0245bf4bbfbce0baa6a55f6524076428d1841bbadd76
- MD5 4c054f9e647dc6ce57cd16ab9953cd6e
- SHA1 929a391e66a6aea66c88624a788643c8ea6ba267
- SHA512 45c4f4bcd60efb765abcbfcf28aba05b5063bfa249b1a9d821ba6c02aa1bb515b0da48bca41388b1bed0d05df6edaf429f98b27d25a24841e39b62c204d69f3e
- SSDEEP 192:sI2WhWphWApD1S8f4DBQABJJYLJqnajjqP6G8rg:bWphWcD1IDBRJJuJlvCz8rg
- TLSH T1EB323AD28BB84943EAD77E700395E9537C3DA3CB182046BE049AF2991C873C6DB1476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f3:71:9d:0a:26:35:1c:ca:0a:67:4d:2c:33:ff:9b:8a:58:ea:63:e3:0f:84:2b:f0:af:9c:ea:df:99:90:e6:57
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fd:44:2c:a0:f1:35:72:04:a9:00:00:00:00:00:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-wow64-l1-1-0.pdb
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
Name
.text
Size
1024B
Virtual Size
570B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-core-xstate-l1-1-0.dll
- SHA256 169d1fbb432de5f1f5d6d9dd102dec48214e6d4d8e7c66c3855cce3e0d57d627
- MD5 60bfd539c9e9cd108f74bd6f2c3e9db7
- SHA1 c0c37d7749e28ddefececaa6fe73606f9e696c4e
- SHA512 bd94e0ca3597be1bacd2d74bb68d032db42a0321bcfa8a3e5c9c8a2e6c22b17eb749a3231de452bbbc93b0074be85a112767509709e351d1667a54399ee97443
- SSDEEP 192:ybWphWAsD1S8f4DBQABJJr7T0q11qnajVtPx9a:0WphW5D1IDBRJJr7Tplxb
- TLSH T107322AC64B785843FAA67B7003A9D9E77D3D63CB28608265049DE2E928C33D1AF1477D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:b8:06:69:af:6d:b4:97:72:ce:33:27:3a:d8:a3:91:31:07:8a:13:9b:67:23:f1:e5:26:67:11:73:60:25:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-xstate-l1-1-0.pdb
RtlCopyExtendedContext
RtlGetEnabledExtendedFeatures
RtlGetExtendedContextLength
RtlGetExtendedFeaturesMask
RtlInitializeExtendedContext
RtlLocateExtendedFeature
RtlLocateLegacyContext
RtlSetExtendedFeaturesMask
Name
.text
Size
1024B
Virtual Size
914B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-conio-l1-1-0.dll
- SHA256 d8e1fa3ca3be1cedfea33515cd80cf951d5a2fdbe1d1cc5fe62eb8964fc74f00
- MD5 b0c872c3a8c0ab961a50e44f23aa4ebb
- SHA1 ce5277547b36ef7c6c2a7ef1cb728f04e9f47f00
- SHA512 afd03a2f79935405b5c533f92219b4d711f4bba17b988a50fc13a9d447c12d5e9032cd734b2d92c4b7b54d6abef7a2915e3ffa5b00aec2d4c10f26c190ead782
- SSDEEP 192:VEWphW0D1S8f4DBQABJtjW5qAAqnaj/Il7Gb:VEWphW0D1IDBRJt7lDP
- TLSH T14542F99357EC5907F5536B3063F9DBC36E3927832920616A444AF56838C73DAEF0162E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fd:be:05:ac:14:e1:81:85:79:0c:bf:cc:0d:6a:64:80:ec:0a:a0:40:10:18:3c:d6:4d:5f:30:8c:1c:18:de:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-conio-l1-1-0.pdb
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
_cgets
_cgets_s
_cgetws
_cgetws_s
_cputs
_cputws
_getch
_getch_nolock
_getche
_getche_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_putch
_putch_nolock
_putwch
_putwch_nolock
_ungetch
_ungetch_nolock
_ungetwch
_ungetwch_nolock
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-convert-l1-1-0.dll
- SHA256 b19106fb9c162faf4bd6e25bcda1ceaf6d5c072458a09577133f027ad7ae453c
- MD5 38e590dfca134b56cb7f75298e4eb5c6
- SHA1 c47a5efa7be61de7df736f7801ab87c8534f8241
- SHA512 3abbc92aea8a7208ff01da26e2d641e88430a0a16e2478c7e051a0cdd89b9bca595ad380f55b65b579229088a3617a3188cb9f700d3d837cf4992cef8ace9799
- SSDEEP 192:SM0wd8dc9cy1WphWDD1S8f4DBQABJtb7AvpeLirKqnaj/k:j0wd8xy1WphWDD1IDBRJtb7A4LIKlzk
- TLSH T1A762954366E43F26EA9B277221EAC7D729391782155143B4C207E65C3883782FEA7D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:92:4c:3e:61:23:29:21:f5:b9:17:2f:ba:8e:9e:96:e9:2f:ef:18:34:3c:ec:e4:de:f1:08:4b:37:a9:a5:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-convert-l1-1-0.pdb
__toascii
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_ecvt
_ecvt_s
_fcvt
_fcvt_s
_gcvt
_gcvt_s
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_ltoa
_ltoa_s
_ltow
_ltow_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wctomb_l
_wctomb_s_l
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
atof
atoi
atol
atoll
btowc
c16rtomb
c32rtomb
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
strtod
strtof
strtoimax
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcrtomb_s
wcsrtombs
wcsrtombs_s
wcstod
wcstof
wcstoimax
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wctob
wctomb
wctomb_s
wctrans
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-environment-l1-1-0.dll
- SHA256 e4c803574676b5517d264a66d9aaa1f87feda1c985f4ea35ffea6b753abdcc56
- MD5 aed979b237629fb5624b48ae1411b5fc
- SHA1 26852bdeadb1369bc011f35c726dfdbf9b9f333b
- SHA512 9cca62e52abda6f2709e77ae58d86a42dbc9016fd992886c189cdc89f55a272c92e7aaa9c5574fc4e4ce93ef41de9c957e58a71f0e0654dac2a6ab6922595392
- SSDEEP 192:a9KNcWphWArD1S8f4DBQABJJEgKqnajH2oWb5lP0k:YKNcWphWOD1IDBRJJEgKlNqb0
- TLSH T1533208C54BB80A07EAA67F7052B9E6937C3963C668104279046BF2992CC77C2EF1476D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:2b:44:fe:cc:c0:31:bd:b6:19:c8:57:ca:89:4f:09:58:00:b2:a8:97:9b:64:b3:ef:eb:ae:94:b1:2e:a5:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:00:20:f7:5c:93:56:d5:77:d0:00:00:00:00:01:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-environment-l1-1-0.pdb
__p__environ
__p__wenviron
_dupenv_s
_putenv
_putenv_s
_searchenv
_searchenv_s
_wdupenv_s
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wputenv
_wputenv_s
_wsearchenv
_wsearchenv_s
getenv
getenv_s
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-filesystem-l1-1-0.dll
- SHA256 9b9bffdaa19518c516dff8fe86c72307f20fee82d7587b276135805e5494f46e
- MD5 1931d2b08a0ae1bf619d68794e24209e
- SHA1 30c196dc917514dd7b423850d3722b697e08ed1f
- SHA512 23897d89976596a87c4ae2c5200759c411de43400052783aeb9571c8fe00bccde78cd892d9b3dfd058dc58bd4e30adef0ae0ce3cc600815e92efef8920b4f2c5
- SSDEEP 384:/nWm5C9WphWFD1IDBRJRl1LzIwS+klTxF:/nWm5C4UI1PBndOF
- TLSH T15B42F98387D47D12EAA72B7252FDDBD73E3D17C2185282668046A56839D33C1BF0299E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:4b:1a:23:2e:3c:f1:d9:b4:b9:08:9e:43:a7:72:10:03:f0:cb:72:2b:49:c9:be:b3:6d:65:6a:f1:78:1b:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-filesystem-l1-1-0.pdb
_access
_access_s
_chdir
_chdrive
_chmod
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_fullpath
_getdiskfree
_getdrive
_getdrives
_lock_file
_makepath
_makepath_s
_mkdir
_rmdir
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_umask
_umask_s
_unlink
_unlock_file
_waccess
_waccess_s
_wchdir
_wchmod
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfullpath
_wmakepath
_wmakepath_s
_wmkdir
_wremove
_wrename
_wrmdir
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wunlink
remove
rename
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-heap-l1-1-0.dll
- SHA256 5e27b270bb53b1f434652b43796281d659171ce2450d8fc399d1628e44d8d1ee
- MD5 ad1a07c15623ff3db43b9cf5bb34ad03
- SHA1 4c0c016663a6b0ee837080903b17990aee722ffb
- SHA512 bc75d3854ec62a2ee7d24eeb8d0bf70bea1c03fdc464e44ee5e738a715ac8b01e98217d64c7d939979dff181ba20d53211917892a260f0189c5133ca98589633
- SSDEEP 192:baY17aFBRQWphWRD1S8f4DBQABJRm9T5qAAqnaj/It3:DVWphWRD1IDBRJRmWlDK
- TLSH T118420CD347A82903EA637F7016E9DA8B3D3A57C62D6085774057E2A52C433C5BF0161E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f9:79:73:6c:6e:06:9c:15:f8:da:ab:88:b9:26:42:d3:db:c2:2f:87:30:fb:ed:b0:22:e8:8a:80:09:a6:e8:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-heap-l1-1-0.pdb
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_callnewh
_calloc_base
_expand
_free_base
_get_heap_handle
_heapchk
_heapmin
_heapwalk
_malloc_base
_msize
_query_new_handler
_query_new_mode
_realloc_base
_recalloc
_set_new_mode
calloc
free
malloc
realloc
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-locale-l1-1-0.dll
- SHA256 87a251a8abbfb53753d3dbf01f1603598a4af97706db145d53f19ba9d8b05a9d
- MD5 8972698c7776cf3fa5bb3d59170299ea
- SHA1 9f53036033e5099d238a4be58e58c7ff2452c5b1
- SHA512 1f27aef343f7d724bbfcf2ae2f4ee7029f12189b81d3538f29466a43c64e3938330c8f51e7c0164d3b189ba72aa0b5d8d2235b739eeb58c6d6a5d7859622410b
- SSDEEP 192:M9vbhWphWDD1S8f4DBQABJdu7P1usUDR0qnajVXj9Ea:M9vbhWphWDD1IDBRJdK1uQlxzea
- TLSH T1533229C686BC1947EAE7BFB01578E797BD3E63C215114569002BF5A82C833DCAB0466D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:d7:5b:5f:ad:93:46:6b:0f:c0:0e:2b:70:fe:db:eb:6e:d5:30:d2:3a:5e:ca:5a:06:f5:37:1b:e6:47:03:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-locale-l1-1-0.pdb
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__initialize_lconv_for_unsigned_char
__pctype_func
__pwctype_func
_configthreadlocale
_create_locale
_free_locale
_get_current_locale
_getmbcp
_lock_locales
_setmbcp
_unlock_locales
_wcreate_locale
_wsetlocale
localeconv
setlocale
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-math-l1-1-0.dll
- SHA256 e0108a0a6f4f8512598ec885c496a4496e2832f28d11a537e1096bc7354848b9
- MD5 72e0d57a10b0cc1498c2238de9804e9b
- SHA1 da0b70100b73d29fb617085f6bbda2e5fdd4a117
- SHA512 e0e533ca0d97ab4f40b1f7fb260aca30a3d05cf94c68b94f33d18fb598096dd9f35bc594e5bfcf361d9fc426b8e97b217a307ea9d29a56c35eb7834225414ff9
- SSDEEP 384:xt1MCbM4Oe5grykfIgTmLSWphWzD1IDBRJtbdOuOMlA5f:b6gMq5grxfIndGI1Ppdc/
- TLSH T173A2854789E8BF67E5CF1BB701F4CBCE26341AA654E1B5F4C887918834927C07E4B949
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
40:42:58:29:9f:e0:79:fd:2b:82:2a:f7:0e:80:11:d5:b9:8d:b6:95:a9:71:3e:6e:3e:be:e1:10:21:ba:4f:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-math-l1-1-0.pdb
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_FCbuild
_FCmulcc
_FCmulcr
_LCbuild
_LCmulcc
_LCmulcr
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__setusermatherr
_cabs
_chgsign
_chgsignf
_copysign
_copysignf
_d_int
_dclass
_dexp
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_except1
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_finite
_fpclass
_ftol
_hypot
_hypotf
_isnan
_j0
_j1
_jn
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_logb
_nextafter
_scalb
_set_SSE2_enable
_y0
_y1
_yn
acos
acosh
acoshf
acoshl
asin
asinh
asinhf
asinhl
atan
atan2
atanh
atanhf
atanhl
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosh
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
erf
erfc
erfcf
erfcl
erff
erfl
exp
exp2
exp2f
exp2l
expm1
expm1f
expm1l
fabs
fdim
fdimf
fdiml
floor
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
frexp
hypot
ilogb
ilogbf
ilogbl
ldexp
lgamma
lgammaf
lgammal
llrint
llrintf
llrintl
llround
llroundf
llroundl
log
log10
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
lrint
lrintf
lrintl
lround
lroundf
lroundl
modf
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
pow
powf
remainder
remainderf
remainderl
remquo
remquof
remquol
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
sin
sinh
sqrt
tan
tanh
tgamma
tgammaf
tgammal
trunc
truncf
truncl
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-multibyte-l1-1-0.dll
- SHA256 c4495bf03e5d3067eac5bdc9c65d3d5c622b545439bdbc68c14ffbc4022b4ac4
- MD5 502c384d3d2913e5ad8dc1ec69b2f326
- SHA1 abcc6161bd35ffc6968981ef739b33b69e8bcc66
- SHA512 79ce0f8a266d0aa33fab99cf26211b434f6544269b7b64e344c418d16d5e99ccf84b41bfded181921f7960f42d07eb208e06305e5118821f9ff09902e6ff9034
- SSDEEP 384:VSrxLPmIHJI6/CpG3t2G3t4odXLZWphWID1IDBRJtPTF2ifl/zdk2:ViPmIHJI6iXI1P3pd
- TLSH T166820C6B4AE83E11D68FD7F3B5F6C7C62A350F8114C073B9A56785483846EE9BD02E09
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d9:00:99:76:36:2b:f2:2a:16:db:5e:bc:18:0e:cf:9d:9c:62:17:e2:ba:65:88:4f:95:20:b3:5d:3d:1d:f3:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-multibyte-l1-1-0.pdb
__p__mbcasemap
__p__mbctype
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-private-l1-1-0.dll
- SHA256 cca7300bce657ad70666686667d1997b5c5238006a71f833b079dfbcd15468f4
- MD5 bc8359b3062350d9977614ebdecd286b
- SHA1 2bf44886bf48f5f47f92c005fc255cb41136e67b
- SHA512 c4d50e86e348d099789642ee773eae03647010805233127b695eed419b2d86b1bebd9cef0c05ab91b586d1a1d530578452fce8214a8a0d0c2db5686a1198174d
- SSDEEP 1536:AfolDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPTGPy:YolDe5c4bFE2Jy2cvxXWpD9d3334BkZ4
- TLSH T1D05329DB89E63F22E18FF7A76BFB13C90B253B4418806174E9C7556B34853A9BC43A41
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
93:13:c0:d1:b3:83:29:80:e1:1b:0b:13:f2:8c:4a:b7:43:0c:f4:04:b0:bc:66:b4:d9:f0:a8:64:36:e5:58:cc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-private-l1-1-0.pdb
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__intrinsic_abnormal_termination
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_o__CIacos
_o__CIasin
_o__CIatan
_o__CIatan2
_o__CIcos
_o__CIcosh
_o__CIexp
_o__CIfmod
_o__CIlog
_o__CIlog10
_o__CIpow
_o__CIsin
_o__CIsinh
_o__CIsqrt
_o__CItan
_o__CItanh
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__Wcsftime
_o____lc_codepage_func
_o____lc_collate_cp_func
_o____lc_locale_name_func
_o____mb_cur_max_func
_o___acrt_iob_func
_o___conio_common_vcprintf
_o___conio_common_vcprintf_p
_o___conio_common_vcprintf_s
_o___conio_common_vcscanf
_o___conio_common_vcwprintf
_o___conio_common_vcwprintf_p
_o___conio_common_vcwprintf_s
_o___conio_common_vcwscanf
_o___daylight
_o___dstbias
_o___fpe_flt_rounds
_o___libm_sse2_acos
_o___libm_sse2_acosf
_o___libm_sse2_asin
_o___libm_sse2_asinf
_o___libm_sse2_atan
_o___libm_sse2_atan2
_o___libm_sse2_atanf
_o___libm_sse2_cos
_o___libm_sse2_cosf
_o___libm_sse2_exp
_o___libm_sse2_expf
_o___libm_sse2_log
_o___libm_sse2_log10
_o___libm_sse2_log10f
_o___libm_sse2_logf
_o___libm_sse2_pow
_o___libm_sse2_powf
_o___libm_sse2_sin
_o___libm_sse2_sinf
_o___libm_sse2_tan
_o___libm_sse2_tanf
_o___p___argc
_o___p___argv
_o___p___wargv
_o___p__acmdln
_o___p__commode
_o___p__environ
_o___p__fmode
_o___p__mbcasemap
_o___p__mbctype
_o___p__pgmptr
_o___p__wcmdln
_o___p__wenviron
_o___p__wpgmptr
_o___pctype_func
_o___pwctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___std_type_info_name
_o___stdio_common_vfprintf
_o___stdio_common_vfprintf_p
_o___stdio_common_vfprintf_s
_o___stdio_common_vfscanf
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_p
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfwscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsprintf_p
_o___stdio_common_vsprintf_s
_o___stdio_common_vsscanf
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o___timezone
_o___tzname
_o___wcserror
_o__access
_o__access_s
_o__aligned_free
_o__aligned_malloc
_o__aligned_msize
_o__aligned_offset_malloc
_o__aligned_offset_realloc
_o__aligned_offset_recalloc
_o__aligned_realloc
_o__aligned_recalloc
_o__atodbl
_o__atodbl_l
_o__atof_l
_o__atoflt
_o__atoflt_l
_o__atoi64
_o__atoi64_l
_o__atoi_l
_o__atol_l
_o__atoldbl
_o__atoldbl_l
_o__atoll_l
_o__beep
_o__beginthread
_o__beginthreadex
_o__cabs
_o__callnewh
_o__calloc_base
_o__cexit
_o__cgets
_o__cgets_s
_o__cgetws
_o__cgetws_s
_o__chdir
_o__chdrive
_o__chmod
_o__chsize
_o__chsize_s
_o__close
_o__commit
_o__configthreadlocale
_o__configure_narrow_argv
_o__configure_wide_argv
_o__controlfp_s
_o__cputs
_o__cputws
_o__creat
_o__create_locale
_o__crt_atexit
_o__ctime32_s
_o__ctime64_s
_o__cwait
_o__d_int
_o__dclass
_o__difftime32
_o__difftime64
_o__dlog
_o__dnorm
_o__dpcomp
_o__dpoly
_o__dscale
_o__dsign
_o__dsin
_o__dtest
_o__dunscale
_o__dup
_o__dup2
_o__dupenv_s
_o__ecvt
_o__ecvt_s
_o__endthread
_o__endthreadex
_o__eof
_o__errno
_o__except1
_o__execute_onexit_table
_o__execv
_o__execve
_o__execvp
_o__execvpe
_o__exit
_o__expand
_o__fclose_nolock
_o__fcloseall
_o__fcvt
_o__fcvt_s
_o__fd_int
_o__fdclass
_o__fdexp
_o__fdlog
_o__fdopen
_o__fdpcomp
_o__fdpoly
_o__fdscale
_o__fdsign
_o__fdsin
_o__fflush_nolock
_o__fgetc_nolock
_o__fgetchar
_o__fgetwc_nolock
_o__fgetwchar
_o__filelength
_o__filelengthi64
_o__fileno
_o__findclose
_o__findfirst32
_o__findfirst32i64
_o__findfirst64
_o__findfirst64i32
_o__findnext32
_o__findnext32i64
_o__findnext64
_o__findnext64i32
_o__flushall
_o__fpclass
_o__fputc_nolock
_o__fputchar
_o__fputwc_nolock
_o__fputwchar
_o__fread_nolock
_o__fread_nolock_s
_o__free_base
_o__free_locale
_o__fseek_nolock
_o__fseeki64
_o__fseeki64_nolock
_o__fsopen
_o__fstat32
_o__fstat32i64
_o__fstat64
_o__fstat64i32
_o__ftell_nolock
_o__ftelli64
_o__ftelli64_nolock
_o__ftime32
_o__ftime32_s
_o__ftime64
_o__ftime64_s
_o__fullpath
_o__futime32
_o__futime64
_o__fwrite_nolock
_o__gcvt
_o__gcvt_s
_o__get_daylight
_o__get_doserrno
_o__get_dstbias
_o__get_errno
_o__get_fmode
_o__get_heap_handle
_o__get_initial_narrow_environment
_o__get_initial_wide_environment
_o__get_invalid_parameter_handler
_o__get_narrow_winmain_command_line
_o__get_osfhandle
_o__get_pgmptr
_o__get_stream_buffer_pointers
_o__get_terminate
_o__get_thread_local_invalid_parameter_handler
_o__get_timezone
_o__get_tzname
_o__get_wide_winmain_command_line
_o__get_wpgmptr
_o__getc_nolock
_o__getch
_o__getch_nolock
_o__getche
_o__getche_nolock
_o__getcwd
_o__getdcwd
_o__getdiskfree
_o__getdllprocaddr
_o__getdrive
_o__getdrives
_o__getmbcp
_o__getsystime
_o__getw
_o__getwc_nolock
_o__getwch
_o__getwch_nolock
_o__getwche
_o__getwche_nolock
_o__getws
_o__getws_s
_o__gmtime32
_o__gmtime32_s
_o__gmtime64
_o__gmtime64_s
_o__heapchk
_o__heapmin
_o__hypot
_o__hypotf
_o__i64toa
_o__i64toa_s
_o__i64tow
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__isctype
_o__isctype_l
_o__isleadbyte_l
_o__ismbbalnum
_o__ismbbalnum_l
_o__ismbbalpha
_o__ismbbalpha_l
_o__ismbbblank
_o__ismbbblank_l
_o__ismbbgraph
_o__ismbbgraph_l
_o__ismbbkalnum
_o__ismbbkalnum_l
_o__ismbbkana
_o__ismbbkana_l
_o__ismbbkprint
_o__ismbbkprint_l
_o__ismbbkpunct
_o__ismbbkpunct_l
_o__ismbblead
_o__ismbblead_l
_o__ismbbprint
_o__ismbbprint_l
_o__ismbbpunct
_o__ismbbpunct_l
_o__ismbbtrail
_o__ismbbtrail_l
_o__ismbcalnum
_o__ismbcalnum_l
_o__ismbcalpha
_o__ismbcalpha_l
_o__ismbcblank
_o__ismbcblank_l
_o__ismbcdigit
_o__ismbcdigit_l
_o__ismbcgraph
_o__ismbcgraph_l
_o__ismbchira
_o__ismbchira_l
_o__ismbckata
_o__ismbckata_l
_o__ismbcl0
_o__ismbcl0_l
_o__ismbcl1
_o__ismbcl1_l
_o__ismbcl2
_o__ismbcl2_l
_o__ismbclegal
_o__ismbclegal_l
_o__ismbclower
_o__ismbclower_l
_o__ismbcprint
_o__ismbcprint_l
_o__ismbcpunct
_o__ismbcpunct_l
_o__ismbcspace
_o__ismbcspace_l
_o__ismbcsymbol
_o__ismbcsymbol_l
_o__ismbcupper
_o__ismbcupper_l
_o__ismbslead
_o__ismbslead_l
_o__ismbstrail
_o__ismbstrail_l
_o__iswctype_l
_o__itoa
_o__itoa_s
_o__itow
_o__itow_s
_o__j0
_o__j1
_o__jn
_o__kbhit
_o__ld_int
_o__ldclass
_o__ldexp
_o__ldlog
_o__ldpcomp
_o__ldpoly
_o__ldscale
_o__ldsign
_o__ldsin
_o__ldtest
_o__ldunscale
_o__lfind
_o__lfind_s
_o__libm_sse2_acos_precise
_o__libm_sse2_asin_precise
_o__libm_sse2_atan_precise
_o__libm_sse2_cos_precise
_o__libm_sse2_exp_precise
_o__libm_sse2_log10_precise
_o__libm_sse2_log_precise
_o__libm_sse2_pow_precise
_o__libm_sse2_sin_precise
_o__libm_sse2_sqrt_precise
_o__libm_sse2_tan_precise
_o__loaddll
_o__localtime32
_o__localtime32_s
_o__localtime64
_o__localtime64_s
_o__lock_file
_o__locking
_o__logb
_o__lsearch
_o__lsearch_s
_o__lseek
_o__lseeki64
_o__ltoa
_o__ltoa_s
_o__ltow
_o__ltow_s
_o__makepath
_o__makepath_s
_o__malloc_base
_o__mbbtombc
_o__mbbtombc_l
_o__mbbtype
_o__mbbtype_l
_o__mbccpy
_o__mbccpy_l
_o__mbccpy_s
_o__mbccpy_s_l
_o__mbcjistojms
_o__mbcjistojms_l
_o__mbcjmstojis
_o__mbcjmstojis_l
_o__mbclen
_o__mbclen_l
_o__mbctohira
_o__mbctohira_l
_o__mbctokata
_o__mbctokata_l
_o__mbctolower
_o__mbctolower_l
_o__mbctombb
_o__mbctombb_l
_o__mbctoupper
_o__mbctoupper_l
_o__mblen_l
_o__mbsbtype
_o__mbsbtype_l
_o__mbscat_s
_o__mbscat_s_l
_o__mbschr
_o__mbschr_l
_o__mbscmp
_o__mbscmp_l
_o__mbscoll
_o__mbscoll_l
_o__mbscpy_s
_o__mbscpy_s_l
_o__mbscspn
_o__mbscspn_l
_o__mbsdec
_o__mbsdec_l
_o__mbsicmp
_o__mbsicmp_l
_o__mbsicoll
_o__mbsicoll_l
_o__mbsinc
_o__mbsinc_l
_o__mbslen
_o__mbslen_l
_o__mbslwr
_o__mbslwr_l
_o__mbslwr_s
_o__mbslwr_s_l
_o__mbsnbcat
_o__mbsnbcat_l
_o__mbsnbcat_s
_o__mbsnbcat_s_l
_o__mbsnbcmp
_o__mbsnbcmp_l
_o__mbsnbcnt
_o__mbsnbcnt_l
_o__mbsnbcoll
_o__mbsnbcoll_l
_o__mbsnbcpy
_o__mbsnbcpy_l
_o__mbsnbcpy_s
_o__mbsnbcpy_s_l
_o__mbsnbicmp
_o__mbsnbicmp_l
_o__mbsnbicoll
_o__mbsnbicoll_l
_o__mbsnbset
_o__mbsnbset_l
_o__mbsnbset_s
_o__mbsnbset_s_l
_o__mbsncat
_o__mbsncat_l
_o__mbsncat_s
_o__mbsncat_s_l
_o__mbsnccnt
_o__mbsnccnt_l
_o__mbsncmp
_o__mbsncmp_l
_o__mbsncoll
_o__mbsncoll_l
_o__mbsncpy
_o__mbsncpy_l
_o__mbsncpy_s
_o__mbsncpy_s_l
_o__mbsnextc
_o__mbsnextc_l
_o__mbsnicmp
_o__mbsnicmp_l
_o__mbsnicoll
_o__mbsnicoll_l
_o__mbsninc
_o__mbsninc_l
_o__mbsnlen
_o__mbsnlen_l
_o__mbsnset
_o__mbsnset_l
_o__mbsnset_s
_o__mbsnset_s_l
_o__mbspbrk
_o__mbspbrk_l
_o__mbsrchr
_o__mbsrchr_l
_o__mbsrev
_o__mbsrev_l
_o__mbsset
_o__mbsset_l
_o__mbsset_s
_o__mbsset_s_l
_o__mbsspn
_o__mbsspn_l
_o__mbsspnp
_o__mbsspnp_l
_o__mbsstr
_o__mbsstr_l
_o__mbstok
_o__mbstok_l
_o__mbstok_s
_o__mbstok_s_l
_o__mbstowcs_l
_o__mbstowcs_s_l
_o__mbstrlen
_o__mbstrlen_l
_o__mbstrnlen
_o__mbstrnlen_l
_o__mbsupr
_o__mbsupr_l
_o__mbsupr_s
_o__mbsupr_s_l
_o__mbtowc_l
_o__memicmp
_o__memicmp_l
_o__mkdir
_o__mkgmtime32
_o__mkgmtime64
_o__mktemp
_o__mktemp_s
_o__mktime32
_o__mktime64
_o__msize
_o__nextafter
_o__open_osfhandle
_o__pclose
_o__pipe
_o__popen
_o__purecall
_o__putc_nolock
_o__putch
_o__putch_nolock
_o__putenv
_o__putenv_s
_o__putw
_o__putwc_nolock
_o__putwch
_o__putwch_nolock
_o__putws
_o__read
_o__realloc_base
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__rmdir
_o__rmtmp
_o__scalb
_o__searchenv
_o__searchenv_s
_o__seh_filter_dll
_o__seh_filter_exe
_o__set_abort_behavior
_o__set_app_type
_o__set_doserrno
_o__set_errno
_o__set_fmode
_o__set_invalid_parameter_handler
_o__set_new_handler
_o__set_new_mode
_o__set_thread_local_invalid_parameter_handler
_o__seterrormode
_o__setmbcp
_o__setmode
_o__setsystime
_o__sleep
_o__sopen
_o__sopen_dispatch
_o__sopen_s
_o__spawnv
_o__spawnve
_o__spawnvp
_o__spawnvpe
_o__splitpath
_o__splitpath_s
_o__stat32
_o__stat32i64
_o__stat64
_o__stat64i32
_o__strcoll_l
_o__strdate
_o__strdate_s
_o__strdup
_o__strerror
_o__strerror_s
_o__strftime_l
_o__stricmp
_o__stricmp_l
_o__stricoll
_o__stricoll_l
_o__strlwr
_o__strlwr_l
_o__strlwr_s
_o__strlwr_s_l
_o__strncoll
_o__strncoll_l
_o__strnicmp
_o__strnicmp_l
_o__strnicoll
_o__strnicoll_l
_o__strnset_s
_o__strset_s
_o__strtime
_o__strtime_s
_o__strtod_l
_o__strtof_l
_o__strtoi64
_o__strtoi64_l
_o__strtol_l
_o__strtold_l
_o__strtoll_l
_o__strtoui64
_o__strtoui64_l
_o__strtoul_l
_o__strtoull_l
_o__strupr
_o__strupr_l
_o__strupr_s
_o__strupr_s_l
_o__strxfrm_l
_o__swab
_o__tell
_o__telli64
_o__timespec32_get
_o__timespec64_get
_o__tolower
_o__tolower_l
_o__toupper
_o__toupper_l
_o__towlower_l
_o__towupper_l
_o__tzset
_o__ui64toa
_o__ui64toa_s
_o__ui64tow
_o__ui64tow_s
_o__ultoa
_o__ultoa_s
_o__ultow
_o__ultow_s
_o__umask
_o__umask_s
_o__ungetc_nolock
_o__ungetch
_o__ungetch_nolock
_o__ungetwc_nolock
_o__ungetwch
_o__ungetwch_nolock
_o__unlink
_o__unloaddll
_o__unlock_file
_o__utime32
_o__utime64
_o__waccess
_o__waccess_s
_o__wasctime
_o__wasctime_s
_o__wchdir
_o__wchmod
_o__wcreat
_o__wcreate_locale
_o__wcscoll_l
_o__wcsdup
_o__wcserror
_o__wcserror_s
_o__wcsftime_l
_o__wcsicmp
_o__wcsicmp_l
_o__wcsicoll
_o__wcsicoll_l
_o__wcslwr
_o__wcslwr_l
_o__wcslwr_s
_o__wcslwr_s_l
_o__wcsncoll
_o__wcsncoll_l
_o__wcsnicmp
_o__wcsnicmp_l
_o__wcsnicoll
_o__wcsnicoll_l
_o__wcsnset
_o__wcsnset_s
_o__wcsset
_o__wcsset_s
_o__wcstod_l
_o__wcstof_l
_o__wcstoi64
_o__wcstoi64_l
_o__wcstol_l
_o__wcstold_l
_o__wcstoll_l
_o__wcstombs_l
_o__wcstombs_s_l
_o__wcstoui64
_o__wcstoui64_l
_o__wcstoul_l
_o__wcstoull_l
_o__wcsupr
_o__wcsupr_l
_o__wcsupr_s
_o__wcsupr_s_l
_o__wcsxfrm_l
_o__wctime32
_o__wctime32_s
_o__wctime64
_o__wctime64_s
_o__wctomb_l
_o__wctomb_s_l
_o__wdupenv_s
_o__wexecv
_o__wexecve
_o__wexecvp
_o__wexecvpe
_o__wfdopen
_o__wfindfirst32
_o__wfindfirst32i64
_o__wfindfirst64
_o__wfindfirst64i32
_o__wfindnext32
_o__wfindnext32i64
_o__wfindnext64
_o__wfindnext64i32
_o__wfopen
_o__wfopen_s
_o__wfreopen
_o__wfreopen_s
_o__wfsopen
_o__wfullpath
_o__wgetcwd
_o__wgetdcwd
_o__wgetenv
_o__wgetenv_s
_o__wmakepath
_o__wmakepath_s
_o__wmkdir
_o__wmktemp
_o__wmktemp_s
_o__wperror
_o__wpopen
_o__wputenv
_o__wputenv_s
_o__wremove
_o__wrename
_o__write
_o__wrmdir
_o__wsearchenv
_o__wsearchenv_s
_o__wsetlocale
_o__wsopen_dispatch
_o__wsopen_s
_o__wspawnv
_o__wspawnve
_o__wspawnvp
_o__wspawnvpe
_o__wsplitpath
_o__wsplitpath_s
_o__wstat32
_o__wstat32i64
_o__wstat64
_o__wstat64i32
_o__wstrdate
_o__wstrdate_s
_o__wstrtime
_o__wstrtime_s
_o__wsystem
_o__wtmpnam_s
_o__wtof
_o__wtof_l
_o__wtoi
_o__wtoi64
_o__wtoi64_l
_o__wtoi_l
_o__wtol
_o__wtol_l
_o__wtoll
_o__wtoll_l
_o__wunlink
_o__wutime32
_o__wutime64
_o__y0
_o__y1
_o__yn
_o_abort
_o_acos
_o_acosh
_o_acoshf
_o_acoshl
_o_asctime
_o_asctime_s
_o_asin
_o_asinh
_o_asinhf
_o_asinhl
_o_atan
_o_atan2
_o_atanh
_o_atanhf
_o_atanhl
_o_atof
_o_atoi
_o_atol
_o_atoll
_o_bsearch
_o_bsearch_s
_o_btowc
_o_calloc
_o_cbrt
_o_cbrtf
_o_ceil
_o_clearerr
_o_clearerr_s
_o_cos
_o_cosh
_o_erf
_o_erfc
_o_erfcf
_o_erfcl
_o_erff
_o_erfl
_o_exit
_o_exp
_o_exp2
_o_exp2f
_o_exp2l
_o_fabs
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgets
_o_fgetwc
_o_fgetws
_o_floor
_o_fma
_o_fmaf
_o_fmal
_o_fmod
_o_fopen
_o_fopen_s
_o_fputc
_o_fputs
_o_fputwc
_o_fputws
_o_fread
_o_fread_s
_o_free
_o_freopen
_o_freopen_s
_o_frexp
_o_fseek
_o_fsetpos
_o_ftell
_o_fwrite
_o_getc
_o_getchar
_o_getenv
_o_getenv_s
_o_gets
_o_gets_s
_o_getwc
_o_getwchar
_o_hypot
_o_is_wctype
_o_isalnum
_o_isalpha
_o_isblank
_o_iscntrl
_o_isdigit
_o_isgraph
_o_isleadbyte
_o_islower
_o_isprint
_o_ispunct
_o_isspace
_o_isupper
_o_iswalnum
_o_iswalpha
_o_iswascii
_o_iswblank
_o_iswcntrl
_o_iswctype
_o_iswdigit
_o_iswgraph
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_iswxdigit
_o_isxdigit
_o_ldexp
_o_lgamma
_o_lgammaf
_o_lgammal
_o_llrint
_o_llrintf
_o_llrintl
_o_llround
_o_llroundf
_o_llroundl
_o_localeconv
_o_log
_o_log10
_o_log1p
_o_log1pf
_o_log1pl
_o_log2
_o_log2f
_o_log2l
_o_logb
_o_logbf
_o_logbl
_o_lrint
_o_lrintf
_o_lrintl
_o_lround
_o_lroundf
_o_lroundl
_o_malloc
_o_mblen
_o_mbrlen
_o_mbrtoc16
_o_mbrtoc32
_o_mbrtowc
_o_mbsrtowcs
_o_mbsrtowcs_s
_o_mbstowcs
_o_mbstowcs_s
_o_mbtowc
_o_memcpy_s
_o_memset
_o_modf
_o_nan
_o_nanf
_o_nanl
_o_nearbyint
_o_nearbyintf
_o_nearbyintl
_o_nextafter
_o_nextafterf
_o_nextafterl
_o_nexttoward
_o_nexttowardf
_o_nexttowardl
_o_pow
_o_powf
_o_putc
_o_putchar
_o_puts
_o_putwc
_o_putwchar
_o_qsort
_o_qsort_s
_o_raise
_o_rand
_o_rand_s
_o_realloc
_o_remainder
_o_remainderf
_o_remainderl
_o_remove
_o_remquo
_o_remquof
_o_remquol
_o_rename
_o_rewind
_o_rint
_o_rintf
_o_rintl
_o_round
_o_roundf
_o_roundl
_o_scalbln
_o_scalblnf
_o_scalblnl
_o_scalbn
_o_scalbnf
_o_scalbnl
_o_set_terminate
_o_setbuf
_o_setlocale
_o_setvbuf
_o_sin
_o_sinh
_o_sqrt
_o_srand
_o_strcat_s
_o_strcoll
_o_strcpy_s
_o_strerror
_o_strerror_s
_o_strftime
_o_strncat_s
_o_strncpy_s
_o_strtod
_o_strtof
_o_strtok
_o_strtok_s
_o_strtol
_o_strtold
_o_strtoll
_o_strtoul
_o_strtoull
_o_system
_o_tan
_o_tanh
_o_terminate
_o_tgamma
_o_tgammaf
_o_tgammal
_o_tmpfile_s
_o_tmpnam_s
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcrtomb
_o_wcrtomb_s
_o_wcscat_s
_o_wcscoll
_o_wcscpy
_o_wcscpy_s
_o_wcsftime
_o_wcsncat_s
_o_wcsncpy_s
_o_wcsrtombs
_o_wcsrtombs_s
_o_wcstod
_o_wcstof
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstold
_o_wcstoll
_o_wcstombs
_o_wcstombs_s
_o_wcstoul
_o_wcstoull
_o_wctob
_o_wctomb
_o_wctomb_s
_o_wmemcpy_s
_o_wmemmove_s
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-process-l1-1-0.dll
- SHA256 a3f0366a58bf61f18b2c970a23990350798e8263c7dc57eef0b76e8af82d34ca
- MD5 e5ec8b0ebca33f8374dc5088b275b784
- SHA1 52e1f628e8fb6935708da4d15d0c60406849cd9c
- SHA512 43e99a7e1a92b7b1d5be43f74b582d00a53229bbc611675241249f2747428f58ce7e2d1491b173656a3de88f112f19e3dc0064546a701bb1e673650755595243
- SSDEEP 192:oonqjd71WphW3D1S8f4DBQABJtdwsy26ArNc4qnajr7PiqX:oon8WphW3D1IDBRJtesy/4lrPiE
- TLSH T1A542F78787F92A57E7636F3051B9C6877E3B53C6591082798852F15938823CAAF1062F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e3:f9:86:8f:2e:4b:fc:bb:3f:06:f4:80:db:7a:7e:06:34:32:5b:89:49:81:a2:b2:34:b5:9f:9b:da:80:50:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-process-l1-1-0.pdb
_beep
_cwait
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_loaddll
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_unloaddll
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-runtime-l1-1-0.dll
- SHA256 67b23770d9202fc430af5048086d330926555707553b5e800b65e48695d71ad8
- MD5 0580f611942d6ba3491511639f52e91b
- SHA1 17a991f59874823e6cbee1f3cdcb946fed208849
- SHA512 bde9a58c8c0f77fb7eb9237f4e263cb6098cfac7cbb780bd49adb6de09c2b36460ed9a318d8c59bd9ac7ecf62e6d4f6d973e89402503ee02793d865ce8993fec
- SSDEEP 192:TJB0fhrpIhhf4AN5/ji7WphWZnD1S8f4DBQABJtpH6ArNc4qnajr7Piv:T0hrKYWphWZnD1IDBRJtp64lrPa
- TLSH T1D962C68387E93F17E6972B7326F9D7DB1A3A238215508179C493E19938C2785FE0621F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:b5:64:9b:5b:21:1a:c0:89:ed:fe:d3:2d:e0:c4:ef:1f:db:b3:39:85:0e:e5:c8:4e:a4:b7:52:fd:f6:f7:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0d:f5:33:87:ea:d0:8e:38:f5:00:00:00:00:01:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-runtime-l1-1-0.pdb
_Exit
__control87_2
__doserrno
__fpe_flt_rounds
__fpecode
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__pgmptr
__p__wcmdln
__p__wpgmptr
__pxcptinfoptrs
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__wcserror
__wcserror_s
_assert
_beginthread
_beginthreadex
_c_exit
_cexit
_clearfp
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_endthread
_endthreadex
_errno
_execute_onexit_table
_exit
_fpieee_flt
_fpreset
_get_doserrno
_get_errno
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_pgmptr
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_wide_winmain_command_line
_get_wpgmptr
_getdllprocaddr
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_query_app_type
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_seh_filter_dll
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_invalid_parameter_handler
_set_new_handler
_set_thread_local_invalid_parameter_handler
_seterrormode
_sleep
_statusfp
_statusfp2
_strerror
_strerror_s
_wassert
_wcserror
_wcserror_s
_wperror
_wsystem
abort
exit
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
fesetenv
fesetexceptflag
fesetround
fetestexcept
perror
quick_exit
raise
set_terminate
signal
strerror
strerror_s
system
terminate
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-stdio-l1-1-0.dll
- SHA256 d6b21c2d5d385c60299f3974ed531f3d780fbe7b191a7a9842402558d46c354e
- MD5 7b122adb73c3eebac63d6567ec011c10
- SHA1 ec0293285e3e944ab3f9ab6191c4593211628274
- SHA512 c61b029b2a25f1482d7b4e0afd79e164f5b58d8affba670b11b983d00a0bd541ef39d851bc6d1863493620ad2289deff070a9436c7f240326092d128fe809faf
- SSDEEP 384:m19OFVh7WphW1D1IDBRJtvAzIwS+klTxj:e9OYAI1P4dOj
- TLSH T17E72C58386E83F02D39757731AFAEBEB1735538328147279C407A99435CA3D97E03559
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2c:17:d4:c8:a3:65:08:65:89:ef:4b:c3:72:51:2d:f7:83:2e:59:05:02:ff:ea:dd:e6:13:e2:a6:4a:2c:fe:34
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-stdio-l1-1-0.pdb
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_chsize
_chsize_s
_close
_commit
_creat
_dup
_dup2
_eof
_fclose_nolock
_fcloseall
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_flushall
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_ftell_nolock
_ftelli64
_ftelli64_nolock
_fwrite_nolock
_get_fmode
_get_osfhandle
_get_printf_count_output
_get_stream_buffer_pointers
_getc_nolock
_getcwd
_getdcwd
_getmaxstdio
_getw
_getwc_nolock
_getws
_getws_s
_isatty
_kbhit
_locking
_lseek
_lseeki64
_mktemp
_mktemp_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_putc_nolock
_putw
_putwc_nolock
_putws
_read
_rmtmp
_set_fmode
_set_printf_count_output
_setmaxstdio
_setmode
_sopen
_sopen_dispatch
_sopen_s
_tell
_telli64
_tempnam
_ungetc_nolock
_ungetwc_nolock
_wcreat
_wfdopen
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wmktemp
_wmktemp_s
_wopen
_wpopen
_write
_wsopen
_wsopen_dispatch
_wsopen_s
_wtempnam
_wtmpnam
_wtmpnam_s
clearerr
clearerr_s
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
freopen
freopen_s
fseek
fsetpos
ftell
fwrite
getc
getchar
gets
gets_s
getwc
getwchar
putc
putchar
puts
putwc
putwchar
rewind
setbuf
setvbuf
tmpfile
tmpfile_s
tmpnam
tmpnam_s
ungetc
ungetwc
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-string-l1-1-0.dll
- SHA256 91939ef769895f2dc0609b0619c7814d37ef46e28c3f54ad0c998d42c73474c7
- MD5 3ae5ab4383a95fc97e02e9da4d427e2b
- SHA1 43cbafa34ab3ec43759ed1095c00d5a457cf6dac
- SHA512 a3073db34b4d50967f16717b165159928808408a780b87873b38d659264e5d3f04c2ded3429613572e6486169119b9242d9d66f0cab009d6371298ccf925e94f
- SSDEEP 384:SeFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphWPiD1IDBRJJaa95DKlxT1xX3:SS5yguNvZ5VQgx3SbwA71IkFxS2I1PQ3
- TLSH T18D82C78386F83F41CA8F57B359FAC7C72A384F4625411375C067A59C3882792BE6BA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d8:b4:95:02:bc:aa:57:f8:a4:cd:f8:bc:13:ed:d4:8f:f6:9b:71:d3:d7:f1:2d:dc:30:88:85:c0:b3:62:45:76
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ff:2f:9e:6b:05:11:d3:6b:97:00:00:00:00:00:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-string-l1-1-0.pdb
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__strncnt
__wcsncnt
_isalnum_l
_isalpha_l
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_memccpy
_memicmp
_memicmp_l
_strcoll_l
_strdup
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_wcscoll_l
_wcsdup
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctype
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
mblen
mbrlen
memcpy_s
memmove_s
memset
strcat
strcat_s
strcmp
strcoll
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towctrans
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsspn
wcstok
wcstok_s
wcsxfrm
wctype
wmemcpy_s
wmemmove_s
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-time-l1-1-0.dll
- SHA256 9fe8435d6d007bd24e777101a95f6da76d1277b59ac385fd82f0fdd7f7df1fac
- MD5 174e2fefcef262400a287fea996eb890
- SHA1 d8bb309e1a10c34f085cc543572fe845a6cd0753
- SHA512 fad0f6661a9f33a7dfda584926ccd27e16bbc9024a43bec3a0fbdb5f3661c23188664c97bfff450dc93da67fc9ff47f1d5df6ee45651e847e24aa5d633bb1143
- SSDEEP 192:ny5NDSWphWHD1S8f4DBQABJtT8Nf5qAAqnaj/IO:nUEWphWHD1IDBRJtTwElDr
- TLSH T12152D6834AD46A0BFAD72B7112FAC7EB3B3513C22A90617A815794943A87384FE0345E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:d5:c5:6b:27:c7:df:92:f7:98:2d:22:a7:c3:df:90:0b:d9:46:00:f1:4a:47:4b:2e:c6:c5:0a:48:4a:50:0a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-time-l1-1-0.pdb
_Getdays
_Getmonths
_Gettnames
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__daylight
__dstbias
__timezone
__tzname
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_difftime32
_difftime64
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_futime32
_futime64
_get_daylight
_get_dstbias
_get_timezone
_get_tzname
_getsystime
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_mkgmtime32
_mkgmtime64
_mktime32
_mktime64
_setsystime
_strdate
_strdate_s
_strftime_l
_strtime
_strtime_s
_time32
_time64
_timespec32_get
_timespec64_get
_tzset
_utime32
_utime64
_wasctime
_wasctime_s
_wcsftime_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wutime32
_wutime64
asctime
asctime_s
clock
strftime
wcsftime
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-crt-utility-l1-1-0.dll
- SHA256 c604589408da77e37e9600caa6dd0f787621d7cb353f2f37e349e84785c01048
- MD5 95cc4c2e31ee92465f7463a29050f48b
- SHA1 82380ef9764eccf029c12f386f62ae9f42612afc
- SHA512 ba38cd3ddf72a008c7f6c30bf5cf67b33eb2179063e51bcc5bf3de088fa0a90469cecbb9acb713ab036321fceda24e0d7e5e8ea18681ecb45e1117967cec21eb
- SSDEEP 192:oTmXI6fHQduHWphWAhD1S8f4DBQABJJUtp9blDJ5iqnajVss1xGq:oT+fxWphWsD1IDBRJJe95DKlxT1xG
- TLSH T1EB323BC24AA85943E7AB3F7043F8E6877D3D27C218208676405AF6992C877C1FF0566E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b0:d0:5b:32:c8:33:6d:e4:a2:79:8e:08:8f:13:c3:df:29:f8:a4:96:3f:ff:4d:22:df:57:19:6a:ec:f3:d4:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ff:2f:9e:6b:05:11:d3:6b:97:00:00:00:00:00:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-utility-l1-1-0.pdb
_abs64
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_lfind
_lfind_s
_lrotl
_lrotr
_lsearch
_lsearch_s
_rotl
_rotl64
_rotr
_rotr64
_swab
abs
bsearch
bsearch_s
div
imaxabs
imaxdiv
labs
ldiv
llabs
lldiv
qsort
qsort_s
rand
rand_s
srand
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-eventing-consumer-l1-1-0.dll
- SHA256 c7f1f6f84e09bc96ca4472b8951164b8980ccf8fcf02d92f64ef7658a4e6d839
- MD5 7c619da95abf258bb3f7683bba3ec70d
- SHA1 68b245e0567a4e8b597ab3d0285360f719ba0641
- SHA512 a18e1506b641e6047c7f6f467a3f5b49145e2bec4311bb0f093a3f4aca17e16c746cdb8ed688bef17fa4f7210c45038a8b3de39711ac125c6204abb15dd4f4ba
- SSDEEP 192:5yT59pLxH9WphWA2D1S8f4DBQABJJX9p5xY7T0q11qnajVtPxo:G9r9WphWfD1IDBRJJX9BY7Tplxbo
- TLSH T109221AC147A88943FAAB7E7013A9D9537C3DA7CB29204256149AF7D92C833D1EB0477D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
95:04:c6:52:6f:36:60:b6:1c:9a:b6:0b:00:9e:28:d5:c5:11:96:95:7a:2b:c0:bf:61:38:ac:d0:63:35:0b:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
API-MS-Win-Eventing-Consumer-L1-1-0.pdb
CloseTrace
OpenTraceW
ProcessTrace
Name
.text
Size
512B
Virtual Size
495B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-security-base-l1-1-0.dll
- SHA256 dcbc7734a5b7ff3bea673a831ecdfa7169c0ddcd9ff052f3314140a8ef6abf8b
- MD5 8110a6ac705ec0c354249b4033d203fc
- SHA1 73041376d98714091e0b600b3aff0cc0c6d7e03f
- SHA512 b23fcf815df313a9f531d041b468dc585992bccae0bacb2f2ed00a70e523632770c9f02082fca9eb4bde39530a8474e105e7f98e87669184050669b7fa989663
- SSDEEP 384:ZgegRaB87W74EsL10c5VG5xWphW+D1IDBRJtCvfuOMlAsw:ZgeMa4W74Es5FGu5I1PK6w
- TLSH T184722A83A6585477FEDD66B40678DB4F7E34238C0C22830A01D2F196E4A67C6DF2A5CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:64:00:66:35:3d:66:c6:d9:97:f9:d1:84:1a:f2:92:ee:60:40:86:76:39:90:37:56:9f:93:19:6a:06:19:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-base-l1-1-0.pdb
AccessCheck
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddMandatoryAce
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
CheckTokenMembership
ConvertToAutoInheritPrivateObjectSecurity
CopySid
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateRestrictedToken
CreateWellKnownSid
DeleteAce
DestroyPrivateObjectSecurity
DuplicateToken
DuplicateTokenEx
EqualDomainSid
EqualPrefixSid
EqualSid
FindFirstFreeAce
FreeSid
GetAce
GetAclInformation
GetFileSecurityW
GetKernelObjectSecurity
GetLengthSid
GetPrivateObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSecurityDescriptorSacl
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetWindowsAccountDomainSid
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ImpersonateSelf
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
IsTokenRestricted
IsValidAcl
IsValidRelativeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
IsWellKnownSid
MakeAbsoluteSD
MakeAbsoluteSD2
MakeSelfRelativeSD
MapGenericMask
ObjectCloseAuditAlarmW
ObjectDeleteAuditAlarmW
ObjectOpenAuditAlarmW
ObjectPrivilegeAuditAlarmW
PrivilegeCheck
PrivilegedServiceAuditAlarmW
QuerySecurityAccessMask
RevertToSelf
SetAclInformation
SetFileSecurityW
SetKernelObjectSecurity
SetPrivateObjectSecurity
SetPrivateObjectSecurityEx
SetSecurityAccessMask
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorRMControl
SetSecurityDescriptorSacl
SetTokenInformation
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-security-cryptoapi-l1-1-0.dll
- SHA256 f42c7a3149b9e6d631c831ca5dd8c457847a306a714544c690601de89bbc823d
- MD5 a2937f79c8f958d72df442f0f2b3dbb0
- SHA1 b4e5ca05c1dab52d30dd8cf7d2ff473dc0259fdb
- SHA512 3a6727cb73bf137733ce16ee7fc116187af10412ed142ecf154dc15e98eed73209189400a5f58d592eadff102fb2217539943eef30be41801c737953c0acec84
- SSDEEP 192:OZQUypjTxhrr5eWg7/XMGmd0h94WphWdD1S8f4DBQABJdKf+hZE1usUDR0qnajVu:OjsPWphWdD1IDBRJdKP1uQlxzC
- TLSH T1404218D39AB4B8D3EFA96E301115CA6FBC38678E1E508B352095E4E45CC33E55B285EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5f:65:a4:73:fd:fc:01:fa:ad:b7:73:ce:e1:7c:46:57:79:88:9c:3a:94:ac:97:0d:21:3e:a1:4d:e5:8a:18:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-cryptoapi-l1-1-0.pdb
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-security-sddl-l1-1-0.dll
- SHA256 858376a84a09a688e6cdf583ae61b6f452d77aee036a0935846ac4c4125eea68
- MD5 912c51425b8a2a916604bcef6d64d495
- SHA1 e7dcf0c286dc2c62aa16fd3d14973571d469f399
- SHA512 2bfa553b8fd6ed72beff602cef061ac76b97136d58a687d10505a0a6a1fee0d4038b3fb40338e4950c247b9f63f23eef63b9fb7f64c0a3dd53509bebd9e630f0
- SSDEEP 192:0WphWMD1S8f4DBQABJRJ5QRW52fqnaj7zd3TKD:0WphWMD1IDBRJRjifl/zd3OD
- TLSH T100320A824BB85442FBEA6F7002ADD9873D3D63CB1C6082AA1499F1652C833D9DF1476E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
64:9b:1a:44:a0:f7:a6:67:27:7a:57:3a:1c:c1:0a:03:41:60:fc:fe:50:88:61:37:99:26:cf:40:8b:4e:ed:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:11:0d:02:9e:ee:d4:ed:05:d4:00:00:00:00:01:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-security-sddl-l1-1-0.pdb
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
Name
.text
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-core-l1-1-0.dll
- SHA256 8d6148de4b62e757275cd11156dfe1edcb2ee870bfc7b8fc2c83f95aec283031
- MD5 66dbcb29e449a409a53b866ccb6d71b3
- SHA1 94a07d9290635dbec1d6828f3ae05a2f50229c73
- SHA512 f5e4b086517c281e6dbc316e81a99cde385709e12065bc5bb3a1365062d980833a0f95f8a2d4ca9eea05cc9a3d329fbc11427c18b2337a5051e787b4e4516e60
- SSDEEP 192:Bmfoh9WphWUGD1S8f4DBQABJt0FJU5qAAqnaj/I5Od:BmQXWphWUGD1IDBRJt0FJtlDZd
- TLSH T18F322CC28BA85403FAE63E70529ADA933C3D77C6192086A91599F6A81CC33C5DF0466F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ef:e5:b5:7c:8c:f8:c2:89:52:0d:b0:5c:db:21:2d:8b:88:61:d1:73:0b:8c:70:ad:fd:34:4a:e2:28:62:a0:8e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-core-l1-1-0.pdb
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
Name
.text
Size
1024B
Virtual Size
570B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-core-l1-1-1.dll
- SHA256 a2b073fc9d99313ea2154d7fe27c4830ce2f13f199d44b6dad0dca98ee02ce77
- MD5 f9d00a77db8ee41cbae3d6830325fdad
- SHA1 58eaa6a0e3b9efd678fb46bc2d83c47e63ea7770
- SHA512 5f78a31e00f10638449e179c741c0d7864def6ee0d32f19711eee1e1104cb762b7fb8eebad99c6a88a420be7b289b74e30a5f459f10a5852dc53e6ac51fef7ed
- SSDEEP 192:tOeseWphWqD1S8f4DBQABJtgC65uE7Mqnajcn1X7k:tOeseWphWqD1IDBRJtpGuOMlA1Lk
- TLSH T1CA323CC18B785407F6A63F700299D9973D3D67CB196082AE1496F2992CC77C5DF00A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ab:28:7a:4a:fa:b8:f5:bb:79:33:4d:00:c6:76:03:ca:75:e5:0a:12:46:90:41:67:55:c5:74:27:f9:a7:dc:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-core-l1-1-1.pdb
EnumDependentServicesW
EnumServicesStatusExW
QueryServiceDynamicInformation
Name
.text
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-management-l1-1-0.dll
- SHA256 e5dda4cd55e43ab9d0217e67e9e0255b58bfa07da54be61fd0dfe186d32f2cc5
- MD5 5e1137aae1dae995d09c6d357b65f64a
- SHA1 1e0eb96ac028db8b833b6e2d528e11f183256b1f
- SHA512 f7ae64e44a056ebe810d7f9b915ae7a3d747ab3cdbf74ba1aceaea19d74316245414c0595e14aaf58bf9d7673ff2e53be3854fcbdaa2fdb044390f3234632780
- SSDEEP 192:ZOogwWphWAUD1S8f4DBQABJJ7M1i7T0q11qnajVtPxop:sogwWphWBD1IDBRJJIi7Tplxbop
- TLSH T1C93229C14BA85543EAAB3E7013AAD9537C3C63CA2D645296049EF2D92CC37C5EB00B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ff:ce:da:a6:e0:d5:34:2a:b6:54:ee:3e:3f:64:1f:92:be:2f:11:a6:07:1a:34:c1:c7:f1:7c:8d:7a:fe:1f:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-management-l1-1-0.pdb
CloseServiceHandle
ControlServiceExW
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
Name
.text
Size
1024B
Virtual Size
718B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-management-l2-1-0.dll
- SHA256 8e6e9ce2b81407ac3f420747b2f876acfda41c4a6c14457b7fdbf6fcee7cea3c
- MD5 3c8a9f87a8c923f082fee2985f2c91ee
- SHA1 455edeb000a4e4278f6d36f85ffa1fc2cbf6e3a8
- SHA512 cacdcc0d480d838f9152550f99a85173198314d3bc4956db17725ae558e3c0306104f67568be8b8201d75ab9c52824f40469b2ddeffce53b29b9a683ce2d5daa
- SSDEEP 192:EHwhhR7bWphWfD1S8f4DBQABJtDdFpeLirKqnaj/5o:EHwZWphWfD1IDBRJtDdOLIKlzu
- TLSH T1AA323A828BB85143FAF67F704296C9977C3D23CA1D2091561599F2A92CCB7C5EF00B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
20:57:c8:4e:b2:00:47:43:c6:bd:ed:9b:e8:e8:4f:8d:92:d2:bb:1d:fb:d1:9a:9e:97:17:ad:46:bb:5c:6d:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-management-l2-1-0.pdb
ChangeServiceConfig2W
ChangeServiceConfigW
NotifyServiceStatusChangeW
QueryServiceConfig2W
QueryServiceConfigW
QueryServiceObjectSecurity
QueryServiceStatusEx
SetServiceObjectSecurity
Name
.text
Size
1024B
Virtual Size
889B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-private-l1-1-0.dll
- SHA256 bfb46901411d0604ca15cd96029d37502a0be6f373beb4cabf118020d8465832
- MD5 9df32c68711941ba972103554c69862e
- SHA1 47d61c56d175581b915febf8f243dcf8b8ba263d
- SHA512 af903d82c00b4b33c8afbf212bd12793856f57021f9920be50e906d5a0055e54f5cebbb1a8dcda22a3dbd2a27a3632f5ecf41fee73953426aa66da7ad75d6298
- SSDEEP 192:akBl3tU3IP2imf1JWphWXfD1S8f4DBQABJdOl1usUDR0qnajVXj9wm:akBRiI2imf1JWphWPD1IDBRJdI1uQlxt
- TLSH T1213229C787A84483EEEE6E705656EF977C3E63CA1D20411915AAF1952CC37C8DF0066D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:2a:17:06:2c:2c:1f:09:73:26:c3:ed:d6:71:d9:e4:0d:80:2b:34:e8:fa:15:ed:c2:09:dc:00:59:04:b3:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-private-l1-1-0.pdb
I_QueryTagInformation
I_ScBroadcastServiceControlMessage
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterDeviceNotification
I_ScRpcBindA
I_ScRpcBindW
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScUnregisterDeviceNotification
I_ScValidatePnPService
SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications
WaitServiceState
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-private-l1-1-1.dll
- SHA256 de0914574b834bd92c2a38e3782fd8c796650145426784386129f43cc1b66d08
- MD5 c50fc9d5016500bfcafd2ecb7491cc84
- SHA1 33b1be0bc30f67168576f18e45a568edc180e033
- SHA512 a32464b08d4aa8185ceab1ff2f1f21c916f8ee9039441208adc9423ff227190e4d166979d7586e559de988c4d36a90e379fa1b40273d2ad3e2b09d93d15fb92a
- SSDEEP 192:+40l3tlQb3IP2imf17WphWgD1S8f4DBQABJte3pPqs7IwdY+kqnajHaqxgmUx:+40ROI2imf17WphWgD1IDBRJtkzIwS+D
- TLSH T19E4219C687A80412EEDE6E709B96EA473C3E23CB1C34815655D9F19A2CC37D9DF0069E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b3:a6:e4:1a:f1:89:f5:22:da:03:4b:94:58:35:1a:d5:6d:e7:d0:1b:b6:aa:bd:c6:d5:03:d2:52:58:bf:55:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A841-4BB4-CA93,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0e:26:91:f2:9d:92:db:81:29:00:00:00:00:01:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-private-l1-1-1.pdb
I_QueryTagInformation
I_ScBroadcastServiceControlMessage
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterDeviceNotification
I_ScRegisterPreshutdownRestart
I_ScRpcBindA
I_ScRpcBindW
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScUnregisterDeviceNotification
I_ScValidatePnPService
SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications
WaitServiceState
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-service-winsvc-l1-1-0.dll
- SHA256 37c49065c654c70c8bc1860ccdb5082b2917c7e66664bf6160d0cd2350b9b684
- MD5 8c03fac3a1a534d612d6e838666307ab
- SHA1 69f96e5c24739f83fad79a1930e4124cf4bdb431
- SHA512 ed83753d68e6a0a19c565b0d7feeea932ba5503cbeb7a20852b297d68b46f761a543a33cf8fe41bcea8ef915dc071daad2be18022640154540e964358306255f
- SSDEEP 192:oFM18k2z1q32irNx82/8WphWtD1S8f4DBQABJhyvuSB0884LfqnajJNtCQd:0MTKU32iOWphWtD1IDBRJhnkJllNtP
- TLSH T108424BC387A45463FEEA2E309697DB537C3E178E1C3492A206D8F59928D37C8DB0469D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:43:c8:2e:dd:24:0a:0b:55:44:51:f8:9a:38:98:ca:78:e3:40:ae:d8:ae:82:19:0a:f9:0e:4e:6e:e8:ad:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-service-winsvc-l1-1-0.pdb
ChangeServiceConfig2A
ChangeServiceConfigA
ControlService
ControlServiceExA
CreateServiceA
I_QueryTagInformation
I_ScBroadcastServiceControlMessage
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRpcBindA
I_ScRpcBindW
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScValidatePnPService
NotifyServiceStatusChangeA
OpenSCManagerA
OpenServiceA
QueryServiceConfig2A
QueryServiceConfigA
QueryServiceStatus
RegisterServiceCtrlHandlerA
RegisterServiceCtrlHandlerExA
RegisterServiceCtrlHandlerW
StartServiceA
StartServiceCtrlDispatcherA
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/api-ms-win-shcore-stream-l1-1-0.dll
- SHA256 fb0dc99e71aa2732079a0dcce54c052bcf9320be359f60cb306eea617365cc24
- MD5 0ac4d89b642a17dc4ff4f24aead9be67
- SHA1 1e33689c93c3d26453990d11d52b68d1fb0eb28c
- SHA512 b598e7ef0a41bfd02cbc551db09bb027ac65ab2dace9b7b9bfb09810a2753d925c0fa45ba9778f405250a30c137f19a3ded467d173b86932d5456a2312e6aa8c
- SSDEEP 192:J4WphW+Q4D1S8f4DBQABJtFSqS4kOqnaj2NLmmI/:yWphWR4D1IDBRJtw2lgK9/
- TLSH T159324C9187784407EA763E701A98CAD77D3D3BC76D20836908A9F2A91C473D5EF10B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:f2:d3:0d:f5:01:5e:c6:e9:d6:98:81:f4:f3:75:33:c1:e8:e0:d1:0f:28:f3:33:ad:4b:12:ab:b4:83:0c:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-shcore-stream-l1-1-0.pdb
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=27412,
count=2, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/downlevel/ucrtbase.dll
- IMPHASH ea37cb467ea2adb2b776c1c8c105007c
- SHA256 ac3319177333327e4ffbc42bc268aa1873d60ef21541085ed0778c5862c466b9
- MD5 f0163accb7c9d9506fa3122fac2a15a9
- SHA1 a1e277e0c41a57dd643c4f5e13bda0aeb1ab5237
- SHA512 c3121b3cd8be949045ed3a26b568f21e4f2ac18edf212aff219091ed9019410164adbac5cb4b5427db31994345c0f23fce7619290f94e69d3f4c5e9ed0a3ff90
- SSDEEP 24576:GWidEhqcKIqMOKgf4GokSnxqZbCU3lYU+6ozo+mSY+mcvIZPoy4PmcLloH:lidEhqFBMiExqZiY4o+mSpmcZi
- TLSH T1DF453A193585E0AEDC6D3279136BB522346C76924BB8ECC377840BE98E301D16736EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b9:c2:54:e6:71:6a:c6:a1:38:05:f4:1d:69:1f:51:69:43:c9:49:0a:48:0a:f7:4a:f9:76:bd:84:ab:73:5c:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 7, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:e8:93:3c:c4:14:fa:f5:7c:00:00:00:00:02:29
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 27, 2019 - Mar 27, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0f:80:72:f6:3a:87:08:88:ad:00:00:00:00:01:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
176496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ucrtbase.pdb
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapCompact
HeapSize
HeapWalk
HeapValidate
HeapAlloc
GetProcessHeap
HeapQueryInformation
HeapFree
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
TerminateProcess
TlsAlloc
GetCurrentThread
GetCurrentThreadId
TlsGetValue
ExitProcess
CreateThread
CreateProcessW
GetExitCodeProcess
TlsSetValue
ResumeThread
TlsFree
ExitThread
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
FreeEnvironmentStringsW
GetStdHandle
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineA
SetEnvironmentVariableW
GetCommandLineW
SetStdHandle
api-ms-win-core-file-l1-1-0
GetFileSizeEx
SetFilePointerEx
CreateFileW
GetFileType
FindClose
FindNextFileW
FindFirstFileExW
GetFullPathNameW
GetDriveTypeW
GetFileInformationByHandle
GetFileAttributesExW
SetFileAttributesW
GetDiskFreeSpaceW
GetLogicalDrives
CreateDirectoryW
SetFileTime
RemoveDirectoryW
LockFileEx
UnlockFileEx
FlushFileBuffers
SetEndOfFile
DeleteFileW
WriteFile
ReadFile
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
LCMapStringW
EnumSystemLocalesW
IsValidLocale
GetACP
GetCPInfo
GetUserDefaultLCID
GetOEMCP
GetLocaleInfoW
IsValidCodePage
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-sysinfo-l1-1-0
SetLocalTime
GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-console-l1-1-0
GetConsoleMode
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleCP
SetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
ReadConsoleW
ReadConsoleInputW
PeekConsoleInputA
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
CreatePipe
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
VirtualAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
Beep
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_Exit
_FCbuild
_FCmulcc
_FCmulcr
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_IsExceptionObjectToBeDestroyed
_LCbuild
_LCmulcc
_LCmulcr
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__acrt_iob_func
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
__control87_2
__current_exception
__current_exception_context
__daylight
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__doserrno
__dstbias
__fpe_flt_rounds
__fpecode
__initialize_lconv_for_unsigned_char
__intrinsic_abnormal_termination
__intrinsic_setjmp
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__environ
__p__fmode
__p__mbcasemap
__p__mbctype
__p__pgmptr
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__processing_throw
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__setusermatherr
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__strncnt
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__wcserror
__wcserror_s
__wcsncnt
_abs64
_access
_access_s
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_base
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chgsignf
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_configthreadlocale
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_copysign
_copysignf
_cputs
_cputws
_creat
_create_locale
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_d_int
_dclass
_dexp
_difftime32
_difftime64
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_endthread
_endthreadex
_eof
_errno
_except1
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execute_onexit_table
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flushall
_fpclass
_fpieee_flt
_fpreset
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_base
_free_locale
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwrite_nolock
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_osfhandle
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_stream_buffer_pointers
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_timezone
_get_tzname
_get_unexpected
_get_wide_winmain_command_line
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwc_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapchk
_heapmin
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_is_exception_typeof
_isalnum_l
_isalpha_l
_isatty
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_isnan
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_itoa
_itoa_s
_itow
_itow_s
_j0
_j1
_jn
_kbhit
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_lfind
_lfind_s
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_loaddll
_local_unwind2
_local_unwind4
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_lock_file
_lock_locales
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lsearch_s
_lseek
_lseeki64
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath
_makepath_s
_malloc_base
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
_memccpy
_memicmp
_memicmp_l
_mkdir
_mkgmtime32
_mkgmtime64
_mktemp
_mktemp_s
_mktime32
_mktime64
_msize
_nextafter
_o__CIacos
_o__CIasin
_o__CIatan
_o__CIatan2
_o__CIcos
_o__CIcosh
_o__CIexp
_o__CIfmod
_o__CIlog
_o__CIlog10
_o__CIpow
_o__CIsin
_o__CIsinh
_o__CIsqrt
_o__CItan
_o__CItanh
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__Wcsftime
_o____lc_codepage_func
_o____lc_collate_cp_func
_o____lc_locale_name_func
_o____mb_cur_max_func
_o___acrt_iob_func
_o___conio_common_vcprintf
_o___conio_common_vcprintf_p
_o___conio_common_vcprintf_s
_o___conio_common_vcscanf
_o___conio_common_vcwprintf
_o___conio_common_vcwprintf_p
_o___conio_common_vcwprintf_s
_o___conio_common_vcwscanf
_o___daylight
_o___dstbias
_o___fpe_flt_rounds
_o___libm_sse2_acos
_o___libm_sse2_acosf
_o___libm_sse2_asin
_o___libm_sse2_asinf
_o___libm_sse2_atan
_o___libm_sse2_atan2
_o___libm_sse2_atanf
_o___libm_sse2_cos
_o___libm_sse2_cosf
_o___libm_sse2_exp
_o___libm_sse2_expf
_o___libm_sse2_log
_o___libm_sse2_log10
_o___libm_sse2_log10f
_o___libm_sse2_logf
_o___libm_sse2_pow
_o___libm_sse2_powf
_o___libm_sse2_sin
_o___libm_sse2_sinf
_o___libm_sse2_tan
_o___libm_sse2_tanf
_o___p___argc
_o___p___argv
_o___p___wargv
_o___p__acmdln
_o___p__commode
_o___p__environ
_o___p__fmode
_o___p__mbcasemap
_o___p__mbctype
_o___p__pgmptr
_o___p__wcmdln
_o___p__wenviron
_o___p__wpgmptr
_o___pctype_func
_o___pwctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___std_type_info_name
_o___stdio_common_vfprintf
_o___stdio_common_vfprintf_p
_o___stdio_common_vfprintf_s
_o___stdio_common_vfscanf
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_p
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfwscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsprintf_p
_o___stdio_common_vsprintf_s
_o___stdio_common_vsscanf
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o___timezone
_o___tzname
_o___wcserror
_o__access
_o__access_s
_o__aligned_free
_o__aligned_malloc
_o__aligned_msize
_o__aligned_offset_malloc
_o__aligned_offset_realloc
_o__aligned_offset_recalloc
_o__aligned_realloc
_o__aligned_recalloc
_o__atodbl
_o__atodbl_l
_o__atof_l
_o__atoflt
_o__atoflt_l
_o__atoi64
_o__atoi64_l
_o__atoi_l
_o__atol_l
_o__atoldbl
_o__atoldbl_l
_o__atoll_l
_o__beep
_o__beginthread
_o__beginthreadex
_o__cabs
_o__callnewh
_o__calloc_base
_o__cexit
_o__cgets
_o__cgets_s
_o__cgetws
_o__cgetws_s
_o__chdir
_o__chdrive
_o__chmod
_o__chsize
_o__chsize_s
_o__close
_o__commit
_o__configthreadlocale
_o__configure_narrow_argv
_o__configure_wide_argv
_o__controlfp_s
_o__cputs
_o__cputws
_o__creat
_o__create_locale
_o__crt_atexit
_o__ctime32_s
_o__ctime64_s
_o__cwait
_o__d_int
_o__dclass
_o__difftime32
_o__difftime64
_o__dlog
_o__dnorm
_o__dpcomp
_o__dpoly
_o__dscale
_o__dsign
_o__dsin
_o__dtest
_o__dunscale
_o__dup
_o__dup2
_o__dupenv_s
_o__ecvt
_o__ecvt_s
_o__endthread
_o__endthreadex
_o__eof
_o__errno
_o__except1
_o__execute_onexit_table
_o__execv
_o__execve
_o__execvp
_o__execvpe
_o__exit
_o__expand
_o__fclose_nolock
_o__fcloseall
_o__fcvt
_o__fcvt_s
_o__fd_int
_o__fdclass
_o__fdexp
_o__fdlog
_o__fdopen
_o__fdpcomp
_o__fdpoly
_o__fdscale
_o__fdsign
_o__fdsin
_o__fflush_nolock
_o__fgetc_nolock
_o__fgetchar
_o__fgetwc_nolock
_o__fgetwchar
_o__filelength
_o__filelengthi64
_o__fileno
_o__findclose
_o__findfirst32
_o__findfirst32i64
_o__findfirst64
_o__findfirst64i32
_o__findnext32
_o__findnext32i64
_o__findnext64
_o__findnext64i32
_o__flushall
_o__fpclass
_o__fputc_nolock
_o__fputchar
_o__fputwc_nolock
_o__fputwchar
_o__fread_nolock
_o__fread_nolock_s
_o__free_base
_o__free_locale
_o__fseek_nolock
_o__fseeki64
_o__fseeki64_nolock
_o__fsopen
_o__fstat32
_o__fstat32i64
_o__fstat64
_o__fstat64i32
_o__ftell_nolock
_o__ftelli64
_o__ftelli64_nolock
_o__ftime32
_o__ftime32_s
_o__ftime64
_o__ftime64_s
_o__fullpath
_o__futime32
_o__futime64
_o__fwrite_nolock
_o__gcvt
_o__gcvt_s
_o__get_daylight
_o__get_doserrno
_o__get_dstbias
_o__get_errno
_o__get_fmode
_o__get_heap_handle
_o__get_initial_narrow_environment
_o__get_initial_wide_environment
_o__get_invalid_parameter_handler
_o__get_narrow_winmain_command_line
_o__get_osfhandle
_o__get_pgmptr
_o__get_stream_buffer_pointers
_o__get_terminate
_o__get_thread_local_invalid_parameter_handler
_o__get_timezone
_o__get_tzname
_o__get_wide_winmain_command_line
_o__get_wpgmptr
_o__getc_nolock
_o__getch
_o__getch_nolock
_o__getche
_o__getche_nolock
_o__getcwd
_o__getdcwd
_o__getdiskfree
_o__getdllprocaddr
_o__getdrive
_o__getdrives
_o__getmbcp
_o__getsystime
_o__getw
_o__getwc_nolock
_o__getwch
_o__getwch_nolock
_o__getwche
_o__getwche_nolock
_o__getws
_o__getws_s
_o__gmtime32
_o__gmtime32_s
_o__gmtime64
_o__gmtime64_s
_o__heapchk
_o__heapmin
_o__hypot
_o__hypotf
_o__i64toa
_o__i64toa_s
_o__i64tow
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__isctype
_o__isctype_l
_o__isleadbyte_l
_o__ismbbalnum
_o__ismbbalnum_l
_o__ismbbalpha
_o__ismbbalpha_l
_o__ismbbblank
_o__ismbbblank_l
_o__ismbbgraph
_o__ismbbgraph_l
_o__ismbbkalnum
_o__ismbbkalnum_l
_o__ismbbkana
_o__ismbbkana_l
_o__ismbbkprint
_o__ismbbkprint_l
_o__ismbbkpunct
_o__ismbbkpunct_l
_o__ismbblead
_o__ismbblead_l
_o__ismbbprint
_o__ismbbprint_l
_o__ismbbpunct
_o__ismbbpunct_l
_o__ismbbtrail
_o__ismbbtrail_l
_o__ismbcalnum
_o__ismbcalnum_l
_o__ismbcalpha
_o__ismbcalpha_l
_o__ismbcblank
_o__ismbcblank_l
_o__ismbcdigit
_o__ismbcdigit_l
_o__ismbcgraph
_o__ismbcgraph_l
_o__ismbchira
_o__ismbchira_l
_o__ismbckata
_o__ismbckata_l
_o__ismbcl0
_o__ismbcl0_l
_o__ismbcl1
_o__ismbcl1_l
_o__ismbcl2
_o__ismbcl2_l
_o__ismbclegal
_o__ismbclegal_l
_o__ismbclower
_o__ismbclower_l
_o__ismbcprint
_o__ismbcprint_l
_o__ismbcpunct
_o__ismbcpunct_l
_o__ismbcspace
_o__ismbcspace_l
_o__ismbcsymbol
_o__ismbcsymbol_l
_o__ismbcupper
_o__ismbcupper_l
_o__ismbslead
_o__ismbslead_l
_o__ismbstrail
_o__ismbstrail_l
_o__iswctype_l
_o__itoa
_o__itoa_s
_o__itow
_o__itow_s
_o__j0
_o__j1
_o__jn
_o__kbhit
_o__ld_int
_o__ldclass
_o__ldexp
_o__ldlog
_o__ldpcomp
_o__ldpoly
_o__ldscale
_o__ldsign
_o__ldsin
_o__ldtest
_o__ldunscale
_o__lfind
_o__lfind_s
_o__libm_sse2_acos_precise
_o__libm_sse2_asin_precise
_o__libm_sse2_atan_precise
_o__libm_sse2_cos_precise
_o__libm_sse2_exp_precise
_o__libm_sse2_log10_precise
_o__libm_sse2_log_precise
_o__libm_sse2_pow_precise
_o__libm_sse2_sin_precise
_o__libm_sse2_sqrt_precise
_o__libm_sse2_tan_precise
_o__loaddll
_o__localtime32
_o__localtime32_s
_o__localtime64
_o__localtime64_s
_o__lock_file
_o__locking
_o__logb
_o__lsearch
_o__lsearch_s
_o__lseek
_o__lseeki64
_o__ltoa
_o__ltoa_s
_o__ltow
_o__ltow_s
_o__makepath
_o__makepath_s
_o__malloc_base
_o__mbbtombc
_o__mbbtombc_l
_o__mbbtype
_o__mbbtype_l
_o__mbccpy
_o__mbccpy_l
_o__mbccpy_s
_o__mbccpy_s_l
_o__mbcjistojms
_o__mbcjistojms_l
_o__mbcjmstojis
_o__mbcjmstojis_l
_o__mbclen
_o__mbclen_l
_o__mbctohira
_o__mbctohira_l
_o__mbctokata
_o__mbctokata_l
_o__mbctolower
_o__mbctolower_l
_o__mbctombb
_o__mbctombb_l
_o__mbctoupper
_o__mbctoupper_l
_o__mblen_l
_o__mbsbtype
_o__mbsbtype_l
_o__mbscat_s
_o__mbscat_s_l
_o__mbschr
_o__mbschr_l
_o__mbscmp
_o__mbscmp_l
_o__mbscoll
_o__mbscoll_l
_o__mbscpy_s
_o__mbscpy_s_l
_o__mbscspn
_o__mbscspn_l
_o__mbsdec
_o__mbsdec_l
_o__mbsicmp
_o__mbsicmp_l
_o__mbsicoll
_o__mbsicoll_l
_o__mbsinc
_o__mbsinc_l
_o__mbslen
_o__mbslen_l
_o__mbslwr
_o__mbslwr_l
_o__mbslwr_s
_o__mbslwr_s_l
_o__mbsnbcat
_o__mbsnbcat_l
_o__mbsnbcat_s
_o__mbsnbcat_s_l
_o__mbsnbcmp
_o__mbsnbcmp_l
_o__mbsnbcnt
_o__mbsnbcnt_l
_o__mbsnbcoll
_o__mbsnbcoll_l
_o__mbsnbcpy
_o__mbsnbcpy_l
_o__mbsnbcpy_s
_o__mbsnbcpy_s_l
_o__mbsnbicmp
_o__mbsnbicmp_l
_o__mbsnbicoll
_o__mbsnbicoll_l
_o__mbsnbset
_o__mbsnbset_l
_o__mbsnbset_s
_o__mbsnbset_s_l
_o__mbsncat
_o__mbsncat_l
_o__mbsncat_s
_o__mbsncat_s_l
_o__mbsnccnt
_o__mbsnccnt_l
_o__mbsncmp
_o__mbsncmp_l
_o__mbsncoll
_o__mbsncoll_l
_o__mbsncpy
_o__mbsncpy_l
_o__mbsncpy_s
_o__mbsncpy_s_l
_o__mbsnextc
_o__mbsnextc_l
_o__mbsnicmp
_o__mbsnicmp_l
_o__mbsnicoll
_o__mbsnicoll_l
_o__mbsninc
_o__mbsninc_l
_o__mbsnlen
_o__mbsnlen_l
_o__mbsnset
_o__mbsnset_l
_o__mbsnset_s
_o__mbsnset_s_l
_o__mbspbrk
_o__mbspbrk_l
_o__mbsrchr
_o__mbsrchr_l
_o__mbsrev
_o__mbsrev_l
_o__mbsset
_o__mbsset_l
_o__mbsset_s
_o__mbsset_s_l
_o__mbsspn
_o__mbsspn_l
_o__mbsspnp
_o__mbsspnp_l
_o__mbsstr
_o__mbsstr_l
_o__mbstok
_o__mbstok_l
_o__mbstok_s
_o__mbstok_s_l
_o__mbstowcs_l
_o__mbstowcs_s_l
_o__mbstrlen
_o__mbstrlen_l
_o__mbstrnlen
_o__mbstrnlen_l
_o__mbsupr
_o__mbsupr_l
_o__mbsupr_s
_o__mbsupr_s_l
_o__mbtowc_l
_o__memicmp
_o__memicmp_l
_o__mkdir
_o__mkgmtime32
_o__mkgmtime64
_o__mktemp
_o__mktemp_s
_o__mktime32
_o__mktime64
_o__msize
_o__nextafter
_o__open_osfhandle
_o__pclose
_o__pipe
_o__popen
_o__purecall
_o__putc_nolock
_o__putch
_o__putch_nolock
_o__putenv
_o__putenv_s
_o__putw
_o__putwc_nolock
_o__putwch
_o__putwch_nolock
_o__putws
_o__read
_o__realloc_base
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__rmdir
_o__rmtmp
_o__scalb
_o__searchenv
_o__searchenv_s
_o__seh_filter_dll
_o__seh_filter_exe
_o__set_abort_behavior
_o__set_app_type
_o__set_doserrno
_o__set_errno
_o__set_fmode
_o__set_invalid_parameter_handler
_o__set_new_handler
_o__set_new_mode
_o__set_thread_local_invalid_parameter_handler
_o__seterrormode
_o__setmbcp
_o__setmode
_o__setsystime
_o__sleep
_o__sopen
_o__sopen_dispatch
_o__sopen_s
_o__spawnv
_o__spawnve
_o__spawnvp
_o__spawnvpe
_o__splitpath
_o__splitpath_s
_o__stat32
_o__stat32i64
_o__stat64
_o__stat64i32
_o__strcoll_l
_o__strdate
_o__strdate_s
_o__strdup
_o__strerror
_o__strerror_s
_o__strftime_l
_o__stricmp
_o__stricmp_l
_o__stricoll
_o__stricoll_l
_o__strlwr
_o__strlwr_l
_o__strlwr_s
_o__strlwr_s_l
_o__strncoll
_o__strncoll_l
_o__strnicmp
_o__strnicmp_l
_o__strnicoll
_o__strnicoll_l
_o__strnset_s
_o__strset_s
_o__strtime
_o__strtime_s
_o__strtod_l
_o__strtof_l
_o__strtoi64
_o__strtoi64_l
_o__strtol_l
_o__strtold_l
_o__strtoll_l
_o__strtoui64
_o__strtoui64_l
_o__strtoul_l
_o__strtoull_l
_o__strupr
_o__strupr_l
_o__strupr_s
_o__strupr_s_l
_o__strxfrm_l
_o__swab
_o__tell
_o__telli64
_o__timespec32_get
_o__timespec64_get
_o__tolower
_o__tolower_l
_o__toupper
_o__toupper_l
_o__towlower_l
_o__towupper_l
_o__tzset
_o__ui64toa
_o__ui64toa_s
_o__ui64tow
_o__ui64tow_s
_o__ultoa
_o__ultoa_s
_o__ultow
_o__ultow_s
_o__umask
_o__umask_s
_o__ungetc_nolock
_o__ungetch
_o__ungetch_nolock
_o__ungetwc_nolock
_o__ungetwch
_o__ungetwch_nolock
_o__unlink
_o__unloaddll
_o__unlock_file
_o__utime32
_o__utime64
_o__waccess
_o__waccess_s
_o__wasctime
_o__wasctime_s
_o__wchdir
_o__wchmod
_o__wcreat
_o__wcreate_locale
_o__wcscoll_l
_o__wcsdup
_o__wcserror
_o__wcserror_s
_o__wcsftime_l
_o__wcsicmp
_o__wcsicmp_l
_o__wcsicoll
_o__wcsicoll_l
_o__wcslwr
_o__wcslwr_l
_o__wcslwr_s
_o__wcslwr_s_l
_o__wcsncoll
_o__wcsncoll_l
_o__wcsnicmp
_o__wcsnicmp_l
_o__wcsnicoll
_o__wcsnicoll_l
_o__wcsnset
_o__wcsnset_s
_o__wcsset
_o__wcsset_s
_o__wcstod_l
_o__wcstof_l
_o__wcstoi64
_o__wcstoi64_l
_o__wcstol_l
_o__wcstold_l
_o__wcstoll_l
_o__wcstombs_l
_o__wcstombs_s_l
_o__wcstoui64
_o__wcstoui64_l
_o__wcstoul_l
_o__wcstoull_l
_o__wcsupr
_o__wcsupr_l
_o__wcsupr_s
_o__wcsupr_s_l
_o__wcsxfrm_l
_o__wctime32
_o__wctime32_s
_o__wctime64
_o__wctime64_s
_o__wctomb_l
_o__wctomb_s_l
_o__wdupenv_s
_o__wexecv
_o__wexecve
_o__wexecvp
_o__wexecvpe
_o__wfdopen
_o__wfindfirst32
_o__wfindfirst32i64
_o__wfindfirst64
_o__wfindfirst64i32
_o__wfindnext32
_o__wfindnext32i64
_o__wfindnext64
_o__wfindnext64i32
_o__wfopen
_o__wfopen_s
_o__wfreopen
_o__wfreopen_s
_o__wfsopen
_o__wfullpath
_o__wgetcwd
_o__wgetdcwd
_o__wgetenv
_o__wgetenv_s
_o__wmakepath
_o__wmakepath_s
_o__wmkdir
_o__wmktemp
_o__wmktemp_s
_o__wperror
_o__wpopen
_o__wputenv
_o__wputenv_s
_o__wremove
_o__wrename
_o__write
_o__wrmdir
_o__wsearchenv
_o__wsearchenv_s
_o__wsetlocale
_o__wsopen_dispatch
_o__wsopen_s
_o__wspawnv
_o__wspawnve
_o__wspawnvp
_o__wspawnvpe
_o__wsplitpath
_o__wsplitpath_s
_o__wstat32
_o__wstat32i64
_o__wstat64
_o__wstat64i32
_o__wstrdate
_o__wstrdate_s
_o__wstrtime
_o__wstrtime_s
_o__wsystem
_o__wtmpnam_s
_o__wtof
_o__wtof_l
_o__wtoi
_o__wtoi64
_o__wtoi64_l
_o__wtoi_l
_o__wtol
_o__wtol_l
_o__wtoll
_o__wtoll_l
_o__wunlink
_o__wutime32
_o__wutime64
_o__y0
_o__y1
_o__yn
_o_abort
_o_acos
_o_acosh
_o_acoshf
_o_acoshl
_o_asctime
_o_asctime_s
_o_asin
_o_asinh
_o_asinhf
_o_asinhl
_o_atan
_o_atan2
_o_atanh
_o_atanhf
_o_atanhl
_o_atof
_o_atoi
_o_atol
_o_atoll
_o_bsearch
_o_bsearch_s
_o_btowc
_o_calloc
_o_cbrt
_o_cbrtf
_o_ceil
_o_clearerr
_o_clearerr_s
_o_cos
_o_cosh
_o_erf
_o_erfc
_o_erfcf
_o_erfcl
_o_erff
_o_erfl
_o_exit
_o_exp
_o_exp2
_o_exp2f
_o_exp2l
_o_fabs
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgets
_o_fgetwc
_o_fgetws
_o_floor
_o_fma
_o_fmaf
_o_fmal
_o_fmod
_o_fopen
_o_fopen_s
_o_fputc
_o_fputs
_o_fputwc
_o_fputws
_o_fread
_o_fread_s
_o_free
_o_freopen
_o_freopen_s
_o_frexp
_o_fseek
_o_fsetpos
_o_ftell
_o_fwrite
_o_getc
_o_getchar
_o_getenv
_o_getenv_s
_o_gets
_o_gets_s
_o_getwc
_o_getwchar
_o_hypot
_o_is_wctype
_o_isalnum
_o_isalpha
_o_isblank
_o_iscntrl
_o_isdigit
_o_isgraph
_o_isleadbyte
_o_islower
_o_isprint
_o_ispunct
_o_isspace
_o_isupper
_o_iswalnum
_o_iswalpha
_o_iswascii
_o_iswblank
_o_iswcntrl
_o_iswctype
_o_iswdigit
_o_iswgraph
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_iswxdigit
_o_isxdigit
_o_ldexp
_o_lgamma
_o_lgammaf
_o_lgammal
_o_llrint
_o_llrintf
_o_llrintl
_o_llround
_o_llroundf
_o_llroundl
_o_localeconv
_o_log
_o_log10
_o_log1p
_o_log1pf
_o_log1pl
_o_log2
_o_log2f
_o_log2l
_o_logb
_o_logbf
_o_logbl
_o_lrint
_o_lrintf
_o_lrintl
_o_lround
_o_lroundf
_o_lroundl
_o_malloc
_o_mblen
_o_mbrlen
_o_mbrtoc16
_o_mbrtoc32
_o_mbrtowc
_o_mbsrtowcs
_o_mbsrtowcs_s
_o_mbstowcs
_o_mbstowcs_s
_o_mbtowc
_o_memcpy_s
_o_memset
_o_modf
_o_nan
_o_nanf
_o_nanl
_o_nearbyint
_o_nearbyintf
_o_nearbyintl
_o_nextafter
_o_nextafterf
_o_nextafterl
_o_nexttoward
_o_nexttowardf
_o_nexttowardl
_o_pow
_o_powf
_o_putc
_o_putchar
_o_puts
_o_putwc
_o_putwchar
_o_qsort
_o_qsort_s
_o_raise
_o_rand
_o_rand_s
_o_realloc
_o_remainder
_o_remainderf
_o_remainderl
_o_remove
_o_remquo
_o_remquof
_o_remquol
_o_rename
_o_rewind
_o_rint
_o_rintf
_o_rintl
_o_round
_o_roundf
_o_roundl
_o_scalbln
_o_scalblnf
_o_scalblnl
_o_scalbn
_o_scalbnf
_o_scalbnl
_o_set_terminate
_o_setbuf
_o_setlocale
_o_setvbuf
_o_sin
_o_sinh
_o_sqrt
_o_srand
_o_strcat_s
_o_strcoll
_o_strcpy_s
_o_strerror
_o_strerror_s
_o_strftime
_o_strncat_s
_o_strncpy_s
_o_strtod
_o_strtof
_o_strtok
_o_strtok_s
_o_strtol
_o_strtold
_o_strtoll
_o_strtoul
_o_strtoull
_o_system
_o_tan
_o_tanh
_o_terminate
_o_tgamma
_o_tgammaf
_o_tgammal
_o_tmpfile_s
_o_tmpnam_s
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcrtomb
_o_wcrtomb_s
_o_wcscat_s
_o_wcscoll
_o_wcscpy
_o_wcscpy_s
_o_wcsftime
_o_wcsncat_s
_o_wcsncpy_s
_o_wcsrtombs
_o_wcsrtombs_s
_o_wcstod
_o_wcstof
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstold
_o_wcstoll
_o_wcstombs
_o_wcstombs_s
_o_wcstoul
_o_wcstoull
_o_wctob
_o_wctomb
_o_wctomb_s
_o_wmemcpy_s
_o_wmemmove_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_purecall
_putc_nolock
_putch
_putch_nolock
_putenv
_putenv_s
_putw
_putwc_nolock
_putwch
_putwch_nolock
_putws
_query_app_type
_query_new_handler
_query_new_mode
_read
_realloc_base
_recalloc
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotl64
_rotr
_rotr64
_scalb
_searchenv
_searchenv_s
_seh_filter_dll
_seh_filter_exe
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_SSE2_enable
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_fmode
_set_invalid_parameter_handler
_set_new_handler
_set_new_mode
_set_printf_count_output
_set_purecall_handler
_set_se_translator
_set_thread_local_invalid_parameter_handler
_seterrormode
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_sopen
_sopen_dispatch
_sopen_s
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_statusfp
_statusfp2
_strcoll_l
_strdate
_strdate_s
_strdup
_strerror
_strerror_s
_strftime_l
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strtime
_strtime_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_swab
_tell
_telli64
_tempnam
_time32
_time64
_timespec32_get
_timespec64_get
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_tzset
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_umask
_umask_s
_ungetc_nolock
_ungetch
_ungetch_nolock
_ungetwc_nolock
_ungetwch
_ungetwch_nolock
_unlink
_unloaddll
_unlock_file
_unlock_locales
_utime32
_utime64
_waccess
_waccess_s
_wasctime
_wasctime_s
_wassert
_wchdir
_wchmod
_wcreat
_wcreate_locale
_wcscoll_l
_wcsdup
_wcserror
_wcserror_s
_wcsftime_l
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wctomb_l
_wctomb_s_l
_wctype
_wdupenv_s
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wfullpath
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wmakepath
_wmakepath_s
_wmkdir
_wmktemp
_wmktemp_s
_wopen
_wperror
_wpopen
_wputenv
_wputenv_s
_wremove
_wrename
_write
_wrmdir
_wsearchenv
_wsearchenv_s
_wsetlocale
_wsopen
_wsopen_dispatch
_wsopen_s
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wsystem
_wtempnam
_wtmpnam
_wtmpnam_s
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
_wunlink
_wutime32
_wutime64
_y0
_y1
_yn
abort
abs
acos
acosh
acoshf
acoshl
asctime
asctime_s
asin
asinh
asinhf
asinhl
atan
atan2
atanh
atanhf
atanhl
atof
atoi
atol
atoll
bsearch
bsearch_s
btowc
c16rtomb
c32rtomb
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
calloc
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clearerr
clearerr_s
clock
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosh
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
div
erf
erfc
erfcf
erfcl
erff
erfl
exit
exp
exp2
exp2f
exp2l
expm1
expm1f
expm1l
fabs
fclose
fdim
fdimf
fdiml
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
feof
ferror
fesetenv
fesetexceptflag
fesetround
fetestexcept
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
floor
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
free
freopen
freopen_s
frexp
fseek
fsetpos
ftell
fwrite
getc
getchar
getenv
getenv_s
gets
gets_s
getwc
getwchar
hypot
ilogb
ilogbf
ilogbl
imaxabs
imaxdiv
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
lgamma
lgammaf
lgammal
llabs
lldiv
llrint
llrintf
llrintl
llround
llroundf
llroundl
localeconv
log
log10
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
longjmp
lrint
lrintf
lrintl
lround
lroundf
lroundl
malloc
mblen
mbrlen
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
modf
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
perror
pow
powf
putc
putchar
puts
putwc
putwchar
qsort
qsort_s
quick_exit
raise
rand
rand_s
realloc
remainder
remainderf
remainderl
remove
remquo
remquof
remquol
rename
rewind
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
set_terminate
set_unexpected
setbuf
setlocale
setvbuf
signal
sin
sinh
sqrt
srand
strcat
strcat_s
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strerror_s
strftime
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtod
strtof
strtoimax
strtok
strtok_s
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
strxfrm
system
tan
tanh
terminate
tgamma
tgammaf
tgammal
tmpfile
tmpfile_s
tmpnam
tmpnam_s
tolower
toupper
towctrans
towlower
towupper
trunc
truncf
truncl
unexpected
ungetc
ungetwc
wcrtomb
wcrtomb_s
wcscat
wcscat_s
wcschr
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcsftime
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsrtombs
wcsrtombs_s
wcsspn
wcsstr
wcstod
wcstof
wcstoimax
wcstok
wcstok_s
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wcsxfrm
wctob
wctomb
wctomb_s
wctrans
wctype
wmemcpy_s
wmemmove_s
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=27412,
count=1, id=256, version=27412,
count=110, id=259, version=27412,
count=93, id=261, version=27412,
count=619, id=270, version=27412,
count=21, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/drivers/afunix.sys
- IMPHASH 188ec343e58aa2d61a3395d1c20e0ed0
- SHA256 bb83da6810925f0b28c7d22ac1f99f46e312b2669b81ee207a66a3650ca9fd94
- MD5 66e126ffbbda83ec089d1bb77164ba91
- SHA1 d784850e42c29e5d22f5d3e91d5ea5d6ecd124e6
- SHA512 d19b21b7de34469e09335aa82b6e06a106e36cacf59be8a549d7e70a8fbb4e22d29f4a5166ee77373770ce354b64277ddb37400bb5eda95408b099a7d7edbfdc
- SSDEEP 768:98D6z7qHpekPfjTEPfPZFTqzK3J46aWevll:9Q63qHpeQsPPsKovll
- TLSH T135D28E136185043EE4A617B3A14C677B1CBF4B40132B675A930C936C7E9CBA0FD226AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
41348
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
afunix.pdb
ntoskrnl.exe
ObReferenceObjectByHandle
RtlRbRemoveNode
FsRtlAllocateExtraCreateParameterList
FsRtlFreeExtraCreateParameter
PsGetCurrentProcess
RtlRbReplaceNode
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwClose
KeUnstackDetachProcess
KeEnterCriticalRegion
ExAcquirePushLockExclusiveEx
ExReleasePushLockExclusiveEx
KeLeaveCriticalRegion
ZwSetInformationFile
KeStackAttachProcess
PsGetProcessId
MmMapLockedPagesSpecifyCache
RtlRegisterFeatureConfigurationChangeNotification
RtlQueryFeatureConfiguration
RtlQueryFeatureConfigurationChangeStamp
RtlUnregisterFeatureConfigurationChangeNotification
ObIsKernelHandle
PsReturnPoolQuota
RtlInitUnicodeString
ObfReferenceObject
PsChargeProcessPoolQuota
IoConvertFileHandleToKernelHandle
DbgPrintEx
EtwWriteTransfer
_vsnprintf_s
memcpy
IoFileObjectType
IoCreateFileEx
ObfDereferenceObject
FsRtlAllocateExtraCreateParameter
RtlRbInsertNodeEx
FsRtlInsertExtraCreateParameter
KeBugCheckEx
FsRtlFreeExtraCreateParameterList
KeIsExecutingDpc
ExSetTimer
ExReleaseSpinLockExclusive
ExDeleteTimer
EtwSetInformation
ExAllocateTimer
ExTryAcquirePushLockExclusiveEx
ExReleaseSpinLockSharedFromDpcLevel
ExQueueWorkItem
ExReleaseSpinLockShared
ExAcquireSpinLockShared
KeSetEvent
ExAcquireSpinLockSharedAtDpcLevel
ExAcquireSpinLockExclusive
ExReleasePushLockSharedEx
ExAcquirePushLockSharedEx
EtwRegister
KeInitializeEvent
KeWaitForSingleObject
_allmul
memcmp
memset
hal
KeGetCurrentIrql
netio.sys
TlDefaultRequestResume
TlDefaultRequestQueryDispatchEndpoint
TlDefaultRequestMessage
TlDefaultRequestQueryDispatch
NmrRegisterProvider
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
51B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=69, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=8, id=260, version=27412,
count=1, id=256, version=27412,
count=15, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/drivers/en-US/wfplwfs.sys.mui
- SHA256 db9011e70da3e93a0f2b73803447a0269c2a948c6b2052ff30035042cd99e404
- MD5 16036adba07fba5031547c78d4ef121c
- SHA1 d5135b444800d433a9d621002518cf3d63efa91c
- SHA512 2e756d638fdfe7a97a6d5ba4948f20cd3fa1b3d8284c55895d157b0d30433dc8cb167bfd015bdb07119dce945b6775f92f91454d8367e5d53e72f38bd163a5f8
- TLSH T18271F2098BF7051AF0E64B709BF606C12BBDBC1372B2E33FCB40215D24A451889A1FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/drivers/gm.dls
- SHA256 3229b09b9d7d9f3f4793b0d9b34fe6abc75cfa4a2503c0c90f43ff651ba7f2c0
- MD5 7f29903cb8f5590d52db0c9f97049a25
- SHA1 57145f5f449624a10a357d64c982c6eaa7ebc1d9
- SHA512 98f3e9de9ac17d8397e59a37accf102f2e4e76ddd1bab0c0452518098c2fd91e4b8e4a956cab2e4134a0e4a80f1ac1c8475a4fddad2fb8371102cbc0b1a74fce
- SSDEEP 49152:kl98eiQV5ekZQQNgW3F+IEANa58DrQaPdqsL3/tdEguV+kGgnq1q:kfvTEc7SrIEPCIsL3Fdt3tWH
- TLSH T17BF5F122F7930E62E86D9137D5CD97C22132F8987BC2C70776B69E54BC8A7604E43939
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/drivers/gmreadme.txt
- SHA256 10bf6e15c08c8c7f5d96b658bab78aed86d1de20f08e7871eefba0939af11a02
- MD5 7111bfa692a22e4b3c07f1e6c6ff6f72
- SHA1 297e8c4e4cfbce24aaede0c1f11bdff5ad6b9d37
- SHA512 c2e50510263e102facc076b9981893b54dfd7f18672429b4709ed4a5a6889f2ef2cbe05c03ef55bbd90f20af7c54ff654ed9126e78f08b775e7e1df81dee081d
- TLSH T112F024AA8EEE901E69B0D9E7548C8C44F13D575224668B19EC5AE1480E4E254579F036
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/drivers/ru-RU/NdisImPlatform.sys.mui
- SHA256 9faefc7def872125703c6ec907a0c6b47507f2ed8c96cc853d28dadedc7793a7
- MD5 d201811ef939b929515f2620a17acaca
- SHA1 78980c593782ba9647ba1b1333ef463ed5b22718
- SHA512 829dc9a95faf886ca76d875f3826f38063a9abe3ed1617cee252d4508dde603585bf4dfe06bc2f0b165b31261ba78ded1d8460722f1547b4eb2fca812597d74f
- SSDEEP 384:swqO0BDN/mol87SpNcr+s+6FTYub3W28AWC:sVN/m9Sor+s1FTY9I
- TLSH T10452798FA9BC9664F168C2700EA341E71279B7C8532955D542CFFDB4B0A86313B287DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/drivers/ru-RU/ndiscap.sys.mui
- SHA256 6bcb21927f49340b2c0a65557ea85afc3b0fe8f458d342b52e90705fb63f83d0
- MD5 450dd2d41958f044ad0bd0a2d228f0bd
- SHA1 61fb5ea5f68019d60b8c2de1acfe0a665018e7cf
- SHA512 992cc3dfa691f63930c951b2fa5a7ac17141d1fc251d7c4618ceb7fb725295a0e6becd138aaac2f307ca5245fc60a781e26118090062fb9543edc622b9246087
- SSDEEP 96:+Bvuf0njvLsrGDuAcfRzL4t4COfbgYZVHY63/4WIqYJWw8:6W8zIfAceyZVPP4WI5JWv
- TLSH T1E7E1790FE6BD8116F840C6305FB342F623BA7681636852DA86CFBD79A4D41752F10AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/drivers/ru-RU/wfplwfs.sys.mui
- SHA256 3b4bd4631ad091cb751b701c4192c31dbf74c9e752767edb29aabc3a7cb154d1
- MD5 6c97d722a7da8f36b0405d825a1cd10c
- SHA1 0cbca89a9ab2dd430b71f83f266be73c5aad168b
- SHA512 f86fa6b1ebe54003c485c9ab02a932c34ba3a4fca774ab1a66f882fc09ba13c7caf7a7cf451b39029b3ecdd6a88bc07309e3f87ae3bde47b258c47442ccb27f1
- TLSH T1D571AD0BABBD4025F0E6C7310BEA46D625BDF911676092DFCB4E2169241453C7620FF7
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dsquery.dll.mun
- SHA256 07b7a951dbb20ffe5cfb3e0b76e8accd0f328b98d9e0661756837e18f85e944c
- MD5 5090d75a2014612693205843a51970ed
- SHA1 d6b5e99d7000d87e29db153286d4bf8ae8cecc9f
- SHA512 711af47c96d21ee4c30634e7abddc1b54fccdb19caeb77d32a3f5ed68ceb020f6cc6bef729ae71b9b12278736110ffc4ff00bbf43348c6ac244d77ba4ba55ffb
- SSDEEP 1536:elUC6lYVRPf+zyp70HpqlCAqHSqoZAhoPhyTvHk86ZHkvgHkZ1Hki1Hk51HkqHkX:elUXlYVV+epwpqPcmJaAUBhG0
- TLSH T181442971E582D977D0668334DDB3C8ED022B3D521D945E0F237DB70A6A7A38221DAD8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dsuiext.dll.mun
- SHA256 811d312f230f9152f9a21f9665fd03db646d62fb341708710efa01b451e53d5d
- MD5 7f0c1f952a9b20d9da7be80c2493738b
- SHA1 704fb23f15b693d4451ee7f3373b9a6db6b44df3
- SHA512 0cfc7b6d08e0b023991e42c085dc710cc08a34260d3dbbfc4efd6e004f7500f8f62ea9d7d993d8b647fde097ea5e51fca4ee8200ac8de9c2121cf0a46f8bf628
- SSDEEP 12288:TIiYAllhMsWlOzrMMMMMMMMMkMMMMMMMMMC33:TmAlYsWlO/MMMMMMMMMkMMMMMMMMMG3
- TLSH T117D46C42B640AA64CC1C0A378807CAF99DA5BD21AD205F2733F5FF6F2C72253765B568
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
588KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/dwmcore.dll.mun
- SHA256 f3765572fe55b7e4b4559ee3f08de87102179ed25e934e7f7b3d800233573349
- MD5 359404760c40bf03c455682c003807c3
- SHA1 bed706663117e4f397cf9f5ed81b0cf17bae8f3c
- SHA512 45e62fa1e0a79953b18e2f2f23c967cc024da1a5748493ee4a7675579ee9c19591c6f6557accde4e4a5d8e20aba456efb4976597df9e9fe4d539ae7d561a26d1
- SSDEEP 3072:idsXve27fYcyTEB3QY2B2ZfbIcsb71mjJZQagKKNgd:id52i9+ZQagKKNg
- TLSH T1680449027ADCA408F0B7A7707EB9C2697236B9759F11D52F3056235E98B1F408FA2736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/edgehtml.dll.mun
- SHA256 98de155ed299614f3b4515af07e00f69beb3b6147d12f1bcd92eb1b8bad8a58a
- MD5 9e1f85860a5f80971c6268c65480227d
- SHA1 3200bbb8839e94ad87c3a59b34fb06fe1c022a4a
- SHA512 05f936ef98f42fbcdad0e672394066d25c9341f91ea6d2e3aec7d102448a5e38b0f918b7114811f10b8fbbcee049a98b95f48d76929f9081448eb496500c403a
- SSDEEP 6144:B4oOnATptTGvY+DAxJKrt3djcwyLuyCxFEUkAmSd0FaFpk7:eoOnATpoDAvAarCyOk7
- TLSH T1B605F9067BCCA82AF2FB0771783A8146B1367D656E44D42F7045B7AD6875F40CEB2B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
780KB
Virtual Size
780KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/edputil.dll.mun
- SHA256 f992d7e3fd0e23e8bcd44b17269c9bd8efc969f430cb9f253dc822e524c723e6
- MD5 1aa0ba2fbd08e603c898fcfa01d107d5
- SHA1 273f76e106110f780211f0237615c17cfc1632c1
- SHA512 bc43125cdde187d001467098fa9327e183f14963e929047016ba470d31535a93570faf1cd6546d4d3b426b482c06b065fed370f5da6688fb012eff6d01f6390e
- SSDEEP 1536:0CQfsCbPBXuod/0oL0XoloijrXhLmTJJJJJJJJJoJJSwc:/Qfs2BXxdXaJJJJJJJJJoJJSw
- TLSH T178E362721E5415D9E765E6B0F28AD2B32F2D3C634EB1B822B0F7F51B003502DE56626E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
139KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/APHostRes.dll.mui
- SHA256 f1ade77c5cbb5fbc475d02d75b97e34687a07a688497b0bf22013aabe6c6895d
- MD5 7ce00017ef1af932a39efe41776c8e4a
- SHA1 dac6767b030e2888c8098956ede59b19cde7ef43
- SHA512 fe728fa3ae70680318f15eb08cf1fe2a991a4c5858af8c5dbbf1b0e68271867f5a56533c79d2f746a023bdbf865b448501ecc270ca1961cf29e5eb657788e0ad
- SSDEEP 192:h1TfvRWATSfyy5pj3wk7UUZUIeKMf1Fo/zidaN9fHcBff3pKMcfp/ClqjqQ9pWMu:3pWJfpxUuUXKMWzvf9WqjqQ9pWMYB
- TLSH T1C682334E4DEF2622DEA469F2513341665F6EF5C24438EDAE72F0B058ECAD8014DC2B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/SyncRes.dll.mui
- SHA256 709cdb4ae7c7894191f45ba088ba97883cc75665a9d4b9147f83a28a40ffad1b
- MD5 27b19d167c01c3c19ff7824765ef2e4c
- SHA1 6902c1a0d5b88395c7960e6b9accb3b374f0739d
- SHA512 119d66da92145b39defe9b0902c230561d0f212d073f7de754f9e61458cf7af2de4807dc79d74e3319584633e9d182e2efe1bf4fd2632aed30d62cd8e4abe0a3
- SSDEEP 768:VANex6AZYxYO/ofV6kJ9QNhmhQXQXCGDiPEFM815enEVEVQtnePptT4:VANex6AZYxYO/ofV6kJ9QNhmhQXQXCGD
- TLSH T11CF2388F4DFF2711CEF9A9F19473426A9A5FF9920814DD3A72F43044EC5D81689C2E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/cdosys.dll.mui
- SHA256 2008a9af0ed79473f8ce98e04b55ce978abd434fd6bfca27b738c53c249146a0
- MD5 4d6944ec7159bc621e5dba10f3e25099
- SHA1 24829f1c3fe9bf1a3df8294d7760806bf0acac8e
- SHA512 a793cdf805e980905be2b1834c30bdc3f873df8330c2bf9492041f6450fde177d52491241c4eecafbe047c03422c4e7470a7ff5c08b54baed06fea84538da913
- SSDEEP 1536:Jw0IJ6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzT4zkxuRZvOkjP2e8BVYhIAA3:JSJ6ivyUcEsx7fNXfV8PszW7yYsznPyE
- TLSH T1EE33E00A57FB5608F5F2BBF558B611355F7ABC82A838C66C21E0A11C99B9E418CD1F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
50KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/comctl32.dll.mui
- SHA256 6e7ac56e668b4c283ed11bfc2e1b7ab61d09e3023456a7cd1cde4b5a9247aaac
- MD5 fb4442d742ac190daf83e3eff4f9d155
- SHA1 7600ee64b0d532a81169532383d106d0a5426e6c
- SHA512 828562f52e239084113969eac0f24b9d74ad2d5b4284c11e47e1394228f5238dbc00e9089c26de2877de65d43dabc7a85e6844b9555ddcba0b705dab6dddc9e0
- SSDEEP 96:UFfVBOAJ0aepsptZISp1VofMsTPbo3K37rrpZSjed0VWtBcnF0:eOAJ0kp1yMsTPboa3nSjMUWAnF0
- TLSH T163C11E4E8FAB9622EDE546F5197386B25B3FF4421324EB2BA2D0601CE41F900DDC1F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/quickassist.exe.mui
- SHA256 677f455772d085dbf7b6d51e9619bc917f7157785365ceb946e6d613a5d52163
- MD5 d7877b15cde42e32fbe0fb2081ea2c56
- SHA1 564d0f672dc6e0f3331880efa5e580441af49e06
- SHA512 23751735346cd1a45e31a1ade468b35068bd226ca238a507a77cdf320f69e91d6ac63832d1a70981cd3d77b8ff0b0b6048324cbf0f31e9c2a8b117d7e22a6588
- TLSH T18C81E04D0AEF0765F9B54AF199B305768A7FFC115835EA3E26A03018BC1C8158CE1F36
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/el-GR/windows.ui.xaml.dll.mui
- SHA256 15a35a9347dba04e2ba9f2cb57da7643b23b4170c729a2d60f0d321d7683a4b6
- MD5 852c6e6d57a7d8c93d2fbe09756aa76b
- SHA1 306f9c5abae1d353769e8f62caa6cfd7b171cb8f
- SHA512 b0e6a1ead01022526ca35648a6d7be6de1434749309b5a5332bde89adb575219f8fa5cf9f293951f6342f0df46323f8cd5517744d3f1890732cb78fa69ce369e
- SSDEEP 384:LmgEYfK6N6gyzTlfVsz7O0XF+42IH5O2HrHuMWWyi6:LmYfMFa9iYTZ6
- TLSH T14A929A4E1EFF1725FAB259F1197382655E3EF9D21824EA2E72E03019EC5C9014EC2E76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-GB/SyncRes.dll.mui
- SHA256 ae14d0e02ca04b9a1b0aa2d563484987fced40c5f645e89485162ab39e1d520e
- MD5 0e3d14fe413332f4e614b7b7916e5305
- SHA1 3b15832b249612ed4f0b0d0607cdaac2e11ab7af
- SHA512 956ed7d4f4071d330511bfbc773f2ce13484b868c5da2d6a7f5423d69c84774278e277ac4b5ca8680c7233a09e710a3d0fdd9a793e0c4ed7b9145cdeed0cde68
- SSDEEP 192:uHHJhh/7UgtSqzqhz53oim5ORXZg6QqimkM6rMgwpgTN9CA88WjbFWJ:unThDUAmmqBSTqoMAMgwmTPlfWHFWJ
- TLSH T189D25552A3F94619F2FB3F7159B90A640E3ABC96FD38C21C0250905E59B1E91DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-GB/comctl32.dll.mui
- SHA256 08ea6854b83171cdcddcfbe774ff850b507d29e4503840eb0b38d4cbbf077af1
- MD5 c2c2fd788fedd4aaf20d0fa90d7ab3c1
- SHA1 9d6d3549d7a1632a04543d25b67ce2662edca4a9
- SHA512 0a5374a3bb9e8716d4b2aa34b56138fff541ff04bd8c29e44a888e7283e09ea36f88a24a1166229f6656bc6e7c2bd64494ab4f635a946d691e2009431df27221
- SSDEEP 96:ksWm2iDgrjTmlpspgiBNFsg7PjWBAJtWwr:QPXmy7pnWgtWQ
- TLSH T12EC14205DBFA491AF0BA5F705AB207901B3ABC136A7A971FCB40101D24A5B14EDA0F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-GB/quickassist.exe.mui
- SHA256 d521e5f51e2a6de2d28ae243a5f2974592bf5dddd8acb2afb23c7b64c4f2db05
- MD5 9350a7a7727e764462ca08d71104ec4b
- SHA1 0a7c5a73e82bbe39943cae5070cb27b5c50be3cf
- SHA512 970f7ac04efa9445c81b4c6d943950ae831f55a4e4e43abd50b61071b26ddc03e548b39ba2a0c0331af120cea1cfa83fa3489d0e3d28568798528bde68b59c9a
- TLSH T15381B4055BFB025AF5F62FB04AF605D64E7E7C13B976E22FCB00002D28A1A559DA0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-GB/windows.ui.xaml.dll.mui
- SHA256 276da9d14accd0b720c37317adad41db5bdcd225585d21e4de055d27233551e5
- MD5 2546d5e6c1676ac6a283bf7d7fbf9a5a
- SHA1 85ea029d8515bf1f8e92c62e4a6b089ed32f977c
- SHA512 6a777c0ed47d481d33927356875c4d0bdce96b9cccf5b4c13eac4edb830d736a4aa4bc4ad213709cebf0287e1ff7da11f4fa54194c0fbf78a9f7f34c980a9e52
- SSDEEP 192:6c6r8+bUAtHEMhyBV+rZBRyp2FkenD6E+Xe694WDVWc:2wAtH3yD+rCCnnmHuM4WDVWc
- TLSH T1CB627741E7F91518F2F76F786EB626605A3ABCA3AE36C61E0250601E1CB1F90DD60773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/APHostRes.dll.mui
- SHA256 daba65fa254ea4114a57a46a63f28d0ce36f81fc148e53a346e12688396bd86b
- MD5 f63bb92bea924b0efd8e391121f87769
- SHA1 afc826f268d67132512bf1dd2da70a2092a6a6bf
- SHA512 7dd3224328906c1bc0233e1fdb234c87357b07a661024aa7982aa01d266c813e87829dfa92df1eb07d8b4300166de04bb6b77f3d101a89071c7054a5060bed67
- SSDEEP 192:6Xgr35j9awoibXhS+Rjot74fTIFXIWTLW4:6U35zoehdM+fEIWTLW4
- TLSH T1D962D21263FD1518FAF62F356A7616A05F36BC9AAC7AC11C2280D21F6CF1A40CDA0777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/AccountAccessor.dll.mui
- SHA256 cc52234329ba0f35f2b5f81bcc8b35d6dbe2f87bc41a8c310b7c7d53d5d71aa3
- MD5 f69e32f6235317bb0993f5ab4f4659d4
- SHA1 b00c850d0f912e0e3c1fc9a26c2ea3ef1d4825a6
- SHA512 702c081d1552af40232e036c06b73b424575cca864391b1e826eb74a1574b061ac16e627caa4b49ec6f0f9498818ff6268fda0e377268feae763d336c8b00b54
- TLSH T11671460363F90119F4FB0B35597B5A351F7ABD656A3AC22D1590A13E6CB0E40DCA0B77
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/AccountsRT.dll.mui
- SHA256 413f96a418cb3cbcd97fd9dd8a645547cb94a1d2d3dffe72a3770f1e4dc99ec8
- MD5 13b7425e737f58b647240cc3d5dd9a4d
- SHA1 c99a54c764872f8c4c55d27f96e1ecb9f16d6eef
- SHA512 001b193b3994a6d93333f3b1a3a3177985a7777437cb7e4154a973b92d44139a8e152cfdc469cb024fbea7f5605833a183b8a5a5367b364a33e27f43f34b5913
- TLSH T1C351770687FA051AF0FB0B3156B74A655B7ABC177976D22F8B80512D2CB0904ACA1FB7
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/ActiveSyncProvider.dll.mui
- SHA256 c53353a3604502d93994a6316cf6be323adb5a0c04692dd2678afa34ec32a7db
- MD5 871a948514e57b23774417f805d36ea7
- SHA1 b9850f341c44ff0583052bac2add8653a9ef8910
- SHA512 b80536048cdcdc44c16cf6b00b95d455c10127d772b3113e7af9452a82207e6ab30dc5073809655dd3515aaa79ab74f09fdc2dece3c75e35341ea8eb3a99c463
- SSDEEP 768:brjf8MSYy/bY5sAEv006BIuC9gLgFgFDgv3g5oN6:zf8XYy/bY5bEv006Br5Uam4i6
- TLSH T192F2F61267F9090CFAF77BB5AAB645749E3A7DD59936C10E11A0A01F1CB1F408DA2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/AzureSettingSyncProvider.dll.mui
- SHA256 6e47a7d76c096c888fdc84d1728a810a791e3dc4e955e11d1e8653f947593e76
- MD5 2ce3c21f2a3cdcb03d1d58fd8fff01ea
- SHA1 c021d1e2d0756b5bc25fbbfaf4e5a73a7da1c187
- SHA512 8a1a6ed8d90340c79f10b12aa19ff454ccb860b200411af8625bf68e0f22f916e7483995c2cec78047c627f155201dc0b911bd769346356002cd3fe8a2aa353e
- SSDEEP 48:y+MA1UMMrCv6CvCtkjC70TAyOggxZV6A8t4coQJIZWA+2uBgy5WwHgZ:sM+CSCvCizTAysreEWpnWwC
- TLSH T157C17C0657FE1019F4F7AB315ABB85A44B3E7C4B6879D12E9740D02E2CB1A045CA1BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/DavSyncProvider.dll.mui
- SHA256 8a6d575ad0bcd31729a8b08e1e807b941f787f5521d39dbf8e04e6f6a5d4ae00
- MD5 e1c066a9df33897da5894175ba210d7e
- SHA1 1ad8fdcc7b0d9d97e96dd684c7eabd1bc37d0ab0
- SHA512 4059070b41fcdc8e56e5c039c45c4463387a773f5a339bb8e4eb9847997c97f97ccc42ffa8447a67332a0760282b6b0de38ad48debf657b49de96ca9221d87ba
- SSDEEP 96:AP2EO6tN9vU1jabWvgWYPoGDpAk5GrfeuDDkr3dN/hdQXSQ0TmSrEy5RLCLZCXHh:1ED6a5FgUx/vz5LE8WmAjWX
- TLSH T167329D028BF94609F1F75BB1297745644E7ABED29A38D21E6180D06E2CB1F049CF5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/DevicePairingProxy.dll.mui
- SHA256 8adbb4bfb7daa8cb5a77384011a020f386365e99c079232b3a68184f32aff815
- MD5 0e99cbdd9c9d8a3d5661b732cc0437f7
- SHA1 798288661732ee65bf07a28a2cf5fb8359d04f5b
- SHA512 996af16a5a10a1097897ab82ea806da0f168e56c4b08c366c4d852881919dab8247c2fecbb8b2bee8abeb2e3e3558d695560cc2be5a4fd46234973b375e9ec52
- TLSH T15051EF02C7FA1A3BF4EB0B3056F74A521A7EBD119AA2931E4B10112D3834949DCA4F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/DeviceUxRes.dll.mui
- SHA256 212206d9fff9d8f8b336f2de606a4ea822b5870e2dd8cbf0e506e1aa0ca8ee7e
- MD5 b2b6166f6dbe52c76f20791acf94d1b8
- SHA1 7c31fcc44c5587b47faf67cdc0a6da46b24630a9
- SHA512 d89b146107f99241e50e10ef3ce15f9b827dcee8c49822a332df4cfe484b9e953fa58f21cd11169c25e12a845e6ce694b8251e25a9267d205842577fd6d5d02a
- SSDEEP 96:VQFuqGDHtmbDHtm3DHaDDHao3FMJxy1nyhZdAqnmXuaHjvCCOEWPfPWwO:Njymr18VWXPWZ
- TLSH T175D1C1066BF9460DF0F37F705AB646201E3A7CE2A879D60D56A0A01E5CF0F449DA0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/DismApi.dll.mui
- SHA256 b46c55dfac615333439730e30a81c83847517c85a3eb03efcac0294193e1c6bc
- MD5 443e5400aaa1d0ca651d375888f88ef6
- SHA1 9d6d6e7de1ea12d015755582563da9209aa792ec
- SHA512 88ef7fa25339262145b3a324355151a35e2250ea305106e34ccef81081985b3dc3371a3ebf1382f56fe61b4985e7e27d6745d547f29e2532a6db8d5c52f9510f
- SSDEEP 96:z/dD3RnWSIpzSadr0r4diG8y/jEWSXn7hWwm:7dLy4ezQWSXlWx
- TLSH T12091CE1262FD522AF0FB2F756AB61B611B7ABCA1ED75C39C0680112D2CA0E50CC71B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/ETWCoreUIComponentsResources.dll.mui
- SHA256 3a751a26147742800f199676bf8bd5a84e58083a2efd1e761042904579edd727
- MD5 fd92f0c4812116d1c27f795b96488e49
- SHA1 15dbf0b11baf05d94248ec9af871cdfda4c2af52
- SHA512 ed31b0381c70efa1686d57e61cf23c8854e7ed77e16f8618c9bbd22a2e1466cd953d74793ad2369bc9a40648db8ffb5578de7b26583e6a9525b13b15627e6870
- SSDEEP 768:Qpywkdqtr6gFIMP5TBBivOVRmvGBYBUPEr7BdB+CNxK109y7h:Q/X5TBB7ew7h
- TLSH T196B301026BF95508F1F32FB4D67A21259A33BDA52D76C46C1290905D1DF2E80CCEA77B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/MCCSEngineShared.dll.mui
- SHA256 8d493a805aae0d06942048154e8a4bce5dad64869614b094cac9eead2ea44bc0
- MD5 fb3aab72c62e15c2543a06577615a72e
- SHA1 b0045acadb930a24cbd165da874e1ba7740af6fd
- SHA512 9288a6ead4ef8b134fc4d1934cbb9338b3841685151c98f611bbee13097b80e7970252a07764b30e1d1be821833eece409baa892c970d1aa302485d5c17ab211
- TLSH T1A351AD0657FA111AF4FA0B3145F746651B7EBC1375B6922E9B80502D2CB16049CA0B77
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/MessagingDataModel2.dll.mui
- SHA256 6c611a9b9f332f9fdf78f43ecd27054995c3c69111aba4778e6b99892f4d77f7
- MD5 3c4ed841ee10b0375b216af9dda580d4
- SHA1 01bd2dfd71fedb707784f5f1aa160e8b11dfd21c
- SHA512 196d4ec5285cb617fd3eb7bdb1dc70865a2cf45adacce3739f6ea923048f14057f2e0cb360edca744011b562b7be4a01ee035f5bfd9e39809a24145a7fffe2a3
- TLSH T17A51C94297FA072AF0FB0B345AF78626663ABC15DE21932E0A40122D6C60654ED75F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/MsCtfMonitor.dll.mui
- SHA256 82f431228935ce71fed1f4e8055749fc92a2aef3c4ee3ca93d6a410f7954b520
- MD5 b41cda325d4e694289bd2427380198ba
- SHA1 46155a60bdacc16657ef2063e79af18195d7d729
- SHA512 60125e9af68cf74b0d06dcc22304d42634670e8faea0d18fa272213ebd436c9f4545f1206f667b7a1ce23b97ed7db6e7852c2a5497e009cf6ecaf3f2bf420b14
- TLSH T11751E7065BF7162AF0BA0F7187E605D55BBE7C1379A3A22FCF00112D68A054998E0FB2
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/NetworkHelper.dll.mui
- SHA256 c3ccf6ba191250ca65688f63be6df3c91cb78d416409ecf7a020e76d6a393d46
- MD5 1b6ca472cce95e7e3a8c813ebb110802
- SHA1 149efc8a76c56b944bb9a3aaa25ca00577fa9db6
- SHA512 762d3815c9861e6b1fbaa825370b188753de05ab2ec1986038eb35909b10b1ce7dfd93475a4fe80f7beabfdfde7eea38cd57a1af63936f45a74d8ea727c1da86
- SSDEEP 96:Tg0q1OnDZDZ1x94vUSY/MiCmifwwOBezM6F8i2N2bmi9/Mul6nJkIEWj/D/+Wwc:JqRTbPmifw02N2bVVMhaW//+W3
- TLSH T13FF1330633F90908FAF76B7369B78638573ABCE16975C51D2180E12E2CB1A10AD6177B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Ninput.dll.mui
- SHA256 84120474e7f56ca84d6c7c7323db01f4e07a0b6f4ecabbecf71bd1f25c32ab43
- MD5 05fd2c049c81b1c8d1cdcbd556865545
- SHA1 417c8488af5117c8d640964b755ad051562fb5e7
- SHA512 f428606c9c798b52a9a62d4f4045c833bb92ab76dd4de93ecfd8ea4faa5b0d9d5ab45940d28cd5ddc4975151012af85c12328cff54eaae44b50d12677f7ce4b8
- TLSH T127515D0A6BF7051AF4A61B3097F605D55B7DBC1375A7A22FCF40012C28D45089DA1FB7
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/PackageStateRoaming.dll.mui
- SHA256 c0d7ee8b3cdd6a12a49d81c1c75f0bea117c080b53f47f07cd6fa2e93bb5e44e
- MD5 9e6074508ff7f126a456245fdec43cd8
- SHA1 f838f5b0f29d1ab4db0fb39f15d8d0a85f4c6480
- SHA512 936ab400cbebdbc230763627ecf3cafb1638d8a314893566bb423e9767a6b588889430dfd2f1c531f4f657f7b80e58b5ae94d06b8ae85c88c85b70b9baf0674a
- SSDEEP 192:sFOpIpe4uRa0AuIa2G0rnTPyW/FL7YQdXbfpG+WXSWK:sYIpe4uRa0AucnTPyGrXbfpXWXSWK
- TLSH T1F0B2AD452BF94208F1F3BFB46EB505608F3ABE92A875D25C0680E55F28F1A54EC69733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/PeerDistSh.dll.mui
- SHA256 67880ca08f5bba1025b59e7cf06bc8d5c38d8a590c4b1689c47abd1c579a71d9
- MD5 6eed3a570bd41e117735ee3011754c3e
- SHA1 70b9e94aca4df74a79900be31352094122e1b29a
- SHA512 b4d21679bf34e4101ccf3e8c7e69ab0ed0e1d75e0b41398d2cc3387a912c86a0cff8679c3c588b0c64f67afca0f36bde913c9b36a0495afe224ea4eaddc027a9
- SSDEEP 384:5k1W5eBC17z1CdrG2ie33VqrtRdMgpTGSWoU1Wp:WRoYieVqrtRdMgt4Y
- TLSH T12513365193FA5608F5F77F7869BA51644E7BBC92AC78C61C128C400E4BB7E90DDB0B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
42KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/RMActivate.exe.mui
- SHA256 cc6300837009054616a2981d0f188eee9fcdca320470ea9863ff4ae7a28400fa
- MD5 ca9b899b044080be0a64140f37e7c058
- SHA1 78b0548f1824a09feb8f58d602dc1ecfa1d8e45d
- SHA512 72254106481022fb5a2d9194b60376681da50f78852bb315ff90a6d3e4101a4322adef8ce945279e7b2195941bdd18b6e86ac85a54b4ed1d00728c0de1aeafde
- TLSH T1B1518702A7FD1A2AF0FB0B3556F746265A3ABC299D32D31D0A40012D2870E50DCB0B37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/RMActivate_isv.exe.mui
- SHA256 cc6300837009054616a2981d0f188eee9fcdca320470ea9863ff4ae7a28400fa
- MD5 ca9b899b044080be0a64140f37e7c058
- SHA1 78b0548f1824a09feb8f58d602dc1ecfa1d8e45d
- SHA512 72254106481022fb5a2d9194b60376681da50f78852bb315ff90a6d3e4101a4322adef8ce945279e7b2195941bdd18b6e86ac85a54b4ed1d00728c0de1aeafde
- TLSH T1B1518702A7FD1A2AF0FB0B3556F746265A3ABC299D32D31D0A40012D2870E50DCB0B37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/RMActivate_ssp.exe.mui
- SHA256 e357918720fb9c0e9384b6e6489b896ee9c84ded47f9b53b38165136a5241f6f
- MD5 18f65ae0c456ef148de3c9485fa71c6b
- SHA1 a136ef4caa3981c9485985bfdcd18211f1b953ea
- SHA512 70aee323fc2a98798635b1d0e5fca107228c0103bdd7c8a9c5c82a5aa3453bc0275b507ccecec7243410aff6e9148481cd1850f9741df2a5390616752d93d69d
- TLSH T19551770297FD1A2AF0FB0B7956F746261A3ABC699E36D35D0A40112D7870A50DDB0F37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/RMActivate_ssp_isv.exe.mui
- SHA256 0d0dbf10ce035cbb521f8ad71e45ed3dfa4c312374ffb5c834ca3866b5c82411
- MD5 521ede8548e6b31277335c7cb3ddfd92
- SHA1 5b081aac9210507f9a9880e4d8868891496092aa
- SHA512 b404c80e8007d3fa3bd1920e0320b69ff77a79bf2128070a1e0535aba590e266fa8b8c68bba9c38643e320f4b1a2958a5382069f8396a2dbfd6b7088574c7211
- TLSH T1ED51D6095BFB0516F0F60F3486F606D11FBDBC5779A6A22FCF00111D28A4A5898E0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/RemoveDeviceElevated.dll.mui
- SHA256 8d092432239ccd819eb6f72c4fb92b06901d1a15a3ec3e2f7cc9c51c6ff29c52
- MD5 55e211456695f35b977a097a84131233
- SHA1 d2b3d2c9374227c8b92a7b699ea7d9935f0b8769
- SHA512 3d1b99a247ac52b66972d7233566b80259a135f3f4522abb1060dad8ed34b4e631c8e43f590032c17305e316477f7f284c29e2972421997daa8ffeb7f2067765
- TLSH T10D51CF4397FA162AF0EB0B751AF74A52563A7D60A662D36E4B50112E3C60644DCF0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/SyncController.dll.mui
- SHA256 5341b94552cefe941a7d3c19765e2566dd2c846ced00c31e92f8eef9e50b81f8
- MD5 72e196ed44c1f9d49f5fadaae8950768
- SHA1 7524900779ace063b8586faa4b4929f921712511
- SHA512 2cc5e73297cc30304eee0b1ab4efb6ed3639d5a37acc4beaef7062806ffe071af363b4b455c9f7990e8fe1b550d391ddff660aba641e4ca2727436ba88dd5dec
- SSDEEP 192:lunqMvNfgKKgTLJKK9KYS7YlEZMDWGbWNW8:luvVgKKgTLwG1S7YO2DWGbWNW8
- TLSH T10F52CC0243F9010CF2F72BB56DBA4A701F72BCD2A979D25D16A0E06E6CB1E409C65B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/SyncRes.dll.mui
- SHA256 5479c295260c25a258bb3265c7ca5d2d9bc06ab9f352cae382f4f0839cdb1888
- MD5 421b7b8c3a4aea552c26aebe48a6b3fc
- SHA1 fce3114126f895fa95c05011f56eb0d6a0d94fb2
- SHA512 f6dc502d642a2c1268c0efc9f8269229f9a7d3ce857d8e2b4f972504d4cd1973be06a0f8b30fac4d248cfbbd5ff5c718f17123861d75781fa329dfeb1f0ba339
- SSDEEP 384:FnSGhDUh9yx4t6STBrg9WgwLTR1YEWLFWQ:1b+h9yx4t7TBrgVwLXY5d
- TLSH T110D26651A3FA4619F2FB3F7159B90A640E3ABC96FD38C21C0250905E59B1E91DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/SyncUtil.dll.mui
- SHA256 f5b93fd315a384064c8d0c5baa2171167448b88be65a2ddd910399c2e4a1464d
- MD5 6fcc7b46eb7614780d3f7f464447d492
- SHA1 9fef27c4a91ca28c95273c0b449fea10dabd41bf
- SHA512 66f4243dd9e7c830e60f4901f527e84a0a461563637f9ea0cec5363c9440b90aa7e6d4b3271c78f1bf4962dd8452d4c97c181b8fb10b630cb60907cc218aee13
- SSDEEP 96:3E1N9vP/RLswT8oKMtq+0ujHFEW3/DKVWwo:UXl/tsQKxyHeWLKVWb
- TLSH T157B1280647FB141AF4F25B709AB646A02F7E7C937976D12F9B90902D1CF09049CA1BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/WWAApi.dll.mui
- SHA256 fdee79b42a21e6f75a2d63a4897e28508de9076107dedf59440a61ca919e9f2f
- MD5 99f83fd16b2cb3138a2ddfcc8ce636e6
- SHA1 5c3c4ea04fc99f067595f9daa16e1d7b49131f96
- SHA512 f4140080dbfc33960e83b789c9beb7ad206c58605044c7a5476bae3b7d37cc78ee6e270b5baca1d8d4e732fae56aa798720e487b744d4f672b5e92debd9432d3
- TLSH T15771B2095BFB1226F0F61F349AF615D51FBE7C1379B7A26FCB00101D28A091898A0FB2
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Windows.Gaming.Input.dll.mui
- SHA256 82b3191f5ea25ab1027ea722a43e73283be2955bb86bebfcd266dbd4d3210542
- MD5 ad9b362317b55501c865f559faae04b3
- SHA1 c261ef70e82bff4e007b55d9e618f78c17fc2ba0
- SHA512 9b440cc1a690af4036e36713505de5d70e0eec7569eeff37016e5b366597433b8764c543dd4e9cba161df6f6eedb68b8933d7829195f810ea435bcd8ead8bdf6
- TLSH T1B1512A095BFB051AF0A60F3196E606D15BBDBD1379A3A33FCF00112D28A051858A0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Windows.Graphics.Printing.3D.dll.mui
- SHA256 be38ddf1d7a29c2d2d12c30dcb1a3e7237cad6b61baacb60188a8a934c9652e8
- MD5 d07a819e217f12b9de185f742760bdbe
- SHA1 87bb419291f200fa6f439c9f3bb9b0f94ff305d9
- SHA512 2c98051f6dd037fb0806f09e8d8326e841e75f993b0b5688031e3bb86e63adcd14af831782847703b083f95d01f8553fd1515efb7cb4b88ac577bcf800d4c72e
- SSDEEP 48:yJNxeYR5WKApADponwX+mBOSmk8XS+9ASjmMVEtO+w0H4owUPq9Mh4RJIZWJHjux:kG+DpowuRASj7VTey9Mh4nEWJKSMWw3
- TLSH T168E17C41A7FA0A19F1F73F3159B616A04EBABC56EEB6E36E5610500E1C70A44DCB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Windows.Networking.Proximity.dll.mui
- SHA256 19d62e28a9b02e96099d3c7a0855d37f61038d9f3381f68c59adf467d7992f0f
- MD5 0e690070a01a2cbbc262d150707a7b75
- SHA1 d516c9ba1b98b0dea2c54a379f0822ff9e0658df
- SHA512 77ef054dbbade51bae62c10e49a862a5ff235b6ba65a1f59303d196e146ac3e694126884b5b1be590ad74fe5eeb100071c46dfc5c781c399481f51831e063a3a
- SSDEEP 96:OhjmuseoOeAsDYWyx3VxD3xafft5UBQQ7ZNTxPtx4KwtD4F/OEWzPWwJ:OFmoWUW4pDWzPWa
- TLSH T100E1AB416BEA0219F1FB3F70AAB616A04FBABC53BD79D61E8740405E5871A41DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Windows.Storage.ApplicationData.dll.mui
- SHA256 410299597cb706487c180f4f555716ac5d26d53f0995653c736914737a8bcfba
- MD5 12bbaba9a641c04f169fc73ad9948b3a
- SHA1 9ae9602460b57804e77da6b54e49d57df83f36b0
- SHA512 37cabfadb181394d19a2a6aa0b67b0f3762bf9e72c60c1d02f890b6fc2677e72853045d5de3f7b0088fe73e182da6c1961f8022a169c3eccb7bdae165383088b
- SSDEEP 96:J7dCo+xCx9Q3xH2B8Fny14pupPvmKrN2j8DCbcN3YF4FmaiEWt0ZWwl:iny14QBvmNbWvmgWtqWS
- TLSH T104F17B47A7FE6558F9FBBB706DBAADA00E7FBC95A939C35C5205002C0831A158DA0737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Windows.UI.Input.Inking.dll.mui
- SHA256 33402c92175a84384ed8ba69cec483162c70e8ca2024ab8d83064879fcdbb255
- MD5 3b04419f1a6773eaa80078bae5b5dfac
- SHA1 94b7853c236e1736993ae27aea23ecea1c037c5b
- SHA512 ecc823f7564bcf192eb9fe454b93d3780d8fbbcacaf190c27fd4d5f835dff311e7a3cf4be1dada9478ba7bc891d7e606b105a466fe97cf64d558b3dc8c76787e
- TLSH T17C51090A5BE7122BF0A60F3093E606D55BBEBC1775A3A26FCF40112928D45599CE0FB6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Winrs.exe.mui
- SHA256 d2fd3daa7b855e6d58fa4e20ae76561563526ae66c3cbf2b4c40bb4cdcb93371
- MD5 483f44deeaa713d4a30123d350c32ae2
- SHA1 f1516322818ed59e9d26c48baeb83f052e76c43f
- SHA512 e9609ab26307696d6a513bf29cb75df09791d42d05d807b07d674e538c06299165bb12c7ea8c441b4b1d037952fffa356ee609bfe4d0618937700499d31b6d04
- SSDEEP 192:ikAY/FxIqF1rWx498KLp7SEwDzZgvHuo7dq6JWukFrTOn7vOW2mno9ZXAY/FxIqB:iROVFpYY6aOVFpY26cWFbW3
- TLSH T1B082895163FE4205F2F73F366DB991641A7BBC92AD7AD65D0288105E0AB2E40CDB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/Wisp.dll.mui
- SHA256 06abf98728abd7bcff5b2ca559fd0fa81710e8820964522f387887941a0f2bc1
- MD5 d63dc821849c09c4e2924b1e1f8d7e01
- SHA1 e5c2fe3928851ed8cfa933d542c3122048b0fd57
- SHA512 8bb7cabb54211fc5f64086c0bf6fc19621c91d734d0a27c122095abcfa3be320599a757176e13cac5867650ba02b52454f5909d4c16b97f7964724c40d793ffd
- TLSH T10551390A6FF70527F4A60B3086E606D11BBE7C1375A6A66FCB40112C28E05099CA0FB7
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/adrclient.dll.mui
- SHA256 31d6af23e055eb4033cdc28382c406849baf57ebe1fcad0793000740633f3d23
- MD5 cb3fd4d3e4cba260383f1db66661b7de
- SHA1 f75b2c39c66e89f6e0679cadb9480de0ed57a471
- SHA512 6059415aff00d7d0968a20ea37124e2024badecc3316b78928ed771d00e800904a9ed54f461e832138f40c5b919f9df6585dcad0daf736bdae82ba4b56234a92
- SSDEEP 96:VGVUnFnuoxoI4auY3H4u4l1y/EWIkowWwU:UVUnFn/4k3H4xycWIkowWv
- TLSH T1CA91E34647FB521AF1B61F308AF605954E7EBD13BC76E32E8B00401E68A1A59DCB0F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/adsmsext.dll.mui
- SHA256 5f59a1afc3600e66e356f05e1b26c18a9dffa50f300121b116b8f8ea60644aab
- MD5 2006ac168cb5535045e2a81886f065cd
- SHA1 a40e717b73682888c032fd44ab48c568c07a46f5
- SHA512 fe2bccfea64adddda9db2424e95d378733a3bf3137787f6c04c6fca046d9d9b602c407f3d751a4a5c24e72f7529f1c312d143a3f48f57eb1ca1f72f966ed97e6
- TLSH T11E519D0797FB1626F0EA0B3157F70A925B7D7D167AA6532F8B40112D38A0614ACB0FB7
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/apphelp.dll.mui
- SHA256 944851832a91d3655f4777e669187a266de8e9b77c769130efb22e68f15df774
- MD5 c41f8bbc042b45dbaaac5e8e31f43ae9
- SHA1 bddd05b71e901527d3eb03a64cbc98af215952a1
- SHA512 6e1a6a7c332f4b4f929cce8fe8d2d12abbac7e435c4d46e65b04c79e703213ef2e04435a264c93c8ef7343df8967e929f891d00a2c40fe0c769e2d0c2739f961
- TLSH T11371260AABFB1616F0B71B309AF716915F7E7C537576926E8B40512D28A06088CA0BB3
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/at.exe.mui
- SHA256 4877e06421da4deb7696015df94a5118040eed766e4fde571f14d95833017f9b
- MD5 84a01d5abd736cbd630220f9086d69b3
- SHA1 dd58718fd5c1e64861fa4cb23307b60c26eb3c87
- SHA512 fc592c6510089a08c24f109a7488286ea9ffdde152a6c73c8bf2905f11a7141344bef95c712a360ec7aa08c832104154c5019858f75614443e6811de8f8bae6a
- SSDEEP 96:mSRfHt9T+qT+utIKecjwW45Dsj/nEWyrPWwU:mKfz311zBN/EWsPWv
- TLSH T1C002BE0256EE0105F6F33B746AF502B14B7B7C96A8B9D22D4A8C511E5FE3E448D60BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/bootcfg.exe.mui
- SHA256 e1d384684633b180f180b66c898973cc1d70da29226c8ec3cfa5fe98260c64ba
- MD5 8f590de5c3092be0cdcdc37dd8e4769f
- SHA1 491e20c390801bd3d6afdd877b8b845491e6d557
- SHA512 1da1b550ca0761b42c7215d530c9f09b9cefaca43939bfcc88597704ba5ff17d0b694d9342ef0ec2ca54d2c39719efc2c083dedf2732f3589264a36a9b53eb37
- SSDEEP 768:N0IjlLeFyUdyikJtsnPiXwg9HS6g3QfgoKHcUfMMlFLZO8Uo+RbBvIaagjs/fum5:OIpedsJtsKXw6SVuKHRLM45
- TLSH T1A983BD10A7FE0204F1F67B795AB945A28B3BBD51AC7AC71E11AD455E0BA3E40DC60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
85KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/cdosys.dll.mui
- SHA256 78a0f7866bd04b34b0bff935fbea3c8b8f9f796717babcb09dd64d918cf5fab8
- MD5 c1182b9ffed4258109131088b18c346e
- SHA1 7706cbc3d6ab1a6e04372a19ce3208622178c2b2
- SHA512 d3435978552a3357e66b0ac0e2f9ec0443ba53b4ccd847960cb298d5d65a9a58bc262a4d949e66a2f525a1c01c691688dc5f4160c7d36f4c877ad9184a8ec073
- SSDEEP 768:yh03J6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfxIZ/xe8BVYhIAAInmVLHt:yh8J6ivyUcEsx7fNXjTV8PszW7yYszno
- TLSH T1AF238D1293FA4608F1F77B7959B616B51E36BC92F83CD2AC02A0915D1DB2F818C61B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/comctl32.dll.mui
- SHA256 4ef7a0d62cff8aa515d6f5e466eb4ab431cca135a40fc85b6a8e71f4c4c5453b
- MD5 93385ded995e259965f948b44a619c21
- SHA1 4110aa364628d5219e43a776025638d9b95e7565
- SHA512 0bdb7488978f8ed62cb87fc46ee91bef28ccabf909f760c8ebaeec17e815fa95c88561ffbdccec589c7f383a3c50543d96b92e6f08a9540326ee8864d8e203e8
- SSDEEP 48:yh5Hiymho96gjf8QaKfTmlpspg3ySsSEFOYAg7YGXVIO2IZWsu1AOJwT+y5WwHg8:sH6grjTmlpspgiBNFsg7bmDEWBAJtWwn
- TLSH T1BBC15105DBFA4916F0BA9F705AB207901B7EBC137A7A971FCB40101E64A1A04EDA0F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/dabapi.dll.mui
- SHA256 8e9e4364f9d9091f8ed2e0bc62a77fd3601db0837737eb180e8b438aa23d1352
- MD5 dd210ea9cdc17c4dc90b888f3e4f4bd1
- SHA1 42dbf83cad4db1a2cb1c9adedae2cd07ce1eb7ae
- SHA512 fdd2c414d47f5180537de646a0a3832e7c1660a2a82c8f923e200c1d49e2aa209a4c3f08b7e15be8cab912e4c6e5e0c6142db9f34ece3cc4d65f969bd213ec1e
- TLSH T12C515C0A5BFB1627F0E60B7086E746D55BBD7C17B5A7A32FCF00011C28A06199CA0F76
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/dot3cfg.dll.mui
- SHA256 721ddc03539ec6b376393d42a27bc52c123db283dcf67f580bc671065f253fd6
- MD5 928ecbf0b9114cd2de25743b8aa1ce38
- SHA1 b1da388e8b7983e0e73739a50bba9e930a7979c8
- SHA512 11f53b1d877162a09a04ef55561183a50cf29938b5898ffab779f3bd764ead11e3631dfedb090276204daeb2bb9fc5fa142ce8ccd14a490998440d49a291355a
- SSDEEP 384:jnn8McWgmPfKXy7kJFSpn8dXGQ+ngTtdl7B/FfM3FhPWSegWo:j8McWgmPv7Ppgxdl7Bdfoce
- TLSH T13DE2551193EA4218F1F73F78A9BA05645B3BBC65AC38C60D0188559E5AB3E41DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/fwpuclnt.dll.mui
- SHA256 3a135ae36c18c79eb048e6b851df5173295f10db7faaec776b929c6dee81867a
- MD5 9c6a7e5a28615ecef4f07298c2811191
- SHA1 afd4bd9c309bc6b594631d35758114859435c68e
- SHA512 e788534a28e2432fb7654b160c82971937c0647739876da45740be1968558fd07e0a48501e9fe2e1a52af3f16af7aa744bfecf30a0e221fa3d3db2facd6b10e8
- SSDEEP 3072:rVmVSVg+2rQpQf1P1N2YXh5HSzS99P9CVDV90FVeY9Y8LMZuHfTcpAzMP/VCP:rVmVSVg+2rQpQf1P1N2YXh5HSzS99P9v
- TLSH T127E34752A2F95248F2FB7FB96EFA51118E367CAAAE75D21E1240005F4E60F908D74733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/gpapi.dll.mui
- SHA256 097d1d4e34891409657f3b431f6b0299e747eb458d942ff22a145d79904dedb9
- MD5 c055ea5123c8b160b30d571e29b0aaa7
- SHA1 e0c5bd7faccf846686e37cfde23255b1299f592b
- SHA512 2f424575e40c42a2a37f0ae7793ba51668211a2b0277d963198a591ccb25fa15913430a95dfb053acf9c5ccee0b7e130d55df4a2cda369c242e03b112a5a0f97
- TLSH T1AB81D14667FA1619F4FA2F7069B605A14E7E7C43BE7AE25E5B00011D18B0E08DDB0B73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/gpsvc.dll.mui
- SHA256 3ffdea230a5324330bd6f58cc17c70ee1768d746fe2d2fe49a4f487f3e7cf310
- MD5 7fb4988b8a4f47e6b89dcac61f3cb8fb
- SHA1 8abc520365274299230d09f5f8d34890298a5a34
- SHA512 4e0eb2729712968581093fce006bc4cb91e3a5681d37db369304fbbf7417de8f23bda8af9f68beb30ea7b0691e9c625edd102c51a59489626879eb3a0e476420
- SSDEEP 384:AZuX5crbMGBkKHTxNd+//y4B56z1OZ3PpiS2lIWtNWYOeIe2gwPpkU9+KfEIiwzJ:0+bn/stKzrUMqK
- TLSH T13E33564263FD5608F2FB3F7069B91A704E7ABD92AE39D25C2180905E19B1E94CDB0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/ifmon.dll.mui
- SHA256 8f19ffa9adca78c9b340a4a9edcb2be3cf0107b592672ee1283f1b2123d025fb
- MD5 c5f83a86d44c01c81c8cd5bd6307ffea
- SHA1 a48f305447fcdbb58caeedf1f013414d84b396a0
- SHA512 df43336b71303f8ecee2bb8ffe0b21026e697425eb9228a705223f232507c14d461942b4d7e69b0696725e1eec0af9d165d1aa08cf41856b98f7dfe92e2c9202
- SSDEEP 384:O3DRrtPnJWDAmbr97wSFDS8vkdBPrSmNSni5RwNGhWvIgQWGjmJKXWcFW9:eDxtPnYDAmN7wSFDS8eZrPyGhWZQVQ
- TLSH T1AC637B1163EA0208F5F33F7958BA41248B2B7C55AD38DA4D128C916D4BFBE41DEB4F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/mi.dll.mui
- SHA256 eba51bd85e9cf1644a164d961e9ce4897bb8d6793afe4c7a8a2779484b108eda
- MD5 0c9ec21cbdf170e3a9a211a9c7963c8e
- SHA1 7dc70b8370c511cad631ac326cde1e11f6ac1f68
- SHA512 9a7b7997d3646b9dbd6c891c7ca735954428602e631f240ab26d0edd833d2262e6ee4b5d96dd07f32a92feb5372dbf350c7b7ac73f40e15f0af39f6ede2d12fe
- SSDEEP 48:yFBt1VYOHl2dGTNhg3kZVYMDcYRdZQnA0AgP0bTxbrlVmoMIZW639fmuqhvy5Wwi:G7Sd6NNZ7DBRdSA0ABsEWKG6Wwi
- TLSH T1A6D1DF95A2F96215F1F7BF706EB956944FB77C22B878D31D2A40202E1870F14DAA0F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/mibincodec.dll.mui
- SHA256 625b0cd6b59196db8380b4b416fc22f1131f4b716beafc6b37e86e6c473ca638
- MD5 8ae8c997f0d66bf0627898edcd5304df
- SHA1 92036c95f3bc2aa4b4b6c3c37a5777bfad05b273
- SHA512 584eacad26bdae8effa945896777be9ff6877191eb542d9abd2fe12cac3024ca3bfc1dfbefcc34f309658801f2a40e2746b4bc3ef17344f772a53fecd433b57d
- SSDEEP 192:GpiG+CznxMX33xKV45o3m/Bq9iiV7YSlxqCf3z/7CWeAJWC:lpl245o3m/B3cP8kWWeAJWC
- TLSH T19392665467FA8218FAF33FB469B905640A7A7C96ECB9C31C1240945E68B1A41DEB4F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/msacm32.drv.mui
- SHA256 d90f983cec30ee987b32bc0ce4857644007703d020ebd455fc67c0a2e60d001f
- MD5 3cf8ac4d3e35768c20712423803d2d17
- SHA1 5ab0a564a3207afe9f0753cc03cd1dbad39d9caa
- SHA512 147c4140a40b081573d59fdd373dae7ba847c5b62aff9b8312931037d5a6f6f019348f8d9d7d7cf1c1e2cd7b22c8af9ca0d7e4297c52da2096dc6a6a4e0ce46d
- TLSH T1B851DF06A7F9162AF0F70B354AF7095A6A3F7C22A9B5A35E4F00112C38245159EB0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/msscript.ocx.mui
- SHA256 f524108c561a0d07e5c7f92392b53cd5be372600e8cc9e32cb5c66ea84f1687f
- MD5 40161fb63bfb18f3bcde474802113cb6
- SHA1 1b7bc441894a829a435d684f1f530431e553df76
- SHA512 2635572f3d032a7ee0ac3a4af8941663b8b7ed8517ea22ff20b725f03f56fccf09d77a0d30ff67800c6e9385180e64d99d0342618ba25d5a87135cae7e28f913
- SSDEEP 96:Ch203Q18Ii1wNsU+QmQnlgMFEWhoRtWov:D1NmoqWhCtWk
- TLSH T175C1D640A7FA4116F1F63F359EB609910F7EBC53B876E32E8B00115E6870A488CA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/neth.dll.mui
- SHA256 45d06a66b55843d680cc2f221a13ba01ea14b3e477124233342edf03a26c5a3b
- MD5 9266b8ca6048cae52e43d0a1e4ca4c35
- SHA1 625234c41fb2a9536a530d565e4def03da192445
- SHA512 3224e8faae034466af6c7873df0160199e97af463f137ae2bdbd0885dda16afc446f71d521600c856e00d3ac6ee857fe80cc15d1744e74c94d14c80e9ba9f787
- SSDEEP 768:brnAspshnBFOM7m2WehfNo32exXAyxc4izqkRfla3uNN:b0spwBFOcRhlq2exQyxc4iz7Rda+NN
- TLSH T16663165262FE5108F5B73FA459BA92748A377CA5AC7DC65D019C200E4BE3E40DE60BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/netsh.exe.mui
- SHA256 8ac12ec1d5056e935921459f16e6deb4e5d40e9e5bc1a958d0c9b86d84dc256a
- MD5 476d906a4ce405c66f2a68ff9ef75f89
- SHA1 7de39b9dd70f19bbafe06cc155a864f2a47907bb
- SHA512 9e5c989c5219239edde851cac8723d1511dd54379508a4dcc37c7883b1090e8ea4fb34ee60b0e5eae847119f57bcf3bf295b86fb7dc695d47c5fef42cd1369b3
- SSDEEP 192:H4VS+6d0RMqJVceU4qeM7sDmued6C3DQnS1X09Vx5Tc7G3jWEGW4:Qt6dwJWeU/eM7MmKSN09VxtVWEGW4
- TLSH T1FF82431162FA5219F5F73F3569BA46608B3BBC52EC38CA0C128C411D5BA7A41DEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/nshwfp.dll.mui
- SHA256 21f1221216fa5d7ff1ba1cb26c87ab8e85316b03f1fb029295eff6412ee5b1f1
- MD5 5f1cd384b1b57a2c909e20c6fb1562ff
- SHA1 ba4421fbd5907421e30a8fd32c9694e3944b642a
- SHA512 b36f8e6ce0e70cf7c3862772d7d5653a348880b335e3fed42d43135c15397125f629317c0f787599b809e0889992449ee04a3ac1fb9e1f4cc44ceee27fd9d39f
- SSDEEP 384:j6xtdrncGnL1wmEZrPrR/y/U0PCkKzaxh/zxkueQUGWRiWY:jkdL1nLkr16/3/z28
- TLSH T174536751A3FA5208F6F73B79A8B611645F3B7C66AD34CA0D118D40AE4FB7E40CD60B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/osbaseln.dll.mui
- SHA256 24579cb69abe262a917d9da03cb362c76cbcd07a6c4fe034ea38e0786c958e3d
- MD5 a33dfdfa50b5022d0fa7eb4fdb930f4e
- SHA1 338b5e61f5008bcad24737cd146156d4279096f1
- SHA512 d3e4fc223898b480dd876a484c14e1bb0e5403b5a8dcd6a29e3b61fe6a23ef5541de2b4bb988aa7bf02befadbf58477afebdd9d44e1e1b89fc45520ecefcc340
- TLSH T1CC517B0257FA062AF4FA1B315AB24B616A7BBC12BA76932E4650113C2CB4A01DC71F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/p2pnetsh.dll.mui
- SHA256 39e6fb495190f28fae9046f3e28adf70d1906fee18319a3634b38f21144b76ac
- MD5 fb11ae4afa4f699334a401ca816f4f70
- SHA1 0a1d214913bade7775c34b134c52170c17abe8fa
- SHA512 14e09d78948255b2a14e9180ac5b441b2b544ce23d20a7d01dd5e08aaf3ef6788794726a5ce5deca5c0a562d1bb08c48ed26f4b61380a5b3fe541e6b1a6bd470
- SSDEEP 384:vdLFzHdh2ewt4vRE1+XG3kiBeqyIByMJ3QssEdk0FXH3x/Xeeu5XpWkb5qe3LZKp:L3hi1wG33Nbbsy/H0qkZK5EwTn3P
- TLSH T19703565163FE5208F6B73F7169B901A00B3BBC56AD78C61C1188911E5BF3A41EA78B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/quickassist.exe.mui
- SHA256 7403c2d56e7c579afb3daca5decd86a5a3bef122bc8c4879f2de72e5c3da8b5b
- MD5 1095726d5f08ae017586924734dfcef2
- SHA1 a747ccd4d6745f441b229fcb2e678932b866a075
- SHA512 18e0305bab6dc86d27de87d53afd5768cf82ea7557ef9b0af14567c632bfc2dc37a0d1692b03f9e7c9db133cb5217ed1653913966413ac92ee0c08c1398d1dc5
- TLSH T17F712441A3F90269F5FA2FB11EF649268D3ABC269D36D31C0A40002E2871A51DDB0F37
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/reg.exe.mui
- SHA256 e0a205de50192ac66b585d95ea233c78845f936d10b21959f50ce17eb335a970
- MD5 20d80bd54b12530721558e14705d4962
- SHA1 2430c6f2ec480c4854d1ba4ed449e5493c99dc25
- SHA512 3f7405eba1a117b817b9e5045b1972f088246fedec6ba3570affcb1f342c5430e5a8183b1f6879b10a4fb3b94e95f376350e53e6b3e6676c1ab3f496a1dc817d
- SSDEEP 192:UK93Wygy6nGq/PwQsUd6wQs6HQgy69ieky6T7ky6MGhGcQuRDugy6UB3y67uxE01:9oG8N0HbixvfyVcBKgS+D7UGbnqWn6WE
- TLSH T1F503B15163EA1105F6F73F796DB645A88B7B7C62ACBAC20E219C411E4BB3940DD70B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/register-cimprovider.exe.mui
- SHA256 f770c7b585b8b4b52bf29f1809c52800ca6f1cc1c0062d8ac6f872c1f4056aeb
- MD5 45755e4e45745e143f8659d6bc03e597
- SHA1 10e8c3a8344c1d103fc39fedfddf352526727ad5
- SHA512 8b359f160109e02c2b56fa0d658af0e8fd95cb745c0be40aee21115a72c6a100b63f79c2d08f49939a9b5edcece3e7f090dfb2ca1a6fcdd194a1ea8bc4d8da3c
- SSDEEP 96:XdQk0GA+vrNcAiINU6IhC2KIOD+LMrmKOq3KDZRvdduk2VxKEWrSdQWwb:NglkNxjTduMrT6ZRldbiWWiWY
- TLSH T1A112EE0267FA5219F1FB7E706A7504A00F7E7C66EDB5EB2D1680845E58B1A14ECB0F23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/rpcnsh.dll.mui
- SHA256 7ff19a93475b78dbbe75a64593523bd209bfbea5a8bd996b4bb7a9be3dd78bdf
- MD5 77462fcf551fbd6b6c49d8fd6d796299
- SHA1 073bf1560e23547f164934a689e7f15486c53984
- SHA512 d666c0634518c8e01f26c48e9a9c64d0a4621ded486f693b6e45235764ff5a5c1859a7850a79dfebc252bca7d9b13821e3284e42533deffe1640f0e7dad7be77
- SSDEEP 192:COUD/dn4/C7ghT67mrvBlfmEMQlhUgFQH75d3lgV+gdn5AHB7iNLhq5LWMyWd:gJOh24Blfm4hRQHKG7iBhWWMyWd
- TLSH T1C262AE4167FA0115F2F72F79ADBA05540BBBBCA6AD74E60D12CC405D0FB3A40D9A4B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/rpcping.exe.mui
- SHA256 ac5caedee5db609ae8189e622fb3dbb6afa447dd15767a32b27c4d3a4c274abb
- MD5 01be474b3e9a23f68a6258667813c26c
- SHA1 654460c70940c7a372adaeaf91b70e6b7a43629b
- SHA512 e811648a7da8b946d299996f0a98d76d0f5691a6b89ce9f0d7de1eecd2f62f080ced584f2affadda27e24f7d44905b9dd66fbb0c15f43796513fb05b3ad4b7e2
- SSDEEP 384:E3/lH8JF38xPqhoZcyHerT6paGWDWCjWj:E3/LqyET6kGyI
- TLSH T1B1139C4263EE4509F2F67B74597912300A3BBC96AD7DC64C1298A11E1EF2E41CE78B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/rtutils.dll.mui
- SHA256 1a11381c36d27b9ab866ca8f28ec01406a84cac55887e80df0435d744ba7786d
- MD5 a3d7c26bc500a7fbd4f832cd88f8d4ab
- SHA1 616b9d6cec3af0bd5cad022e4aee97c1a61d8fcb
- SHA512 1c8d58e4016fb101c2842fdb65e4bb77ce0da584af4c3057156260d11469f32aeed0953e3e489c1ea10ef1d59320a206bd98d34f0cc7c79eba42d19209ca0fd5
- TLSH T1FA51170A9BFB0217F0A61B3086F705E55BBE7C1775A6A27FCB40112968E05195CA0FB3
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/sc.exe.mui
- SHA256 dd0114a92796d9f6404aeb3cfbef944d164a68e52848a0d342fa219ee8f74101
- MD5 2f7efeb15acf208be578459e3cc7a53c
- SHA1 33ddedcebbcb7975bf1b2920eaf8c10516b356a5
- SHA512 addd6e72fe7bd8662fdc17ea0f51a4f5ba0322c566fe3afb4153e9938959c1a7dcb4d16801a166430941f98d1791c6874031a4ae57843fbd230f6f4aa10e5911
- SSDEEP 768:fWMblvHqXq9r9Lb5qz5wWrcYCLiv6JZ+gprO3r8qN:OMblVqz5wWrcYCLiv6JZ+gprO3r8qN
- TLSH T1F173594263EE4608F1F63FA85AB681748A677C959C3DC60D029CA05E1BF7D849D70BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
71KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/schtasks.exe.mui
- SHA256 17a2d0bfff94d5c5fe01c66269b783b638920dbd7f001bbdb726784b1749077f
- MD5 d1f31d65c3377d0edaef32dc79609da8
- SHA1 b9886440ad08a8780a37d2a4d4db8b645e4752c2
- SHA512 f154afabbfb1b1f51e984f94406e0378a6949bc556733710a70a8c5b9a742e233d6c1d828201d9ea8e1674f33e9f95ba4947ebc9b9836a9d7c9ec9404b87ea86
- SSDEEP 768:DhsHzGwLq2fTYkC6GRAmcikSTq2neqHUzw7DoppXk:Dhs7Lq0YX2Bq0zyUppXk
- TLSH T10C73AF10A7EE0105F6B73EB96EF555614B3BBC92AC79C31E11AC465E0BA3A40DC70B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
74KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/shellstyle.dll.mui
- SHA256 4347ec5e5f647cf9a7954d23462563b7fb621f05f0d2a1c49a3084f504619397
- MD5 053caeb7cf3fbd5f6d7c79b0f355139d
- SHA1 5bad80029e1246102b99fe0006a4f8110cf4a178
- SHA512 3c152734b591d101e6f6e52378dc7488b7d913e5389aa0aac664ace23974f803c279903ae9835f1cc16fbce50fd6df4556f915f0d3e3f1fa05178be1a551aa42
- SSDEEP 768:jAJAEDgF1sdr5PW0FVirccc7uog+ZTe2AIuxP:jokFCd9PFXCcccNg+ZTAP
- TLSH T1F3D29FCF93822A3ED82F2BB74B0748A0A567F4653B13474BD659141E3CD2B18A9F5363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/shutdown.exe.mui
- SHA256 d5cd2268dcf25517b06d2ce209bb0f55c2b8ac488f9a394ad88e90a300ff2a08
- MD5 53ccd5bcb3892f7d7edd093abebaa4e1
- SHA1 cb0cada51e075420dffa739b137f9562d5f2ae82
- SHA512 7e07bf76fd8b640a78c129ec6b8ad0d23c51d9d37daafc1c0da59404fb8425b54f95bfc1e7f3dbc7982a168a7334a3390f1cf1bd945b3c00b682ba237bebc55f
- SSDEEP 96:7SnY8nXuJNkgGowKP3H5L/7pSRfPZcZfwpSpUiN8JksRf4/OMzi9jUEhQitRB0MR:GnbMkegVXaEZUrQW5+tWq
- TLSH T13622875167FE5208F5F73F7859BA12618A3BBCA2A83AD75C069C055D5BB3A009C70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/srm.dll.mui
- SHA256 d59658b79bf76f1cf8b07de7cdf19f2e1fc82bd72f7db27341264a77e60ac77b
- MD5 b79b6b481f1fd978e1bafbe1b35a8c94
- SHA1 b4b49fe42aadf7cdef4a53335abc9fba66953870
- SHA512 dd5cd1d7cc392e84111de7249910718d0132f7b3cd243cef536b25b435fc33bf9f9ab5b24387725fffd7121eb06f94abdba29d865b3cac83c3d7aeccd45a1662
- SSDEEP 1536:+pNL7mu6oCg3ONPs3gLeIQ6vmG8d0W8y935Mi+MVu4oyX4IQ1OpLAs:+vrGBLep8yZ5hu4oOQ1Op8s
- TLSH T1D6E37A4267F94608F6F77F706AB916200E3ABD96EC7DC21D1281905E59B2E90CDB0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
143KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/srmshell.dll.mui
- SHA256 0d7b8b9ccc5d128e63c4ffe1102e931cfe9643c79d75ed47b87860cac75e0d19
- MD5 72b14e08368375d9b3635111c6dff40e
- SHA1 98ff886aa8d4d9531fd470551eae7c31cd15906b
- SHA512 22f969045dde5e8c83d0f90964de59ce977880b2e8b73fda17e6214e973d9af8ef08751035b3138e852c35bc05e2d252274ee2d85826addf6dc614023babaee2
- SSDEEP 96:qNbzLuVmrxC/DFqVsIIVRrsr4v8hFh9EwHNm+dIEWBkM0WwG:ebzLuVmrx57jfWB90Wl
- TLSH T124E12301A3FD461AF1FB7F306DB65A650EBABC56EE7AC66E0600011D18B1A14DCB0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/sxs.dll.mui
- SHA256 8f016ab75e9e56502ec89466343bfd721d9703aeba453882bd2f93061a74379b
- MD5 47aa7fba4fcf49c0e8d7c14a1c1b4aa0
- SHA1 a674e93aa6375d7075e0257ff13d088f7227c04a
- SHA512 749f40ed1c6cf0aed4ff9172bf4addabb134124304d79086ba0a7a4c9d2e02d199cdf29050473fd4f6ff394a064f1466beb6e1054a170f2db4bd41cb47c41db2
- SSDEEP 384:7vVeJTVi+N8eZZZ8h5Y9eJL+kD1cG5fI1rzzr3K9WfGWt:RoZtgq0K3zrl
- TLSH T172B2F64657FE9608F5F77B306D7A12300F3A7CD5E83AC25C6290999D28B0E509CA4B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/sxstrace.exe.mui
- SHA256 359975b64c75f3f8a143027ab95111de5fc556b7433eeec00f49ed8a0891ace1
- MD5 a8b446bfe2411ab27f1021f6faf7a09c
- SHA1 4e6f64e013cfd9a9b22437023e144b4718bef2f1
- SHA512 7440ec5e048f2d1b6bb085a6672516b1f4a70d603e87fc79e566f6a7ea7f73b2c1f8abb9a0d8e7c3fdd8f14111fe9fee9587315ece6e492f3364ad0c56abdb5f
- SSDEEP 192:sIwb8+/9fsln6G7lPCnbidETN1jJ8WZTWC:L+/9fsl6G7lPCbidoNwWZTWC
- TLSH T1B0627D01A2F85608F1F63F727DBA22548E7ABD55ED3AC2AE2250D01E5962F41DD70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/systeminfo.exe.mui
- SHA256 34f6af14ef1311d2130e37a68dc8f92cc326a443106db3645e21ee2c4ecbcd73
- MD5 921f6d2b7289cf558087ceaf9973f11c
- SHA1 3c0a349226db19d0abde6aa86dc8c88358e3f429
- SHA512 852860a2620c8c0e16fcebc8728dd5b7f29583f2416d11ebf533f886cd420362e5251aef2e31c5e30f2cddf22bbad2636056136dfe32dd246e7c46de12bd7346
- SSDEEP 192:6bZuKzzEr+ht4dMWHtgPXiPqOAgF1WYSdgS9WtP1WS:cLHE0t4ekIWEn9WtP1WS
- TLSH T11D52B910A3FE0219F5F72F3469BA45520ABBBC96BDB2C31D129C550D2BA3A40D871B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/taskkill.exe.mui
- SHA256 ee635c44f7c538bd3c699406ff59f4354500cecea7613ffd193fb690aa6ebf99
- MD5 67445d70c35964b313165f55917b4c09
- SHA1 61c57eb6866e4c37b5131363850020438c2eecbe
- SHA512 048a82b84db4d507da95a1b12df3661b10cdd89116da7ab8d9bd28f1a7db77834d95dedf2465d21083d27c6ca0af194d6f82ace0370eaa0631cf78b3f34c0a6a
- SSDEEP 384:9BdlsZE261PIT4w4sVySmfMPQHRXMfwCpdnSW+hNWY:L39R
- TLSH T15672D810A7FE0219F1F63F755AB956614FBBBC62ADB5C21D528C454E1BA3A40CCB0B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/tasklist.exe.mui
- SHA256 bb92d6e947cc414cc382721e0076ad5ed9f7a57d471a697816693946d78e997e
- MD5 ce17de98394ac7584f51d22bd9afdc6e
- SHA1 a4a2e159bcdbdae91ba546c2e39c966646e14a68
- SHA512 64cb7455b6433611cdd40ace709c3d7ee0af71e109aecaefcee376e66dae60471413f523f17334d9a95b7531e982338c0a957ee81278bd4a717dbc5bf6cd8608
- SSDEEP 192:GJqcSrlUvBeEBtoHqc/FqmF+eV1WYSdgSVWutWk:G8c4lXQoqOxUnVWutWk
- TLSH T1CF62DA10A7EA0219F9F73F7959B945950F7BBC52AC79C71D029C590E1BA3A40CD70B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/taskschd.dll.mui
- SHA256 6a450c027d40bdff71c3eedbbba823ad0b7e1237ff718e080bedc491cc8cf29c
- MD5 783cabe4a1a58d3a7a11d500a0f72c20
- SHA1 58e5670bd073b5045274f1ddb751ac16cfe5fda9
- SHA512 a1222ac7d2aab2a7a3c84e66563e9af327334031fe8d4c8100bbf83551737498d860d336dd3e999240a76bc631d5f54dd331dedc969d72a358336e8479165f36
- SSDEEP 96:evfZfLUJ/WPIA1AGNG0xYxSVcascwlA/xYxfBpfuMf27EW3JQfWwN:wfZfk+9x+Obv/+fW3JQfWG
- TLSH T115F1F80097E60509F5F63BB67EF64550CD797E25687AC22F221091AF1932E83AD60F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/termmgr.dll.mui
- SHA256 8355d6bb68cbaf86e53e8e6a6c048aa0b1065ea2ab5a120a9f9c09d4faa518ed
- MD5 9a5258cd4ecb9f9f01341e431f580506
- SHA1 462068fc47d6615b4f0d5b2f1aa8b5001aa6f1a6
- SHA512 f854fe3b63fee92093b823103590d73fe9fd121ed796d21389f08f5fbf076e419975507cfcaceeed4e8c19930a1d2daf0123be7f3fa83a7f09b7422507029e77
- TLSH T1B881F1058BFF0116F0F71F71AAB625850FBE7C13B576A22F8B4001191CA0A19ACA1F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/user32.dll.mui
- SHA256 6921a8d82bd3586df770d2854dc9c538f6de996a64c63c29e31b1e84be040f4a
- MD5 90b43ec7eb2e379561b0efd0d93342bb
- SHA1 efdc5321144229a02e2347ae71ef1e9a869d8d3c
- SHA512 5cc5f9045c90e8fd7d0ddbc242ef64df71b10e36c3a6e5d25db8dbc2608aa3ec48b2a6b71686fa4646e40eefec700e0b2c324e8bde7da9239be98f1416a58e4e
- SSDEEP 192:onnn9hDQLrbyxrfrJm/Nkeeu9DI3iqscomAnGhWgbWI:onbsbEf9m/+ea3pzomAnGhWgbWI
- TLSH T12E72EF41A7FD0618F2F77F702A7A52608A3ABCA6AC3AD78D1741401D68B2B54DD74B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/wecsvc.dll.mui
- SHA256 a6cf9099b48556281b5c1ddbcc2a7129c1e3593d1827a8263c6e03db9fdf37ee
- MD5 635f521167819fcc518351b0ed594df4
- SHA1 8c9d9dbef5213cf7239949fce3c3cfb18673f3d5
- SHA512 94dfd6664bf4f4cf750455a2a74c9228c3748040cae7213a2dff53eebe75fb9732b33c771630d1ab1975d98698686a8d55076c4c2a04ec256ae459fa1ba23077
- SSDEEP 96:+X9O35hP4lgYWSjjJOYcG5wL7EcDYTaOCWbu8EWuXmAWwx:Y9I5AbjVPOvEIfLWspWC
- TLSH T14FD1AB5263F94608F1FB3F7669BA46604F36BC9AAD3AD21C0650501E6CB1E84DCB1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/wecutil.exe.mui
- SHA256 bc4793e4b1cc7a2f823bbc9f8d86426a6161848c14d065b6b95cc6fbcf33ebff
- MD5 bbfaa3ded33bb719d5cb4dce4b52cf65
- SHA1 ecb63383213a1bf3cdc2a9ef1531eb276a8315c1
- SHA512 6c41c4fe6bf266f61b57c58b055160e866f73d5682f5b3273fff87da8a9f970837247c087bc8cb919b0493401f2d2c9a7d5b0a7646aacebd627b7ac3721b6c2a
- SSDEEP 384:dj6hJySfqHtZ5wMvLEb+3ebPWLv63vR6ebQjgdS0gBKE7JP2di7t4k5njC0jIwWv:ygX5wMwb+3yWLv63Z6ewx1h2ZkcT
- TLSH T14B237A4263FD4208F2F63F755ABA40604B3BBD96AD39D65C1198540E5AF2E84CCB4BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/windows.ui.xaml.dll.mui
- SHA256 407aff91f566dfd0e9d65b74ed4f2d52f78de8d3fb2634cc909f6fa555c1938e
- MD5 d26fb93422f029bda45053454e278b85
- SHA1 8bba6b3ecf1c0fe2eb6ae69211b984be7b1f5f69
- SHA512 49f547fa7269ddd03b923d8f0666cfd2fadb9293852d61c3c3be2b2c35176031f23f97eb2df7246ac9f38c1b32a90d58c66fb22e617d67ddc36821e377171626
- SSDEEP 192:M6T8+biAZHETTkmXV+4ZBRyp28senD6E+Xe690WDVWj:XOAZH/mF+4Cr/nmHuM0WDVWj
- TLSH T19D626691E7F91518F2F76F746EB626604A3ABCA3BA35C61E0240605E1CB1F81ED60773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/en-US/winsrv.dll.mui
- SHA256 12a6d6a6dd9a20989ef28760cb5c82a941e94d10072ec5277c268210406e8bf8
- MD5 90d9d30d05d4ae6b565a9ac2eff0f4a6
- SHA1 27f18bd07de4dd6c8fe024e03d06b27cf774c6f3
- SHA512 1c7753c2fa4e6085e2489ad138f3adeef4355a9bc5ee58aac5b742be67307c8e46fbfa0c89c1684074f79ab4cd5e5f6a1c9e7e512091779bdf87cfb011142245
- SSDEEP 96:9lgNuHvLvyhkwU82oG4MsNMFZcoKfonpmdEWzxWwp:/gsKHlFGhhc5dWWzxW6
- TLSH T162C1380263F9461AF5F72F705AB666711F3FBCA2A979D35D4640606D1CF0A148CA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/APHostRes.dll.mui
- SHA256 d4104c429143bbafbdc10bb74add0f2e85d9029105f45d48cfd48e004903a393
- MD5 32328fb817455c24433c9d53e0fb4a7d
- SHA1 5bbfabbe776f6299a9562cddc2b28798b82c58f9
- SHA512 4801c374f63ab02d226d07a08a9d9981be8143ffa652efdf2ee2a11c946e25756f4d74570bdd372d73049aae23b7e08ca3f8822c4929c0e25d7cfa3817d48795
- SSDEEP 384:ZdxziAft01FZv7Ee+fp4/hM0hM5hMi2yGemWEZ:Zdxikfp4pp+AZ
- TLSH T1DC72AE1117FE1605FAF73B3A6A7A06684E7ABCA5E93DC11D6260912E1CB0F44CD60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/SyncRes.dll.mui
- SHA256 df6b763561d6fa921360c8c9492d33b870da21875362a661329456c90589aa64
- MD5 9cb26730d5c19f9eaae9291e03b5216b
- SHA1 6aa21bec9c850bde4df8835f7d00cae4ec06e566
- SHA512 a275797ef266c4289eda370f0782877b06b93de338e0b52fb2638625badf1ea44d820b570d7e000e9ebbb7c5c89d75c691334b10fc51bf2e64ccf22a9414a2ca
- SSDEEP 384:7n2Rnhg6mvZLOrNzOr8RBwkoww3n4sCvywHwH9TpymWbb:72Rnhgl4rNzOr8RBwkoww3ZCvyb9Ub
- TLSH T10BE2319067F95646F2F77FB6A8B916684E3ABC92EC38D14E4210515E0DB0E44CEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/cdosys.dll.mui
- SHA256 f17795a79e083a8ed3c1e005eda12ce05271f1539b85912ca24f4db924d66827
- MD5 4a35411e1f364bc91a42d410c861e965
- SHA1 e35e2b7869e762b46d7a9ac340c0f879a130f504
- SHA512 768902c54cec97bc21e614f5429e740ac4724b31d92279279fc8de47dd89d326af2fe4f9845e6f57c6a2c14defb29f62d9534ec1bfd385b6b0867aa43c82b092
- SSDEEP 1536:1wnfumm+VivyUcEsx7fNXjTVk+YrszWv8liysznGmbFqjPxGQ7jzTTjVLsXLsjwW:1+fumm+VivyUcEsx7fNXfVk+YrszWv8f
- TLSH T125338D2293FE5605F1F37B3968BA16665E36BC92E83CC25C02A0926D5CB1F458D24F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/comctl32.dll.mui
- SHA256 c382adf8b2836d2cc077e3549864fc50fe0c36aaa0ff4dd025fd65bdf7f32e0b
- MD5 f68ef64f1fa3bf898836d0b65d3d82fc
- SHA1 f9723e0522e400debe16b2d77a950a34129992e4
- SHA512 5eca3ed8dc8ba03aebd5a9cd228a0e37eed2ee1a3436fefc284d990788265ac8ab669f006807233f23f2dfecfe7b15aac6bea4622ac26929ff833da53325c437
- SSDEEP 48:yt5QBxCWE8o+A05nvEBWlo0pspKRbsSUcy8waLX5ZaxZ/1RfjBqeZWyX0dpw5+RE:4Ebz0Wlo0pspIAMw8gZ/HYmWVONd
- TLSH T1E4C175429BED4611F5F3AB74A9B606911F7BBC52AA3DC31F8A50181D29B1B40DE24F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/quickassist.exe.mui
- SHA256 1148ac701e3de31d30bec8f7ac1184961b166d77ad94216b28b0e0eabda1c6da
- MD5 12632f9754f4449fc6265d2bb0cbbcfc
- SHA1 e09bd64f46d15f172c8ae961de6430f431fa2f17
- SHA512 eeee780159f9acf19274059c67cada26176a907c0efc53add99d5adfcff2364ee446d71e669e5236a151f1bda346a60b88c084f232f0293e5ad1b2a9d1d52e6b
- TLSH T19281074157FA025AF4F72F709AB606A65E7E7C63B97AA25E8B00015D1870A04DDB0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-ES/windows.ui.xaml.dll.mui
- SHA256 a8a0b883083ca55c887581e1d5469e275e14830f5d3c404cfa5016eb3026e5ff
- MD5 cf333c0184685bd6feb0cf8b3f8ebeb2
- SHA1 a5cf52dc6d1f2614a4f9d24eeff9894998677165
- SHA512 b3d17e2fd145ef6e43c65437583c69171c16184dfc71bbc6b5b731ba87f451b62b37cb82e00d55f41a7282512c22b7429aeb6f9c95db1e030b2b2ab39da87acf
- SSDEEP 192:t6maeeqeQxRsapcEO5joMN3aM/cSj4O9BV+4bvxp+kfVa6E+Xe69tmWF1+:VlT3pcEONo+aM/cM+4D+kNXHuMtmWFg
- TLSH T114823451A7FC171AF6F3AB78AABA16558E3BBC96AD39C10D4250211E1DB0F44CD60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-MX/SyncRes.dll.mui
- SHA256 e2d2b74abd06f6387cf2e161cb2e5b198a6a8d454d647891f619f8a46cbefd6f
- MD5 6dde284c9d210daa3c8839cfbb84d7e1
- SHA1 ce42d5e9e4bda504bbb35b3f05cf3113a2195f20
- SHA512 a6c965f2c80508410a78b68a71ad3c786297b9d2e18c7dc72e6dd1f2f527ccd55159fbebfecc7e71d91361d23456a10e742a9dbca858fd08368d82f971e4fff3
- SSDEEP 384:+nnntPeA0/y9zrxr975L3WWkubM4Bhk8MVTH7WbI:On1eA069zdr975L3WWZbM4BEr8I
- TLSH T156E2529067F9564AF2F77F76A8B916684E3BBC92AC39C24D4250416E0DB0E44CE74B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-MX/comctl32.dll.mui
- SHA256 822221915c9fd9c7ddcb8eaf992a1c43cfda4639f7f33a5ee66fcec196bf2b17
- MD5 64e34cc4389bf2fda0351bb8b3946050
- SHA1 2bbb93d5de2ef5c5e4b5eeb4a3cdd0ff17421343
- SHA512 55c0c3f53217cfa50b09715580563e273de907e998dd31a46a0a6da0853efec1b86350b3447a4d24fd5bb3d8c8405d2e1d5246b45d312be358d477c90ae4151d
- SSDEEP 48:y+F581FqWEcoAUA05nvEBWlo0pspKRbsSUcy8waLX5ZaxZ/MJjBkZWyX0dpw5+RP:LgRUz0Wlo0pspIAMw8gZ/2iWVONe
- TLSH T1AFC187019BED4615F4F36B74A9B606911F3BFC529A3AC31F8A90141D28B9B40DE24F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-MX/quickassist.exe.mui
- SHA256 d3bdfaf32e613a723b5028e7cc159fb5a27fb6c5c3384b19b1941f9c6744bbbd
- MD5 0cff74973d2a6cd89e9baf94ce8c35a0
- SHA1 2ec82a0bdd0ca5f6da1622e298db53790a724c60
- SHA512 8ebf4faaa29f525739d6e1105be5ff2f94875a1eae0ec9206cdd54de43d17aad779934776051e54d4677d175adca3af58d448eeb9ff2437116b628095c3f15b7
- TLSH T1FF81C3445BFA025AF1F71F709AB605A65E7E7C63B97BE25E8B00015D18B0A049DB0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/es-MX/windows.ui.xaml.dll.mui
- SHA256 ff57b135914b0620715f91543b72a1e0f28592dca236c49ea50d2dd4f6ff161b
- MD5 6ce2867da893fd0f9653ad303230a416
- SHA1 5d3ee7949239ec6e0ba1cb398522b895a75810c5
- SHA512 071bcdab57388c68160b8ed133d84190378460fd3c92eb92a509203ba197ad4c3c5c79f3da3d8029a6a7451404052533df5f68c75a0ac03fe99bb0ab397c635c
- SSDEEP 192:l6v5TReQxRPaGdEue/M2LPNe5PqJAGrV+4bwMpL1/K6E+Xe693WF1J:IRTiGdEue0yM5PqeGB+4jL1/HuM3WFL
- TLSH T15D824841ABFD161AF5F36F38AAB616948E3BBC93A939C11E4250611E1DB0F44CD60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/et-EE/SyncRes.dll.mui
- SHA256 7cbaf81a9294c7de029bbce5d76baa08ce37e9cb6b00ef17463332fd70cf8c5b
- MD5 8ba6cff5569940a10ea31fa260feb5b0
- SHA1 12404bfc5d376dce90265c589fe0dd8c437f23d1
- SHA512 22a13d4e4019671ebfb738b21803a8a091b511bfd794afe79d3b7a1c8d345d282ec0ab2231d62a1b084179fdb1eb2b0569a9dddab6a5d6c5778d1e3ef43fcb58
- SSDEEP 384:en/JmQt2gruqb5mddwmbOUvCtZ7pTkHunSW0D:e/Jmgvu7vCBoD
- TLSH T112C2EC9262FC9208F3FB7F30A9B416551A37BD93EEBAD20D0A40445D5CB4AC0D974B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/et-EE/comctl32.dll.mui
- SHA256 0455e9bbf711e58e9d7e76432f11b7260d6857bc78bfb51098b3a4f1659b10ac
- MD5 b8c184929e782f5ae1a8b80db48a7575
- SHA1 ae85345169e4eba473d00ff3eefbcbb7e5cf160f
- SHA512 b7e8ae27feb038806e6f738d8d9496b0d0c14748eed6fb0fed635767eb5cadb3c4cde54854730f8e6715b85f635663e10d0ef9f627ef272a3b9fefff443a1f2b
- SSDEEP 96:nHG30/Bb3R3VdtNpspVGEn1gQojmGIY/u316WuhvLd:mghFdsl1gvjfIY/ugW8Td
- TLSH T156C18645E7EA9916F1F75F346AB202802B7BBC13BA76931F8B40881D6874284DD74F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/et-EE/quickassist.exe.mui
- SHA256 311e294fa52e1873d0164c916a77ec471d1230e860a877453c4838b9b2d30dfc
- MD5 6d95580117dfbb475d4035e33810a94b
- SHA1 f93d787307c4255bfe9f6ef3dc4430ea171e2531
- SHA512 aa2d38fbdfaf8e5de055db242af496a45412ece22861c7e9d95d2f6a90f75d82224e5d0fc8eb27996d14222b8ce8f02a4577db2a4c091412d60b728d051308d6
- TLSH T19781E54657EB025AF2F72E709AF106A55A7F7D53BD77E22F8B00011C28B064598B0FB2
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/et-EE/windows.ui.xaml.dll.mui
- SHA256 cb0417431e7cfe34682cd2f4765882e4269efd68260fb675b0dd9ad210d29efb
- MD5 2a8f650a3015a8a686305dcf475c7fd1
- SHA1 56e8e8ebc7e6194a2741040289867b9c24c176bf
- SHA512 1718f014d7453d423167ddb9963a0a5acbe5a995f9aa286f26f02053db11b18482b2f61fc662df0d84ddba02624f91a83fb72ecbd705bafa1afc5e1b34178fd8
- SSDEEP 192:y6rLf5scN9O43dZqK1Ncwijs2iAipmrcQZTXV+42BRygp14SX4Aj/c6E+Xe69CW3:RLKMtkAEIyLlF+4Op14SXHuMCWgA
- TLSH T1BF727382A7FC6529F3F76F742EB122415A27BDA36D35C21D1944A01E6CB1A80CDB07B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fdprint.dll.mun
- SHA256 4aa7d038b4c771344c7ae051631981b874534b4df3fc0d3f35d4aea6670e6ac1
- MD5 b45cd0df62efedbfdefc4be9f0877a20
- SHA1 ab0e11664615f3beeddc557187093dd404d9ca97
- SHA512 37cbb1f6be1b4e57d324194e081d016642feebdf52057175bc3cd3447579ffe8175f7626c8a2e36cfc63396b332638e28945dd700cfb293dc7a7f05e99736185
- SSDEEP 1536:w4GKUdp+UmBo6Atfei97YOcHOmxue7hZNrGACX:w5hmBo6p7
- TLSH T147B32394A7A0C14FD8D90EB36B62ABB079BA7CECD5E0250DF5D8FA1D09F3241580D1DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/APHostRes.dll.mui
- SHA256 66bc4faf41bc0425af83aecf905ec474dfb78d6d6739159c4ba331462033ca73
- MD5 08b4b6e32397394a347b0a7990fe4107
- SHA1 40df4275e2aca71d345360d740a6aec3a73c6cc3
- SHA512 6530529142445a8016c9fa0a7d21850e3d8a3166f2f25f893d3c20ac9029d6b66628963d771ff4e433f7949f8dcacba7dacf3b7cef8876c4278277880bb72220
- SSDEEP 384:gYerFp4umLcxUDTkgxF1leEoDkcW8EdW0:gYerjEcxUDQiFjcSB
- TLSH T1E072B11566FE8225FAF3AF316A7502601B773DE36DBAE10D1B4091AD68B1480ECB0777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/SyncRes.dll.mui
- SHA256 e17eac600b0e78d4578d22ad12aeacec9444fd6bbd5dd8a5c64ab00f58ea0183
- MD5 87a4a6a7a5df17f0760ea01c67a37350
- SHA1 cfe3c72318c13e5b8a941782e02048ebcf8e4bac
- SHA512 ecd363ec63e05fc3e3d813e2817b0a3ae4d5c2abc87b8c4e83d3092ebedc8b749fd9e8e8ed427f8bc9b4bc7cc361c8444eb8bfe4151529a0be885a6b42a17f6c
- SSDEEP 384:fP9tMD8sXu9C6d9kxwwuwWjUFckjm61LpxeM4MkTTHwhCWlGzWX:H28s6Cxwwkwl1tw1o
- TLSH T184D29A4692FD8339F2F39F707DB842610A767EA7AEB9E20D0F00555D5820682E970B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/cdosys.dll.mui
- SHA256 9b2f8dfaebb409cb04e5769e8c49bbf382174740288ebc4398b8513bac26e271
- MD5 e280e4fb69de7b189aa7d1454dfdb216
- SHA1 ed7b890545a12c22a656776858d61cdb6b586b98
- SHA512 ac65027c6aa18898945bb651520c67fab32c8a6992f296e4b2da0010b9bd6f8f1af41e7a37a51f08b99e0307b5219528ec25833b049d7b35f70b1acc6cfae9b1
- SSDEEP 768:vloJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfvJ9PaTtNO7aope8BVYhIAn:vGJ6ivyUcEsx7fNXjTV8PszW7yYsznPo
- TLSH T14A23BE1293FE8618F1F37B3969B612761E367D92F93CD29C06A0911D58B2E81DC60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/comctl32.dll.mui
- SHA256 69fa848b91bd329c6880f990019e2ce91b7d4c8ad68e9917bb29c6a859505dd0
- MD5 e1bd2b97aa218c7ecfa4c9a7af5391fb
- SHA1 442adb8bbb5f4b6812b4919daeb58f5f21fa7e68
- SHA512 16e75d4879dd36cabd71e317b275982f4e1b51438a141fc15abebb47b5da5abf0f4c6074620fff6a2a99e782d8b8b1d7eeb6cfaabb1361db7823f5ce658e5091
- SSDEEP 96:CX5WoOBKmpspGwuIl3rYq6f9sPl1AZNpvWGXEpbWwuK:mkKlxYhfqAXhWWmbWO
- TLSH T14AC19609D7EE8A36F1F74B389AF606511B7BBD636BB6C70F4E00585C68256C0D960B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/quickassist.exe.mui
- SHA256 6cff25cd0f3961ed9418a17660668d69b4ac9b43178e11a5dd9c4b23101ac4b7
- MD5 d8ff6a857456e7992a404a80aee9f092
- SHA1 1b8cba8a0f2c7fda8f8c7d1d365cf290c02068df
- SHA512 6fce538ad014b9cc45fb3fbc543012a88246477e6fdda9d888f45697ae960f3d130190b9e632ade7acd82f00adbe048f5bf8005bdabf9200ed7555a2364f2f4f
- TLSH T16381F44657EF426AF1F64F705AF606A54A7E7D23BEB2E22F8F00112C2860555D8B0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fi-FI/windows.ui.xaml.dll.mui
- SHA256 f9ab9e4728df77d7d19360ee4818da3c6a457c86ce17864a87ab96fc05e3460b
- MD5 2c89e7d5fb1245440671116897938305
- SHA1 819bb87680c557c251d568e81d3f741f63062916
- SHA512 cda12e8f878b65b6ec8edc2f4e73735b4850909a4c5916aa912cdfa3b04b239cb7781e9e343a814787fd2889d18d06aad32cc0ea6d8141235f23e232fc5a2b95
- SSDEEP 384:BonQuZc/Z9EULQCOP4f6+4PajLiril2B//CDHuMoW6DW5:BonQu0EULQCOPuaqoT/CreW
- TLSH T12D823E49A3FC6634F2F38F386AF512541A7BBE936EB5D21E1A04640D5871AC0CEA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/filemgmt.dll.mun
- SHA256 780f3ee58878444c0cf63b0322822928814c123015a1366b480ae9398cbb3df1
- MD5 c64858c19ef4969e1c6fbffa1c6afb90
- SHA1 d9f71da32e3070faf5a36f2b12729b81a72c29ed
- SHA512 cdac70df9e82a6eac9942ac666fcef85848cd662dda561c03b47d31149202003b2b6fcc9ec822597ec945a3adf9fbdeb9fbdb38271917d8c081bc8899fd4d436
- SSDEEP 3072:zZZZ1ZZZccZZZi923Ho3P0JHgJFWh0Wgge/VGaO:zZZZ1ZZZFZZZi92i1FW
- TLSH T1E5047DC97144B6A0CC2C0077851BC6FE4D1B7D1996A82E7732F8FB1F2932247655BA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-CA/SyncRes.dll.mui
- SHA256 53272e5d1f6e419c1b5da62951383ec853b06ff3a96d6a37bb118387a1bdf85c
- MD5 e5174c1d035c530d58c91fd37be839ad
- SHA1 c607853c7cee81ecf5e569b03b0f365aad3673ae
- SHA512 6e265b84d60c4a2ac7740eb975efe20431b2f12d993a76f0978369179be20af033ee35494746540e0796541f10e171a567409ba9286494ea989c1a56d1517aab
- SSDEEP 384:/fqjm8GwTWcKuxhjz2oOuTZlatoxurzjmGqzQTDwqEWh24:3wxTWp6lzXOuTZlaKxozjmGF3wsN
- TLSH T197E23F51A3F94611F6F67F71A9B815258E3B3CA7DC39C20D0690409A2DB5E58CEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-CA/comctl32.dll.mui
- SHA256 0f87d9acdeb6f013d870e30106a878cc5e874a05facae46733033aa096fd6082
- MD5 927727c65ccb04e19e6bfcf979965f0e
- SHA1 4f0094f56017fcfc937b8c226c20d9fd2954899c
- SHA512 498521af8e929787b2cb5853eae6e600217e842049bc180bd855800a177e386765012e1fd3d4abf1bdee6e77ed0a4c35cae6af78dabf4f35ced9bd5e53590fba
- SSDEEP 96:YowxgL8x2KCpspe8aeA+lB+aMVmHpjuzUZAEWlNgr4g:m9x2KrXQgZAEW/gD
- TLSH T192C15521A3E85622F4F6BB706ABB06515F7BBC129E35C30F8A40595E3871A50DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-CA/quickassist.exe.mui
- SHA256 9aa90f2fdfeb27ced432160f7120281287feb515da113a22eecdcae7c1acb259
- MD5 35e3d06075be09e14afefad5afe4e9fd
- SHA1 d24203144770ef2c9b5272a707aebe696f5f7e2d
- SHA512 a1c3dc71a9ab720ba755b35d9cd619db484b6c95ce398cc88adec439d1a99c7c532c2fb2d9413e7f0a9212935593dad26888a27c65203e1c6bf03847fadfd8a0
- TLSH T1208137016BF6032AF5F66F7169FA05568E7B7C939D72D22D4B40006D2831A14DEB0B33
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-CA/windows.ui.xaml.dll.mui
- SHA256 01921fe1b7f2a22d609ef5387e61237f21741e9435a280a1753c038d2a1043ef
- MD5 53661fbda00de35846ec69162d6f0209
- SHA1 a3aa1ca64a083161b9d0b95ccde86b396a7b281b
- SHA512 438739c427f4f9ac62753d87ca1c244709d57601964616ac887e17fb5f11079fc9c6a0bb4642c3dfa390adead0da6b42eacd74e906bb3dba6f5fcbabf89e2f9b
- SSDEEP 384:LMPzHF3q8t114OhNN+4yKBMdlHuMxEWLG8:LMPBrB0VZ
- TLSH T15F825351B7F81616F6F77B746ABA02544E3BBC9BAD3AC11D0A40609E2CB1F448DA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/APHostRes.dll.mui
- SHA256 c24570d8f47b65e53c130d58cd46813633fbee93f88d5d3f94841f525f758936
- MD5 6e60abea7bbe0dd35aeb473a0313a719
- SHA1 421d3abad150f54323d75ac07cde819b4d431ac9
- SHA512 a3bdfd88d85f9c1f14da317cb77e341c29bbd35f4280a42e8fe3398f059916bad33b52dd1f57452c2d4546fa95d029086a1c2771f20da629470249381a4b0636
- SSDEEP 384:LBKIJogWkEvjbPTumA3AtH0uZuiW+fZzzWSkg:LBKIJukEv/LumA3AFdgt+fZz5j
- TLSH T1F6827B5567EE1606FAF33B35A9BE12201F3B3C9AD839C11D264191AE1DB1F408DA4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/SyncRes.dll.mui
- SHA256 fc6119b5d7f2fe098abcb88c6d4952a13b87843098d1bae1a3d347f5a5bcf300
- MD5 f5ff012577b61f9623d74bfa4922fd38
- SHA1 2b3a3f91a8a09d8d40839396b6c8b62c0dc83a4a
- SHA512 16de4f212e29b4be7c212240da5dd8e892c78605b758db700256630fbbd79f9fc08b82f40065301e71f415e2da30d51bd0c35de9113ad058028d1aacca4ad76c
- SSDEEP 384:6fVr/gog50ofFyjiW6JlKf8Qo9caEzXx6TeWWh2g:inAGizJlKf8F9caEzXx6yZ1
- TLSH T136E26261A3F94605F2F67F71A8B915654E3B7CA7EC39C61D0250509E28B2E44CEB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/cdosys.dll.mui
- SHA256 053aa6dce12eaadb834109d97a318396f685ee79b61007c9689129ef30e1b6f3
- MD5 fe37a085e3a4e1ed7f3afcdfcde34514
- SHA1 3f9d6acc1ceadc19c1054f96139529438b9b189f
- SHA512 bf1c30dfe1171a3f8944d955cf9250e25d3cdebc5cec4e79ff36c7f21284f41096b167c24cd1f77c73800b5ae99c714e2aa66c095d8b410a965f56280303f7b3
- SSDEEP 1536:QfPcOivyUcEsx7fNXjTV5AszWSHdsznExn+mgxzTn7yBMUBVIPyvzLVTiRCrabrz:QHcOivyUcEsx7fNXfV5AszWSHdsznExW
- TLSH T1AA337A22A3FA4605F2F37F3969B912655E3A7C96ED38C26C02A0919D1CB1F51CC64B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
50KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/comctl32.dll.mui
- SHA256 334ee6c8f3fe27a1115652a5e3c802f4e1fb0b7b6661f8372b91755614c00412
- MD5 b8ff32b41a45d4abafcac69743f62e25
- SHA1 fe3a2fdb2f731a2552841a9e5459e0b952074962
- SHA512 d039573794bde20c89e2250da5d173eced9459713990f505d00ecce223442735cc5265311776a070549f2c197e24e179ba7147b7c5bb23c3667c4c0e43fbca4b
- SSDEEP 96:aQHHHHZPrgL8x2KCpspe8aeA+lB+aMVmHpjuzUj+WlNOrMl:hnnZPXx2KrXQgSW/OIl
- TLSH T19DC16611A3E85626F4F67B70AABB06515F3BBC13AE35C30F4A40595E7871A50EE60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/quickassist.exe.mui
- SHA256 5dfa865a235118979f0d1eacab2689765b28a962027d6c33b9e6374d3e9f821c
- MD5 42903ca27c76964e7e714e3bca0f61f6
- SHA1 8e2f637882fc3dda3ca537f5e68b4d9651263f72
- SHA512 b17773d3d7998b287c78076123080683ef83b332eeb91db53a42701e52287eedac409e43e01f4375d6cc9433a07d9713abed345745e9552f227b3aea85ffba48
- TLSH T12A8125056BE60316F5F66F709AFA05968E7F3C53AD72E22E8B40016D2871A54DDB0B33
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/fr-FR/windows.ui.xaml.dll.mui
- SHA256 0588027aaca55d5956ac1ef50753ae33f26502a1878c717de95f1098e12c997e
- MD5 2f56a7ffdc61894fc03ac99de412d5f0
- SHA1 73da24953eff83c01328be274ac2833c15e8894b
- SHA512 6a00eb6903deecdce02a658de44893282d1d4e5104b4cb0f2306a6401995316f708f89ba9e767641b90d8445896529795e338a88c6201c8844590914d6b8541a
- SSDEEP 384:00Dseh1zHM84OhNk+4yKbIdQgHuMlWLGk:00D1TobDSYB
- TLSH T133823051B7F8161AF6F77B74AABA12544E3BBC97AD36C12D0A40604E2CB1F448DA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/gpedit.dll.mun
- SHA256 f5aa1b8142992f53d47fda2915b35c20d7c6c02341aa974bd469c93700c0bc82
- MD5 90d03e3970440f90876135b3f3a3bbac
- SHA1 f281d0ea077bb617dbb0001eccea97c60cda2046
- SHA512 b2812eecb39ea0cd6c2ae5ba01e6f5db5e4edcf2f7fb4d0e8973a7d3c0f2dc6e817d120e52617bb97008c822e5b3a0a0efb8b643ceab4e5b2c45d5c95cd4b27d
- SSDEEP 3072:9Y3QilrVhlSzQ6MSJXTXRo8j6nceZZZ/ZZZ3NnwNf9PwKL:9gThgVvJXTBo8IceZZZ/ZZZ3+Nf9PwY
- TLSH T1A1B44264F0B2ECB3EA126B7039BDF86C91AD79551346854D364AF0B791E230131CEEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
517KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/he-IL/SyncRes.dll.mui
- SHA256 e70665dec742af74c21db1d766780f55158252a88e41f83aa5ff55f3da593a4c
- MD5 22a505042c133d33b2dd2f62a56ec91a
- SHA1 57f3d1cfb882c0bbf163fe4eaa347d88e4e6292c
- SHA512 814b62f0b1fdc91154d309abb9fa74d56496078057e948b77e671dd8b607862f557b6e6b676377601b320617df07b902ef2007b3671602b78b4c5307ac37a8aa
- SSDEEP 192:xXXdCO5+jXTVxzbD/77zd/1Vf+SjgKc055nSH8nKHTHe/bQMnXh8ZLwv/TJTWANX:xndCIYXrbL7tflGU+anm0TWqp7WLFWt
- TLSH T17FB256402B90C2FCEAA2EF33922F296D4755DB80453D7A17589C5670192CBA2DBEC73C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/he-IL/cdosys.dll.mui
- SHA256 e802e1697e4286509e36f99fb36ae851d426dc91f2eba8d477d9995c973f1f71
- MD5 8ea0a1a1bfbf9e2d105c8874b07154f4
- SHA1 e495a930bc7967ce2df4dc5cbc84d15289f07433
- SHA512 0674368eacd1b10eed4a3919dd72a7a677276e90914f83fb7c7cc265b197ef91bf2f1ba8ad48108770d62538f822773daa85686705e9488a8c74f49d33935e5c
- SSDEEP 768:wi2JSJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjf+oqlJ0Lade8BVYhIAAI9:ESJ6ivyUcEsx7fNXjTV8PszW7yYsznPZ
- TLSH T17523221253FA8648F0F2FB3A58BA11791E71FD41E93CF25E01A4512C19BAF818D29B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/he-IL/comctl32.dll.mui
- SHA256 82e0dd15ade04cae9d6afda3c98eeb7d342b242805faf1a60e04e8b4dbdee1e8
- MD5 5896502e03c477371b53ca3e64a529b8
- SHA1 10ea1379279d655dcc1e71c02e16c340f01c2e26
- SHA512 530e2b682ff8d879cfe13c99c254bbec0982a3c9afd1ab237d7ec1c202c097b65ee9ee8191fe2061e71628d39d03ba337d91acec3676dff04ad952447f4c50d3
- SSDEEP 96:d4auVnpG4pMp+I3gx3qmOFE1tRH5U0AJWBAJtWwY:0Vnk1gxdf55UWgtWr
- TLSH T1F6C158029BD1C9A2F49ACF3752770B6C6776E84A5B2A771BCA44055C343D244EF2CB35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/he-IL/quickassist.exe.mui
- SHA256 8c002111cfe22e02f0db11bbc45a2c7655db904507fddbe0451eb9810cced909
- MD5 f6b2e511e1451d31658ccd41309282e4
- SHA1 c62af25e88548a7e502392bed2323dc608ce6d96
- SHA512 412605ac0d8a14e299487ab92a835644736c908b524dfa7f473637a6d40419348a906b8efae88ac9b2703f31e9df09e4c80c6ba5af871c5118ff70c93285e8e0
- TLSH T13171010153E653F9F4A6CF3182AB056E1A7DF942997A732F8A440128382C341DAECF39
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/he-IL/windows.ui.xaml.dll.mui
- SHA256 5c934aa946fdc8b5233cd72d04f5d3c40014c723a23907b1651451b89844333c
- MD5 a13cac79420493df1d9b6b322ad2ecd6
- SHA1 22b8660f897f6f43cda93c9caf85f8668ec84e34
- SHA512 505d884d7db2a4f8b67f4117412fc158391ac2fce3090331e69e741df07b153094a39c6515c02d27ebca661e66a482f5f22cc036e7942f312dbac22ab16b605f
- SSDEEP 192:j6uNq1a/D+umkr+T3XyYGJBwifOlb+V+rml1XEo4Ve4AeC6E+Xe69JWfVWf:Bs1aikYDGTwhW+rcrIHuMJWfVWf
- TLSH T17872B90167A492EDE9A7EF3642BE36EC57E1EAC25529B31B0CC01318186D7808EDC77D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hr-HR/SyncRes.dll.mui
- SHA256 9a1a9a25be0d0d95fbd74136c20e8ccc3bac08453197d2ed0f44694e0ea92d58
- MD5 73639f311cc4cf2fba576b0d19a25064
- SHA1 4f8cc4333010d12bbe9745d4236476f2168bf5d9
- SHA512 b8561fd10d3122b403b956d323a7a3fcabe801dd96bcd1e0435559ce2549f945bd5d9675451531d670d955c84757ede497ce8e2c86904b95c40a5fe12f81e715
- SSDEEP 384:8nKaeFzWrF/mxvIfa/RaImJIrMcTYVYDYDYM1VgPrJ/gJ4TJ6bTkPI6L/y6UGGWt:8gIFuOfNvJ7OccMjgzJBTobT+ZnRYa/L
- TLSH T1E7D2AB52A3F91659FAF7BF71A9B507740A3F3DB2BE39C20E1140018D1D71AD19AA4B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hr-HR/comctl32.dll.mui
- SHA256 352c05718f8b96d223a000da55f36593c005fefe2cf48780c1c415a826e2bc5a
- MD5 d95a2d7a4fb87fb5be94e568bb914b62
- SHA1 55786f5c43953c181f98b1904b176cd91f638597
- SHA512 2fa17471f32821fc29b2805195232006cdc0eb037cef64d2edc4022799335f5468d7170dc7d22a60ac58caa76337bcdf18c220a6bd3efff44c3024142d527828
- SSDEEP 48:yN5YJ5i4oo+TTj794Nn7NOzpsp39I4TySmyEmMW3egWVJosqq8HnkteV0QetODZf:UuSvj7wCpspcAJqqq8if8lWoRj9
- TLSH T10DC17746D7FA1A16F0FB4F7496B60BA12BBBBC627B35931F8A00154E28312449D94B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hr-HR/quickassist.exe.mui
- SHA256 1be18985918cec8e8175058c9ea63f434001e808dd69d3c958894789067f7cca
- MD5 15c2357673e5f4574440a57a514a7f0e
- SHA1 7d983fe8ec1cc7d12bef949142eeed9907c1b40c
- SHA512 b120af2c65ce0a3de449c21137b4b469b49e837b0876e4661cd46ab22f73beac5a8a732b15e4b8f5d20fa2698e9ae76752146a354147664b65dc3dc8960313ef
- TLSH T147816946A3FA021AF9F71F7086F602B14A7F7C73BA72921F8B40015D1970A9589E0B33
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hr-HR/windows.ui.xaml.dll.mui
- SHA256 f3857c7163382803a0ba995f0bdbcc9caa2b4adb2adc257f5db0bdb571fe450b
- MD5 30771f068a1c1eeeda2d849cdf23427c
- SHA1 517321a86ca1d01322cebc49fcaec00f9bdf657d
- SHA512 e20dfbc13ea6c2335f025f930d2ee520b84e96cc81ef75f33557a2bf958bfcfd7837b0138365e5a92492d07704832608698e7e80ffc78ed5fb8e6573e87820e0
- SSDEEP 384:fwlaxO0Eye3M6mfhqChXGsFFO9FrX+ryJzkxHuMZWzg:fwlaxO0Ey87m4AXGsFFO9FrpzkBsg
- TLSH T1D3822142A7FD2559F2F75F78AAB613A50A3BBCA37A35C21E0180614E1DB16C0D9E0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/APHostRes.dll.mui
- SHA256 103f384e789c01c1c7ecc4a253e137a6cfe5df1a2f8ea34df76544082d51f3eb
- MD5 08b2df469aa24587ef8f91261d9cbd47
- SHA1 7a48a29b93b7c196794ccd569c8e803e43e0d43d
- SHA512 26b11cb098c904a0ca8156c01c5550e77321ac075dd7947d71f25a694caeedab5fa7f078b678136f71a3ca0034a39c0755442ebf130b41eaee62b0d913d88ed3
- SSDEEP 384:3VmMMTTypX7eAJ48F3cOo7Xq66VvAxCyIWZIgWOdWG:3VRMTTYX7eAF3H0a66VvAxCyIWZIQb
- TLSH T16682264692ED550AF9B38F367EF146511B35BCA1793CD10EA680A29C2DB1684CDB0FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/SyncRes.dll.mui
- SHA256 f30ef2d8b44935cb4048278ef26dd746781598ea8d96c9e91d0e20921eee1f5f
- MD5 dc1c8c974c97b194db2361a74605d643
- SHA1 c777def49aaa582dba700f769fa6e1a5f0f6630c
- SHA512 f641a26a10691bbca30bffa14427048e3654bffbabbe9219665db012bf5d80cee628aaf5e167a9be58c8357bf03c99ced6330581128a00153155a89a3a05ef96
- SSDEEP 768:U81UFlGUPujNJvWOsF6YfYhUvyCwYPZlIy1/1cbtAnANSB/P6An8nQ:UoUFlGUCNJvWOsoYfYh9Cw4fIy1/1cbk
- TLSH T1FBD2BB4552FC528AF1F78F727CF553590A76BC65BE3EE20E8280A28C1D61981CA74F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/cdosys.dll.mui
- SHA256 5fc641ba99d6848351a0ed82cb42c1d983d9ce9286128a077175c87c8e93cfea
- MD5 cd135318685971ecd1849d3529b0f342
- SHA1 fa25d9d968f61d718a5f14a4f401ef6a74ba2adb
- SHA512 925f2c235957519f91b69a6af2829cff1ae9913ce4529dbd26653357fc662be8cf09df952494a2d5f7dd68202baa6048ccf0fde2292442a921e56d362353b3ed
- SSDEEP 1536:gm9J6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzTT2UEKIYEdp41CGOn+mDiyTiA:gYJ6ivyUcEsx7fNXfV8PszW7yYsznPyN
- TLSH T11C238D1253FE4609F1F7BB3969B612B51E36BC92B93CD25C11A0925D2DB2E81CC60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/comctl32.dll.mui
- SHA256 e4687407de280a2a80f7123131bf4429fc68c87442d659c97605cb484fc181d7
- MD5 ec905ec1880f83d3fb18d5b73e54c601
- SHA1 a7af5099d8ace7840b5830f8e59d4594402f2e45
- SHA512 6a05d3467fe07435880b2812b58ca8f230bb12951a58060421c7ccdd9c1104b31c3fdd5a6b0ebd2ad05e07a59557be86e14ce919355955c68d9637e36eeba7ec
- SSDEEP 96:J5s3Yvkpsphgh5yYjdidrIrqcbYWJUZbWw3:rjvFghbj/rqccWJebWQ
- TLSH T148C18645A7EE5516F0B78F766AF602911B7AF8136B36D31FCE40914C2875644CDA0F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/quickassist.exe.mui
- SHA256 b5cc1c4606a4780dd4eb5d60b4dc9cb44b5dd7a710a0a5671b80d29a0780ac21
- MD5 2ae8041f626b15f54f811c0d858ae1ce
- SHA1 a7435a1c6e808690d2288082543a797047c622cd
- SHA512 36d16e3440451a1137e420bbe3085039a70cb10eabc2332e20f9b731fd214f1ae7c3ce96780e317bf300595e26a7799bb6c9d9ed57ac7eec6f2a607cea7060a5
- TLSH T12081294593EE129AF4B70F716AF246A54E7DBC23BE7AE21E8B40111C2870584D8B0F32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/hu-HU/windows.ui.xaml.dll.mui
- SHA256 b2187d4ef88711575be9fed86573c32cc12a39b306f706212c5b249f52dbe6f3
- MD5 9c9a4d1e090ded25f86b5758d51c63eb
- SHA1 e0877aee8de72fe5e19b84892048d9748424e044
- SHA512 dd3727025718c78b17ee4123e7c23f2c9d0ceab00b7d1ec750723599ac64d156a652f1cb1f6ce85bb6b1bf17832a4a1385b223fcd7b406ba476ba750ecc1ab70
- SSDEEP 384:MG8xfK3vfrqATNJW1bfXBaRQB9yj1MXczr/lG+rQ3SwlPRSjhjca1Khv5HuMAWLx:MG8xC3HjNJW1bfXBaRQB9yj1MXczr/lq
- TLSH T137824541A3EC651AF0F78F757EF142950A36FCA27E39D21E9580624C5DB1A84CDB0BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/icsigd.dll.mun
- SHA256 da0567db08ba91399e20965f92ccaeee0a597503d8128cdbe9ea87725a919953
- MD5 a61e503b362ce24e417ed3d0c8b2f33f
- SHA1 222a29383757a8570c2c64995e87fc43a1c14f29
- SHA512 03afd4f3d70b164d06d29e892c011b484fb25fd21302c0fe821d59e6f1f5034f05feb8cb9e1efe69271c19b75a659b847d855099c0af073d504127701e8c0a05
- SSDEEP 3072:yXjZZ+XKsQRoT9ibMEVm4PjZZ+XKsQRoT9ibMEVm4:O8XdT9ibjm4d8XdT9ibjm4
- TLSH T138D3BE81B655E5A4F52C0332CCABDAF81A68BC1CFD42031725E8BF1F3DB461618976AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/icsxml/cmnicfg.xml
- SHA256 ce985d30b184c71e319cd617731397a0e413cea7a24e98ec2354f746be226e85
- MD5 1c61a449988b0da447faeaee31b7b7f1
- SHA1 bcc4e232d5148f4845dbc975f864e46c2a955710
- SHA512 7a8a6f785b68a0206f484bae32d0a8049d9678cefd61f73709de65474a0cb333ee873293e2c8952da9d139bb436fe518ea9101c3c955aeb964252f8f9e90a5de
- SSDEEP 96:veKf4X+uZjiVYVcjw8ajtYaVLOaV0xaV0saV0DaV0XhXaIXjMaV0e:vT4PeVYVcMZRtVLDV0sV0JV0uV0RKItH
- TLSH T1EAC14A1538DAB295DEF6924D49B75101FE20364BB5080070F5DCB37B1F748B62A1FE95
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/icsxml/ipcfg.xml
- SHA256 a94d4191be0193bcf412814324f1ed2de76158d29934f95454bf85b0e937b6a1
- MD5 a055556ecfee5a81a581c87f9562c12b
- SHA1 804c0cdbb41fcb8bc428964c04201035f5c1e1bc
- SHA512 9225a3b40a0484586a1ce6d329d6e5e7d2226026b97458bd8840ec6913b34f9e97349ddceecd822e7fc8a06f91e8319aa8029d7cf544748ed80764fe62f932ac
- SSDEEP 192:68GFAm2JZWy/4/rKyp6eVeRcrK3CRnsIQk/rHEyienLYS9yjvxMJWVZgO5DyRiRS:6zW3O13/rHTienLYS9yjvxSWVZgO5o
- TLSH T17A523C2538E5B2959EF7825D8DB74111EE20330BF50800B0FADCA36B1F75866662FE9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/icsxml/osinfo.xml
- SHA256 96c82f0838cf7e7c327bd09c1c653b6b50d9e3ba8769e809822bb95bb80c9772
- MD5 43aa0003c871e10db961e2028a6a6ff5
- SHA1 004cdefeac16c5e7409f321bac3bf5b3698abbba
- SHA512 caa4a6d9280ab0b23ae0659522c1620f8c2920fe1ee35acd7fd13a4b6c9d1416b4896d13f6c6222d7eec0053fb2a1e0f5fe966e5bcc5d269bdfe32fbad26b68e
- TLSH T14A017C09B5CBE13C8EBBE19C11BB2851DF60605BD8401425F0CDD3571F794E8661BEA8
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/icsxml/potscfg.xml
- SHA256 b062deaa06769a6054aefef284637e76370d123105d628540225f6c0d53a61df
- MD5 40a06b19f7b7c416be35750198c4f445
- SHA1 7080edccb8e3b70966823037f241a5f701d81497
- SHA512 072bfc6b4d8fc357f7af802647c6adf5f462345b63a2eb25146fd0b41f6e5ec12aa0ff552e10623561114583c3d3af0b5abffcc1cb175911a06665e680ba2377
- TLSH T184510B143CD9B2569EF6D14D49B74102EE313697F9080074F68CB37B5F758B1261BE54
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/icsxml/pppcfg.xml
- SHA256 947d9962b01f242be5888d9a38ddf0bac9c395c50d355049cd2cd5a6c94558a7
- MD5 a21438a0d4f5f68e03d9d58015d191c9
- SHA1 0b1e1a55fe397803f744f5d2cc27002300ac960d
- SHA512 27f6f5defa53fe334cf12fac674e33d7f8d64e78a866d17c2d3aba66d7703deb4e0ab136d983ebaf89219461a29552dd2ecab87034f84bcd0823b59e666aba02
- SSDEEP 192:68GFXm2JZWy/4y/Kyp6eVecVL3VLnsIQk/rHBienLYS9yjvxMJWVZgO5DRcrK3Ce:6zh3v13/rHBienLYS9yjvxSWVZgO5r
- TLSH T1C0522B2538D5B2959EF7924D8DB74111EE30334BF50800B0FA9CA36B1F758A6262FE9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/ieapfltr.dll.mun
- SHA256 2cfeed8c7155b3c8a1ad8c8c5077c099c748dc8a45a52ea62d0ae6e024fbeb80
- MD5 b630c9758f3350b8e27416f8850da9a0
- SHA1 0de47759017699a560a29958b52c8cbb62191e19
- SHA512 3f52d27eb76ba6b2db650f674036fc899ba48f6efc01ac430bbf2df0b88087064aa292afa57cc5d2b8c00a6222ac84d8ac8e6d26540867cbc120d15dd0f46826
- SSDEEP 12288:VNVc1ysMbElv2E3I5cD+aCN2cKv34BXE+:VPc1XDx+aHBv3c
- TLSH T143E4F00E6299DC35F3AA47BBE9695C713236BE17C63CBF6BFD101208852062A7E71315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
691KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ieframe.dll.mun
- SHA256 923ef314fd01534a5f1519122329ab2e6992a4ee5184669a09a83717d4a4a34f
- MD5 a2e5ec7e54b56422563bfc7e2300b1b6
- SHA1 47db2de894b28971b256aabadfde8d30da07dd3f
- SHA512 ea7da9957fb93b019440a4ce1b3e0ababd5b9ee57175719d82ff2343dffe8b29b7ed136a360312654b72fd0e052c1f0c6459788c8daf9e039891c3a7f80171d1
- SSDEEP 98304:Q/yMl5YBLjU8/c0T0MMHMMM6MMZMMMqo30MMHMMM6MMZMMMqaYMMHMMMvMMZMMMY:Q7l5CxfQ1/tBu
- TLSH T1D546C560E384D86DE42B8674C972C9F5291BBE15E8A4885B32DD3E1E7B733436427D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/imageres.dll.mun
- SHA256 bbf9e150a1375235a0629ebf84eef0ecd21c8ceaf5d58c61f56c5c66986b7e53
- MD5 2b657282905d3d0e1af44ef3159aff0e
- SHA1 d22e3672c0cb501fb593086301733daba4622478
- SHA512 6c80984e08871ee3c07b2a13dd3d6ffe13225fbe58f3c5ffc83a329baaa65b84df6ae27712086826afcbc7b82f7f81e8ee5c99a8a09792294476392bf4e00a91
- SSDEEP 393216:9HTqde8QsOe5rexpMscBJIBBI8I3HWbFvv9:1TqM8QTWIMDBJv8ImBv
- TLSH T1D1277CC9FB05ECF1E954823A7831D97D2F527D29C9A4053675DABA0B34321E268B3C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19.8MB
Virtual Size
19.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/imagesp1.dll.mun
- SHA256 e34c9f95ac1b4a16d809a5f6af93b6622d0f2cf8d44dd56c0a8ab99fb6ffb580
- MD5 d8b5b135b050ecb6eb90668447bffe1d
- SHA1 74df4e16db4d1c0ce39762fd071cb0d92680f340
- SHA512 a900ca6807eb0d3383447f34110cc19f5eb10d7272108d6d6e897973a57a158834f6e7d6b107eebe5ea571653abf29910276ae1f19bd5909cc606b9ddca55411
- SSDEEP 12288:VpJrMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMXnTppc6g7MMMMMMMMMMMMMMGfYCC:LJrMMMMMMMMMMMMMMMrMMMMMMMMMMMMY
- TLSH T181E4F1893759DE92CD4DC5388873CEB06DB0BD29EC40466A36A67A8F2DB27D63403C5D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/inetcpl.cpl.mun
- SHA256 b0962dfdbb9451b0d3082419bb8a1a44d7d68868cb97552611a4dbee18839a12
- MD5 09b7aaae75bb0bda11d09dfc99f0dc7d
- SHA1 6c28ceaed185beae2ab778bf86de5108e0198071
- SHA512 7bd2b08c9bb504a243de90163325946a54afabedacd6447d97e77420437808f6d1e05a201bbd9d3771c6a0b98207b20bd5112d8b1cefd2c399019e8b10d9ab48
- SSDEEP 49152:QdmMMSMMMqMMfMMM65oyKEYItEURfiGfL:QdmMMSMMMqMMfMMM6GyKZItE6fL
- TLSH T122756B85F290D8A5D0685631C933CEF8176DBD35A8642A2F3298BBDF3D72343242695F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/intl.cpl.mun
- SHA256 d2accca623f616ca386c20540c7a6ec1f7768ddcbb81b7c0aaf74169218c071e
- MD5 6008dece8051a03e99cb868cb2bf1174
- SHA1 80368d7b348ea391c50349c9464a119046c7132b
- SHA512 803eef0eb0bf3524d434705c8c0e9da9053a4959fd5da37fab4d6ebc63a49ee85efd2ed163af29e9d7aa7bf9756cecfd8b4f169727198f427a7f85733508417e
- SSDEEP 3072:b73mxanybMMmUotLSoMMaJLQAnTJh0CgMz7HDnKEj1lVtdqRRM3703TT7QRVns:g24MMmRlSoMMyTwCPyEplcRKIPUV
- TLSH T14F44F7036BDF0448EAB61E39583355640F7B7C551E39A26D11AD790C8BE3E42E872FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ipsecsnp.dll.mun
- SHA256 5bfd216cfff79eabf5583c49b58c7f423bfda4291a2c400843ec0ebed7a41b1e
- MD5 811229014b346192d29ed2430382c59e
- SHA1 4b27a298e3bcc1812103feba2ce429e6e5b31431
- SHA512 25d0f5b42bee8c7c6b0e80283ab9d4558b4c3903c2e360340c8b9fef2ae06475e8b186747a42e97354a421a47ec84224d132ba52bd57abd6de17db01162b72f5
- SSDEEP 12288:cDFxTzmevkYKVixFxTzmevkYKVixFxTzmevkYKVi1FxTzmevkYKViP:GFxTzmevkYK4FxTzmevkYK4FxTzmevkf
- TLSH T16594D6F6EC096F4EF0FFE63BCA768AC404DD14E984162B9A4463E4A8D5D5A410F603F6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
421KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/iscsicli.exe.mun
- SHA256 3a5148071ed0953f1eed65ffbda57e3ec6baab30ed626178c122c17bf1e05983
- MD5 5405ffb417a01ae38ba04caaa53ecf5c
- SHA1 2557ee56e7cb7d291e80ce67b163754ac4ed4eab
- SHA512 7ea680e90c4db978cde8eb8e878f5a27fb7a680835927f5108515f6073e50d3ef094dbdd429ad3093730c4e269db4fe13f5c8e6f90b73725f2cfa60182a70453
- SSDEEP 3072:QBRAICgKOKaeqUKOpVk/qfWJTfS1n37M:iKRaeqUp3WJrM
- TLSH T14EB30241B7969E1CF2A00274C55389F67E603E909D58031F6381FA7F7CB5912BD31E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/iscsicpl.dll.mun
- SHA256 06fa78993c8ee8e156dbbac4486b07d18ab9ccf8c62d582abe8ab01eb4e4a46f
- MD5 46dc320baa7c41578878e5b342aa295c
- SHA1 8c6c13dffef5fac712f67b53cac914e8fdfcf0f2
- SHA512 a84faae07536b39c6c979113d7e266d405a95f78d6b1519c0775fc66cb4168ab3df77d6f4b06f0a277ecad5e21200056b5f0dac1baaaba98db642784aa0de50d
- SSDEEP 3072:rDz1AICgKOKaeqUKOpVk/qfWJTfS1n37MfkoQOp:hKRaeqUp3WJrMmx
- TLSH T1C4D3F091B3B6DE58E0B01133F093CAB51A992E54980407272690FE6FFE797209E35E77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/iscsicpl.exe.mun
- SHA256 1d8c3fb56e43966337447aab5a9131125680bdff123a86e716d3ab1f853c0123
- MD5 baac7c45cb9b777a26068c55bcc8df92
- SHA1 71fde7daa9d046776b401fcec640b05e4aa367eb
- SHA512 466db5f6b3cd3a058dc7bea19e720f92cbed93ae5c441bbfc2dee210be071dd582a34b43dca7ecde3fb06b7573c4ae7001fc58d7008e22bf8ea37f395ef57bb7
- SSDEEP 3072:qGFAEM82n7GC2jctoKpsusT2rEFpeoIUpZ:2X8I0jct5rEJdp
- TLSH T1FFB3F162B7A2D91ED0C4063C0917CB7E6E36AC007E9957535B81BE7FACB63163C911E8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/APHostRes.dll.mui
- SHA256 7ee3d26df0d2a78afdb6f3f83a6df09377244081bc7af6138abf3609cd4a0866
- MD5 5f42bb0fc0af396c27ec235fc407498e
- SHA1 3e3bec0654a40825e3ebeff01c33458e464285cc
- SHA512 10a4a5cf2de536196a1a4d4de391d5dfc47a675c292d87b85986a3eaa85769f125a363988fa2464274eb02bd68ffb7a216ccabcc842691cea8cdcca93445219b
- SSDEEP 384:Mds3pG8DOqOgaZTa5aR26CanamanetitVX2TioipHXhv13ngsNNm2ZeaABK8xcYB:D5Bm6rhpmYlXduSHvnqtOROYO8URB
- TLSH T1F272B112A7F91608FAF76F35A93A06245F7BBD86AD3AD01D1280906D19F0E60CDB0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/SyncRes.dll.mui
- SHA256 2aea8d321430071a7d5bf1ed917468bddbf46f31e5a4d80abbfdeed3f5471e31
- MD5 8944fc38dc30ddf604bab643cb3f194c
- SHA1 befc7d082f26103e82650b2e00398d925253295c
- SHA512 89f5792dc6a0d24c199f91ce472090ab194e465cd78d7c22259eee4737010ca9480166e4cd0aa154922cc46b149b3b2af3478be3b7620ce028d5b8f56c53158f
- SSDEEP 768:sDInDus9yk9alFzD0JHl51ckwAJ2F52WSJQNlLic:wI9alFz2ckwM2FIWSJQNlLic
- TLSH T13AD27652A3FD0618F6F7BF70A93A1A250E3BBE96AC39D21D0280505D5870E55DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/cdosys.dll.mui
- SHA256 b78d47775b22c05eaa43f2dd5636a2bf9115c835b9572a62b6379e7f1c675271
- MD5 2a2cb2c66040977eee6591d3e034b328
- SHA1 6d4abe02cfffb93bbec7ba17c55bdf83894989fe
- SHA512 8b3e7934130900367d1b2d83dd40e0c490f9b3e72416dfb0e2f9d74ff9b8db19d0194ba701c40b18dad7353f423577ea8272fe18e992ac3f4cc1334da92dfdda
- SSDEEP 1536:0/enKivyUcEsx7fNXjTVpnszWNACsznm7+SOGAzTsboLGQgvBV/BYkaC9CbAGgcc:kenKivyUcEsx7fNXfVpnszWNACsznm79
- TLSH T18B33B02293FA4708F1F37B3869B912655F3ABD92E83CD26D02A0916D5CB1E55CC60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/comctl32.dll.mui
- SHA256 e2860583f27517e7b7869ac7325933799e610b4982fe6c5a70a361166e638093
- MD5 79ce3c11222335ab7e1cb520a48beec7
- SHA1 06de3926e341017569f71fddcda9210c7ce236a1
- SHA512 4b95fc7381af54b3769eb2630e4b6c43c919a6f17ccf5ba6fc67711ce689c04fc8bf3a60a7f32126fba621a18b6adfeba093f7fc336bcecc0f228ad67802b4b2
- SSDEEP 48:yY5O7LGV3oZUkB4gcvOB39psp8AfgRWnSBwpdWFTk7O3OMRckAA39dWQGO2oZWWD:JYUe4b839pspdvMWqka9ikWnYj9Np
- TLSH T108C14315A3EA4A16F5F35F7469B60B511A7BFC02AA7A931F8B40145D2874A04EE70F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/quickassist.exe.mui
- SHA256 d6d705c05674a5e92b9d06fc2e94d695fb3ed8711e5e5d74e3620b32e7802e81
- MD5 8684d80d9e5fc12f6f7a9455eb4ac633
- SHA1 c2851757f40376f3777a492dd9337536cb51662f
- SHA512 19fff4b5be187a0e23284211bf66295738e377f12d324224d0d57cb0abd46754cc32d54595491c4163416c55b62dfd08daa18dc723e5785a96224ad61801d23f
- TLSH T10181F74567FA4215F0F72F7099B606A65E7E7D23BC7BA21E8B40006D1870A14D9B0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/it-IT/windows.ui.xaml.dll.mui
- SHA256 90f92b8787445cefe332ad02ccc77f3e6c7b31e42debf71fae604b1cbf951756
- MD5 46dee2ae14f3f9f9f400e82f29bf21d9
- SHA1 602e62e13b5cf175c6b3eaff404443c118b4a1f4
- SHA512 f2ef3c1d2fc80e82bbbf4d9456e56cbfc9feeda652796645a5bdaddb5af7ee6ac182cb86102117b32e82412b43de854fe269dac536ef6f8a029c13c708461567
- SSDEEP 384:Bp1fSq9hSma2y+rVUF7nwUGusmwmHuMrWi8:Vff9hSe+7nwUM8r8
- TLSH T1EA824052A3FC1618F6F3AB746A7A1A644E3BBD926D3AC21E0250604E1CB1F50CDB0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/APHostRes.dll.mui
- SHA256 1000e86d6aa2e7c27f1aabc469ef41f355e844fffc3ba94ad9b07ba4a14a68c7
- MD5 58df98a8dbc6c9ef1a0671402152b390
- SHA1 e775ee06822ad09c000f397d1999c7e9685ba661
- SHA512 8b71fc4410347ca40cfd638a209037ebf0b2910dd8c32ed3bc7b0aa8c661a265c1255e279bd95c37f8f492a2d3b57dfe7701f42915648451d3edead46427a30c
- SSDEEP 192:q0jUQuG5mzo3oKguPw9gnzjCi3os6jiWRFhS9xfflqBu/fBW7LWt:XMo3oNu33o5FaW7LWt
- TLSH T12C321198B5AA4549F8F34235817371E137BDFA81D4AB85082AC8E12F7870A4D0F56BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/SyncRes.dll.mui
- SHA256 88285d63cf972bd9c453927e7bb50e743dd06efa6d7064510e645b0c999e6f81
- MD5 71b1ae4542a9b635735037fa3c8f1329
- SHA1 5407751287fc82bc90b70134e4f102bdc9d7e89f
- SHA512 578a006e044c697fc659492a53168287a1413ed5018ef207bb27910cfffd21dd7aa1f1aee8a9001f9bfa555beb74ef48ddedab727c51a81144e4a3eb89b79e9c
- SSDEEP 384:on+zrSW7xWFIqC2/z2un7ijvoICeTyQtIWPFWr:o+KoIFIqC42u7ijvlCeW0JS
- TLSH T112822DC8B6E0465EF0F7893700E265F833AEF95A59E245F04A81C84A2054FCEA751F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/cdosys.dll.mui
- SHA256 bef8402c66925a2bf42d2b3cdb27afd10a2857e0916b0e9518f6f6fa127b69da
- MD5 8d4f1ae0d6edc18e34b8ab0cfb243226
- SHA1 2fb3faf6e2aa2c15e772c236d17d6325b0c808ff
- SHA512 b3a3fa4c41bf37ce534b3bb75b24c05623e6041a0d660ca3075a3a2ddc0b4352c2c42d0b7427e488aae274823418b964fd9cb94fe0e0446c647a5ef534ad48f6
- SSDEEP 768:kFnZ3z7HiDjyUcEsx7fNXjTVKa/szWf6szn57LBRgzjfxXsXShVxi3/HBV/yCXJO:kpZ3vHivyUcEsx7fNXjTVv/szWSsznO/
- TLSH T12803B00263FA4604F0F3B73948F521B52B79BD519878C69D01E4E25E18B0F969E21FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/comctl32.dll.mui
- SHA256 c0eb1ac0ab6701c08ddb97cef599b1ac3f9f3bb0ebf7a6138e2c8d22911500a8
- MD5 a83f60faf292d79abc4ec20621a54038
- SHA1 310c7126a004186922de3b2812fbcae31742f3bf
- SHA512 27b55d08b355789770c74c5541bc7886d189c59ad0f2f3581b9e712038f24c77c4c5729d31e84cc125135fefe3e43ab75aadd6b5c006c76213d1f61d05fa989c
- SSDEEP 48:yA5fqam+xo5Dh9GB+bvVUp0pWf6wVSB1iAmCOjHZWvTQwT+y5WwHgb:VE3GYbvVUp0pdwVwixn1WrrtWwI
- TLSH T1CAC1ED0AA7E74A12F0A64B3482E717D02B7EF913B363675FCF40191D6068618AF54F35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/quickassist.exe.mui
- SHA256 cd2d71aa5fd5053bde999377acc16be819a69605a21481288ce31d29b01c2320
- MD5 525eb8dd87cdec8b275f18756996513c
- SHA1 8164418903cf581f711aca45e9db945a5326a58c
- SHA512 5255f1b339c341916c19991a2d7bac063172da4534c887325e41e9971b3e3192bc4917c7e32693ecd3791f2bcf4b1de32e003f086616b240d8a24e520fd1a947
- TLSH T11F718D485AAB051BF0BA0EB286E255D12FBDBC13B5E3623FCF04411A34A090D99E0FB5
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ja-JP/windows.ui.xaml.dll.mui
- SHA256 fe36e791453145c64ad106de5a0db741ff962dad49eb3cdbf52a365b22c905df
- MD5 545eb7c5ec6791e84642dc42a042730b
- SHA1 7165fb0cee1764fd67ad915c58d62946f6ebe5f4
- SHA512 0f0438a9ca666d017940edc6dcc7cc6a94b85b3376b7fff17d3f0988ea822e5bd3609e07e8c0c0788d5bc60ca06c217a565b9b3002b0d199b361e4536dd8bff4
- SSDEEP 384:7EXFHkvk6KQIC+T2/F+4+c+qRCHuM1WfVWG:7EXFn2CYP
- TLSH T168526346B7F9190DF1F38B7867B372916B3AFCA26A32C60D1640651F2C90B449E907B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/keymgr.dll.mun
- SHA256 6a515ccb5bdd5339865ab1627722b61b457f68d4b7f7ff9b7b587703127b3031
- MD5 e22e38125825decaa1fae0a82a5e3ecb
- SHA1 81fc9850e04b22289e724b6c2a62d683b3f720c6
- SHA512 5d80a80d365c7bd9c9e42610a0c9ee599fc8815639cd45bd3c5ba887a69df314709fbf7438a32bf1a127649913139d3a990a59ce0ecc02528a8e397c48f5c658
- SSDEEP 1536:a4FhG55knI1fd+QVeVAsDRXq9WAlzyMh0wen5EO5mm7MCH5EnNKfbS1LuZoQuWR:REDknI1dCysDszyMhM5fLDVgKZoA
- TLSH T109B3FA1D74991980E23F8A37823AB650D872F2BE7728DC7DF4D247DE3818921A297C5D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/APHostRes.dll.mui
- SHA256 cd6519a99dab03f318eaffc7abbeea7cc82cda9b753477dd5248f235e1c559f8
- MD5 7c72173627b43139b54ecfb580b10c45
- SHA1 ecec11f905f8f08f11e5ac2f784d989bb1962370
- SHA512 b0a2a2569157ef5086aa3699a18c3724d05b3a8e56917e49edc9aa9d406d1037d0e288e541b7020a73bc80d8b51e1a9c79dfd13c07e9524744d0618959956b7b
- SSDEEP 192:8QFClsekugTaXXtW1LqTF0arf+s8qGIurYSplDlIKa1VJN9HQy5rpH0S6Kh8Kza8:TTekuyx2Ui2swYrpUS6KoT3FosWWiLW2
- TLSH T15C22300616A89415E950573782B307B9FB3F7682B92FD84E62C0E53E78F16019F21BDE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/SyncRes.dll.mui
- SHA256 76ad7e42b4dff15223a7da7700e03c9a3062d3b87a49bdef99b358190dee5bad
- MD5 bdc8ae7345b13d8e7e1edf8ef7a47ad3
- SHA1 b2a0718fb1c11653ae344705db7dad053325c8a1
- SHA512 1f1e0f163a7556cd2d485150fffee7e8ee72e265f6f6950f6a024e760db0626f0d2dd75bf431bf4703d6865dcfadc72e1e7ddf9be4df6d33ac7c5bd4b2038b43
- SSDEEP 192:z33x/VXoKCyYzTv9hiNxj9h/uUoqtEOGKQkTFW0FWc:znPoKCJTv9ha/h/5o4FGKBTFW0FWc
- TLSH T15A828502F166D242F0B1DB7167A70BD3033B24D1AE27940AEB50912EB4B9B98F7643DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/cdosys.dll.mui
- SHA256 f0c748334afead393755b44c779aa79c5f2ee7f6f07c35fc53ba19b8cd9f397f
- MD5 522fa59ada7f79c8daa03010e12b1f89
- SHA1 81cfb877a0bd5a79926726d094c0f6b3f4a1e3fb
- SHA512 b36d72f44e6d1ee52bf1024b3143b1ce95bf25d458d0d8c76939ddc25c606e8a8a3c0d96fab61780be24b8868034e460eeef9e5b9cdce9e1d61e7deac09065ed
- SSDEEP 768:6vAJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfTzdIr9e8BVYhIAAInmVLHh:6YJ6ivyUcEsx7fNXjTV8PszW7yYsznPg
- TLSH T11113E21253FB8604F0F3BB3958B616762E367C92E938D29C42E0915D19F2F919C21BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
41KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/comctl32.dll.mui
- SHA256 6f3c3a966708415b705a925d687b3e5245144daf9b517f06a5b79dcd493133b7
- MD5 2e9970edc7af6fa1b65103f12fd7b8bd
- SHA1 bffa8258fbf72705f6ef9c1dc31d3c6ac75f66a4
- SHA512 01b128c33ad5c50659693c297fd91c5ed66a9620acd2f4f5148b3e9077177771ed30781abed43bf508a943c95bad7bea7c150e6dd0f8637b389270be4e90ed26
- SSDEEP 48:yx5ARBi6BoFZEBP6QYl1p3paSZwC/7SHFMuRyzRO72+ZWsu1AOJwT+y5WwHg2:ghZEBxYl1p3pz7UF5yNOqGWBAJtWwF
- TLSH T1D9C10E5A8BAB9923F0954E7482A747C2277EDD13B752532FCF40045D606970C9D90FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/quickassist.exe.mui
- SHA256 d3f3032d9bd7f7bd124c01d687e885da72562dac383fb6f4f48c86bb3693ed3e
- MD5 f446148da3420cd4d23056bcc22b631f
- SHA1 f28d89ade167ceb85bb96bba8b4297a9cca664ba
- SHA512 4d0d2c2d249432bb8e388dbf542a24bd05fe303574903ecd5c4875ff4619e25eca254f2dae286391403ba4794dd17b8908f4a8a1b5f09f1f45e955580385abe5
- TLSH T1E2510F42A3E946AAF0BA0B325AE34B56553B7811DB73961D4F40022C3834294DDB0B29
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ko-KR/windows.ui.xaml.dll.mui
- SHA256 bf941f3c02571b99ba176d3d0f50d480f69056192744542f1e1dd3506bd43612
- MD5 beeba47e27a7d465893bfe6e6ccba1ce
- SHA1 d818a01ce38382f2a82a75a261b2618526c01c68
- SHA512 4023f667674d47b4eb226803b75a00016978af589cc22b9a29ac4d809a7ca89f77da891a646357cf112df322dcd3304a4ceb0d1be72480daa7219c6ade04449e
- SSDEEP 96:+L66JF+yGNJAN3X3x76yDFzV+j8r86Jy/+Oc8uYGHFOfJS6Ox+Xesd9PSKQQ+2GT:56j+rjm6QV+4x0leFh6E+Xe69GWfVWR
- TLSH T128428686B2FC2915F4B3877457B34363A33AF8926A16C60E5290725D7CA4785CE207FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lt-LT/SyncRes.dll.mui
- SHA256 8ffb42e2ff23faa9bfa8f6ef42582b135849598e12fbfe8da588875d179cfbf1
- MD5 4384d57137962c4ae7c367b80a6b5519
- SHA1 405b7ffbcdd613b52f07ab1c8b4a0bc1b202711f
- SHA512 a7c7aedb1d4ca46bb581984a64f0b6890ccbc319aa21e8dae5a3bbca613dd9a78cd2fff0f64c6171625217362f4437c232eff67a34fbb936c057a00f07b6ac8f
- SSDEEP 192:i77WqoSSW2thWqOQpu6QzvQoQX4QVPQeSau2euHuOu/NLrm0kTe0K1WB/TuHIeuN:if3upCc/XPVIgMt1KKTBTzcW7Q
- TLSH T1CDD20145A3FD1699F2F32F7095F84A660B7ABCA6BE38C20F2500515D5830AD1DAB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lt-LT/comctl32.dll.mui
- SHA256 691b9d5ab651badcfcfc3b81a3016999fec0fa18c6adf200e5539781d07a0542
- MD5 bc742666da08583390b30dd6651cd7e8
- SHA1 850ec7291f7c7eda8295ff074746def67f31fdb8
- SHA512 23208d49899cb728187679cbd932ca34b2a5025c370a960a3199f5d091c3d92dfcc68cc10e0ff3a9f68b66d4e7d404b16548d759bf1a33221cc88047bd330e13
- SSDEEP 96:gHFyEB5HpspEEre3/sMOv7Tb3K8hOT7bnYWgR:KyEB5REre/sMOz68hOT78WgR
- TLSH T18DC1994583E9598AF1F74B746AEA47822B7BFC177B25D30F9E40000D7865688EE60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lt-LT/quickassist.exe.mui
- SHA256 be01c3b5135ff66ee8dbf370d24174d00ab1bb17d0a1c4a8ca41565e61e2a0e8
- MD5 79783a12b6070efd9a8ef255f4e4c934
- SHA1 3e7a9ddd4b076b99fbad0b1ec85b9869ad9f7cf3
- SHA512 e961fad08cfde79dea897dc6eac96843558128c296df9789cee85f5268c2cbedda6c72aa6e1cb04e5a24fa5d321125e775fcd6a5d43156372aa7af29ba9aeb0c
- TLSH T109810245A3FA026AF1F75F3096F649A54A7EBC23B972E22F8A00016D287014599A0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lt-LT/windows.ui.xaml.dll.mui
- SHA256 72bcd7ff1b43575cd5f0e5d8ade413e11a51e3489641b47e5202a03e095b91bc
- MD5 990ac762e0edeb0d67ed938f65e9f415
- SHA1 65bc4523b5d7bc20203df1a935a8d7219d0a54f6
- SHA512 60114064a750e8b98213748f767798ec1e2f5c797beeca497fe21f29dae47ba83442500d4b1ecb3177779d1e811361e03e34bfe86b5cdaa49b85e8326f72f23b
- SSDEEP 192:16089ezwmQYPpLtr337x8EC9Hrw0Cjw8x5U+fXV+4TRMS2I6aka4y8KGBm6E+XeI:YGRLp3372FRrhyF+4P2o8lHuMXW4T
- TLSH T128826255A6FC1559F2F34FB4AAFA52125B7BBD9B2D31C21F1110A10E6CA0AC4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lv-LV/SyncRes.dll.mui
- SHA256 68e93d5eb467ab25013f281c3fce0812aedebb977521b0c250ae1080bf81ecac
- MD5 fffbf3122567116f3f41a17ad0ccc7fd
- SHA1 55da83af5a5a11534b32d3d1fa31289b4f1c097b
- SHA512 03d35acc7da30483f2035981b6e9ba4d8b85b4df92fa704fae9baad4f5aa6ecfcff620fae807c10f81554040f1d7f72cbb064412c292426ab3f22babc9699e28
- SSDEEP 384:CngwKG464gcknMp/cK0pHxxMfVESF53ejWxLzbDfVmv5TwzLONk9WS2Pi:ygp6O840W9z49tPi
- TLSH T168D2BC91A3FC156AF2F35F3185B947261A3A3C92BE38E21F1500516E0CB5AA1D6B4F37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lv-LV/comctl32.dll.mui
- SHA256 dc9f5a430cc419a94aa5f3d1e4050f0fecec8cdfb1c3a096518ab889f1779cb1
- MD5 ba1e0b9fdc2d3fde32e4571beb559264
- SHA1 7a71b4d52c83678444c16df700b941ceef704363
- SHA512 d7e277258700ea106dcdcc8f53fae59c2252d7842281c3bbf1b3379fe560716e0d484c3ae7b8884a5f1609294b1b2111444cac62224885e2a3763d517eb023fb
- SSDEEP 48:yH5kFVSko+gCjliWpL1txbLpspWnj9lS/0nXbfq87X0LlvDW3ZWsu1AOJwuk+Hgy:m8thHbLpsp0EkbfqGq1SJWBAVXvK
- TLSH T119C18695D3EA095AF0F34E749AB607812B3FBC632A35E31F8A80515E6465644EE60F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lv-LV/quickassist.exe.mui
- SHA256 f0e63e792da4bfb2ae0b0484e48280e5a0abd1fcc23170691e8e87d9b014c7c0
- MD5 3fffc26b709de1aa8fa7d259d159ea23
- SHA1 1a5d524f4e48b69927d1388e4b699002e25da870
- SHA512 2c60ba974acd8882eafdf6d5f7fb5357280fb56d3ec96bb06a2adff0542d1e03ef85a8928459c926bad4c31dd59163c85b090db401d13aebe62310b3d06a50a1
- TLSH T17E811585A3ED026AF1F74F705AB60B252A7F7C62BA35E21F0940016E6871555D9F0F33
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/lv-LV/windows.ui.xaml.dll.mui
- SHA256 b109ae26f9e27fef10227147b033fc7b11af054795a8ac8fe5967ce5a2afd9ab
- MD5 b11c7d6d670c6d01f6a95c82ae34851a
- SHA1 06d0d986b5a6e8c8737ca9e22fb664b86a20ac31
- SHA512 e8c58aa36c6acdfad32889bf10943eb83554a4dbec002e33a7ec175f66cfe2a421edebb8bbb011de79b3096dee459a75506670e021c4153c8ae5fa8492b55d70
- SSDEEP 384:EpPyMKxshcjoC9F+4UBBqm3b36HuMxWTf9:GyMKxzjMBkwb3MQf9
- TLSH T1F7726382A3FC162AF2F38F746AB617112A3BBC976E35D21F0150515E5CA0A90DDB0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/main.cpl.mun
- SHA256 8b49f80bf99cccb67670afcc155177f80d77008fa1d82cd2e0288294cbcf8e56
- MD5 affd60b063509016ac35d8f99e0c36c4
- SHA1 00a333b0609c79ff83fd3cca174b3e742cbdd831
- SHA512 8ea837f5b155b22f71bcdc1bc90ce5cb5a46cca23c486b271dd88a02964a0c58df08631e74666aab664217b31e618b1a17b7c6978a216e6b83ae82e267915c86
- SSDEEP 6144:RoBLtiR44glq9X9obKDwV9NbwLWFu/TlBAvTndGQVxw:PRMlK5DwVz/cTAvTXx
- TLSH T15CC48D51BB1095C8D41E0932CC22C5FC1692BC356F40569F77E4BF8F2A72392673AE9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
562KB
Virtual Size
562KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mdminst.dll.mun
- SHA256 dbf4eeac13e0e2e75f93ceb634c4b4d1fd4de7c8ea632edb16e4f7b2e704dcca
- MD5 e96512146a5ae21c57b158ac041e88f3
- SHA1 78aac72692fba2566fd38b35e2cc7c82eca12d9f
- SHA512 285a4eaef28090dd5409acc88b78e8994de5f968146d78aa1b468d2b49d142fb6bc4bc58f18c10f733e27ab15d872bbd538dd0ade35c772ecd21d1de1d74630a
- SSDEEP 1536:j6Upgey89L65If1NtxmYFXPJj9SMUWaD:jXxz9L6Wf1NnvrSMUND
- TLSH T1D2A31AA0AA2D6D1AD032C93CDE729CAF2C4F0E97D685D183D16DF6CB34F8295064176B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mfplat.dll.mun
- SHA256 a6fe4c614955abbca0d5afab1a41b5a3913258d1fe06eddc79febe1a022e87de
- MD5 b2e6860edb00224afa9b447ac7f2942f
- SHA1 2dfe69f185eaf5b87cf095faebd54c92e7ab6b65
- SHA512 a4e11ddcd2c816978b109621bab740e57104686ed771eb844730e4560f9342397861cce71b62457f721ce98cdb18234bb50e987a57e03b47d2061818577ede0b
- SSDEEP 768:qT5qDvwdeKW9qllNdDQUimV2I4QYXYMiJE1q7T/GlebqnMhg:qT5qDvwdvW9qlB3vMiJSq77G0WnF
- TLSH T183C3DF123ADC550DF0F76B31E9B589663322F9B4AB91D62F7215235D9CB1B008F92B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mmcbase.dll.mun
- SHA256 23ba43dd0dbae4ee491673d3417d66893ccbb1bd5e1cbf126cb4f3ae20886b94
- MD5 90c034cdbe8fe1a7e24a5d5a6fb1c8ef
- SHA1 276c0ad178bd8cf401db83fad785ea51058ce3f5
- SHA512 9f9ad2ff17fe113891fe5b672769e6a37d575f4e38071d3863e1fa4ab2b7e3ab0bf72d6d6d664e7dfe56e0d08ee1051efdb422b9be6b327141545ebab5817a32
- SSDEEP 768:xzqvIqq1WQNyB8XTyPMAdY7OqkA03VPdECN76Hnn937veL:TPWQkaGkA07aTann9j
- TLSH T17FF3F742B311D628D0895672C957CFF01AA8EC38EA611B0773B07E6F7D72392BD16AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mmcndmgr.dll.mun
- SHA256 14a305356e331c06ac527c30029a544298641262114140c8ce8e07d83e4eb358
- MD5 47db160eff4941c8952f514a8fb5c9b2
- SHA1 8c68f7cbce4ce88bb67e7254363f7854b359f34c
- SHA512 7f6088ed4e699a43fe65982e8457e02a7cee550a2b6bfe13b34d4643203860ebb5b58e83a0f779a1c18a82f7bb361b69e575d0f20c59d87a1964f160101bf3ee
- SSDEEP 12288:+sTEiDUy55zqKGIEiDUy55zqKGFEiDUy55zqKGynIDkfjh6uwS4+gY1GJVUt29Co:/joq5W6oq5WToq5WHS4+gY1GJVUt29Co
- TLSH T1D3D42A0BB0595C80C41E49328927D7A4DCB1BD7A7A28A97BB2E1BFCF3D74621B412C5D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
598KB
Virtual Size
597KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mmres.dll.mun
- SHA256 e231a191a8a6ff358fbf7ea2a83c1b35df1744a7ecab57cd45b6cc4120b57e93
- MD5 fd52a739947d8a36a4df888f24f445b6
- SHA1 4d4c648f1ea1913c512a76e214946866b56c7a91
- SHA512 768ebd229222ef4ae37f37fce34e5f715db1a6c30a2e55d3a283acf44b12cf72dfea12a7135fdf69e4eb0463e554502d8aa42381220b380de7c295d47d03d452
- SSDEEP 98304:286FJQHD0L8f2fT1L+MID/qAD5HQu6OH/:d0v1imO
- TLSH T160A659A9FF7D4CAAD1D65FB48AF580C536232D0C0B120F9F74D22B2246B86B15B7D909
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9.1MB
Virtual Size
9.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mmsys.cpl.mun
- SHA256 32b40f852c3b3d6e0d1eb82363b4ea5a1a4c8c7ba5f6d4f93e459f9e73f66a4f
- MD5 5ae285d07a5f4aff0e69dd5d0d9ac4d9
- SHA1 3b9e43b8e440da149ba79bacc5eef2af491ae0aa
- SHA512 f05246f9ebfa59959802392c3c0c7671a789d052512661a71a012074b862aee490ea74edcf86b6ef554cdd4ab297e96e219c27f33bcf9c64f3d56903bac1601a
- SSDEEP 3072:n2kf4rXj0i0JBLxHugk4a8hqVWYUcgSGhxX14rXj0i0JBLxHubEVPX6zK/W4n:2PwVtDxhqEP9xGwVtGEVP6zJ4n
- TLSH T19094AF20731CFA54DAA401B8CE96D7ECB2B6FD151EB1BE173290730E2DB52A1D98513B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
413KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/moricons.dll.mun
- SHA256 22b793465444951b691bb551b198fdbc5c129835aaf2b443e15aaabd9244d7ab
- MD5 a14aa9c355bb6d981946573ea1a795c9
- SHA1 89baf81089a70a0a67736d4582a4a16be0310356
- SHA512 b80338ea8c6e185ed201dca4d2d67c51837a07180b6e8195bd1c5b4b9fdacdcd7a58cc68acc0ce5d157fa3659d145e7bc8f0b4eae42436311356a5cc06ba79eb
- SSDEEP 1536:0Yq+6O+ZZoN+5v+AvAcuxYmLTHERgZBdUzoo7W5P:0Y1b+ZSN+5mAvAcu/0gZBdUzoo7W5P
- TLSH T12B04C616F6118480D44C043988178BB86925EC12EBF457E736B27F2FAD727C1AF2E69D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
180KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/msctf.dll.mun
- SHA256 78e0982d9ffdcbf39b8b17243fb74900ec5b36c9db47e52d76e0a16dce13e45d
- MD5 98b4defe94275bf5a9d7dd8283724ab6
- SHA1 11edd94e987a5b25ae95219c10471cd5b696068d
- SHA512 9d9cdd68d5debd31a21391924e37bb1a4a00918de00b7d963f3dbd75fd80895c04e52e0e1cbbc6a1750dac8eda3bb20e1b626ec06575164a7c4f8e281ce6ad71
- SSDEEP 1536:bpo6Psz3iFyYr/EvZvnAHmbnp+VanOAIzPOXKla5jzwjlB:bpoJBTb8anObzPUKlal8
- TLSH T19A44B462B2D0886DC17E717AE84BAA7AF563BD6188203B672BD13E1FAC35F010F11557
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
263KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/msdt.exe.mun
- SHA256 fbc80df2d8337704392475c20a43c30d3e8bc238bedabdbd48f5bd7da895e7ce
- MD5 ecc8f42a49348012ec3e30b19febb20d
- SHA1 92160c3b9316ce2eef0758278b7fc5d4a7758657
- SHA512 d4a7d6d8ef32cfa83b67ace965479df80207d2f57f15113d1f6dc8aef70c71410c21c04951f36000b89eb5ae2fc800cfff45793fd0132c57b8054f320af9d18e
- SSDEEP 24576:06XH4qvIReK1odddGdBnyE0k26kVZnBm:aqNK7utRB
- TLSH T115453BCE6D01B8C6EF169730B8329F7D46A3AC19D8B0C7326997FE9A79711316011A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mshtml.dll.mun
- SHA256 fd29969f482a23db4f1d71eb1c700853dc86ff0913b5a0aa9e0c06fa58e2d07f
- MD5 b9a2fb3ea36471e6dc930b2a7bdfe7c1
- SHA1 dd9f290855c97c06ffbb963a3cf6d0d82afae97f
- SHA512 55ae0bf3df9dc329c248ba52276cd57fd2c23c324238b4228d8367e7e549517ef01ca93a36c080c01bd1b9653618d8bf98ee6bbb848a5c7f1fc4d2e4f324d692
- SSDEEP 12288:IV9G6DMziMMHMMMyMMMZMMMV+iMz3X4DKgPT3MMMRMMHMMM6MMZMMMSMMzMMMRMV:IvGLuMMHMMMvMMZMMMUiqX4TPLMMMRMK
- TLSH T119F4B602B7DC9C19F4BB5730AD3AC1B52536BD659F11C52F30957B6EBC72B008EA1A22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
767KB
Virtual Size
766KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mspaint.exe.mun
- SHA256 c4ade79034af8f6a0fe6b0cc340ed60d148e9e01f69dca04a57bd9479d688e55
- MD5 de9614ba77269696bfbe85a15ad3dd8a
- SHA1 7a0be4f184e10b10f23b915e3f132bcb03eb9eda
- SHA512 67ced524d074257bbd519ee20aea1172b4cec3b9f2900f37bb4fc32a1351f198e9ae83f8d4c44f844a6971d0caf9c8c70f44e90432faa1d0b639de2015db7cd5
- SSDEEP 49152:i09VmFjOgWpTyR6/agFJXNBbUXaSbUgcxfDP9Ph87YbWCG:ioOjOgOTyGFJXfgXohxfDP9Ph0C
- TLSH T10CC5E0A3B361DC69C41D0232CC7AC5BC5821BD53AE51270B36E2FF2FB9B2782245564B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mssvp.dll.mun
- SHA256 1a7c7d8318f589e37a9e9a4fbbd4939f5517147a22131e802a81eb7e9f7d1e9c
- MD5 28ba0597ea38c75bb3dba8ffe2950ff7
- SHA1 a5e7a8a92c4085b3d25f4aa1c771608c6560436c
- SHA512 5c3b6269bd539c35ad30b01c6b3a00155b7076b418705b51e1d28ea6863454a865dfd06f5dce862a02e48a7d1b7d237e88a7570aa49ee0a9590565f7cc0c9cd5
- SSDEEP 6144:jCB2IcZLk1/A06lJ2GqFUzxvAky82DfhqFlG8FEtYW7V45i:pIcZLkSJZz9by8El8FE72
- TLSH T1EB945B82B310D550E9284832D817CEFD0632FD66BF15662335A1BF2F79B31926B13A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
418KB
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mstask.dll.mun
- SHA256 eb5fc03f1826d113753c63c448f20fc5ca2fceffeb99ee2e2ef86ae75c173c8a
- MD5 0d47c9c72d671f2cd972d5cb8e198558
- SHA1 d1f7a9b8bb9328b564ceaa13c6afb8d866a0208a
- SHA512 f6599c3c49a5d839ba39324d0358436aa1f5969e8a525ac66d78201f395c0bcdcdc9ef82342dbd32dcd39fe1238625e8f4f14c7b392d2267d1d773557b2197b4
- SSDEEP 1536:uO2saB0Gj3DdwtFdW7dPw8MeSFLIW6VHu0p1Thr:/2Rz7dPwfeQsW6V519r
- TLSH T1A7B3D84273008246F75907B04507EA94E0607E3E5AD5E8BEE0B4BD7AD97B3837B5782E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mstsc.exe.mun
- SHA256 3e40f2e71936bec149d58ca152ca057225e347b7cc7c45101e7b0a3050f7e198
- MD5 a759824ab1b25cc861d69fa72b52582e
- SHA1 51db0337022c2f3e25a1c577a32ba3569fe1951a
- SHA512 5c13fed96de43b84f750cdba868d297eea9ecb4498c363930930cf4c9a814506006d0d1f480ae8e0992855732af4b7e21e34c21733f926b3e5c59c8226db8c0b
- SSDEEP 6144:k72nJgIKGadEI2hmDl5i5jktZ+lmA0oCAuDl17jAW+ztGowUuhkJW9s+6/:DJgLQgbRtUoAyCNes+6/
- TLSH T1BAA5B8C1F235964BFA44C5F040A4BAF642943EEB472342DBB4ADB95E72FB22E8C154C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mstscax.dll.mun
- SHA256 621a4285d671f47ca3b8930e25a1e9fa78acd8866de5911c195953f7c311e0de
- MD5 5a2310dff10ade748529a3ec4be28930
- SHA1 e86e6d0e17f74265c38c0b8e2d9e4b6ba16dce0f
- SHA512 d6d4c1068c2c475feca45a5ed5ca2d5b208f460a27c234ee560e0604faaef39ec80b7581f07b4d475edbed6abee08ade5f4a656e4da9ba3c377b64e86289193b
- SSDEEP 12288:Jj8sVvRshwJgLgg+IRf5geUQJ47SwmlpmDZ:JjhvRshJ9+IhievJ47cCZ
- TLSH T177155B586264805AEC7F0930FD5DE9FD56697CD66FD8020B30FD7DAF7B722262009A0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
890KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/msutb.dll.mun
- SHA256 843932465efb3a274f839ca3a41c967ab40f90bcd99a5266714c9c6103fe6aa1
- MD5 8e68476c0f4b88fa2f520aa06d10ba5a
- SHA1 821c6fe6892023e6ff0f43eec7e0f3adfcce6622
- SHA512 73dcfd9d13c2ea7587738627b55afeefd10b0b6af71313a8e912d211376aafc3eff26a3cfc0504829cd9b02110d55797d00388c972e195b31fa4c395b6e229fa
- SSDEEP 1536:eL+9la5jzwjpzzivnAH1bCxpjLaAOAIpPv2:ea9lal8JG4bYaAObpPe
- TLSH T115247262B2D0846DC13D717EE80BAAB6F563BD6188203B6327D57E1FA835F401F2255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
217KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/msxml3.dll.mun
- SHA256 47b5066b888e567a52ca8bd8670f3ae0ab433da05c470831021a8a0074379bec
- MD5 1828816480cdc2c745c26fb8dd10163d
- SHA1 fb70dc2bfab67effff8db2c04a4e4c9dd5e82ef0
- SHA512 ade423a6430fdb0d222a19311d03942a9be585d43b69c00d4d921c106dec9ea13192f2e03e6a01f8998a39691215a9ed9d2dc4a798f20897cc401b818f932080
- SSDEEP 3072:D3+M5L0eWgR1YGwnphmZ/Iy1++YrAzVVhIBl09QuFL+XG:D3hZ/IExYubhcgL0
- TLSH T1F404E69CC9414EA4C23A53320975BC9844A97EF1244E117D30FCBA2B7B729E53987EE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mycomput.dll.mun
- SHA256 0bc34ad6fd76bf05322341a2ab8506d1b1010431103f3e34f19f450783c41d6b
- MD5 951f881cebd69ef2d11685b949033e66
- SHA1 5795e1b45b6326d2a705ba836ff1e5f43d9645fa
- SHA512 ac9140e0854649d7ef399806223cadee50a409e70cc169d8ea8ccbfc2cc347e9751cbbd04afc63dec1150ced9f46dc464735133edab50af781ed58848a382f9f
- SSDEEP 3072:id8oXSkBzY35KFlZ2Le4HS48EiVo1EwcKjwB2SMQXlj+:iGoCyYIFlZZ/vEv2wDjxSMAj
- TLSH T178D3CF427B801964C89C0971C46BCFF55B79BC3519112B5732EAB96F2D313A0B32BABD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/mydocs.dll.mun
- SHA256 060501b8812c649fa87b29ba099a64c0bac95d386216e13b5880376db9c9a034
- MD5 514b818738b313aa0c28caad837e083c
- SHA1 b38bb653c9b56785b6c1b6bb996a8c975387ed72
- SHA512 4ac767deb0ba2e7bccc5d3cb459fe5c5592839d5c35016a162901c47962b2b93c71d796778264c4cf909f09f95fc6a9d6a73fdc126d34056903562ac5f2e741d
- SSDEEP 1536:XCZF3CrYFZBqhEHDirBk71WloQA1sDx69n1aztkKOUK8foRXsWK2:XsF3CrqBqhElSksQ9na/tK88sW
- TLSH T1B1B3CF583BD161AACA444F309547D9F40AF63C54F612263A82F1BE3FBEF02373A66255
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/APHostRes.dll.mui
- SHA256 656482cf19c5852f1fa4ab383c9be7cb49c68ca94c4448e8e85e12f3526e6a4b
- MD5 91f8c33c78ee2438d571ba396a1935dc
- SHA1 5adb49470cb9819fa0836023f0ed8d2c45ba43fb
- SHA512 ee2081879ab39a2adb76219804de6e3fe42a1b140dfa2c6ae0a694840f3be9372bd10fd21d56b96a3d7c41003765efe94aa96e1fa613e14fb9e2381175ac624c
- SSDEEP 192:1AFVQaUYy030Gdrade1XKrwTDp/bNfAUeVUSjXrQExzoRWZ4OdV81fDSWRR7:1AFVQP6ALjXsFm8DSWRR
- TLSH T17462DF9163E9560DF9F62B357DB202A46B79BCD1B93DE10D2680A21D1CF2294CDB0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/SyncRes.dll.mui
- SHA256 a18539b95ac3abf66daff3b2946affa5ebe7eda7b5b187b65e2ee6b8b4e1aabe
- MD5 346e7f3e2b7b3e4fd7ad58e0de7a7e15
- SHA1 c27b9dc7ab16a5edcaee442ff8b0be005ea8f9f0
- SHA512 4fa07f6ec450093db6f3efdae679fbba82fd0c7892708a7e97cd5fe695fb99d616e6968ea17160d5490cac931731f819d35324dcfda97c141d982d6df9d9f9bc
- SSDEEP 384:V8Mcs8Rhxm2RhxBRhxBRhxm2yCSiyCSiyCSiy+Puhi3Daw6DJ0nXaFkz9NWKFCwy:T9QeonKvZK5lp+
- TLSH T17AD2CB9163F98619F1F77B71A8F906A40A7ABCE2EE3DC20C1640514C5C76AD5E6B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/cdosys.dll.mui
- SHA256 d55c63055f94771611e949499df8fd1cd0deec6e25d8b1fb212a5b3f84ed5dab
- MD5 04ef8173e0668a9e9054f93a783d44be
- SHA1 e13064014e5cc22e3481f19a451122a57ab8679d
- SHA512 b89fe1e72df3af77b85351756150bba57b3e7cd658a14a713aa10367dec843511f93999c67df6a90db2e8101c3feab16b5a8a211ac10601733f36b17f4f0914e
- SSDEEP 768:9veJJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfQcQrHe8BVYhIAAInmVLHT:9v0J6ivyUcEsx7fNXjTV8PszW7yYszn4
- TLSH T17A23CF1293FA4608F0F77B3968B612761E36BC92F93CD29C12A0915D1DB2F918D61B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/comctl32.dll.mui
- SHA256 51781669c684ed77d50aad56c9fca03f48e9b65bcdb6263cc34f87b80e1e13e9
- MD5 53e4c755d6f0f17e766ef4a44f2885d0
- SHA1 443b0463fbcd3298ef77d35e8e7ed64e54fe2981
- SHA512 6fa13e286d85bbb7bf2a454dab4820c755bc92cc4e0002c1ff22c16455d5a8c12f2a53b1e271014bedeb3d254190b04f1ff83189b2f8fe2d0aef97783df3cf2b
- SSDEEP 96:BFOWm2GWm2Lbr7Lbr7L1PcLY8LIr+ppspevb3iOH0lBBLnASACbOBE2gWLGXz:BAWm2GWm2Lbr7Lbr7LRcLY8LIr+xvLzS
- TLSH T15DC1CC11A3E5451AF0F66B747DBA07811B3AFC927B3AD31F8A40641D6872790ED60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/quickassist.exe.mui
- SHA256 9af5382d9337b6b9bcefd9b74f4ff5b56d7cb0c9e8bc46d5b92137f35e0c8f32
- MD5 423b3ba3ee327e12fef3af6295a16567
- SHA1 c20ba2ebeebc1bbfdcbea713a5132c149c5aa549
- SHA512 ea862f276bc0dc814809ea608ef6835b5ed302edff33dbb592f552981f024db4af902fb5f79403eec1ed5999e02130ed1e645d96215848920c64452109b787c3
- TLSH T14B81265557EB025AF0F61F70AAF606D11ABE7C13B976E32F8F00011C28B129999E0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nb-NO/windows.ui.xaml.dll.mui
- SHA256 63adabaec946b1d894b1f131ea88e95524820e91b5afc379f7179abd5ae1278d
- MD5 a6a662a267349fce27bf21b7c59f0547
- SHA1 19316f26ae909d73fd20b00170617ab2926983ea
- SHA512 8391aea45676ed3693581618683e00bc27dcd81f9cdd121bd7356045fe26eb5d8b59aa7670f6e893f98b3c9bff12eda7a0140d1548566e92ff48b9d0df094cf7
- SSDEEP 384:/JZp5JZp5JZp5JZp6Kaq6Kaq6Kaq6Kaqv/PfvIYObRDt1c+rGLFW7xbDGbeHuMwB:rOtR1QxWFbDGbYyr
- TLSH T16F723251B3F82619F2F36B743EFA12945A3ABC92AE35C21D1150600E1CB27E5DEA0777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/netcenter.dll.mun
- SHA256 cc1f6128ec503a3a53a761661c0ad68fd9e655679efe99da1625409e03d2f9b1
- MD5 dbc8e4205e89289f31957178486acc3f
- SHA1 e2321be1f97777b030c9b793757950e1c9e2afb9
- SHA512 2b94e53a317837210a22cb722fcc6a5051706be4196ee859a31a7c4f74968bdbd414d0ae21e0b5f1b0d13087838a6460ce962ca0ad63ec255b550e6e2b418380
- SSDEEP 24576:iFqRMxi8ckvDLinb7pRSTOPeZiH4e/9NXB:iFqRMxivkv/cIIeONDB
- TLSH T1A025E0857344C899C56A4130DD57DBF99920BC20EC02536B76E6B7DF2CB3A92348B78E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
986KB
Virtual Size
985KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/netshell.dll.mun
- SHA256 0ab50f4f6ef7ffa48d419eb09637dea09ae07e072ad744a429710b17e990bbc8
- MD5 4248270e47967d0ba788c2d9ab330d73
- SHA1 575af69f84430f81dbbf60ce6d8bc9e1c0287fdd
- SHA512 6fa228802956de15226e229e7783d7bbc41e96bba67b630038515e713cad5e57dda6f9d3d36997e26dc94a7e21959dabfe6e7d53ed25c5bb47864dd1a80eca8e
- SSDEEP 24576:ZMBwxR15eEgzwLgmDJ6e/PNnCeRYgaWDqRkdVc0lNIkP5P1F4en:EwxMPFe/x33ndVcJkP5P3N
- TLSH T1FCB5BE86B625D45CE88C0171CC67CFF95A24BC25EC80065B32F9BF0F7E76652AD066E8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/networkexplorer.dll.mun
- SHA256 994e88b5c2eb209d1ac1d16fec7daf723c8728b8a9d968ea66cface4ef875d3a
- MD5 fd400c92e0df4d2026df6d0225f75623
- SHA1 c5689c32c916907aeb472afcb5f4d7a295e7d556
- SHA512 0aad5951ca0a314c6df6f8aa0c8e9ce335501e2ede535d3eb0b8f7d6e82f19373cc96af6cc6f7f2d154300a61205f76d5ffa7bd772186526c1385f4a357e31c5
- SSDEEP 6144:31WmOyB1OE6ji4rDLUQBaul5Y/JxXvmXRWNF0czkdmeMb7iUQy4dcLLKFmR9WRV0:3QZE6jDXVauvY/D/XL0cDWB+2ooG
- TLSH T1F0356AAE7A9B8287CEC6DB3CD93DC3148BE2BC608858B523BDD1374A41F99C47A15447
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/newdev.dll.mun
- SHA256 807f186eeb194375f1e019f3ad7d8d9f3efe9f516e7cf7b9117bbfae350702dd
- MD5 59f3f319de07cbbbce84d9061d212a66
- SHA1 b3f41339bc3dc8a28ef29554b66e9812569357f3
- SHA512 344bd9170dcb78e5bcb8566139c00ff360a0eabda984a7c89c06b04d675a10afb863a69f454b0a4e182c4800677e82e7973bd2ebeacc7bf623caf1e1f4085f0a
- SSDEEP 3072:T6HJZvOXTro13oJZvOXTro13TehVCDs6IX10M:TKJZvOXTroqJZvOXTroyVCDsJ10M
- TLSH T1D964F28AF7A3ED75F6D85336B36D9A691F015B1980E8243D558D371A38364C230FAC8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
309KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/APHostRes.dll.mui
- SHA256 87e60659ddc01683c51116b45026779dbf80d6d1a604ae1c5f32d8dd808392d2
- MD5 a5ed8e42f26e4d550c641a899826c0db
- SHA1 69d8e7f2ab0c091b9e0eb7fc73ef5c5dce57b032
- SHA512 9d6d6fbe8fef9923225e79bafa25a45231a7d2982b26cfd80baf407c73680f871a24ec2c0fc79096cd29b7aba5a4caaaa343beb0d8b82a943cdd5e72802f6638
- SSDEEP 192:HorGwt8TCeFwHNvKIMcmWBzG8aNZ3IAI/T80X5W9OWW5:jOF9W9OWW5
- TLSH T16972C25257F9851CF9F76B796EB603609F36FCD6A879C10C1380A26D6CB1A408EA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/SyncRes.dll.mui
- SHA256 d25a290c2a01eec732d06d07712ab976cb878ae2747589d44aed6e19ab917a6f
- MD5 0d9b8e1e02e123677c471104535b9854
- SHA1 e5112d65d6f95d0b32e81371c39eafd03d19dc96
- SHA512 6e70a15893cdb3b8c8a9c164fface25bf1cdf0c03f4a87149c958de9c322ab8bf0945ddd6351affebc5abfa6e88ee732cf8a204de95d64ed75364805e334113b
- SSDEEP 192:xjjwpie+3QGCoyyUtR/VA7q1tYHpnKCWBYJHe3jfaajIyDHDOEnvtG3E66pB7uT3:x/wpimVGT5CFIyDHD2TqdWm0oWF
- TLSH T1B8E29D9213F98618F1F72B716DB956A04F7ABCD2F975D28D4260616C4C70E809EB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/cdosys.dll.mui
- SHA256 4916987beb9e2eab43175f15fe9d5de394f1f76ed968f3b1b79ea2ba1c123078
- MD5 be3b38546f87094fcdaaece0817ed4cc
- SHA1 505922579d116304b6a6181b773c6be99a44a445
- SHA512 06348aa09e16564e838b385b6397e45548bd3e94dbe145730c1cacc516f35262cd1f2d06af46d52b815bbe78b1bc02c6e5c4dacef5b5585806d607047bf8fa24
- SSDEEP 1536:mNO+EJ6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzTMWJDe8BVYhIAAInmVLHPrc:mNO+EJ6ivyUcEsx7fNXfV8PszW7yYszW
- TLSH T1E723AD1253FA8608F0F77B3959BA12756F76BC92F838D29C02A0915D5CB2F818D64B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/comctl32.dll.mui
- SHA256 2efeddf3b6279e15eb2d3c29e8a0854e26d0f00b811e9e0ef8ff3d34fcc1a0bf
- MD5 547bf04359209827fb93469b52dfa53a
- SHA1 6816b73291d0b111473e0b44330990147f6598cd
- SHA512 00016c0d55529d100430121bbb448c28e64c6054bb6a37f04e5d0c62fab8d21d1095aba9e8e75bb402b23c9fe46d4f6a8d3cd5acf99579237ee4439ed4010f15
- SSDEEP 96:W7GSYAjb09pspQPy1m0ZpME/rEYwhCqXWL9OQ:jv0b0JatZUWL9OQ
- TLSH T1A4C1BC02A3E94525F0B75B346EB60750AB3AFC92AA73C75F4B401A5D2832B80DD61F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/quickassist.exe.mui
- SHA256 ff0ddae6cff15da8ec18ae9613db28705f426d348294b5a3b79fb39ae3bdff38
- MD5 1f7a327177bbe6351b5f9fbc0250efe3
- SHA1 bc85fdc06525a60f5192fa3f908e04c34d80c5d1
- SHA512 4875aec53d706ed00e0dfb49968e9b45bd5bd3a886b0b134612ce965e3670e9b7a9f9087d4647676cfbed76be5b7908b3db8b002171d19312c7ff51caa870571
- TLSH T12581024253FA4229F5F60FB11EF605A28E7EBC93B976E25E4B40116C687064099B0F33
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/nl-NL/windows.ui.xaml.dll.mui
- SHA256 5f46f7e3446ab47350e7e37440b39eac63ae391d3120fed6f53ae15922b4b3c0
- MD5 916773db12d01b55aedaf73b5e85b482
- SHA1 eba6f02f5f1a14ade7119cc7d3a69f8a4c34315b
- SHA512 4b6112e167abe9a7dd4b3445110b6b80b69cc48a8347119380523bbe06ef1e6beb40cca8f09e57965e70ca9ee7cd556088344d97cb198601e615bc031d9e3bfc
- SSDEEP 384:LvId+JC1pq/zLFjqmVf+Zsm3uMbufGzGEwX+rB9wpDGDmqAjkULD4DZHuMYWnM4g:kOzVqHZsm3uMburEwQ9wtImqAjkUXiJS
- TLSH T17F825351A3F9161CF2F35B746AB916905A3BFC97BD72C21E0250655E2CB1B80CEA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/notepad.exe.mun
- SHA256 13db2838a080f855952f11fbf92bd26b7bdb2b8105e379c630f1ba46dfcc52ed
- MD5 40816bedca22bbef48496bc97bc8217a
- SHA1 a6bd18736a6d3a70bbf1b8c4e725397f0b47d4f0
- SHA512 01d103efafc08e041c2fc580fe523f3805d200bff2ad7db7e486f36ac56bbd9ac9a955205e343cfc08f19ddc864cfab5a614627d19bf4862bebfc7929eeaf20f
- SSDEEP 1536:TeIHLKsNjCRfqgyYKKHsLKMKF6hJDE0mtMwIEvH1y9SL3eL+ggZga1:TJLgf7nDVF6PUp1Yo3ICgg
- TLSH T17CA3F181F2409957E8AC1E708913CBEB0E48BC218B255F1B23D8B77FED316210A5B7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ntshrui.dll.mun
- SHA256 7f4c98c0a4129c9dffaf76b8738bfc96209242bc2084b026dda085bfdfefb3aa
- MD5 a1cca16808095d5ea9b69ea0def8df2f
- SHA1 076b6a2d38a1f805e82749fb0c738b96bc2987d1
- SHA512 f9f61f753bbcd68f5c0aaadfd37c858fff5b2f367681923ada0a6a2a4ec75372b164a0b7b806594f99ed60c2df6f637639eec26f910a23ccd18033174e51d7c8
- SSDEEP 3072:QUOIL7UrspYTdwDeN+abE3koQOpA+/jwHjbXRVl452TVNKbeR/fK/+1YI+:7LwsG6Z3xAKMHjbXRV65GN2m/fN
- TLSH T1DD548D02BA00F595D8150533FCABEAB41B6EBC06A809451775E4BF5FBC760A37473A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/onexui.dll.mun
- SHA256 dbe1d8183416354e58797188626d545ec8a54a973591c98c2f4721b9852495bd
- MD5 34cb564cf1f3c260ce3252ee1b146117
- SHA1 fe69888d67fe1fa8d10e0ae28124b71d51e04edb
- SHA512 a483378dc6b85b1850d8411520a8e7dc89745b89116f48990a07d758d5f74aa263e84ddca3f9c89d9f87ebeb68b40db9a0d922f3c02fc9bf3e0662a427760eb0
- SSDEEP 12288:KdgjdWK+rz8jenQ2TG3AOBXrZSfVrg6plCCqrcrADvXOsiD2w9ZrGm:KedQX8B2AAOBXtILqqADGTD2oZrP
- TLSH T1572501BD0BA38F85EA5D767085692F7A252ACC5501DFC33B00E57F5A708DAFCD1AA021
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
950KB
Virtual Size
949KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/APHostRes.dll.mui
- SHA256 ca03a1ccfcaef53bb8223ba158cd4b2be1b9422f92be05a4371e30bbf5837fed
- MD5 9d3f93e44dcf044adf3cc15c32fc672b
- SHA1 4d2a8d843d99765ab17c275450bd7205734f0243
- SHA512 3b813f267366062c52d050dc9aa9e3b6039edafdce4d242b88e0c78b7ddde7f97b1cfd6d20774e6a04b34b23d3f4318f7c4df83eb7703d7afd04ef977b867b01
- SSDEEP 384:kll8WDAbTFyKc4wX42DyGWDc6O3q3U1817p9V594Wxp:klllAbTFJcLXMGWDc6k+cE99f97p
- TLSH T1EB82460127FD1188FDF76F34A6BA26A08B7B7C62BA3DC05F224091591DB0A95DE61373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/SyncRes.dll.mui
- SHA256 9b4e618e1f17a26f9ba9526c16e41bc0e105d889302bdc45a4698e8585ec84e8
- MD5 74cff18895cfde648dbcef0dbcebfe40
- SHA1 23b80f60bafa9b3f1b9479eb7f93d4633ff197ec
- SHA512 91eca7b64fd205c9a91107a701edfb69f3c749ae251c9979fde62f77fbedb3fcd603b39a8ca6acb90ec6fe43b3656e05ec14f751efda6dc58033586a0f0da346
- SSDEEP 384:qnKbFBF5LcG4gmoz9U/3fReDWsJ7RuxWJpL3VL0p8TzUx944TzzWlw:qazKpe5J7Ru0Jl3VL0p8TzUx944aw
- TLSH T1FAE2244073F80656F2F36F7499B936A98F7FBC22B935829F2A00514919B0DD19A70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/cdosys.dll.mui
- SHA256 5122212918056845659038787553d6bbe4cf875d556e8ca653e2fbc989c5efe6
- MD5 3a31026e64437a50e7375f808864f1a1
- SHA1 eaae9d3738c64ca64a47ebf0cbf0f87e6bb20824
- SHA512 d4b75886e823063ae3c8e10aece893c100e1bf3159bf263bf8082433d084fd961bdbcb86be1ed76bcb5d017d46d0e19fe8607ff9591d63b9370edf1edee6dd4b
- SSDEEP 1536:K5J6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzTH0Z2g1e8BVYhIAAInmVLHPrzR:K5J6ivyUcEsx7fNXfV8PszW7yYsznPyt
- TLSH T14E23E11263FA4608F1F77B3958B626B51F767C92F93CC2AD12A0911D1DB2E818D60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/comctl32.dll.mui
- SHA256 3ed7b602b0ac459a780c6c1f5a2eca4b83b5d9832fc4ce5346f586eaeb45003e
- MD5 f74323b746af69fa10271565bd9465f7
- SHA1 8e36d9ee17d9be6ccbe02c8be2ad5985b1a940e2
- SHA512 c2ca335ca8ab7e4d5191a36d2c9945ef904ea5d42bc0d0e4e1f626f1effd685b1e4c7c2699d22be54b1cd04f7bc90ed1b5bdde14228c0f64abe5acc43098a578
- SSDEEP 48:yV5D+uOHo+vfSe8j3OlJZ1Le4pspd01UQxSStPgHz3yT06QvfZWJL4wv+RkPg8:0uv6WvLVpspKhIe6xWhn7
- TLSH T1D3C15404A7FA4916F4F74F7846A616A15B7BFC237AB6935FCA80100D2461A88DE61B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/quickassist.exe.mui
- SHA256 6952507a1391dde73a3b9652622aca66ee09203bc7e4ceeec316cd5b4d065880
- MD5 da6ff0a53debd639675b522e4f73100f
- SHA1 d3e56519c41ff31cad52f465e7b4f100a378e079
- SHA512 7ce56175e2a0ec21ca75a741c5cfacf05c53b8f0fb2c117edb5014597dbbd4f0d913997e2c29b7662ac24dc2ec17b719f2de3b560ff9dd4e0aab74315e4a6034
- TLSH T1C1816A4073FA026AF4F70F7095F615A98B7EBC23BA72929F8F001119286099499F0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pl-PL/windows.ui.xaml.dll.mui
- SHA256 80877057fda8a52771f9a1ca99946adffd2a1ba5aab6a316373a5e3d621eaa0f
- MD5 df8f197504e96b5ce5126ba378624fd5
- SHA1 25b469f06acea4747c11004497152d1ad8d624c9
- SHA512 dacd16cde9c4c60e6bac43b74d3c7f7e4bba72918a5964a9014700094e048dd016aed29aedb20661556e17a3496bb2042b0b8ca02c4b92c3a7d669e0a41e4207
- SSDEEP 384:HqazrZ3VAclwO0cdzjDVH+4UE/DYQxYJzrHuMKWjl:nzrBVAclwO7/0rzhl
- TLSH T117825541B3F80959F6F79F7896BA26908B3BBC236A34C29F1540610E1DB0AC4DE60777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/powercpl.dll.mun
- SHA256 b44f8a8f16da1c935ba371eec414505ec5d48634de687d7634cab3684a50e510
- MD5 dc83bd634e341c8edcba7f1ef9003c57
- SHA1 332e255d105e155ce7683eb0b6e17292aeee7712
- SHA512 2534fb11e1de5c4f0d1c0e86b5dbb4b7484289c7abfe4aa8a51a423a429bed6c008a01d5f91b169ec3b32c3f6238f956a0bb4d2304a9afa9be041ff060c6be62
- SSDEEP 3072:GjfzOm9MDdYP08nkZt6Dl7YesaNAY54nWOpiaTuD2nLK5rkA+S:6fmDdYs8nkZ0YaKI44yuDiLIz
- TLSH T19F547D0033166C49C37F6171F693AF9A6548BC41CA4A19F7A5B33AEF2876D3170DD22A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
291KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/printui.dll.mun
- SHA256 0361b7b29f9513f64c04599d67f86c279571fa78d65b0f9782dbd93fd04f5a75
- MD5 271c10e16c85dbf4ac7f05a513a7b965
- SHA1 472f6bee28451582a996bf06aa48b4787cb08eff
- SHA512 29fdc10a6d9a72523abe36e70835acbc3dc8bcab5bfb2b3af141f82b349658788d9d0ef2ad7ed6ce8b50abff6e9a4d59aa9329a0ee4714cb8799ec576ab3f7ea
- SSDEEP 6144:5Nz4L3FxT11meRpkYKCg25eV50VyAZ2Yy4rLPB4sn1q6666YaFJ:YFxTzmevkYKViCCTZ23MJ/q6666YI
- TLSH T16FB431E2D8B0BF06F6770C3963615E95004C1CEB4B980625B4AFEBCA76E3C65316F592
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
507KB
Virtual Size
506KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/prnfldr.dll.mun
- SHA256 f9fe73723bc9e96f946e9374bccc8c58c3a4599c294d91107c6e86a725d1b3cb
- MD5 f118c8a4dabdfeaec6ebe7169c68417e
- SHA1 0696874268ff60c5c1dfb5b59811535913e049c2
- SHA512 54854ca99ae4dc86ddf7de832e3293c59eea7e0d7ad469a6436b91e56e02f6f9863d228f7092ecabf95915eb1bf5ac356a45feef5c322c3953bbb5829eba2c23
- SSDEEP 3072:DInM8pRN4HflcIRRCLDXp0aNFJoLMNFJoLqGBNvdTxuND+hFcGsXhIJ7RW6u:UnMS0HdfaNv3NvXUdFCDiUX6L
- TLSH T191344A43BB40DAC0C8580632C967CFF41AB5BCA1EA904B1732E17F6F7C762526A1796D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/propsys.dll.mun
- SHA256 1aeca96b86346fda698709094d048ed05fb8a111e378a2a656fd93fd28c55014
- MD5 471d5ab4b7cff12a9f8e4b0a306fddc9
- SHA1 b8e5ac58f83d24deba30f3775eed18bb78b45e3c
- SHA512 b82587184d6eb555644e1f50484c570e76e8cd2f23568b823102229b4a36fdc81f1426454c138e54155e35687f77ca74c785cce9dbdb20b226e3f1247333831e
- SSDEEP 1536:+ROWDN4swjvsaZ4L5OvEYuadxyrs9WdKNm34ZeMUYJ6ODgqHwANyv/nSA3z8PYjG:+RBsNJeN/nSA3z8PYr6L5hjRa1Zwly
- TLSH T11FF4F134F96D9E1C4C9E001B9A706A548D5EFFA1CEB8D112F3BC7237F9816C458A9722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
752KB
Virtual Size
751KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/psr.exe.mun
- SHA256 d3e1ee21b169bfb42e2118803a8e98e713fc4ffce83203128ecd13c82ac75209
- MD5 8ede38b677a29d46abb96e917f8d8bf8
- SHA1 7e7250ad4b1080fa118317439e5c47d130bacd19
- SHA512 002e1caf486d254a8f834b89286728a6bd029f601c2331a24be1806bf0fc956e7c78974f357be758a6a107f8904e6cf4e8b96cbd50a0ee53306e06fe9afb12f0
- SSDEEP 6144:nJAVcD8LPhSiWofQr2k5l8BmMxowi/EH1:ucD8pellpco//EH1
- TLSH T17E84284545589419C8BC33F0C812FEEA05613D2F8D806B6BA2F8FB1DA83365BDD466DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/APHostRes.dll.mui
- SHA256 8985fac291a9116e039596b52d3339a9309f20c24076bd92527ccbf6fb3a6d00
- MD5 c5eb079293b11bf5bac461fb65c1ceb4
- SHA1 78758f1ae80aa5a1fd494664f544254066c4486b
- SHA512 f383e4c17ed315f566e4208de87c9cd5996d5fe727f88b1cadc8fb9ff1e0127bcea117f1f42cfe644cfa58426f47497b3592b31106ea0a542e54ec2e8d20a3e8
- SSDEEP 384:BLO1qDfDAadKzNyN1MkivWKFlzuX/CleG9XlzhAT/jWojylC8mRiU/qgBZyUZykM:BLFD3hTDrQ
- TLSH T16672D10267FE1605F9F36B3A6A790A645F7B7C95A83DD10C2260926D1DB1F00CD68B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/SyncRes.dll.mui
- SHA256 7fd80b9c2ad73d9df87de12b495f70125faeeddbfa6f04438af21afbb63e4752
- MD5 c7d2ca36e68d027ac0bdb6560a2488b2
- SHA1 3a9237cf08298b817bc7819262db5524072937ac
- SHA512 ea8c565ecb2de67230cafb387f3441e1847797d04dac3a8d0d04afccae63ebc6e27be14c56935adc4de3d4013160b04fe8bdcd4752ff766401645b5c0b9eb190
- SSDEEP 192:633t0O1dSf8k3v0DnDYUGnIODH7oHf1F3oD06MpmQpIt11KTXfWMN5:6nt0O1IODYUGnICoNFYwrpPIXQTXfWMf
- TLSH T1E6D2339267FD1614F6F77F72997916258E37BCA2AC38C24D0210516A1DB0E81DEB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/cdosys.dll.mui
- SHA256 0db5ac9e6b59be2427ee4042524319cd2c128cf224993d2c96bbc7b27c5b1bda
- MD5 fb7f84e90eab705a58341b1b40885f2b
- SHA1 304c6ed58042f1974ba9e2b60775a2db5ca7f0ae
- SHA512 52dc46c4baea102336f82e8e416598db9f663fd390e2c127919c7b52ce1e2f58905fe9d83f8c312c5194bf1e27868d50af98a0d0708698c9c65fa6478ae30519
- SSDEEP 1536:nkZJ6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzTQTRncjAee8BVYhIAAInmVLHg:n2J6ivyUcEsx7fNXfV8PszW7yYsznPyl
- TLSH T17A239A12A3FE4608F1F77B3958BA16751E3A7C92E83CD29C02A0915D5DB2F818D64B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/comctl32.dll.mui
- SHA256 48891dcf79054d46afda64d08813e1f85afdf9b72a29d3a4cdf1d2ce26a79191
- MD5 8db0b4f58285fb8e9e30b1d368e88f65
- SHA1 c0d98b144789c5ecd5ec35543917c52386f069bb
- SHA512 e2fd51cdc8a8ec30af5d44e7fd01761482754efd5ff9ef0c48cc26d71acf3050e060e5de5e525320019161e1a4c959f6db1ba717dc281a997a56ab74d8a1dada
- SSDEEP 96:rexUAnavPr7XpspLs22xZZgIDpaVCWyAk4xH:SaYOfLIYWRVH
- TLSH T12BC1779597FE5611F4F76F34A6B607515B3EBC526A3E932F4A40140E2871B04DE60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/quickassist.exe.mui
- SHA256 44dbec8f83e6b2127e2a2eec2dc723c5bed3265815ee84c5892ffa0aa0ac5cc0
- MD5 b352f77bf979e11a48d10c32f29dbd17
- SHA1 1abee94e2698fcb19ad17df8bc20aa4d480d40ed
- SHA512 964dfcba9cae6589cf83176ca024752a93da577377345c9abd83ba6650140d9ac46278428b02e924b9fbe41d46dcd62aa5aa684ea3794c1f7369637786750dc5
- TLSH T16C8105455BFA0256F4F72F7146B606929E7E7C23BC7AE21E8B10112A2870A04DDB0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-BR/windows.ui.xaml.dll.mui
- SHA256 33367dd07de5ef5329e2f52a3b24d114d4b667d13dc131aab47a3a16f8cbe31d
- MD5 922892bb6df7ef1e8ef18f438f0af957
- SHA1 cd0137fe328bfe151d5d9cedb9db299d74549dce
- SHA512 259e172de367a999bead4a17a3284f8987ab34895d0c5d0770c816806c0b1038896863702d1fe3f268b0c98578e9ff1384b2e4b3351ebc3ad6619992b449e8bd
- SSDEEP 192:f6kxLaN8RlhXGDv8K1j2TiLl52Gzp2Ps2i2U2z2j2Fnc+UV+4SNNw5SOrM6E+XeQ:RxLa4lGj7LLZWszlie+4SerFHuMhWAx
- TLSH T1FC825692A7FC1609FAF36F756A7966618E3BBC97A939C11E0150601E2DB0F40CDA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/APHostRes.dll.mui
- SHA256 261da9104cd7827c465cb79e4cd389018dbfb442abef4fa74ba86fbc4d6236c0
- MD5 dd3c2c2f9a2b555ae17c4bab2897512c
- SHA1 24dfc1d498c37426bfef838f8e3f259bd0e433ca
- SHA512 4853619010da649768fae7867720c2ad47868b721ebac032faf0d13c7cc172e644151842d5a4a1f33259700df4ea324e7ff0d454d72eefc889ebf07ea876de74
- SSDEEP 192:DcRjgO83eKS3jiEwiLeJ3plxWICWom2Rkn5xn0+1CoUPyWArLG:DcRjgONXVwiLo39Wlpm2RO3nWArC
- TLSH T1BB72CC5257FE2605F9F36F3A597A16286F3B7C91A83DC10C1290A16E2DB2F40CD68763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/SyncRes.dll.mui
- SHA256 a5a4da1579b628c7ef86c0194bdf8197cbc5ce8720ec715b674835cca87b4863
- MD5 98f2e303d44d1cbe79d61c53e06652db
- SHA1 609433fc5a3695d788dac70007b2ac6cda1d439d
- SHA512 3878e7f88c9659e2e06a5566ffc6681395bcfb35d8f3ca4a518fe2ced5807cfe74af9fc14bdb063b6a5fdd251ce63f2d3f10ed9800007bdb7e8d2f93dfed6e58
- SSDEEP 192:MnnNWYjbIGhI5EB7d4EeZSsBGGSAMNyi1V4ylUIM52fdf0/tYEThTWuFz:MnMYjr5eZSsgccdV47I62fd8/+ETtWuh
- TLSH T179E2328267FD1614F6F73F72997916264E37BCA2EC39C60D025051AA1D70E81DAB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
30KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/cdosys.dll.mui
- SHA256 4545875c73d827e6c983ed8f022e04b08bebdc6ba71fdb33bff7ad8faf043dfc
- MD5 2b1bd948e2828b498b32eb802d433c80
- SHA1 88d6ee1de716693c57aa9971f76a148c101a5e48
- SHA512 fd0f6d697e91854c660fc16d2b99d55a307d3ecc101775775f1fe5974fbc2b4dce6cd6645672c232d2cf46a3f5cc1c85829a069976150b8421556d89637269b6
- SSDEEP 1536:zQ4J6ivyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzTs4cfpHH9e8BVYhIAAInmVLHj:z/J6ivyUcEsx7fNXfV8PszW7yYsznPyl
- TLSH T188239C12A3FE4608F1F77B3959BA16751E3A7C92E83CD29C02A0915D5CB2F818D64B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/comctl32.dll.mui
- SHA256 7b6937aeb35beb3fc2f37554342082098f2826e4eb4fc8f44676df4218651adf
- MD5 89b4f423d25d297ddfa8a9bd49d2fbf8
- SHA1 751787795e1b795ec7bddad16ad3ad0d6ec0dc9b
- SHA512 23f2ddc4f62b1ec8b670e1e03614483bf7cbba8cbd81081c46b5a8e8e35091ec7889bea212ed5fe731d5356d3fe82426a23adbd8a03f1a2589c577d149d62d8d
- SSDEEP 48:y95Q5pKQ7FoenGzWZozvPpsplzIbrS/WLaZfblqHATItapkhvWVrikMyYlZWNUjN:gynnQzzvPpsplmFaZfTktapMLjWy+ti
- TLSH T16CC1789197FA6615F4FB5F74A6B617605B3BBC526A3AD31F8A40140E3874B00DE60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/quickassist.exe.mui
- SHA256 47bf2eb9f7679fb5505472d266839192b18fca9b714aeb2f02bf6211b731314b
- MD5 96c9986d89bdb1ed0636c214e37273df
- SHA1 35c90b281494498cdaa860ed03653b50267cb484
- SHA512 8578dcacaecb63f85433ef7e646c4187c6e22124d419656407209a719fb8a49cfba9065f33dfb63d000045d694a4068147ab73bed0822d15b0d662f58df3cfee
- TLSH T16E81234157FA125AF1F71F715AB616A69E3F7C23AC7AD21E8B10012D2C70A00D9B0B73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/pt-PT/windows.ui.xaml.dll.mui
- SHA256 17675d9d5f1fd77b98e5eb618979d08695106cb311e0252e8910416f5820aca2
- MD5 e250896ef8b3adec121854cb46c80826
- SHA1 f6622bbadad19acf1def4c65efca6bddae4e0ce4
- SHA512 66528bb183867bb22f99c0f7d7a4f902cdf5c8c3342b28278f0339bd5d16525cd5a315d37e0d33112c95e146ee59513e57ccdc4371417edfe32883fca5e36e4b
- SSDEEP 192:46D55jTKN2QP8zC4BdVv99fUXc5Zr6+LHV+4V20trtcoNDUP6E+Xe69pWQVX:j55jTM7899fUs5V1+4VvOo9UyHuMpWQB
- TLSH T139825452A7FC1619FAF76F766ABA66618E37BC92AD39C20D0150211E2DB0F40CD64333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/qedwipes.dll.mun
- SHA256 bc5b47c2d18dafc0e4a4580bba220db04f476cd514ea73a9c565b1ff678bf77b
- MD5 dbee5afa8acc83c819a29b9c25a86f85
- SHA1 d3ad8393732e6d2da322343bc2a19e16c77f8016
- SHA512 df44cdfd116f39489446689b07dfecd4f965a42913ce14089441e122e20134b61b6d81f10e72a8876c50c58ad8996e6b35d74198a93bac3b456a1f56e3d04499
- SSDEEP 12288:OHHhsO4j/aBz5ge6BbeZ2gnzM6MNCTs17pfST8iypSovFLBs5nrSi/7F:OHH6GzaD5Fi5rSi/7F
- TLSH T1C3F4CF0FAF725C56CCE8433006A93375D7189A76AFEFD68C7469AB3E5C1044B947A02E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
715KB
Virtual Size
715KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ras/cis.scp
- SHA256 c5a2369ff917f8da838c2e571ca94c65032eb000de71e7570b2a8ccb925d6cae
- MD5 55b2939f36e26ea9b5f7ab59641b35a8
- SHA1 0154b492e8df25171d3eff4f059de7f091f98ad8
- SHA512 1dabd2c7b473532618c2413aeac4d95f4009deebffdabf2315f95ef86dda841f7313d14d1f733da280c83b4ec8b4d5c48edbedf78a96349a241f5778b82050a2
- TLSH T17401B8C12456A67481F143B02FA2A10EEB08C01F4E64D26CB328EF0A0E3891E0977CDA
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/ras/pad.inf
- SHA256 aed705deca543f90ba9d39eb72ab0b501619af8dd48f4fcf50e10f84d616bdb7
- MD5 c4b76f3759a69abf4007c17a1eefeccf
- SHA1 6c598b581e95c0532900c0a4d0578553201e4ab9
- SHA512 fed7e67be9cdb4f5a2781c5b899f177558e3d43aab02d449f1cd6a487fe080d5b752a4b7e53d533d60c3b1401070e9269ea441833213e0c56480990f37cef2df
- SSDEEP 384:Ucz4GfaoWcz4GfuoeemoeuypPRb7fDlVfMfwMLfVfuywjo5R:U6zfo6zfjbyXfPfMfzfVfpR
- TLSH T1516278BA9F8F37B21932E062A8585EA6DE15B0B4E2C52018FC5C185F4D448E4FF1F0E9
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/ras/pppmenu.scp
- SHA256 09f1d5b9680896a9bf9ea0310eb407bccda8d24595e7f0d62b450f5baef07a73
- MD5 f109811e841d67f224b397e21ec9d3ea
- SHA1 853112b26fa9424177a5bd3a183dda0147ee6de6
- SHA512 efa736406036c867b49758c07101efd00a4a24e725b8fbf96a158364bfda010de64e56bcf9da985cf8ce3b3e1d4e49916da9ff342ca79194a77a2f06bc754f1c
- TLSH T144515F123DC7876145B8C4151F6A504BE309D06B17F64855F67D87049FFA10E1A3E9DD
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/ras/switch.inf
- SHA256 e673b093586b90ded20081d2217d2d6ed265f35fe34c28473cc17ff97c53f78d
- MD5 d0117a524f574442ca7d6680645cb80b
- SHA1 dc0e8b6f70557d4b7840cfea53201fc42b8a1df1
- SHA512 3cc0e77b5c71b294c40f210817ee04df5f0b0db3a342cda8d184d2b721ecb69e88bb72f085bae4347d44d52275732f041ce394c67e7bd7dbcef920824ac18966
- SSDEEP 192:AMqIxPW1iCmDm8UHFcONouZRY3zPBYuPZSlTRY36kRYOb5qr:/PWIIrHibsRoWxRFkRGr
- TLSH T173D1436A2A8A5B6156B20441334A968BB320D43332579D1578BD8C1D77BF7C7C232DFE
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/raschapext.dll.mun
- SHA256 8c4dc82ef9fbdb99ad8cc8c21593aa31f02dcdfbd53becd2582326d95d40b82f
- MD5 c818f4f70aadf9ca904470b4f0c5d58f
- SHA1 51c9234736b4d6ee3559d48c984b3ba592dca93f
- SHA512 e9ffa5bed9380058af729aabce265f2231b6274ab94f15411474c32ec8178098a0c8b8e36c566b08796f0d5a9f24b08b61989ed6282edd74ca6994355d978123
- SSDEEP 1536:t1Inbb+cVgeOyQhR1o+eSwaieMGOxRpqF+1Ibh6K5J/NGXuP2vPicg:v0mcVg9dhR1ojWiEURpqE1Ibh6QQ3iF
- TLSH T1B604AF137E1409DAED7D2731B07B1EBA01B66D3B88D2065D709DB9212BB35D7260B90F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/rasdlg.dll.mun
- SHA256 f9e7a01416b8fb902ebb9d8e4323578bae838b72669c5b60b007b89e2873d0dc
- MD5 01d073a476cb1e9d7dfbd6fd2661c287
- SHA1 06625e7ec77a740d4c66b9945a71007b12eae390
- SHA512 c65b9999723c73deec1cf946b3ec9ac0aba4a3fe70d83621c46048239c6bbf8297d4998bf3cfd8ce98cca2dcace1c57271abf5b4d2a3fb3c8649e34e01aadee5
- SSDEEP 3072:NnB0mcVg9dhR1ojWiEURpqE1Ibh6QQVqAmcfjpknUPRUUoSb1SO2PlorTCV:vd37CjWiE4qboQUmc7bPaJSkOYl2TCV
- TLSH T10D848C43FD0B8895CF5C157E8857CAB50D34BC2D6B70CA3B21E4BB1EA9F5393A906528
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
364KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/rasgcw.dll.mun
- SHA256 da4cca81cee105140f6dba6791f4a36a31b6a06b3e16163b037f038ab80683ab
- MD5 446675d3070d0543390244aae9d6f960
- SHA1 5860fc3825a7219224213b49e1aa34302c0a5e09
- SHA512 88c6e55bb6ba26dd88fa086f5cbcdbbb4bbaf992cf0cb46c6a4d3fbab79be3cd866f88c18adae7d0bd6c1be00140c75c28c56b12747d0a284787f87bf1d58252
- SSDEEP 3072:nlSO09k54qlhHxAwd1f/tXqv+SaXrUOjLOiFaOkCEA9Dd9c:tLd1f/tXqfaXwgnaZCZ9g
- TLSH T13594E675E282DCB2CB2D0230981BCAF55A23BC6A5F54563B359DBB3F6B7035320C9649
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
410KB
Virtual Size
410KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/rasplap.dll.mun
- SHA256 93e45661b3dc8e06004424aca3b1dcc601a45a8f2b26f2f6f956b6fb000c5626
- MD5 bf18ae018c2f9489b954f3d3a1ddc3fa
- SHA1 0658063d737d5d8ac00683b6b8a8dcaf4058b85a
- SHA512 22b46216327788fde3c8ff492cae28e044a8dd7e43e0a9389c3bec64988a690ec13498cca963ca815f9b436eac371d8ebd3362c9f722446858b1928a962a0d37
- SSDEEP 3072:Ubv6Hz5ggLOQftnHz5ggLOQ5PTWbHz5ggLOQTV5CHz5ggLOQ:fT5gU9T5gUZLST5gUzV5CT5gU
- TLSH T12E445A97BC44C5B8CDAE8130D26912F402FB4C22DE5669EF92F97CA03B762572374E49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/rastls.dll.mun
- SHA256 0c1ff2a2f1cd9963a6865f3e6f1ee73242a0acd52b5b929d36970c1be3a6537f
- MD5 52b4edbf0d6c30ffd597ea29b9e2e530
- SHA1 fe89e0efa233a56b9cbe7a93d9c9eaca5dd41fb0
- SHA512 0188e1dc6b8835cca43efffa0e9092da145c71279859e3e83a6b3e60ac5f959dcb8005c98418a75918f17262fcf9960f2bbf0806d7c2e172e472634b7629a73d
- SSDEEP 3072:kAeR1gkOf5v/SKHxZM01/1vq6PGnuj02X997q+siyo:kAeIf5XDo0t9XeVC97Ps/
- TLSH T175E3BF91921049D7E4552630ED0F9EBC7BA26C365E3A6F4B3D50391F2E363D3682628F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/rastlsext.dll.mun
- SHA256 82723a226ec5ec11f7fcc2219fb3b7339abd0167d7bd7e6e7c0365830e0167a5
- MD5 3654c71fa574be112aa374e34065a890
- SHA1 de471de46b8c52fd3ebe30f89dc10961f8504227
- SHA512 2040545f4bff1917d6b663b1c2ac70920261bfe9506952e549d9c0f3354f4bf666ff3da06484c8879923ec32e9204390f3c28edb4d38d3195f30241ddd3f7f1c
- SSDEEP 3072:i4AeR1gkOf5v/SKHxZM01/1vq6PGnuj02X997q+siytg:i4AeIf5XDo0t9XeVC97Ps/
- TLSH T17BE3AF5052014DDBE0692230FD1B9EBD77D16C328A3A5B4A3D9C391F2B367A3792624F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/remotepg.dll.mun
- SHA256 35034a1b7fcbac486b275457bd9bae407faff5983039a1eb582f9037d330f993
- MD5 b2c620c69bbc1df05bf4df8c5ec449ca
- SHA1 9a200f310ee4f3a48bb5e38ca4ecf8dd90667f8a
- SHA512 3db8615e9d80d8813c80ed892131550d79cc7e1223f791b34734c80b221b2a52c1610cac614c83b1df0b27093a084a86732a0bb15e56a66d67630339812cfdf0
- SSDEEP 1536:7OxkJMdK4RCyXOL2SaII/Z+x++ZXK46HO0Elbdyf+UYk3Zc:7OxQ4K4RCXdVeG+/K1yf+Jk3Z
- TLSH T146C36D437B0041DBDC7C4675F8AB8A751B78AD754A4209D736A4F32E1DB3317AA0AA0F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ro-RO/SyncRes.dll.mui
- SHA256 9f3cef88f9eadb837fc3ccd92f5753899af164be03190ddbeb2bee767dad676c
- MD5 c6aa744f4fc12896500dd6778f5fbbfc
- SHA1 4744bda64fb3deb14622d404ca2e2c43418ab15c
- SHA512 ca0ea7ff2f19c179c52a234b38b09072e0758ee27cd827b07e9479116720d8d9cd821076f23078c727fd8ca2fe1649068abf4a3fdf50c0bf5ceb96a581bbd391
- SSDEEP 768:6UZVdHUVEHAiVYH6VXHXHcVy1I3boavAyellBfM/VlBA:62n0urSat38eI3bJ6zBfM/VPA
- TLSH T14CE27452A3F80214F7F37F78AD7816250E3B7EA7A839D60E1618505E0A71EC49E64B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ro-RO/comctl32.dll.mui
- SHA256 d641f73475f6f152e7c54cc3f0173369e01cafe04b3af6f8550e78e3e23ab897
- MD5 b08a684eebebbd5270044f84fa21335f
- SHA1 c9c509419a952839b3eaf4d7a339116d48b183f0
- SHA512 8c2415ca9bebd570c3d82abd7b9251e0335ac8149da9679bd4582d56a64d498b9a3fe59bcbccc4358660c23ff5e303d65dd954ebb21e195a7feea98273f015d4
- SSDEEP 96:DGtMr3zFvgmpsppKJfEy5lFvEkMWMJVZ+K:iSFvgrKJfEaANWQZ+K
- TLSH T1DBC1AA51E7EA4915F1F36B746A760B542F3BFE13AA36D31F4A80540D2572A84ED20B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ro-RO/quickassist.exe.mui
- SHA256 622f2ed55fa7f1260f6c9ab0437f254c4c3ca23a33e8697e5499c2d833c27d6c
- MD5 76508605ea032bc24696eda6ea1cd7c6
- SHA1 1160dfbd46f4333ae6321040e1a3d65d8db63576
- SHA512 bcbbc6cc5f6b3e366fe6a74faa665468c15d9f9e5ac04f84dcc33f011723e6c739971abbd2eb2b1d972b1185c44a7324048791b74430f01a36f945a934d686ff
- TLSH T13381351157FA021AF6F71F70AEB505A55E7E7D23A877E21F8B04012D2A70E549CA0FB2
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/ro-RO/windows.ui.xaml.dll.mui
- SHA256 bf06a8d5e80565f1a6e1aaf5c215aed1c5c26d11647450efdd46c56125874c21
- MD5 6f884fec3f4360d39160f13f5cf16930
- SHA1 8aab3f3731329d82a71750fc7704a0b35f1e8e67
- SHA512 b91894b7173bcfb35c3f8823e5e465afb030a34fce4c8bbda7fb9c589286471b4ab1d06cb7706b3835bc0dfa83e71795134599200aa95d90b03a57e2eed65868
- SSDEEP 192:46dLrvrbQuekXTIJvDoaKkqyDe4Dj6FAl55llaP2V+rwZkjcQ2qUDAtGrD6E+Xe/:ZrAuLT4lEK5blaK+r12utGrmHuM3WT/
- TLSH T112824282B7F81614F2F36B787E7916595E3BBEA7A936C10E0114604E2E72F809D60773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sethc.exe.mun
- SHA256 28d35ea7bf505deb384aaadd01f02e869ccabaacee812877069c6153e0b5a24f
- MD5 9edc9b4d258db3d62db2ece2c1cc38cf
- SHA1 03f9a2844f4b06f8eeaeef40fd71cf67c24e4874
- SHA512 62f8350b5f2683f73591546e01f2336e8ddd94c2c2da09fef48dd1590fdcfd8d46b034e38f37d8e97e14b1e671eb7eab7e5a9fd60fed698ba626565799f1b9e3
- SSDEEP 3072:D3YAlGrRUpPcN47V1FOds2Vlt3hg7rXZQG0cg7JOkLNCIei3EnTGD2cS5s2:DoAlGr66uFz2LJGRg4kLNnei36cw
- TLSH T17014D080731098A9D26D1A31EC67DF2448A83C92DC511B2FB1677BDF28B2770768F56E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/RasMigPlugin.dll
- IMPHASH 65ce814a37409e4d0d114e3ab7e82d81
- SHA256 2acfd5cc4a9466eeb8aae5417c79b25bc47005eb3dfbfdee2f0285c7591b253f
- MD5 54fb466cd99269c1603f646515face05
- SHA1 dd7682334a83379c61775f19b9e59453b4f9494b
- SHA512 bb5877e85d4fd98031c7a81394dba25eff130c4231d73e5cc28a000614368dd227002d227372da3a58a1ea99a7bbf7f81cee743784499c239105295b6ef37cf4
- SSDEEP 6144:V1q87eXjv+iJRoiZ5spsSj6xNZY50mUhZOTVJ03q3EmsOkYE1PR2vx8Of6LC:8JG6xipuhxPPOfx
- TLSH T17EA4F702A7FE1438F1F72A716AFB5A256E3BFD306970C58E6245905E2871B51CA7033B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8e:9c:78:f0:a0:40:03:d5:60:66:c4:30:7e:e2:ad:11:dd:ec:7f:08:66:6a:23:69:10:5f:b6:29:d8:09:f6:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 5, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ed:e1:5f:cb:d5:f7:a5:5d:73:00:01:00:00:01:ed
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
408848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
RasMigPlugin.pdb
msvcrt
_wcsnicmp
_strnicmp
_ltoa
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
strchr
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
calloc
qsort
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
vswprintf_s
_wcstoui64
_ui64tow_s
wcschr
_errno
_wcsicmp
_vsnwprintf
wcsnlen
wcscat_s
wcsncpy_s
malloc
memmove_s
free
_purecall
_mbscspn
strrchr
wcscpy_s
strtoul
_vsnprintf
_wtol
__CxxFrameHandler3
atol
_ultoa_s
??0exception@@QAE@ABV0@@Z
realloc
_local_unwind4
memcpy_s
wcsstr
memset
ntdll
RtlGUIDFromString
RtlInitUnicodeString
RtlNtStatusToDosError
VerSetConditionMask
DbgPrint
kernel32
GetSystemDirectoryW
CloseHandle
GetVersionExW
lstrcmpW
HeapFree
DeleteFileW
HeapAlloc
GetProcessHeap
CopyFileW
GetEnvironmentVariableW
SetLastError
CompareStringW
GetCurrentThread
GetCurrentProcess
FindFirstFileW
FindClose
HeapSize
HeapReAlloc
HeapDestroy
CompareStringA
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
ExpandEnvironmentStringsW
SetFilePointer
WriteFile
GetFileSizeEx
GlobalFree
ReadFile
LocalFree
LocalAlloc
lstrlenW
FreeLibrary
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
LoadLibraryExW
lstrcmpiW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
LockResource
GetLastError
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SizeofResource
LoadLibraryExA
DelayLoadFailureHook
GetModuleHandleExW
SetFileInformationByHandle
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileType
CreateDirectoryW
CreateFileW
SetEvent
CreateEventW
ReleaseMutex
GetProductInfo
GetSystemWindowsDirectoryW
GetSystemTime
SystemTimeToFileTime
WaitForSingleObject
VerifyVersionInfoW
lstrlenA
GlobalAlloc
GlobalReAlloc
CompareFileTime
GetFullPathNameW
FindNextFileW
OpenMutexW
CreateMutexW
advapi32
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorDacl
EventWriteTransfer
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
AllocateAndInitializeSid
GetSecurityDescriptorGroup
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
FreeSid
CheckTokenMembership
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
RegConnectRegistryW
TraceMessage
RegFlushKey
RegDeleteKeyExW
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
RegDeleteKeyW
ChangeServiceConfig2W
StartServiceW
ChangeServiceConfigW
OpenServiceW
LsaFreeMemory
LsaStorePrivateData
LsaRetrievePrivateData
LsaOpenPolicy
LsaClose
RegGetValueW
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
user32
CharPrevW
LoadStringW
UnregisterClassA
CharNextW
ole32
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoInitializeEx
CoUninitialize
StringFromCLSID
oleaut32
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
VariantClear
LoadTypeLi
SysFreeString
VariantInit
SysStringLen
VarUI4FromStr
SysAllocStringByteLen
VariantChangeType
GetErrorInfo
LoadRegTypeLi
VariantCopy
shell32
SHGetFileInfoW
setupapi
CM_Get_Device_IDW
CM_Locate_DevNodeW
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetClassDevsExW
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiOpenClassRegKey
SetupDiGetDeviceInfoListDetailW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
CM_Get_Parent_Ex
CM_Get_Device_ID_ExW
CM_Get_DevNode_Registry_Property_ExW
mprapi
MprInfoBlockFind
MprConfigInterfaceGetInfo
MprConfigRoutingDomainEnumEx
MprConfigIsMultiTenancyEnabled
MprConfigRoutingDomainGetConfigEx
MprInfoBlockQuerySize
MprInfoDelete
MprConfigFreeRoutingDomainConfigEx
MprInfoBlockSet
MprConfigInterfaceTransportEnum
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportSetInfo
MprConfigInterfaceTransportAdd
MprConfigBufferFree
MprConfigGetFriendlyName
MprConfigRoutingDomainSetConfigEx
MprConfigTransportDelete
MprConfigInterfaceCreate
MprConfigInterfaceGetHandle
MprConfigTransportCreate
MprConfigServerDisconnect
MprConfigInterfaceEnum
MprConfigInterfaceTransportGetHandle
MprConfigTransportGetHandle
MprConfigTransportSetInfo
MprConfigServerConnect
MprInfoBlockAdd
MprConfigInterfaceTransportGetInfo
MprConfigTransportGetInfo
MprInfoBlockRemove
MprConfigInterfaceDelete
crypt32
CertCloseStore
CertNameToStrW
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
profapi
ord104
mfc42u
ord2836
ord2099
rpcrt4
I_RpcExceptionFilter
UuidCreate
ws2_32
socket
WSAStartup
closesocket
WSACleanup
WSAGetLastError
api-ms-win-devices-swdevice-l1-1-0
SwDeviceClose
SwDeviceCreate
userenv
GetProfilesDirectoryW
rtutils
TracePrintfW
rasman
RasGetDeviceConfigInfo
RasRpcConnectServer
RasSetCalledIdInfo
RasGetCalledIdInfo
RasRpcDisconnectServer
RasSetDeviceConfigInfo
api-ms-win-devices-query-l1-1-0
DevCreateObjectQuery
DevCloseObjectQuery
netapi32
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
412KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=27412,
count=20, id=260, version=27412,
count=361, id=1, productName=Unmarked objects,
count=39, id=257, version=27412,
count=8, id=261, version=27412,
count=1, id=256, version=27412,
count=61, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/cmmigr.dll
- IMPHASH ae51bc2f31f169dc11e19627a0095cd9
- SHA256 cbeaee3bd9002f1c0bd00df51f3938f6094db93bcd4622c064d797475619a35b
- MD5 2fbc1fc1e6b9b5020d58f81827c8aa1e
- SHA1 2f585c550d48b30cf9ef6be10ab42294a7a3b6a7
- SHA512 d7a6fcb19b0615d51cded468513c118080fc8b97a7245ac659c606f3c91e4eaa13f664c022943b1113d19541825200cd9839877b0944dc4140972b35729be937
- SSDEEP 768:19QVut75dAoVMHBiDWm2heN0lfjDP/9IFNcQagIJPPPjyFrREDhIH4229:19Rt75fVtWm2hu0F+PxivjydKDK42e
- TLSH T1AC43F74167D86268F6F72630683A4235657EBC309BB5D2CFDB0785AA2C707D0E93472B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
47072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
cmmigr.pdb
msvcrt
_callnewh
_initterm
_except_handler4_common
_errno
realloc
_lock
_unlock
__dllonexit
_CxxThrowException
??1type_info@@UAE@XZ
memcpy
_XcptFilter
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
wcscat_s
_purecall
_vsnwprintf
memmove_s
memcpy_s
malloc
wcsncpy_s
wcscpy_s
_amsg_exit
memcmp
_onexit
free
_vsnprintf
wcschr
memset
cmutil
CmFree
CmMalloc
kernel32
WideCharToMultiByte
SetFileShortNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CloseHandle
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
RaiseException
GetModuleHandleW
GetLastError
GetModuleFileNameW
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
LocalFree
CreateDirectoryW
lstrlenW
CopyFileW
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
GetPrivateProfileIntW
LocalAlloc
InitializeCriticalSection
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
CreateFileW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
MultiByteToWideChar
UnhandledExceptionFilter
lstrlenA
Sleep
user32
CharPrevW
CharNextW
UnregisterClassA
ole32
StringFromCLSID
CoTaskMemFree
StringFromGUID2
CoCreateInstance
oleaut32
VarUI4FromStr
SysStringByteLen
SysAllocString
SysStringLen
GetErrorInfo
VariantClear
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocStringByteLen
SysFreeString
advapi32
RegEnumValueW
AdjustTokenPrivileges
GetSecurityInfo
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
LookupPrivilegeValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
shell32
SHFileOperationW
SHGetFileInfoW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=15, id=260, version=27412,
count=146, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=3, id=261, version=27412,
count=1, id=256, version=27412,
count=17, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/comsetup.dll
- IMPHASH 6a5e1b849b53bf9ea20b899c05765fbc
- SHA256 246460ac56518b5f6e567396dec590103ef4ae60d6f94dacc09e3c0036fd3d6f
- MD5 730f47fd8f4670f71938bbbce6b78f05
- SHA1 21005f4ae7b0ca99d2c0ca20b59b10b1daf812a6
- SHA512 8ea402ebb519e574edd13d5b8ba0727f1a5073b737b5177cc211bea5b37618a73958711a47d4081d1027f75755451ff419100369aa4542c66a71a4aed5e176c5
- SSDEEP 3072:d4dRwIJsWzL/hHfYDG07p6GIqyLOj6R+1xsvCvWzSn8Q:8xJsWzLAl6G5yLOU+DsvCvWzS8Q
- TLSH T139140902A3D8E934E3BF0D357575A2AA383938715DFAC4CAE621CE0D557A5E0C5B1B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
141984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
comsetup.pdb
msvcrt
memcpy
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
exit
_itow
wcsrchr
_wtol
_wcsnicmp
wcstombs
wcstok
_purecall
_wtoi
iswspace
_wcsdup
swscanf
_waccess
malloc
atoi
_local_unwind4
_CxxThrowException
free
wcsstr
wcschr
_wcsicmp
towlower
_vsnwprintf
strtok
__CxxFrameHandler3
memset
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
LookupAccountSidW
LookupPrivilegeValueW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemAlloc
ProgIDFromCLSID
CLSIDFromString
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoSetProxyBlanket
StringFromGUID2
CoGetObjectContext
StringFromCLSID
CoCreateInstanceEx
CoInitializeEx
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-core-registry-l1-1-0
RegLoadKeyW
RegEnumValueW
RegCloseKey
RegUnLoadKeyW
RegFlushKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
QueryServiceConfigW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
CreateDirectoryW
WriteFile
GetFileSize
FindNextFileW
GetTempFileNameW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CreateFileW
SetFilePointer
FindFirstFileW
FindClose
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FindResourceExW
GetModuleHandleW
GetProcAddress
LockResource
FreeLibrary
GetModuleFileNameW
LoadResource
LoadStringW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcessId
GetCurrentProcess
SetThreadStackGuarantee
CreateProcessAsUserW
CreateProcessW
TerminateProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
FreeSid
AdjustTokenPrivileges
GetSecurityDescriptorDacl
AllocateAndInitializeSid
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetLocalTime
GetComputerNameExW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-com-private-l1-1-0
UpdateDCOMSettings
kernel32
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
advapi32
RegEnumKeyW
SetNamedSecurityInfoW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
setupapi
SetupGetLineTextW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupOpenLog
SetupCloseLog
SetupFindNextMatchLineW
SetupGetTargetPathW
SetupFindFirstLineW
ntdll
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ComPlusCompleteCbbSetup
ComPlusGetWebApplicationServerRole
ComPlusSetWebApplicationServerRole
InstallOnReboot
RunComPlusSetWebApplicationServerRoleW
SetupPrintLog
UpgradeDSSchema
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=27412,
count=16, id=260, version=27412,
count=5, id=259, version=27412,
count=233, id=1, productName=Unmarked objects,
count=13, id=257, version=27412,
count=1, id=256, version=27412,
count=21, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/msdtcstp.dll
- IMPHASH b80ca426f86e2d0ed1c8bdc115a142e4
- SHA256 f14a7e096b316c6142462a53da579b1b81c5a36c5f95bf9811f6d9343b448237
- MD5 09268483c8f74ffe38d557199a677e83
- SHA1 9124752939f14cb1ffdfff35fc5a1d8fa87d810e
- SHA512 f309e04fb9e5e85ae391d8c884c5db9cff1a8cea4536bc9e91eb010b307b90e5644cf85f8dc4fd581eaadb74ab40d316ec7fc21eb9674e2e255ebdca8aac46b9
- SSDEEP 1536:ZKS8m1kCdEriv21Gbf08ti5nqljSt0HvXLGLEPaWCzW:Im1LdErwWULi5qljSt0HvXaEyWCK
- TLSH T1D9933B5177D880B1D2FA353C693A9276263F7DB14FA854CB5320766E2CB47C29E3432A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:8b:cf:dd:c8:e6:fb:e1:4b:c5:68:1e:1a:29:57:ed:e9:06:bc:89:4f:3d:ee:1e:a8:0c:0d:c0:40:25:9e:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 18, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
61664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msdtcstp.pdb
msvcrt
wcsrchr
memmove_s
_stricmp
_vsnprintf_s
??1exception@@UAE@XZ
_wcsicmp
memcpy_s
fprintf
fclose
fflush
fopen
_waccess
wcscpy_s
_ultow
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
strchr
_wfopen
fwprintf
??1type_info@@UAE@XZ
_local_unwind4
_CxxThrowException
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
_vsnwprintf
__CxxFrameHandler3
memset
atl
ord57
ord18
ord58
ord23
ord32
ord15
ord16
ord21
ord30
ntdll
RtlAllocateHeap
RtlNtStatusToDosError
RtlImageNtHeader
RtlFreeHeap
VerSetConditionMask
RtlCaptureContext
RtlReportException
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
VerifyVersionInfoW
CopyFileW
FreeLibrary
GetProcAddress
GetLastError
GetVersionExW
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsGetValue
GetCommandLineA
UnregisterWaitEx
TlsFree
TlsAlloc
GetExitCodeProcess
CreateProcessW
LoadResource
FindResourceExW
DeleteFileW
LockResource
SetFileAttributesW
FindClose
GetModuleFileNameW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemWindowsDirectoryA
GetLocalTime
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
GetFullPathNameW
ReleaseSemaphore
GetModuleHandleExW
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
CreateFileW
ReleaseMutex
QueueUserWorkItem
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
SetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
ResetEvent
HeapAlloc
CreateMutexExW
AcquireSRWLockShared
GetProcessHeap
GetModuleHandleW
QueryFullProcessImageNameW
DebugBreak
CreateEventA
IsDebuggerPresent
LocalAlloc
LocalFree
CreateDirectoryW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CloseThreadpoolTimer
oleaut32
SysStringLen
LoadRegTypeLi
SysFreeString
version
VerQueryValueW
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExW
RegQueryValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
user32
LoadStringW
ole32
CoCreateInstance
CoGetObjectContext
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=260, version=27412,
count=5, id=259, version=27412,
count=256, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=1, id=256, version=27412,
count=46, id=265, version=27412,
count=5, id=261, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/pbkmigr.dll
- IMPHASH 1d6020d704f0ce448a621e06066a174c
- SHA256 5b100b8200b6e30d295a7a7cf3362e96f06e5bba2cd3da9bb4cda558802f7f70
- MD5 76bb7906aa40d9ea31b535e0a9fee953
- SHA1 723d28c4740b397cabd2c6b4e0603b34f64f00f5
- SHA512 006343c683e2166b653be5b4b27d711fa3e51eb8455e46a6eb631c4814cb4f861d098af7628efc0086210cc16439be8214babad523e9e33cbad6c4444fc85e09
- SSDEEP 1536:SuS7SVqbL8CO66plbm2IXl8gl0jiMrjAxmPyezS:SuSrpO6IlbmbXvlarjTKeu
- TLSH T113432A41AFD84590F2F325702579A372653EB9725BA181CB971396AA3C717C0EF3432B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:6e:c2:18:66:be:fd:81:5f:8a:1f:7c:62:b0:d1:d5:3b:a7:42:f6:fb:67:84:41:50:5e:a6:f9:91:f2:43:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
39152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
pbkmigr.pdb
msvcrt
_onexit
__dllonexit
_unlock
_lock
realloc
memcmp
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
free
??1type_info@@UAE@XZ
wprintf
wcscat_s
_purecall
_wcsicmp
_vsnwprintf
memmove_s
memcpy_s
malloc
wcsncpy_s
wcscpy_s
_errno
memset
kernel32
ExpandEnvironmentStringsW
DeleteCriticalSection
RaiseException
GetModuleHandleW
GetLastError
GetModuleFileNameW
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
GlobalAlloc
InitializeCriticalSection
GetThreadLocale
SetThreadLocale
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
LocalFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
CloseHandle
VirtualQuery
FreeLibrary
GetSystemInfo
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
CreateFileW
GetSystemDirectoryW
VirtualProtect
SetFileShortNameW
GlobalFree
user32
UnregisterClassA
CharNextW
advapi32
OpenProcessToken
AdjustTokenPrivileges
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
LookupPrivilegeValueW
shell32
SHGetFileInfoW
SHFileOperationW
rasapi32
RasSetAutoTriggerProfile
RasEnumEntriesW
RasGetEntryPropertiesW
RasSetEntryPropertiesW
RasGetCustomAuthDataW
RasSetCustomAuthDataW
RasGetSubEntryPropertiesW
RasSetSubEntryPropertiesW
GetAutoTriggerProfileInfo
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=15, id=260, version=27412,
count=174, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=18, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/setup/tssysprep.dll
- IMPHASH 4d79b96ea2935e93209d33fa91a556fc
- SHA256 6a3b24f4e02586f8f5ce0516dfd350570aad88e2a3ac18ddedb2234cf1c53442
- MD5 6f4a2cd3559f18d29e905d6e3fb1159e
- SHA1 af347db7765f118874446968482bb82f9aa1fb89
- SHA512 480086ba49e3ed0109aef8b5b1f4b236a59523631003f38ecc17f7ee65132a77ed95df477add68331535e3a2ace4143a864844ad9fcb6bb28bf78404cc788843
- SSDEEP 768:wORlU+TkY3qo8k2WFbKoBmDOHhd5AzAwriZoTRoH1:wOR+MkY3tBFuBOBfA7riZoTRc
- TLSH T11C13F71193C49C75F2EF06313A36016B1E7BBD700BE291DF6253998A28757D3EA3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
32352
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
TSSysprep.pdb
msvcrt
_vsnwprintf_s
_snwprintf_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_callnewh
_purecall
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memset
wdscore
CurrentIP
WdsSetupLogMessageW
ConstructPartialMsgVW
kernel32
GetSystemFirmwareTable
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetLastError
GetCurrentThreadId
LocalFree
GetCurrentProcessId
GetVersionExA
OutputDebugStringW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
RaiseException
WriteFile
SetFilePointer
CreateFileW
GetVersionExW
WideCharToMultiByte
QueryPerformanceCounter
Sleep
SetLastError
crypt32
CertDeleteCertificateFromStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
shlwapi
SHGetValueW
SHDeleteKeyW
SHDeleteValueW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
advapi32
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
DeleteAce
InitializeSecurityDescriptor
SetSecurityDescriptorControl
GetSecurityDescriptorLength
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
GetTokenInformation
SetSecurityDescriptorGroup
MakeAbsoluteSD
MakeSelfRelativeSD
RegQueryValueExW
AddAccessAllowedAce
IsValidAcl
GetLengthSid
AddAccessAllowedAceEx
InitializeAcl
FreeSid
OpenProcessToken
IsValidSecurityDescriptor
AddAce
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
AllocateAndInitializeSid
SetSecurityDescriptorOwner
GetSecurityDescriptorSacl
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
oleaut32
VariantClear
SafeArrayAccessData
SafeArrayCreate
SafeArrayRedim
SafeArrayUnaccessData
SafeArrayLock
SysAllocString
SafeArrayGetVartype
SafeArrayCopy
SysFreeString
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayGetUBound
VariantInit
SafeArrayDestroy
cryptbase
SystemFunction036
AppsrvSysPrepGeneralize
AppsrvSysPrepSpecializeOffline
AppsrvSysPrepSpecializeOnline
CBrokerSysPrepGeneralize
CBrokerSysPrepSpecializeOffline
CBrokerSysPrepSpecializeOnline
LSMSysPrepBackup
LSMSysPrepRestoreOffline
LSMSysPrepRestoreOnline
RCMSysPrepGeneralize
RdpSysPrepGeneralize
RdpSysPrepRestoreOffline
RdpSysPrepRestoreOnline
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=3, id=259, version=27412,
count=172, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=14, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/shell32.dll.mun
- SHA256 78fb99b57d96c2b0e237d1d3ef917c831ed767b62b3f78362916a84ba7751536
- MD5 31d318b8fc97aa9f9aef2113a81841e7
- SHA1 4a6cbc8fb0409d51a00f273ba4ca641659ef73d6
- SHA512 5e5141198b2a95c082fe5aa97edbd9bb4007e7de8daf33717e8cd7b1c4830da89a94007289dfc24af1f4400bbfd9c484444cc7cc91fc27fc80a42daaf64df7a4
- SSDEEP 196608:sb7Jyee+DwCFUFvJGoquoo+arPfBeOj4kP:sb74qFUFBPoGB3
- TLSH T179E64B85F745ECF5E5545431AC22DE7C2B51BF25C899052B32EABB1F28712C22CBAD0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/shrpubw.exe.mun
- SHA256 3dd9e1fd81f223ab6268277f4cc7844d0dfb0dd296d1ae00eebc2210bf379eb7
- MD5 f805e01a505d4278af09d370b4e5cda2
- SHA1 39440d1dde0709ad2a5c5757579c71f2b408dd59
- SHA512 904fbc2bcf8734c6c778c5f5835d6d5a8f9c0844912615feb4edf0729e36220b96e08dc50d29b0048f45a81e1e28bb1c702cdf7f0d0bb8bc338bc5ab64ed383a
- SSDEEP 768:MeSFs24vO2puAxZ/W9vF5NXWxo1vK+44flFsnVV:MeBTxWJF51KsvhFsVV
- TLSH T153746764F0B2ECB3EA136B7039BCF81C95AD75551386CA5D765AF0B292D330031CDAA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/shsvcs.dll.mun
- SHA256 77eded6ca9ef1d34e2319a19b35f0ee9456c3aa3554816b1f5e4ab134eeaeb11
- MD5 ef5b161b3a45bed94fdd93b6622fb3c6
- SHA1 1d4b9e129849f58a7900c76c5a05be6e2ec98bef
- SHA512 b1bb2ec0c9aeb2546580058c933d449dcb2a810861a579030588c5c6b481efe0fcb59287ebadf7910bb4ae0f10d59291a9f4841d1c0b83de5199334c392c5005
- SSDEEP 3072:YYVM4r2N/IagOOwPdDZoBUKb3bLa6ORbAd1faw9/fX4Vc0Tbbo/7obwTzMkwODrx:ZAh7KyebVJMk8rKqaBsC8Yw6
- TLSH T18D849C06B7D9CC09F0B35A706EB5DF591B2AFCEA9E01C26F71A0539F0C70A518E59722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
362KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sk-SK/SyncRes.dll.mui
- SHA256 5f1ce5c5eafc789eb137711df2903d630181a22dcc6449befc554e47afacea9e
- MD5 c2f7333d3a0e90892b6a0d87dbfd4789
- SHA1 66b956e91c1540e5651a9971d83ee9b031853727
- SHA512 127b062e8cd39d5f401945c0a601434477cfa0b0ac1bcaf5f8009ed4ef03faa8aa58790651302ba1b017fff6d5ee9f8a5a048fb8207969115f3ef9908fdc8370
- SSDEEP 384:KP9n6IVwJOpIeJDp36/ue6CuuYZ9Tqqhqf/2vv6RxZhGzPnaQYJs5KoKPuGYspTw:y93pIKyiJ5UszPbYJJvA++
- TLSH T1EFD2D35163FC0695F5FBBF70A9B506610A3B3CA6BE39C20E5610929D0D30AD1DAB4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sk-SK/comctl32.dll.mui
- SHA256 4204e71eee37de93a3a173ac31e975e111f790c46d7a56d83b7e88b3240b0e7d
- MD5 146c2e780a7897fec928f3016cfce364
- SHA1 a5c7b126f905d70e46dde0696355ac28f38e1940
- SHA512 bbb7d51ac0ce629bf6c86d88ddecd257b9ee3000ed66d81efbd11a52f7fa4b748c5c00594e6faddc318e5e8c04d186360617eebc5e388c3d37d52cb14ccc6cc5
- SSDEEP 48:yq5p4oyQloe9IiqQmzeFw9Ipsp/NA+6QNS5WhUvM3MIj5PlFjvJgbeGVIebYWOZ1:HX9IKwipspUQNhlPPFmxR2WBArtWwZ
- TLSH T1E1C1B41193FA1912F4FB1B38A6B24AA11B7EBC137B36931FCF40050CA864684DDA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sk-SK/quickassist.exe.mui
- SHA256 eff33467c7dbfa5a4a0aa7d413bae1d17385ff94ce941a724daf7a3a4665632b
- MD5 fd561dda3c7a05384a23a372ef732b2c
- SHA1 870115b3b393492569c5c3e20cb0c294e03616ae
- SHA512 e2a8a1b0917fbe13100cdcdcdc67cf9c625a958bab4480bc6263d172a0ef28950b268d05b5b32ddbb1ccb5c4dd840f21d7255d4db504523d3a6c8951ba7b8a88
- TLSH T100810405A7FE0156F4F76F7096F106A54ABE3C63BA76A22F8B00016E2870945D9B0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sk-SK/windows.ui.xaml.dll.mui
- SHA256 8176085a6c7e6ffc8eb71d54d2ef8b400e49818ffe6e53ff15113b0e126de09c
- MD5 8731943c8575622570f5d4ed5789cfee
- SHA1 8edd11291664b75b306f72b14dda87b1b6ac9633
- SHA512 12f977e811f2c82705c3394f39bd401168d03ae838cd081e9380ee1cff6ce1db4581f0c945605c5fee526bc2f8709adcf9a9ef91fb041092807a995af510b10c
- SSDEEP 384:Y9ejO+6/05XiaaO5PFXzK+4uItRDYHuMeWZVWJ:Y9e6+6/05XialPFPICbs
- TLSH T11882312263FC1550F5FBAF78AAB502A54B3BBCA77A36C21F5640510A1CB1B80DDA0777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sl-SI/SyncRes.dll.mui
- SHA256 df1a4990b7b824544fe0cb3ba264575fb20ebd9ac9434bcdb8aac37d5bbb1286
- MD5 a65729d439736fed2222f060392dac33
- SHA1 dee0de5b8555407d8088fe661b4b7365c06d7eef
- SHA512 d041fdef3873a6740917b80f393fb2878fe9a1e8399de106ae06ad243ca70d36d967f53f1c6ae767d1e739654f53bde56954a960d2d074426cdd88c7ef3b15b1
- SSDEEP 384:yvFZO50ufPGToRdnisJAm7Jx477kJGyNdf2W6S8fcNF9iftb5LvhTxVDrF1qafiy:6E0udJrGNW6S8YHMVpzdoG5
- TLSH T1A1D28942A3FC1699F5F7BF71A9B506344A3B7DA2BE38C20E0250419D5A31AA1D5F4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sl-SI/comctl32.dll.mui
- SHA256 f6e15d42e2cd3da6d6d7e34b73696fe2af9d15ff4f1d3d99d5a16c4a225352a9
- MD5 852bb381a98e48263ea09b32f02abee8
- SHA1 171ba3564ecb6be0ce03ab0f873227bbd8b0c0a2
- SHA512 d04376c7027c467d3f618b7806f2ccd4828a6ed4c9b2822d48ab0dda12295d960bb67274e9e72529a78c643f1e6edffb963fffce8e1264694c9465076a070637
- SSDEEP 96:GRHkPcpfGhpsp0XVeHUGOMcSxE6VrWBAdA1:tmGlVOlXcSxhhW0A1
- TLSH T11BC16706D3FA1A16F0F75B345AF60AA11B7EBC527A35931FCB40105E2861684E9A0F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sl-SI/quickassist.exe.mui
- SHA256 a6ad8fda3b5ae09b03b803a33976a8bbd3072c7c8c225e413139c04075823b2b
- MD5 bb337714d4180b4cea00b9c97d6ba969
- SHA1 044204061f85a42717afedb5e8e1418c12935a37
- SHA512 ada914f65460e339e49519fa2077fe6654d0765aa0e497bdbb6f307ebe13c8c1e1a6517865e2364bf15572607edbed968cf3872e24abd6a223842cffa1bc0813
- TLSH T11F815942A3FA125AF4F76F7056F606758A7F7C72BA36E21E4A00016D2871681D9F0B73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sl-SI/windows.ui.xaml.dll.mui
- SHA256 2a44cfde190e4f235fff12f8e54a03fc549abd6bd2aa911b5409c940160faf9e
- MD5 5aece1253e204c638124c226883196f3
- SHA1 17c52529d4c21a4183d14298adb223c0ca0c54f8
- SHA512 c80d17f307c5ad529df9700ce12f377535bf46fe1c9aa5b56db03c4d729bec2d3b1838860be3a5939202dba0527af8f03b9c3edfbc1d472fa2a2b6b5eb4d193b
- SSDEEP 384:uE/iH+ytdwDVuLHrQq+4fXi1j1DS1cgHuM8WpU:uE/iH+ytdwR6MKqSpU
- TLSH T118823256A3FD2506F0F75F346AF613A44A7ABCA27A35C21F5250210A1DB1BC1C9E07B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/spp/tokens/legacy/client-issuance-rac.xrm-ms
- SHA256 af45a3f82b5453568c628e942d4e61a87e9586bba10d0bb19a0358581729973b
- MD5 93712b405d8eaba6f5bb177a5c4331f9
- SHA1 1b7074bbf72546b3c980049d3cc60f7a00c6a387
- SHA512 6d269f032cf160158674ced8ddccef12313cef99d20a4007d832ec838df60ef93f40261f252fb8473d22fd52bbaf88b7e43483501b763784d5dd27d51b2cd1a3
- SSDEEP 96:Tm3gLebLZiwSN5J6ZSLs/bXe42mSKPEBY3lkb:4gLebFifqSLs/i6umY
- TLSH T155E111AB94920C7339855E70ACD7F7C774051EFEC0EE2CE745C6CB696A244B760A8087
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/legacy/client-issuance-spc.xrm-ms
- SHA256 9a051f76206eadd96a57d77536abfb4c99847a68795ce5c6d5179d2ebfc8899c
- MD5 3a41ab5de50700209887f5e07a5e18bf
- SHA1 6ea53e85376b52b2f44e29e7043b074d7f54acca
- SHA512 3a7b0d666c7469eef489f308a545ea4ea42f02e7447862a15e2e8c9e3261f7dc47ecd765aa49901a8bfe9c2fa0efa950383da2a16bcd04883a7ee4df8333d3ef
- SSDEEP 96:+m3t0WqT7ZMVZiwSN5J6ZjXF+dz35uKPEBY3/kb:Tt0fT9MTifq5GNumm
- TLSH T139B1948F94A64CF334489D34ADE3F7CB64811EFFC1EE496705C6C658AA150BA51BC48B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/legacy/rac-generic-private.xrm-ms
- SHA256 c1db639083300dad9f66c0a23d59a52685a6d1df1e254b657c6bbedaee91fdcc
- MD5 dc7b2b05709149693d9be5521ff96a4c
- SHA1 bbaf907ac463ec7c9a6808726c6efe63bb662e23
- SHA512 eac9b34215907ebb1ecf4dff69eb330aaf652c938d31ad1125fab3435b197421e7a4c42952fbf3147bcf4c6bcc1701f4d90309772442228c15887591eee4c347
- SSDEEP 96:um3gLYLuLmL5qe02f3gQL6a5UfFvS4mXYwAwSN5J6jY31TrUR:jOmE85w2fQe6a5UNv9fwmC
- TLSH T143B1D79D95C4CC63B4C8D8783DF7F746228327EB80F8B18A09EB4C4855219E4A159F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/legacy/rac-generic-public.xrm-ms
- SHA256 1d05309fb259fb3a98b556e9dc573e6fe84f7b3ac6b8413a28a1e0957c952cbd
- MD5 5a4b3834d7e536b03be0d0621ba76587
- SHA1 671fadf32d8ed746096482cd158a14400c4cf11b
- SHA512 4bf372f637ecfe95a76ce631fe9f87b4536af50a222f239333c7be35b64e1876587abf497cb41bdec71e76d6a5b827fd2dca00b89a96fc4516bf7649ea5d465a
- TLSH T1AD8175EE81D1887379C4DC347DD3B68F22562ABB80E9A4D705DE8D4C98200E56155AAE
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/spp/tokens/legacy/spc-generic-private.xrm-ms
- SHA256 2a148fb2ac60df03c1736d90edfe473c87a00b5432c4d12543e55b3e866ef249
- MD5 dcc1fc8f748c4987d06dd1ddb747875e
- SHA1 4b9e8d7e7db6d826d285c09bd5ab523008dff6a5
- SHA512 eea09228c364f281d783bbaf15c831d36e9c58f6f709e944edfd6637770f4cd914e4536774f144297436501b7ee3aa5167749ba8168597ad0a2271435be02b19
- SSDEEP 96:Fm3uLYLuLmLLUsV/5gQL3rxlsw1aXSJ8SknqmXcavj1HXwSN5J6oY3bHOn:mEmE8LjEebx7+X5j13frm6n
- TLSH T111B108AC89D9C8A3A598E9787DF7E75752932AABC0FCD48F19EB8E0480414F0A04576C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/legacy/spc-generic-public.xrm-ms
- SHA256 dc74fe59509e2261c5b6b5dac191acc1a4cdbd65378fd4d9c0fcc7492a985470
- MD5 204ce5a834b972c8478038d5b4b1a6f3
- SHA1 a1ca2ea9aae5c5dc6e8bceac9bb26bdb40f30ced
- SHA512 7d804319a14f0711c20a023be9e4f487cd1f76b419034f0da5cfdd42ed5187eea79248d10f35ebbbbcbc029707c0894f75449d44bbd3d2b4d3c14395cc2600b9
- TLSH T1A751549D92D8C8B75488E9383DE3F24B12C73ABBC0F4E08715DE8C4C8A515F46169B6D
- MD5 SHA1 SHA512 TLSH
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig-csvlk.xrm-ms
- SHA256 53e97c9bbd8ce317791f3a2f7eab1aeb44e4d62ab89b2a0dfd6fc54b9179a46b
- MD5 58aa9d765719eebffc5188098a5ca07f
- SHA1 fc28a2c88bef584aea402149056276abcbbf6652
- SHA512 5af6c6997c23c57cb6d8ae603be4bdf13c9812d22228198f0e94a1652414d130382fcb2ee7722eefa7aa968f4bc918f0ab35abc4746b10a78f58d62341e577dd
- SSDEEP 384:knjHJiaKLPCmx/EDAbq0H3yXHdJkp/HQ0DNkoh:SjpbKTCmx/EDAv/HQsuC
- TLSH T12A821A4353A32574E9CA19CBFE90A19BA670AF2F877248CC272DC707092DD81ED5762D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig-downlevel.xrm-ms
- SHA256 d1a08275ba32c824da0c3af266c8226b2dc1af9c3682bb175c478baf2ba57d9b
- MD5 2601ad09a45a9ffa65477b2e3ad40e80
- SHA1 a299f0bb6372ee8443ec445f6a5d053e27ed8734
- SHA512 cddf3a0063bbfeee9d909b98b838b2a31d1ac57d577b6190e27909b055af98403ea8ca2812f24466f0f9b7333a94aa908742f3e9ccaaf94ce48e45768c9e3cd8
- SSDEEP 6144:b56d+gGAXIgWs2bZdhMfcP9VTlTGZshoOf1+afPc/x:YdWFPfUG0/x
- TLSH T10CF4B64223A318A4E2EF1CCD7E68C4EF86B0A7BF9AD35DC4533C43415C99542DEA3A59
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/pkeyconfig/pkeyconfig.xrm-ms
- SHA256 c9078d397c043c42daefdda8bf0f7746269ed7e50779679461ccc92b274b7f31
- MD5 8c95e579f03c401c614abb22075527fb
- SHA1 5859e870baa4c13d3bb81cd5186f84ed2d2019f0
- SHA512 b98e1cc089a48fd8dd32e7fece7d9f1389ae1d1f73d40379232239f2574839701ccb6751447dea5a5e00c65da15c877a9f8d6bade0fbe1be4c1dc27a4e86d163
- SSDEEP 6144:AeUJmDIHwVeCx2qTMTTnaP/d5/NbyBNiXJixdDx7OT6CT:AfAkHwVeCx2qTMTTnaP/d5/NfhT
- TLSH T108E4B54367A30864E2FA2CCC2E74D8DF95B1BBBB6AD36DD4633C47414C61142EE93A19
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/DefaultPpd-csvlk-pack-ppdlic.xrm-ms
- SHA256 408c295478fa15c4931fe1889839d89e45246965e98c5f61527c542f1597e002
- MD5 1fa510a3ffcdec7364d56be2eb657651
- SHA1 d284d24de7d10368fa75f7f8473808d2e30f736f
- SHA512 12167ffdeb458f80c1cbf76e47c55a2ed94868f66704ab1ff0b4b3d8f2e0910c8e7d5eb6cccb6e3cf324847d102e13c35395e5f620d3ed210fcdf79e4d93cc19
- SSDEEP 768:xd7h8KO1HQFVfo1R/8gdMDMr4pJNmv8rdUJcOs85dZmqhBZKnmYMt:xEKO1HQFVfo1R0gdumv8rdUJcOscvKna
- TLSH T15423E600656CED62A8567EA29B31BF4AC55B78FA38EA716033C8FF3504F146E19E1713
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-pl-rtm.xrm-ms
- SHA256 953b8f9033edaae86f3a1423d7993ca28952bedbfa6b2c20e526da526404883b
- MD5 2485ba9ef7bea5f5db695143562377d0
- SHA1 d5b3906facb4b51b4293dd3fd042cfcca5260d2f
- SHA512 b28638dcccda738e30ab2f14897ed029cc71c8306eb1a852f27f17f92e6f83012e43f38ddbb622836fd3e099e4db26efc53c07f452d8c8bc3adbe6f01a746368
- SSDEEP 192:7DLUtfqjjTuYuk3F4OWT6f2cmXoNqLUHjTejT3LUuEf2cmZ:7DOf6jCS3F4O7fcXkq8jKj7tEfcZ
- TLSH T14032C7EED1E4CCE36C94ED343DE7B28756872ABF84ECA09705DF9E5880110E8A15879D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-oob-rtm.xrm-ms
- SHA256 b19223e3e8f41da0a127f158a9af66cc8e97eaf3c4fab5f8cfa17738f694eb2a
- MD5 ad0725494be7c4b12278fd8fa4763a5f
- SHA1 4f35761a2e8632e21ca1923a80a59de2237b29be
- SHA512 6b68f2c7e1dca83370b17d117cd1f7e26ac24ac0c21367602e84fb817cb75fee9e2c823ef6cd8637ea837b3104569f2b3226fd8dbee7a60078aaf1b384a93540
- SSDEEP 384:Nikf6jCS3pjO74sIfcfnAUFYojjfllfcf4:2CS3ROBn9DpT
- TLSH T1B842A6EA9094CCE35CD5E9347DF3B3C726972ABBD4E8E05315CE8E1881420E47299B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-phn-rtm.xrm-ms
- SHA256 36fc2225ffd6af556b6733e75eecb108fe21b2b83dde032a5dd26faee754d504
- MD5 df6803427f0ef07f4111ae234d8656dd
- SHA1 aff034c8396ee08f2c38e08fee4b54dbb47ddeaf
- SHA512 7713200878d2f5f7256463802d848198cfa379d4ed6545ee01ea82d68435fee1f9916aea14ff0ead9f11a145f02e460d648700a09c9d58992954a62f12148d60
- SSDEEP 384:UYf6jCS3xkCNrSDym0ML5d4SX8yfcHVTkCNrSDym0ML5DTMjjf7E1fc/:SCS3xnBWym0IQTnBWym0ISfEq
- TLSH T14F925BFDD1889CE74DC4ED207DF3B7875E9B2ABB85E8908314CEDE5881010E5AA94B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-1-ul-store-rtm.xrm-ms
- SHA256 4be348c62a42fa37c7c35526828964656e22163463867696aceaaab963f9ca79
- MD5 6f5c180bc7a2c3f7222c0b94e09fa48e
- SHA1 11c10a3974655fbfe374b7d8e0c41c9ad35edfaa
- SHA512 48c63de98397c9fac48d1616504f907204615169b4b08514a73e0fb060a5121fb363c5eef4029dfdc06c2aab3465e9ff48e02ff6728dd20634d6cd0e6879e9fd
- SSDEEP 192:4XfqjjTuYuk3Wc4Satf2cm7H4lBBjTXfqIw1f2cmN:4Xf6jCS3f4Swfc7gBjjfF+fcN
- TLSH T1A522A7EE9194CCE35CD5ED387DE3B38726972ABF84E8A04315CE8E1841520E87159BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-pl-rtm.xrm-ms
- SHA256 1e38b0ecedb250614ce9e0bc87742ccb683bf20bf1922b7b0427a834c18358f3
- MD5 bcdf0a7b9669106c941b17a44b383c9b
- SHA1 eac37636af51573aa64d7085dbc48de9a5cea36c
- SHA512 5a10e0667e61034bdc46ec98df7e5aeed350e46621289363016addc9bd02ba289ef72bb1d3dc630c3a2657825f55fd1ae624745377e88a6c4dba29f76aa026e1
- SSDEEP 192:YDLUtfqjjTuYukF4OmRf2cmVo7qLUHjTejT3LU8Pf2cmI:YDOf6jCSF4OYfcVWq8jKj77PfcI
- TLSH T17E32C8EAD0E4CCE36C95ED383DE3B28716872A7F80E8E49705DF8E5845110E971587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-oob-rtm.xrm-ms
- SHA256 b6ec2012f1b1440b83ed2ca28c7e23e2a0615f5cd5f99ca9d295066f6038f115
- MD5 57196e9a5a61db09ff2cb0fa1a38fde4
- SHA1 4c4803fa3d6598ec5564ebd3d7906fba31ae4da2
- SHA512 07c24ebae5a0f71476c83bb0e0cf15adfbd8a91cba8be7257758c5a335c7264d45cad0eb504606e76e95cbe98be3be6e092b142f1cefc0f8ae90f768477f661c
- SSDEEP 192:6kfqjjTuYukWcjTapgo4svf2cm/Hi0kUui0ojTXfqv6f2cmu:6kf6jCS5jOL4svfc/6UF0ojjftfcu
- TLSH T1173296EF9194CCE35CD9E8347DF7B2C616976ABBD4E8E05305CE8E1881410E43259BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-phn-rtm.xrm-ms
- SHA256 6872296465a7cbbc6afd1103c0e03e3c77a9b16367140af7140ae3415fb9053c
- MD5 9b2913357554cbc070f1b0f1f20529cc
- SHA1 69a668023073aedd4d7561b2e5d0d8fc3bf94f33
- SHA512 3de42897fb22b05ff5469970bbb6d469246b29ef833dfd102dd20d9f110675d42b8f59679c5f64109d4159a6779b5fc8095af09e5ab3da88609cb7d7a152cb99
- SSDEEP 384:YYf6jCSxkCNrSDym0ML5p4S0fcZJkCNrSDym0ML53Mjjfffcz:WCSxnBWym0IxJnBWym0IuM
- TLSH T184926CFED1949CE74DC4ED247DE3B7826E9B2ABB84E890C304CEDE58C1010E5A994B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-10-ul-store-rtm.xrm-ms
- SHA256 cd09e442b3777ff6439e02e68ccf1cc6502af8c8810f653192954b6057395ffc
- MD5 37359b185da8e31e70d13c81755f48b7
- SHA1 fa449fa8dda3f3968a3e067dded1e3169c707a3a
- SHA512 2bc7113312529880388917972569931c77aea97817ea7ec4d7faf6b955581bac6692859da06db33273e6476dc7eeea9b96bd8ca49fd82a2599ca1fb142eed915
- SSDEEP 192:9LXfqjjTuYukWo4SNllChf2cmGFHiluDBjTXfqbyf2cmrC:9LXf6jCSP4SzlChfcGFRDBjjfGyfcrC
- TLSH T1D522A5EED198CCE75CD9EC247DE7B38626972ABFC4E8D05315CE8E1841420E83159BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-pl-rtm.xrm-ms
- SHA256 2adc1c36ee6908732a9d9c9fd51e6643dadd1be9adbaed60ef8f441060f93adc
- MD5 68dc7c66f77897c58b273ad52cda4bdc
- SHA1 a3fd04abea8e7c75402f2c730fb3f074202d9895
- SHA512 8af8091aa390bc6b80b3285f64bf43a0d0a96dc98d9bf23fcab3a4ef869f5e0f87b3cdf28eb63ca553a9f93114ce83deec989977d0d877dcf816fd1e6852f01d
- SSDEEP 192:lDLUtfqjjTuYukBF4OIQqjf2cmRoUqLUHjTejT3LUggf2cmj:lDOf6jCSBF4OIQqjfcRhq8jKj7Yfcj
- TLSH T1A532D8EAD1E4CCE36CD4ED343DE7B2871A872A7F80E8E09705DF9E5884110E961587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-oob-rtm.xrm-ms
- SHA256 c604ba9503db0a250e2c62c970a08d3ec1bc16b6b89a1eaa1b758443606d5ea6
- MD5 07b02db4e2bbebdf1d26529572e378f1
- SHA1 53829fc8f34bffd2d58260f69057b6bcbf7efe48
- SHA512 278f24d410b9b4d392729676038fb8f63a6c8c2b34acd85daac903bcd9911067f5d1dbe1f5598fa73ebe2d0ff2e115892cd2efee88c6638062e4e27e4dcf88d7
- SSDEEP 192:UkfqjjTuYukBWFjTapgT4sigf2cmuH40kUuiGojTXfqXUdVf2cm5:Ukf6jCSBEjOk4srfcuAUFGojjf5ffc5
- TLSH T10442B5EE9194CCE35CD5E8387DF3B38726976ABBC4E8E05315CE8E1881420E47259B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-phn-rtm.xrm-ms
- SHA256 1e584718fdc5e00e0d7f273d4e0c480ff357b882bed9d53699dc2c00531e8a3a
- MD5 de88e51b46371d8eb3e59cc87adc367b
- SHA1 ea4945f2c6e0e908a9505f7cd515631ebb6460bd
- SHA512 135efb3384564f20f0a9743f490979464efb1152128096536516b6b38f02654921a5d211c9c3dd8a8b35bef32e26f6fad91e309b04ff5b8b89baee8305218423
- SSDEEP 384:QYf6jCSBxkCNrSDym0ML5C4SBfceTkCNrSDym0ML5LMjjfdfcc:OCSBxnBWym0IyTnBWym0IaR
- TLSH T10A925BFDD1889CE749C4EE247DF3B7836E9B2ABB80E4908310DE9E5C81510E5A994B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-2-ul-store-rtm.xrm-ms
- SHA256 9fccd8b27960ab3eb1406bab9e3a140e4f837e9739fec3918edfe0f1be9c8eb4
- MD5 6e5f0025d39b92633b653fd444ec3ae7
- SHA1 38877fc2c83bd76f3160bf81d0c7f3f455e093bc
- SHA512 fd900d8407c35cbfd40ba7b497ddab0ebc1ed8420e9280741120ac86540ff10841f074a38bd0f212a95ea04be7a5f2a0f0b6cecbdefd4baa9dd2d0596b631bdb
- SSDEEP 192:n9XfqjjTuYukBWT4SI0xf2cmcH4lZBjTXfq5f2cmD:9Xf6jCSBQ4SImfccABjjfyfcD
- TLSH T12122A6EE9198CCE35CC4ED387DE7B38727876ABFD0E8A04315DE8E1881410A47159BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-pl-rtm.xrm-ms
- SHA256 353e73a2ebec75bb3327f01d83ca3689d0ce4329caeb073325b18a6e20c11a0f
- MD5 1093961095eb265a00a009133a276de4
- SHA1 810adc561dc50d08d3fc2fe61d166b7615b03569
- SHA512 81b8687b79aed6991a30fe40455bc59fdc9b29c72f7862e9689047030f721731a371eb32d249b8954aae58d33b275b53512babb8f0b69e9793c7d9b5e50251d6
- SSDEEP 192:93DLUtfqjjTuYuk3P4OPNf2cmEjo91qLUHjTejT3LU7Sf2cmgk:93DOf6jCS3P4OPNfcyCq8jKj7Ffcgk
- TLSH T12532C7EED1A4CCE36C94ED347DE3B2C716872ABB80ECA09705DF8E5884110E961587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-oob-rtm.xrm-ms
- SHA256 72616fb4f0241b9ea23440f02ed7c97ea736df3d624c4130f20288ab5771b41c
- MD5 239bd09250498f7b68e79d349f498ac1
- SHA1 58f3d2205f4bc633960ee458a47e5668c50d23c1
- SHA512 aa8e5e7494e605706ed3629125d50453e7939db5afde2328dfad71eb92bcf4198ad4750e7887bcad0bcf7c3f4e5bac212de46b5d7a286f0a531f403ca5e84462
- SSDEEP 384:qkf6jCS36jOU4saSmYfciAUFiojjf5lfcL:kCS3OOUmi9Vm
- TLSH T1CA42A6DA9194C8E35CD9E9347DF3B3C726972ABFC4E8E09311CE8E5881420E47259B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-phn-rtm.xrm-ms
- SHA256 f9ae22d5a9da3b0876b203d680afa47f7629b363546d3bdc53ecb7d896df161f
- MD5 013a3ef7849669635a02e5aca50a4e2a
- SHA1 25e1fef35416248b5499c29a217fadd503f104a8
- SHA512 e10af871212548dc6edd1ce0c5fcf8155e84c106574fc924a0bf53eb367af729954321ca6cb314ff0e7865abe3b6fff9ddc6f00928fbfb261f3435532dfda5fc
- SSDEEP 384:/Yf6jCS3XkCNrSDym0ML5u4Sy1I+fc0TkCNrSDym0ML55MjjfWfcD:dCS3XnBWym0IhIWTnBWym0Iop
- TLSH T187925BFDD1849CE35DC5ED247DE3B7876E9B2ABB84E490C310CE9E6881010E5A994B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-3-ul-store-rtm.xrm-ms
- SHA256 709a5d4c25c2ce1f295d37a36b60a4a79a0c997429eb9237b9d0395469dcceb8
- MD5 3a72d63e13e2f50e246a232b592a13be
- SHA1 2515307038b1a33fb1dc1895445daf19f3347f64
- SHA512 43fc5203a4919a7d82da621c5ec50df4ac1125c484f0bfcea31abd196d19a23d5d97e73290c68b3469b46c65410b800e9e6bbca5d4b17993ca667eeffe7e7db8
- SSDEEP 192:/XfqjjTuYuk34b4Smmf2cmndH4lqrBjTXfq7tuMf2cmp:/Xf6jCS3C4SmmfcdhBjjfYdfcp
- TLSH T12422A6ED9194CCE75DC4ED347CE7B38B26972ABFC0E8A05315CE8E5881410E87259BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-pl-rtm.xrm-ms
- SHA256 e0eb930e4233817a6ec7e95bb3cb0e05533b3f71dc64dfe0609477209285beed
- MD5 21d02421ded88b060b16545a28104d10
- SHA1 b96d5e32d42dbe882bd35bb1f047a765afd21137
- SHA512 977f69a38496b59e68eb5d04d80ce416d94efcbab08346961ded18a77a57a9969c58a516684c76959fc77688289b56defdcbb941352bdba097423ee59813016f
- SSDEEP 192:7pDLUtfqjjTuYukF4O/f2cmU9eotqLUHjTejT3LUFBf2cm6q:7pDOf6jCSF4O/fcU9eIq8jKj7gfc6q
- TLSH T15F32C8EED0A4CCA36C85ED347DE3B28756832A7B94ECE46705DF8D1884110E9315879D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-oob-rtm.xrm-ms
- SHA256 833a8ba2010571ebc3ea67984e6acb57d016b1a84027af206c50229d30c48e52
- MD5 d0ba296f0cb4b617a247b8da5e1ecc95
- SHA1 79df60edebb0da1bb63c5e7975f1967f5013f306
- SHA512 fd28500621976091781c29c897db0cae1ef43aaf86c3667769acac20350675e38e59a7260c8260b33d63550cc62d26c2d66cd2a4030df407e3c6b45bdb22092a
- SSDEEP 192:wtkfqjjTuYukWRajTapgRe4sHf2cml9rHi0kUuiEojTXfq2Ef2cmW9z:akf6jCSOajOCe4sHfcl9r6UFEojjfXEL
- TLSH T11E3296EA9094CCE34DD9E8387DF3B38766976ABBC4E8D05315CE8E1881410E87259F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-phn-rtm.xrm-ms
- SHA256 073b68b789dd58d13f40b53c9eb4e33504f6f02a962088815759e42cad88765f
- MD5 deb5b25f5be6efb317a4b735c10ce58b
- SHA1 24c671e89aef6a133652a2554f140de1c0fa96ac
- SHA512 a406e5b37d9dc0f691c3645483f1339a381a7fc4477e8d4d2b78946557ad1b89b0cf2cfded6f8211109f3c0187e5fd8829bed25f9160ba2e7ebc703534f12937
- SSDEEP 384:uYf6jCSxkCNrSDym0ML50e4Sk0xfcZ9TJkCNrSDym0ML5lMjjfkKwcfcA9I:oCSxnBWym0IeD9TJnBWym0IAwVs9I
- TLSH T170924BFD81889CF34DC4ED207DE3B782AE9B2ABBC4E4908314DEDE5881111E5AD94B5D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-4-ul-store-rtm.xrm-ms
- SHA256 f600ffbd088dfd4a52ef409f265959de3cadcd7658c77ffbef198e9c4f52e794
- MD5 77f9d8ca5211e1d75cc25a08f4cfd1e7
- SHA1 818fea07b815b07daff9e9010fc6b4d43f6b4e83
- SHA512 7a11845e25040cddbcb1c20ea013b6ffb541c985b2a7c647cc8ce5475f264ab481220c82dd8e3121edcdcdafb9ba8accfbc7a5d8f5661a9bdac62fcf8ed5983f
- SSDEEP 192:qXfqjjTuYukWRe4S9OTf2cmV99HilvBjTXfqYtbarYf2cmy9+:qXf6jCSOe4SkfcV990BjjfpbVfcy9+
- TLSH T1E62294EE9194CCE35DC9EC387DE3B38716976ABFC4E8A05315CE8E0881510E87259B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-pl-rtm.xrm-ms
- SHA256 1987c93fcaa0a4d49b11495a020a83c3fee50721312648668f62dd5029edaac8
- MD5 76523705647d188a9fd8fe812fe1e926
- SHA1 5d719ef90730adadd093486474b49d5fedf6c5d7
- SHA512 7e3666c4bd20135e7d9c718d1cd7b73133d5090345e566beda281f4dd660d774962ea97d6603b697132ee10bfd5ec3e564252ea615864f42d26b4f328b40cac1
- SSDEEP 192:lEDtDLUtfqjjTuYuk/4Op+IVf2cm8oVqLUHjTejT3LU0je30Wf2cm+:eDtDOf6jCS/4OoIVfc8Eq8jKj7rjjWfr
- TLSH T1FC32D7EAD0A4CCA36CD8ED347DE3B28756872A7F84ECE09705DF8D5885110E871587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-oob-rtm.xrm-ms
- SHA256 4270a9af72893f98e8ce7f35a6e4292c10bc735bd557265d39562e48d5865888
- MD5 19f03214fb42cbbce25109570115a2a8
- SHA1 fbe1433c2624400d8d766af693a06606639942ac
- SHA512 8910a3c47e2241b95c256a03b97ea9076551b6a8cbd868f5b41b3e386fde7eb82803ecb133bc86c804842a59d1da2ddcb27f9e5b0aa3cf1f65eca6b49ae87015
- SSDEEP 192:hkfqjjTuYukMBjTapgX4sdf2cmsHi0kUuiQojTXfqRd9f2cmq:hkf6jCSqjOw4sdfcs6UFQojjfM9fcq
- TLSH T1354295EE9094CCE35CD9EC347DF3B287669766BBC4E8E05315CE8E5881410E432A9B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-phn-rtm.xrm-ms
- SHA256 e5769f63a8394f4af59744396f7c0d41ee211d7048741b79b1540da049e545cb
- MD5 5981d7cb3c4eedcc6667041fdff290ee
- SHA1 e4ad634469583049ec76cc708446b152c24a05d2
- SHA512 fdf7806bc8a919776fffef27b599982637b84084d92e5b37514a5435e0e28fcb8f52bfe337c8f3d4749a877886422381b677ca77aa8de8481b3a9b053b1b8a34
- SSDEEP 384:SYf6jCSHkCNrSDym0ML5u4S6fcBJkCNrSDym0ML5QMjjfWsfcS:sCSHnBWym0IqJnBWym0IfaW
- TLSH T10F925BFDD1889CE74DC4ED247DE3B7426E9B2ABB84E4908304DEDE58C1010E5B994B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-5-ul-store-rtm.xrm-ms
- SHA256 ae2582d5a7ef40ee5aed2f0d04fead8879fd2193bab6e679f595d0edab040e5a
- MD5 28414ae82cf35f058f4375215d624012
- SHA1 9e52c051e1acac948cb1c09cb9c1f920a2415454
- SHA512 b639545cd8460cb6baa588d5029cce5429f426f1b35e78cb6e85e8f003d6ba79a9271804b1933ff8625bc965463b60328c49eaec8846c2eb27af81756235e872
- SSDEEP 192:dnXfqjjTuYukoX4SsruyXrf2cmQHilZBjTXfqAf2cm7b:xXf6jCS64Ssrl7fcQGBjjfDfcP
- TLSH T18B2296FA91948CE35DD9EC247DE3B387669726BFC4E8A05315CE8E1881410E83159BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-pl-rtm.xrm-ms
- SHA256 8ef8ad232934a59760f65b5dcf14c6fc42b23aba16d07f47eee6f2c14d13f960
- MD5 c7c4e7efbf0f835aadf1a1f376a0e63f
- SHA1 1c875fa42d04ec6da76141907549140989a2f9c2
- SHA512 3073b106202023a335ea99e4158a3224abaf44d7774c5224b053bc00dbd8fb0fd0e26edb5a1ed56f2ef6cbd48ec1a9d070bfbe05d3b60c9326288ab7dbbc62ab
- SSDEEP 192:iDLUtfqjjTuYukK4O+d2ef2cmMkhoKfqLUHjTejT3LULzC4f2cmC:iDOf6jCSK4O5efcMkhrfq8jKj7OW4fcC
- TLSH T1D332B7EA90E4CCA35894ED343DE3B2C716872ABF84ECE49705DF8E5880110E97159BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-oob-rtm.xrm-ms
- SHA256 4b8da30d3489ba39d0aff7cd16a9e3530e673d554852690347fa2b0fd3719d2b
- MD5 7406310f5fe2e388e78515a04f09e09c
- SHA1 0a68079f035eb751f56a4737f35c1123fc7ffc47
- SHA512 23047a0aef0e100f1a2c41adf0d66511630cce9ca466c7b8b1308ea5535fb8a81f71d7a44a61ccef5aa97d925ac834fc1932299f1aae4fffb9389a2f359838d3
- SSDEEP 192:PzkfqjjTuYukTlBjTapglX4swf2cmZPHi0kUuibrojTXfq7hhf2cmhJm:Pzkf6jCSpBjOyX4swfcZP6UFbrojjfKP
- TLSH T13F3284EB9094CCE35CD9E9387DF3B387665726BBD4E8E05311CE8E1841410E43259BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-phn-rtm.xrm-ms
- SHA256 d354a3bb374276d22e349482d29086354990cc66be5ce2250f552380fa440315
- MD5 28db8dd70c8a54cc7aa6a8b777b8fe22
- SHA1 91a950cb1bbc78f61e38be1ed9a26df27c28c276
- SHA512 aafa2beb8abddc8be3ffb31a3e9ba83c726e9326d1ea5274e65ebe2fe5322c005b7de77cb8efc329c79e48cfc28bfeea8fdb62a26193161eeb431e65e3692a48
- SSDEEP 384:oYf6jCS+kCNrSDym0ML5sX4SgMfc9fJkCNrSDym0ML52Mjjfmoufc6n:mCS+nBWym0IRBJnBWym0IZKF
- TLSH T138925CFE81889CE74DC4ED247DE3B7876E9B26BB85E8908304DFDE5881010E6B954B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-6-ul-store-rtm.xrm-ms
- SHA256 4e96644703c9bcb8805809607dda0418dca2b1b4f87e50fa5fe8baf0d5e27b66
- MD5 9e9bf30a2d6132022e7c8bd685e3b777
- SHA1 1c3409de7ffb54d23a7228aa98fa924f10a635af
- SHA512 5cf52c13f99a71f7d7d3279d7b82c6ae2c61dd8cc9f08215f772349c1cd77411065305b768f2e2b6410af18f6c46cd6d26f39c7eba694520616588c9873c5637
- SSDEEP 192:UXfqjjTuYuk5lX4S8Of2cmp9HiloBjTXfqM6f2cm0r:UXf6jCS3X4S8Ofcp9XBjjf8fc0r
- TLSH T17E2295EE9194CCE35DD9ED387DE3B38726972ABFC4E8A05315CE8E1841410E43159B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-pl-rtm.xrm-ms
- SHA256 a808241447cc9e81dc0e398be88814ed7e71043b0ec9ff3e777fdda5490fda1c
- MD5 c0cd5bfa94bbe2641059a8f336bf6eb5
- SHA1 a1795d6675813fcb44514ac1947b53153b2a677d
- SHA512 f462e23edba554bb11b83124acdb410f806941af7feeba764add1c3a7beaa29cf4b03310f51a84af52038d034b0f9cc8b06d0e498ba39e8c51cc5a705fafa0d0
- SSDEEP 192:MDLUtfqjjTuYukA4Ovtf2cmAoZqLUHjTejT3LUVLDBf2cmw9:MDOf6jCSA4OvtfcA8q8jKj7yfBfcw9
- TLSH T1AD32D8EAD0E4CCE36C99ED343DF3B28716836A7B80E8E49701DF8E5884110E961597AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-oob-rtm.xrm-ms
- SHA256 7f3f11a6e78d98c55a70df796a378cf13f4632648badd1b7773d9f5dfa88ea26
- MD5 53799abf950baba3c9f0504534538219
- SHA1 3c4d26f91d6b0aabaaae52df7ac684d74a5b1031
- SHA512 3d20e2ac8a0c414814dd6495a8e3970a082c7c1886f8b5546d093d6cdc2ea5fb521ca95d9b097f489becc605fcbc340ebb8d4df71e2f69b9db7ec9fa3e506158
- SSDEEP 192:EkfqjjTuYukdRjTapgH4scujf2cmmHi0kUui+ojTXfq+f2cmF:Ekf6jCS/jOs4scujfcm6UF+ojjf1fcF
- TLSH T1444285EE9094CCE35CD9E9247DF3B38726975ABFD4E8E05315CE8E1881420E43259BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-phn-rtm.xrm-ms
- SHA256 d93d0078f9752174434569a94a0eb3f9f977a1df8e7c9a4e414ee7172954b01f
- MD5 6556b2bd895fb9546527bfbea4ca68dd
- SHA1 3a2d89b08bfe8692af31abf8d5a16ed5194ca3f5
- SHA512 9c5b3484ee8d0a13c5e94280cd5fbc281819195d6f53261d4eb0e2d80a8244dadd47908fa178d1a3caca982cda5f6cf4495815c6937d7e0c7e74c80759c00636
- SSDEEP 384:zYf6jCSYkCNrSDym0ML524SVfc+JkCNrSDym0ML5vMjjflFfcL:BCSYnBWym0I6JnBWym0I2U
- TLSH T13F925CFD81889CE75DC5ED247DE3B7836E9B2ABB84E8908314CEDE58C1014E5A940B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-7-ul-store-rtm.xrm-ms
- SHA256 e1542ebdb4985e6c60da493a8d51817044f63ad59165c334e9384da1ddce07d9
- MD5 95827f10161862f09728bef9dc60e2ff
- SHA1 890a8455ab9d5336a8505891df85727599b5316b
- SHA512 e3e0d30563736675be90eafe880fb26392c75d46f997d197abe9ddf3082da998092db142311a90060e71d78c1c9d25f923c45043c06cbf6fbbcc5dec77779e28
- SSDEEP 192:IXfqjjTuYukvH4ShKVYf2cmCHilHBjTXfqNiYCL4Lf2cmM:IXf6jCSP4SQ6fcC0BjjfE7CsLfcM
- TLSH T17822D9EE9194CCE35CD8EC287DE7B38716972A7FC0E8E04315CE8E1881510E83259BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-pl-rtm.xrm-ms
- SHA256 6174fef3c4ddc5f2cbe2a8b933d9b14bf3de51790828294833fa372d3ad0d5fa
- MD5 0b54fa61185e9891813b3199036df23f
- SHA1 1b11993ad83f7d2e73e143a9f6ed429ae9d343a1
- SHA512 9b80a3eaf98c5ed9cae1ccb302998113618e291e36b44277895e3657861e163dc54971d2573b3fef7540b7ee2aec2aa1747dcd97b2a0057623b38812cf7722e5
- SSDEEP 192:WDLUtfqjjTuYuk74OT4Kf2cmaoLqLUHjTejT3LUIc0huf2cmK:WDOf6jCS74OxfcaWq8jKj7bhufcK
- TLSH T11632C8EED0E4CCA36D84E9347DE3B28716972ABF80ECE49705DF8E5884110E971587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-oob-rtm.xrm-ms
- SHA256 51b88b1fba818a2297eaaeff7ee86d768a1ea1191576e24cb0318151622f865c
- MD5 a9eaf80c1a4071bf3d7f21a8a76b864c
- SHA1 b9e246e67bf51343c0f8b25c8c48b43b085db43e
- SHA512 dfb9c64efbbe8fbbaf81912b811b016343ad72d3a475b5894bcc915dfc9c5d02bfb75e8c210cad23bc9197c4740b08e68df47b96a3e0d79538b98d3cc45368a2
- SSDEEP 192:9kfqjjTuYukAhjTapg34skT1f2cmV/Hi0kUui3RojTXfq9oef2cmS:9kf6jCSKjOE4skJfcV/6UF3Rojjfqoen
- TLSH T1DC42A6EE9094CCE35CD9E9347DF3B38626972ABBD4E8D05315CE8E2881420E43259F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-phn-rtm.xrm-ms
- SHA256 0927198f3ebba4b342e502f573f02c8341c1a1072439ec93700f0f7cccddcb8d
- MD5 aadc83464b734dbcb36787e2e299033f
- SHA1 da90f04d114cb4ce77fb000297645e34d9aab46c
- SHA512 1261fb321b5b32105a748e790c346143c4bae79fabfb14d6bedfea49febae0a97dd745d33e7536ea0d221d464a741447383e2972d97224ac20663677a74b734a
- SSDEEP 384:ktYf6jCSbkCNrSDym0ML5a4SWzkfcBJkCNrSDym0ML5IMjjfLs1Zfci:QCSbnBWym0IFztJnBWym0IPc1f
- TLSH T163924BFDD1849CE74DC4ED20BDE3B7825E9B2AB784E8908304CEDE6881024E5A954B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-8-ul-store-rtm.xrm-ms
- SHA256 fecdc39ccdbce556ea4b906cfb1e2d33f3cd26d18ceb60572f8b3341e0f2f3c3
- MD5 56226b422be0dc78efa9214cb9090230
- SHA1 3b43a9d4630c5cbc9119aeb464ab43d92507adf4
- SHA512 8f82febeb668c0064f1ab7b9a89138d21b657be48e9c389ab875d2250975d4615aa95dc71d4c822ebdbabb4e181cce4bf622183068f6f2f3798b28c63306ba90
- SSDEEP 192:UXfqjjTuYukk34SMf2cmFHilkBjTXfqw6f2cmo:UXf6jCSC4SMfcFLBjjfGfco
- TLSH T10E22A5EE91A4CCE359D4E934BDE3B38726972ABFC4E8A05315CE8E1841410E47259F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-pl-rtm.xrm-ms
- SHA256 1678e938003421a2b5022a56d5a8f2cd013d01f044267eb2b5735f4d3bc7678b
- MD5 139ae2c45782e3f8e765dd0672fb0300
- SHA1 1150bb8f92eb21e88a2b9635c7736e226d4e228a
- SHA512 12ca3198457df51096fd192684b9508354f5721d18fec6bd8fdd30ab67771f896b347701c453a144a01cfe541584aeb608eeec12c658205d5c73822d7d8b84bd
- SSDEEP 192:MDLUtfqjjTuYukB4OpxPf2cmiy9otqLUHjTejT3LUKXQf2cmw:MDOf6jCSB4Op1fcvoq8jKj7ngfcw
- TLSH T10532D7EAD0E4CCA36CD8E9347DE7B28716872A7F84ECE09705DF8E5884110E871587AD
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-oob-rtm.xrm-ms
- SHA256 bbe49b2e5a38ae359bec6e94e8a9a03c8b2065a4f3f5872f0684637950411047
- MD5 14a13b57a4c1c1cb198caf3f5c5ac7e2
- SHA1 b08fb58718a7c22f9289334d5f064c486e6cc5af
- SHA512 5fc85985f4a64095c7b0d71f624e524461a76b0f4a20a3b0638479dc62375f19569d42830cbc044bebf743aee0580b371fde1a2384ff923fd508a669218e2c55
- SSDEEP 192:BkfqjjTuYukqTy1jTapgTyj4sOAHLif2cmXyXHi0kUuiXojTXfq0Q7df2cmDyK:Bkf6jCStjOD4sxHLifcE6UFXojjfqfcH
- TLSH T1D042A6EB9094CCE35CD9E8347DF3B387269B6ABB84E8E05315CE8E5841420E47259F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-phn-rtm.xrm-ms
- SHA256 b11185bf5e8aa801fc8193c17883997246fb9169d0fab02921ccad76e61c760f
- MD5 98aec571a728d9575cded34ccc619273
- SHA1 5388778c1c64f9724c8633b16b93e33121622299
- SHA512 b2646cdfd1762ba32e18fcb12924047f8cf79f67cc72103bb42077d077a0877759d2c34543a8703cd886f777581e53b3dea15f19d82719f67476b88d901f268d
- SSDEEP 384:7Yf6jCSFkCNrSDym0ML5l4S1rgCYfctJkCNrSDym0ML5HMjjfJfcw:JCSFnBWym0IBr5JnBWym0Ial
- TLSH T14B925CFDD1C48CE74DC4ED247DE3B7836E9B2ABB84E8908314CEDE5881114E5A954B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-Volume-CSVLK-9-ul-store-rtm.xrm-ms
- SHA256 d72f07ac356b39593996d4c4e234ae97c3d0f5a0a7f91b460597696bb8376c2b
- MD5 0a1ea37b09a09544b2b5df6c3fc7bbf6
- SHA1 50ffea63745879450e34371bda9f001c254e7311
- SHA512 32be535912ad6d84b9e1eea1c93613ef0f15a1bba503eb7f9294cc21c5340c5bedbb3249bc45de99052c50abe5d99b7e0c4ee25ffeb3ddc1a5e2927538d63fe6
- SSDEEP 192:1XfqjjTuYukiTyj4SwcWr9f2cmnyKHil/BjTXfqjf2cmTy/:1Xf6jCSz4S9EfcVkBjjfsfcC
- TLSH T1D422A6EE9194CCF35CC9ED247DE3B387269769BFC0E8A04315DE8E1841510E87269B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/spp/tokens/skus/csvlk-pack/csvlk-pack-ppdlic.xrm-ms
- SHA256 75f245c51650511851789dfcb6232a110c6e9e5147a2676e2866e91b77d80b62
- MD5 d47e47f50e762920e5c2baf3b237916f
- SHA1 d427616f97c4e0dafe497922d939afa982583743
- SHA512 1a7c22fcfe3f2a2d131bc225c939a702f31b0457a6cb082a5bca282798d4e021a7d7748d5996c84dbfac2b4a4395ffdd54992842ec9bef247035a86101c4f7ac
- SSDEEP 96:Dwm30T3i3TYMonwoFQn59z+lCji1jiDjiKmwJvZv0jpsgXVDWyGvwSN5J69cY3pg:l0roTvonw0Q59z+lCji1jiDjifwJvZvT
- TLSH T19BC1645C6198E9B2AC45B990DFB2B3904287FAFBFCF4B0513688E77004E609C55E479B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/sppcomapi.dll.mun
- SHA256 52ba57020e1ac1b70f71d7096eed90a8d67d169e1049f3927027d73889877c56
- MD5 3ef1d2c57ccaf7256f23ff39b67ce520
- SHA1 2719144910fc173d927cb3bfd4ef1d1af176454f
- SHA512 dd3f5cdf372c7d86ecaf87e54a533e37160c5638c2ac2fc763652c2fa0421eb92b4af76bea55c72bc58d5c4b15136fa35de69904b1cff5e9538210fa25f6db81
- SSDEEP 1536:k9gxxFO2Nx0ik0yQW5GkhuRgpdv/iSBqOjvrdbtQbwts:k9WxFO+lk0yQW5Gk0GH/qO7rpKC
- TLSH T1A5A3E1913AA2F1A1D5ED4472CC8BC2DD063B7C89AC01275B7635BBAF7D77060A121B38
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sppui/phone.inf
- SHA256 b71d288e2eb03b3a4cf0291261cfb8b07901649291f974896bfec3c01317d524
- MD5 c58455032ffb5cbb2302a0e42a953c63
- SHA1 2162c75ced87716ecc323ddb9d712f2e2de7f1e1
- SHA512 c20c0fd9507a870ab6e977d8fb58ed5c408423944e72ab767aad3487d43b60c719de437df89103256c5bf9cefc34a1f5faa59e01f41f118c131c17a7a5da7728
- SSDEEP 384:GDlquTaCyI8OEuxwG/GdPT52bEiECnsN8B6HCktQ9EJK+GdJ:XcabIDEqw8wT59isqrqQ9EJIJ
- TLSH T17BB2C7EBB6DCBC7B6C8BD12D5A13BD218B6819E414841572734C8F943B3F76066E9E20
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/sr-Latn-RS/SyncRes.dll.mui
- SHA256 e5f25ad871150153f8bdc0277e760300329550f7f9b88c7d1e1bce02b45b35ca
- MD5 3e143d5938ac0a2cd45a153b92c83db8
- SHA1 762699dac1db7cac86ccb0ab3ec3399336d2183d
- SHA512 5ff50f88031d8d8111e9bb0aabd006a347f6448e570ad3547cf90b62c87a7db3583633e6937d9f10c9853ac749495be48026d6100e16c2fb401c2b98a843f1a9
- SSDEEP 768:6h76HgcKfb/9LMJi76Hhxhxwv0uPYaPiqx3BgxxsYm4us12VM2Nw0:6djFh3B8Viu0
- TLSH T177D29E52A3FD1659F6FBBF75997916650B3B7CB3FA38820E114002991D30AC19AB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sr-Latn-RS/comctl32.dll.mui
- SHA256 7bc9c114b7b7d5c2969396c002a1d0a04da144fa140aaef432724c7136f3eb6f
- MD5 7af6a424058357c2189720b66d5cccd5
- SHA1 737c2490ee58a6a264166c2fa6645ffed1042e96
- SHA512 52e9956ba49eca8ee1aeeebca1c6696ffbd58698f9b6dcdc832219e223c8b7a00117801cd7e1e69c7bdd1e1b37da0ab98d06531362e59fef71aa8830fb515830
- SSDEEP 48:yw54pZitDtew5tMaV1F7J36kBzpspBM9KX+TySH4uPU2bTvW/GRs0Dpl4mgvKA09:BrD5tvnBpspnHAOtG7SyAdWBAJtWw36
- TLSH T194C1A706D3FA1926F0FB4F785AB64B511B7BFC526B36832F8A40145D2875284DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sr-Latn-RS/quickassist.exe.mui
- SHA256 0d86d32e8e6c469ad746570a417b0d96daf59fd0aa28621e1d068c2889305e25
- MD5 2c6658e6a9e4299b049f559ad174ce06
- SHA1 f4a831e86d03ce2e3d72865ff67a5bc7a6e500eb
- SHA512 c68673e299bf36ae8eeb3e7c39bcf8eb8bb387698d3211b941dadc5c404c67c2961024ce8a8553a6c2bbab46674718d3dbb906ff058afbce5e75d2abf63cca2e
- TLSH T175816942A3FA025AF5F71F7096F606A14E7F7C63BA76A22E8A40105D1870651CAE0F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sr-Latn-RS/windows.ui.xaml.dll.mui
- SHA256 f3c9feb485114dc439201545486a710641a5d62a6efdce2e0f066b29a4ac15f9
- MD5 691dfed0a4f52923e451d54d798e96da
- SHA1 55c50962b0daea47b5dc7a9f53f3116bc69984f3
- SHA512 c1d49911f0fbc16187292f1e815e74cb47b4987b1edefd2190beeb9d64d870e9ba9fb812b7619951b931170f463dfd6998ad72ce408b0698b7fd3b776bd1def0
- SSDEEP 384:C66klB+dJzU3KecSZkeVuny0+rZ0OeqM+iHWHuMXWAt:CmlB+dJz6KbSZkeVunEAHQ9t
- TLSH T150823542A7FD2555F1F75F78AABA13A44A7BBCA37A35C22E0140204E1DB26C4DDA0773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/srchadmin.dll.mun
- SHA256 b34723a5b43b6371c35998c7c6994959ce46d1d05009b905c7ba770c4f7f9912
- MD5 db8347723d1fc10e427fd0ce75c516a6
- SHA1 6b32a6fdafb70f2bcbf8a8676509fadb616467ec
- SHA512 e70325d763306dbc70278f139d8776d0af67e1f99ae734ab319c16e626a05f81b498044ca2b29519531e87cdc35c45f589ef4f78a2c1aee4fbe741a5fb4d1534
- SSDEEP 3072:HT1ihk6kvtfGq0ev3U5WNbJ0RF+L77VCyw:HWrkR10efUKV0P+L7ZCy
- TLSH T197F3D09277509942DD2E4A36ED878F76083C7C91D61C333E3290BF1F3A3A21399596E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
163KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/stobject.dll.mun
- SHA256 d25331841ffd1f839ac9d6738d2ea471947c2191ba8c9c8c1caef8dffd4cb367
- MD5 5144277f1b78982d0ac70651cf1930c9
- SHA1 34a4297f54fe5c24ceae737d37b5fa148853e706
- SHA512 ae5e8fa4b67d02129c8ded0b0b4ff20097e94480248a7dbfac3373676690ea002163797a5837603b7d957472914366a6a56b4045356eb3b96b96483fbdf38d0c
- SSDEEP 384:3iskvhnSn0WjWFjWz9m9Fwf2pU2ftpUEZpUy01RMWH+ffssssssssssssTsssssD:yVvhDNfdWH+GWuMhnFfLgS3cr3Pfsfr
- TLSH T139D36A17F212C804CC8D84358E6FC9E81821FC42DCA1AE2777D87B5F6F76A19BA1265D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sud.dll.mun
- SHA256 75bd16181137bc45961433b8265fc15cef3d3b8c29c97ccfcdc9e802d7cb9cfc
- MD5 221fe5c304ac751ab62d8f17600be812
- SHA1 974f73df24f0b9893213c19e6065b3aa3127a164
- SHA512 a9f1e29d5662719453df78eafbc4ce34d2aad91d7114edc761d5ca339421e9744c251583d35f2af8e53e5fa13a274411a9b80818660302c69c42b0e7e5659425
- SSDEEP 6144:+7KOVgUEevr7KOVg58+dOhRFQ9Vt4mvCMIBSUNtXXkX:kKJUEevKJ58+dO3FQ9taMIBSsXU
- TLSH T1C3B47C84A2C19CA8C33E7334E4369F9555A57C71C8C53A3A9367B26F3871A83709E71E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
492KB
Virtual Size
491KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/APHostRes.dll.mui
- SHA256 2590679b7417da2c42df4509befbadc3184223215fb49cf551c350a81ce7565c
- MD5 db838286ae72931e9d0fe0918de69ddb
- SHA1 65f20f0ceeaec7df0fb71d6c1918789758eb44fb
- SHA512 741407b416dc9508f3b5ec75d14c4ef2c02d65d58663fca6790c3e9ee1c55547942656bf21ddf7ca297cafe6cc15cebb56f32cb1d9b2a19b46f0cc2c2bef4e5d
- SSDEEP 192:NgjLUjr3fLis1KQk7xjUnt7xcQkL/c1Uy/8OJQr1mPcfjFj7lVtilwrR57tVWyRk:NfGs+h3WyC
- TLSH T14162025257E85518F8F79F3569B202A45F79BCD4AC7ED10C1680A2AE2CB1A80DDB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/SyncRes.dll.mui
- SHA256 5b9a6875d8b6346aa1e2818e0710f38e55e43b9cc4912286c3ddca3bc61c739c
- MD5 5c3ccb6b71a8cd555ec99a0d170167a5
- SHA1 0bf663497f72d68bfa26f9aa24fb3db6c9f30355
- SHA512 32b26cbf1b361b144c411841e7b819bd61f9f9ac234b5e6b8ad4376f12af9286f9c547a122f609772de20579848ee2ebd16c05f394090a631ceb77fdd906a186
- SSDEEP 384:8n7npFTwbHCFEGK7dJ03Ho8cCTNkKxUDNPgT7GM6JDtWBJ:8z4wLxfNJ
- TLSH T11ED21C5263FD5618F9F79FB07CB90620497ABCE2AD7DE21C071055AC0830AD5A9B4B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/cdosys.dll.mui
- SHA256 96d4c5083915a6aee900a4d666decda0b197b09bc99079a4119e51d497e37be5
- MD5 f455234fb9734b14a235ef6101aca580
- SHA1 8cec902b45cb7eef204ec4c6b7c0db45eedc581e
- SHA512 6af98ea14e8f73a40d8aa4b541bf0b476d362b86f11dd9113c4dc820d3416eff083e632adf4d5bd8abab9ae627350893800ab9bf8c62759202c6fa079dd06e22
- SSDEEP 768:/YVpAw4J6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfo0k54e8BVYhIAAInm+:/YLAw4J6ivyUcEsx7fNXjTV8PszW7yYh
- TLSH T17A23AC1293FE4608F1F77B3969B616B51E36BC92E93CD26C02A0915D1CB2F858C61B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/comctl32.dll.mui
- SHA256 218a0edde4f1f1fcd956e99193698da7a5fbf279ac3809f925e05d61d0d0cbe8
- MD5 7526853e8e9f95230001ef6fdfa8f243
- SHA1 aff49701adae350a8c5637dee0803fefd13d1788
- SHA512 f03179db9b08e4992f0bc437ce15fac992970efb71f78b857b37d33f2261dbcc2f6407e8ed631868d19ec53906252632435c260e3ad135c46971cc3df41ba346
- SSDEEP 96:N088hKcRr+7psp8qJjUaKdypxGz+qQWy5Xo:EhKcRr+tqJEIzTWwXo
- TLSH T18EC19B1497EA492AF0F74B7079B6078116BAFC527BBAD30F8F40515C6872648ADA0F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/quickassist.exe.mui
- SHA256 1de95c5ff57b21e12c3e38057ea376e72bbcb9287fd3f80d723a2aa4cea5a7c9
- MD5 37250373d38ef2bb86ee96f9cc265075
- SHA1 fcb41b5ab23f59b1b960345affb2aa5e55c23a4b
- SHA512 0498ea65f813e983dad99884af34a9252014c6c4fd86805769eb58ace4732bfd2f9ae3c1c6bf0df4bba675ab0496c211664947a0e799aee89b7acf8570c2b76f
- TLSH T11881D34557EA022AF4B64F70AAF606D15ABE7C5379B7E32F8F00016C187065899B0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sv-SE/windows.ui.xaml.dll.mui
- SHA256 77e7244fcbc4be7a10032e5c953726ae4706accd3c5a1db20b2d53463f3873f8
- MD5 0dfd0a215a147c264d689a339a25ff5e
- SHA1 8583731205f6414452e250cc541c03557db63303
- SHA512 abd5f3888862268fdf4f9e7eba1de4f8ecb076233c90c70dbff4126292f56c06147ce46b2fb433f3df8b62327bfe7215a0c959ba73d23f7f9d1715d641d29742
- SSDEEP 384:mz0qkRXxoVCHYj+4fLBM2DFp3/zZfVYPvHuM8WN3:Qh4HYBVLIB3
- TLSH T114726441B7E8252DF2F38F743EF516900A7ABCA36E7AD20E0640615D1CB17858DA0BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sysdm.cpl.mun
- SHA256 9093328f7de8704f13bfc46e3db318d482575f34553e6e020dc44ddbcc5a0092
- MD5 cedcc91685cfa40013e38f41fcc0a60a
- SHA1 6f344b64cdcdb1d6bb689fc611ea8bf6e65816a2
- SHA512 b0271790dc66df1d616e0fac7daaca7f04533b1a08c70bdde8d42a7e9a8383df556b38a104af31bba9fe13c759eeab1bfd48110460c9306923f97fb135da3cad
- SSDEEP 3072:VtRzECTMpuDhjRVJGosms600+17bgYzUqyoOxev5jbvhRxWNwkrxj:h3KuljRzGodSZ7bgdqyERWNZN
- TLSH T15F14E083B6C0E297D54C0631C417CEF70D63BC59EA90266762847ADFFCB6381723A56A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
198KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/sysmon.ocx.mun
- SHA256 304c244e19544de028a1f3183566fbb5c981e61b8b0d20068362a3d37647f4b1
- MD5 31ff6cad478520af8b1aa8b7f6dc7768
- SHA1 e18fbc9ce057379a41dba80e0981e1269fad8a6d
- SHA512 14cc7d8c8c5b276711c1b06c26d81abe275c089419d4689fedd885c40e06b5a53c945179b91a4f2dae2701c4e03eb3c6b8ae40bce6f66e6d557b4d28c38fa276
- SSDEEP 768:kWwv/54OjuMhZ1oJc1W8d94bJy7THKPdpU/bcMqTSSCqNbh5P8k2Lfi//:SvLaMDw8dKQnHCUizCqfV8Lf4
- TLSH T137A3D4231794C95AE0AE25348C5F8E908920BC33AF11AABB6295FD0E9DF56C47D3731D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/systemcpl.dll.mun
- SHA256 7515126f62e85ebf27e514d73fad3e08eef612d766d4e6bb753963086124e487
- MD5 40e615c3bb236712d2e8659ac6031227
- SHA1 34630e3f7ad482507b29f3d9ad517751d7539c75
- SHA512 c32ef4130d2eb3107b0b49034d4928bec5e2faa7b5eb5fabd0eb4ffb4f7897929a804810c1662381b558575906196288c70967063f750c9a5b48aed933b584b3
- SSDEEP 384:ewAPMWnTW29r+JotLl7tJezhX/qJPCPr+:eRPNWweluw+
- TLSH T19792DD1061532C5AC33FB272F353BF8BA194AC01C60718B5A5AB21DF46B9D65F4E932E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tapiui.dll.mun
- SHA256 920dd92e0958ea9f124cfd094a4c5aa2c19dec488f9626d252bad19694cc7837
- MD5 4dd19379d79dabbff47b1c6fb7910e75
- SHA1 1117d6bf739f887151b54d08d42dfc5751cfa691
- SHA512 d415cd7c95823e011575e1bee014353c3b79d4453b1c14bad2c52539c43fedff3744ce0504902dc4c017ae5d5533773ef8a355c2bd0ba2a506f71f1503ce1bf9
- SSDEEP 1536:b+dXhXFKAwpvOgDPG3726ylE04TaiM+HS9IlyxLKjGM0+3Uonyxm:YVFKAwJOp3ilr4Hy9IlEKjGMz3dnyxm
- TLSH T11AB3E00FFB72A155E55C4172CC63987B3A11AC5089A1122B7AA97F4F3CB0311BE26F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/th-TH/SyncRes.dll.mui
- SHA256 7f9e3a14fc786366cd5e354e2aaa9d8bbcd2f02552a75b482c448fb1755d1213
- MD5 b35adad82fdd78af6cb6a0bb8735f4e9
- SHA1 a4abebcba93215f92ee2f3eebcfa409fc3a503d0
- SHA512 080dab1549623ed039a4d0f340162c1eb259ae0b7904af1eb70559d3d609a2080c729a7ab5ad28b7f5682a580fadeae79cb38ff3363eb15e67d40441c060bd44
- SSDEEP 192:LtdX1Nti/GoZK6oFCZq35kUnir35qhnyVKI+Tl8quaoisKkeXAECsYFuZ7TH6W16:5dHtiXw35kx3g54volz9yKYFuZTaW16
- TLSH T19AC28870D6721712D246A4F0D2D54F727D28B822E85BD246C52BDF28A2509BBF7B8C7C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/th-TH/comctl32.dll.mui
- SHA256 12b5c84b632e71ac927a3d2ff87d209f2247715c67861f1ba5361a059ac09ddb
- MD5 bc2d75eb91aa560acc04dc9f1942346e
- SHA1 586a369dce1b3127b75672d98a4c6eb48b6b0636
- SHA512 517a73bcce7610c37510eea50892244e73126c533706e220aa193201e96fafb6255ec4acf3b79ff5932616ca1cd57a7a379f639dbfdb462621a2e2f251bb2053
- SSDEEP 48:yV35stdy9wkMdo+SQmj7QRlDo8CKWpppmCgK6e8hLSUYoMqnPf2Ri+vZWQlAjwkH:YckMbPolJpppxgYKLW9hWJQ8
- TLSH T1A7C11D35F7F3A722D09A82F0C5EB4B617F3AF81187168707C565FA2C6524260BDA1E26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/th-TH/quickassist.exe.mui
- SHA256 d95e555b66cab8a989746eb6d5d87c45e175d26cb729660c1821c053ed8811e1
- MD5 deab5738975a444395345ec6ac3d1eef
- SHA1 fe0e6ae95e25d5b9dcacf9812b5fe4f1d89e5bbf
- SHA512 9fd003d5892cf28565dd372f00314f5423c3ce174d1e007b41d99ab714e3edb7c3231d998b34e7815af8584a5301788adb3282ae572ca406ce1df94d43802e47
- TLSH T18A817B199AB75313F05A4AF0D6D20EE23D7C6C13F467A22FCF19C518246013999F1EB5
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/th-TH/windows.ui.xaml.dll.mui
- SHA256 36b4976ba5655e8e8e551a0ccc55be94dec3874cfc433e9a3a109966d04c5343
- MD5 c83f2bbff1e63bbe8efab7c0cfeaca9a
- SHA1 7d02a9db77dd204cac2b5162acc13882ee3ba9b0
- SHA512 dc12ecb79760eaad9cc56f5318ce3af2befde45cfa3f68a569929459a4f956f864beb79bf4d9f0ee264fb4a5da195abfb6a7736eeceb01803eb764eecce9a121
- SSDEEP 384:pBrf8Li1hZcXcoB/DMF+4CTjKeHuMlWsu:pBrfz6XcoB/DfTjFXu
- TLSH T1AC72EE76B2F72311E0BBC6F0D3F647B27E35F952C805C219402BD5186960675AEB0A7E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/themecpl.dll.mun
- SHA256 a611ed78aefdc6a2fc954ecd29ec67c4d5f7f00253b7bb15687db0978a4914d5
- MD5 aaf55313db9f00fb4da4328fb7579006
- SHA1 86a26281ebdaf074dfd0bf68e7f364811c1a5ffd
- SHA512 0433da6b97bb540cb1492e78a93dfd6aa08d0d5fe1eebf84efe81ae0d0de13656a4f55662fb70012317150be3d1b162f328f84762dd4e55bdb9f34d9a637c8de
- SSDEEP 12288:L8CRDJl12XI4xhA2102XzBnaO6Q9GAhk:L84l4XTl1DXV6Q9GAh
- TLSH T165A4E11472196C69C33B6131F612FB0EE0D4FC60CA4629B1B5E3319F1AB9E66B0FD15A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
438KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/themeui.dll.mun
- SHA256 bb45231241fd02bb711d4099ded4c5737209922fabb680200951f9b3d7c4a753
- MD5 73e407850003135fb1f2da9117a5f973
- SHA1 20580f7854404039e12209187117c7877484a23b
- SHA512 4d392c932505322339bf455b3e03c4cbd21144adaba1fc12a7e4a79990c01cbfeb8e9a6e2bebfd91a936485797632cf06960115255c5a7f3e74ce07bf793acfd
- SSDEEP 49152:sja7Wzp73WuRuY1jZDWuZuY1jZDWuRuY1jZ0cgq:sja7o3WuRuY1jZDWuZuY1jZDWuRuY1jR
- TLSH T13EC584B8AE0CC555C915063CDC48D9F5205A5DB1EA13E0A3E6DFFE3FF074BA098499A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/timedate.cpl.mun
- SHA256 c1ce0acd6b8a4e65d6f604e8d6dfbbd44dc86f939370e85853003288388bf713
- MD5 847b8983e00bd0fa991201a74f290f6d
- SHA1 782bb9c6857b091c440c4302b83ced2b1edd69d6
- SHA512 59224040ce65a6119fbb78ab2586a4a7aeabaf2740fc3f140260036acaf3aa8470c482a8b35515cf1d083e87251b61958f60a9b72655fb3932b1e4726ea7a6e2
- SSDEEP 6144:PVfRg6KH0KXMDVCw1jgVHTsbwc1ohTv69DVCw1jg:PVfRg6/KXOCwiRsbwmokCwi
- TLSH T1D754F28226E51559E0BF0B71E5B7C7301420BC25A717E45F75ABB2EE2738900BAF3725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tquery.dll.mun
- SHA256 da0ece70df8230d6c29de6479052ddf50488320612b9d919feb8acb6c14c479a
- MD5 7819c76feb53248b0b38c1e1d426a87a
- SHA1 83ff1303bebd7d4411dfb4ec4ae42fd8454afc8b
- SHA512 036650ffd2e40394460af696df8a7a793a0e78e114bc624c59bd48e263932c0cc8ab0bfd4fe118db6e5dd8e1a3d2dc987d500b8d0b101c5cc5744ea4ce2da97a
- SSDEEP 3072:CcU1tCSBcr+/Qj9NaoUAWuUcmccvDijHjm0cxcY9:nU1uOj
- TLSH T101C300235BEA9805F9F31F313A7946752322BC625D6CC51E61C8421C4AF2698EEB47F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/APHostRes.dll.mui
- SHA256 ac361dca0721eb6f772df3a2aede3140ef527138215e9d1b50e51e5cc16b7759
- MD5 b2de992440c9222931834de61c2d5363
- SHA1 f5ab18066ba1667bc9b0d63b81f4cb9154215075
- SHA512 95f218226ae7b392235e5bb07d17d6a228902285f89b18cab2ae27faf335ca6f6ff2330b4dad2988d3a9034fadaeef0fc861b2afebffc5e238d2221ca20d0b9b
- SSDEEP 384:5Xm7sfo0j70EU26p7g5MGJo0s12znv0wbwx79hgLWKgW5:5Xisfo0j7fU26p7gGG20s1AvZbwl9hgR
- TLSH T1BF62020553EA141AFDF31B36BDB252601FB57CB6BA3AD11F3A91A06D1CB05909C14BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/SyncRes.dll.mui
- SHA256 d856e1e046514444e137f20bf7dc975dc3f578b5dd94c5582853834fa3c87ea0
- MD5 72b6d9962163370927e3d2d3e9a4fb54
- SHA1 01e918b229b17baa0740e388390cde55d7745ee2
- SHA512 73247d0e3123e1e02c5c9003a5f8f3479dae7febf53235f8d01e6579403e76257a6efba4e13551682bef9dfb4f959bc4f1684aa796851cc65fae81496e920228
- SSDEEP 384:sgvIku5QLr9pLE1a+GaiWi4HVHVqqKTj8lNq0ajLHm0UZD9rxtajfTuX/5WheWz:nIkumr9pLR+GatvKTgeS0UTrDajfS0z
- TLSH T159C2F04153ED5A16FAF36F712CBA52A20FA77DB6BD38C21E125121591C70BA09A34F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/cdosys.dll.mui
- SHA256 a42e2c01bc96d72e2107e9c962428c2dad5858d885441613211065a142e2b602
- MD5 6836bb345d18be941e8c03cb2fa8048e
- SHA1 f768e00c96427eccf78c8350f1550f899a336217
- SHA512 1414909436f4e00884a3d01eb6fbd87db2a19e6638f71d9f3dd222f9d114465c88403de69a7e6d71eecb9151961abe27140be85af5ba66824cd7a7b0a21cdb01
- SSDEEP 768:lkmJ88UJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfp+HEufmX+1gVhPLrCM:lkmKzJ6ivyUcEsx7fNXjTV8PszW7yYsb
- TLSH T14623BD1293FE4609F1F37B3968B611B61F76BC92B93CD29D12A0915D1CB2E918C60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/comctl32.dll.mui
- SHA256 04478d3ac46af97f0c0b642b32b5ff8c07e01c5f1b26123189b1f8aa57b43165
- MD5 58372d170abd4db43d8424cafccd8e64
- SHA1 7f9b7439b64d9382b3c168d260c5b1b88590ad89
- SHA512 b5f6982ea275e03b2de96b25b9fed502c4f8055bb3bde10fed197ac2db47aba886b2fd69c6dfdd9bc8bd9b67772a7bb68ec192f06b8c6618770f13564fac319c
- SSDEEP 96:NnkU/okSoaLJspspyODzBBkIl0NJfyWCGWwv:aJ/oaLwOX/L2IWCGWI
- TLSH T157C1A80697EA491BF1F75B786AF68A911FBABC63B736931F8B00241D24712849D50F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/quickassist.exe.mui
- SHA256 8da5a932a8d140afbc7831efe4442f45ad1c8ef7c181fa2803cffd7675156652
- MD5 c86cdd97e6d4f16addba66eed4912c02
- SHA1 d18cc07faddab784c038955ee71fa48744e3289c
- SHA512 509f1bed29eab6f18fc1b30e0f2fbbed2803e772c31028d1c7c902f6631f6d7bd32822e85fa6387f7b3a84fcd5847046c351f4df3cc38a9234088d60f2efe8f8
- TLSH T11281440557EB061BF4F70F314AF645920BFE7CB3BA76A22F8F511029287066499A4F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/tr-TR/windows.ui.xaml.dll.mui
- SHA256 6b9501401125c6b1ab6db2fb57184a8e72ff01ac85a010f97960d8c650e7508f
- MD5 8cfb0ac565af65c716303c2153e7eeba
- SHA1 92c9ae7da500cc96b93e6863616b8202848be9d5
- SHA512 72ce4af4ec598a1745f3ef8b80e95669ed9acc2aebd381f9151c24ab41f607fa3a2ec398700092bf4fff3a0f01b374fed1daa21048ea28e6fd22446dd4d25cde
- SSDEEP 384:Mo4/djBtONN1HaPDzlq20+4aAMi0ZbURhUjGonHuMaWVuWF:y/lBtywPDzl5ohUjhHzV
- TLSH T1CC72971593ED1916F6F35F356FB5A2900BBABCA3BA36C21F120061691CB06D49D60BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/twinui.appcore.dll.mun
- SHA256 884f81777e19c0df82c3e011cc68497d1bde540dfb418bd282b7cc79e107ad41
- MD5 e2c09db8b74284617df81b831377fa8d
- SHA1 c9631852af32ddf1388968c4b2f6717894c8af62
- SHA512 f2f1aafad6172e8395b57ae47d66da9bbfc0df166509b06d7e8222de11644350493693f659f99d228a18334007ed5ffde27ec5d3db168b8d2f143d31b822dc0e
- SSDEEP 3072:VNdFXYHJVpJIu17LmfenP4IqJrqdODZ30:3XX0VkuFP4IqJrqdODZk
- TLSH T1B1F389027BECD598F0BB5B706EB9D5992625BCBA8E10D22F7051535E4CB1F80CEA0736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/twinui.dll.mun
- SHA256 0913094923af43d891b2c77e0d689430c52f8605e4d8fb67457c1bd9a72da499
- MD5 4c5758daeab8e9c8f1bd6b8b91eace74
- SHA1 99f17c4a42ed4215d8ee70f264d75c3bae0c5d18
- SHA512 173f2b1b84ff0d9e9aec6a19e4c8366b56e48980ab4b900da140570eacdb9655eee4d2b0630abbec875abf17a21989f4886e39bcb4c83c1793564edae795b610
- SSDEEP 1536:wG4f/dRzKOmtRke7pkUeAakj/qiqB0VhcPD:wXf1RW5tOyeAakTqLmVhuD
- TLSH T151E4D94573E4D614E0B69A30ADB9C5FD092A7E21ED05D24F36C03F4F34B2B58E92A726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
674KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/uk-UA/SyncRes.dll.mui
- SHA256 e6a4a629048714c300e0a6bb7ea647fb2c404c87a26cc9479aeff5957d328cc7
- MD5 103759f0dd8feef7f6f6361520ed312f
- SHA1 96a9a39b03747d2669379f2724ad7c1235804f98
- SHA512 c767e5057cd380c3bb5ab1fa46c44169815141f7f617ec3d900aad1b2b670da60f8fe35b4d7ca3c8d04ed1f7b74720efd1a10e12ebafa5f1ad411ebfa585ba26
- SSDEEP 384:hnUFGpPIKeOCXsd4wKByZHE7fO5nH+zCeR4kDTZYGScWSXU:hT8OysgEZk7fOZHiCeJD1YNmU
- TLSH T115D26C0FFABD9514F5A8E5B10F5289D301A8B79027E886C9B24F7C71306C6367729AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/uk-UA/comctl32.dll.mui
- SHA256 d9fb5ddb13902fee3182af64fd1d9bef0ada20f4d1247dc43f91f7a2f34a75db
- MD5 7ffb3bd0d95f6be48c12a0827607c997
- SHA1 a13453b3373aa1dcdeed810091a79543a19c61a4
- SHA512 2444d5b1f3101a90adb4f268073295d43a95c187bc567c8a6c62960c156c0972c33c69b6875e238b9f94e39b91a084546f985e216b007d01d432d27e14d4c1f9
- SSDEEP 96:bMvWARO0pspqol5bRpeguklY3NWBAOh5Wy:geAceo/RptgWb5Wy
- TLSH T1F6C1E02BD7764A12F09686704B8306D317BDF903339642DFDB4A381C2464238BB60EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/uk-UA/quickassist.exe.mui
- SHA256 502179ee4370e135a916aa65c96bf7477c40fb2ae4085f08d83dfa9b9e0b430b
- MD5 7a203b34f7af4c44881293c05c20d43c
- SHA1 c6ea33b857e97e71cf13ad61e160859999875fea
- SHA512 4a477028c14136866e55244ccabfdba6ee58043c7ab89aab8073711dcb282a13b5b3426344e71d8057fb10fb09500be60e8b3ba308a91a2b3ea97ebac4b8aad3
- TLSH T1FA81CD0FA6B60265F569C7314AD345EB157DBF122BB292DEC70F24243028634F6A1AB3
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/uk-UA/windows.ui.xaml.dll.mui
- SHA256 87ccd4f9a8a7d23adc0ca75a49346376d0e4d1316826fdf8540e7c7c50622551
- MD5 7aa08e6f40c434c2fd84df1322805b61
- SHA1 eabaa4b5f848bd446d9283e689ebe25d68f9879c
- SHA512 eef422ddc7f6012c60abba077a43ae9ca22af26fc0e5f7bceb77ca97c3c89c246e3f214f351f764d6984941e9251b67b52f63dadb501a8ff7c5037a8be3060cf
- SSDEEP 192:I6uSfY1jgV2DXIiQyLIqzPlb8XV+4ZBRyrjIQw7n6E+Xe69KWm4uN:efvDXI3yLbb8F+4aweHuMKWVk
- TLSH T18F82B94FAAFC5614FA76D2700BB646D30169FB112750C6CDA28F7D292458738BB603DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/usercpl.dll.mun
- SHA256 929a475daeb54ca3996dcf52b08cfd8e9a97e546d480b7f82d4c893d66efd848
- MD5 b2faf16ef8a172612a4782cf266337b6
- SHA1 40c1889d2c614938fc5239c2b3804d9b3287ca32
- SHA512 e12a9ff30cec018d8574e292f9fef0f59d617ee8847457022bb1e7990c1f4b22e6ecf4857ae29f3111de2e74fb0dd22f955864351049b1dbce56587ea851b327
- SSDEEP 6144:zdSZ7bgdqyERW30PUS3qsPqHyPqHSS3qsPqHyPqHUS3qsPqHyPqHiS3qsPqHyPqq:8Z7bAqW30
- TLSH T184D4930422565C5EC33FA135F293BF5AA0C4A801C65B59A4E4B731EF257AD36F1EE20B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
628KB
Virtual Size
628KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wcnwiz.dll.mun
- SHA256 89cb427a9fe57972828454f619b8d51f9f8c0bebc281c02f9d61e75c9e3b8af3
- MD5 b0c93bef3982c7f8273f7929b38601dc
- SHA1 d15e498e66732fef36beabcce80e4686f42b3d52
- SHA512 323b9e5ad7b135af3159649111a43c47bb2897c2f194e5f45980a284c07f54b7e0f4bebdb4ab907700d8af2cb5c763395a0c46590910d4ea778ca07e5b3fc8b9
- SSDEEP 3072:7qlThj31B2s39yVV/AHzgb2y9NBCTQ9mF7lzPcZawJ+ZL74FWav+re:O5hf2sULNB9mVlzPc3JaL7f
- TLSH T1532508223133DC89EA5A15B05C1ED6E419A77C879A30154636BBFF2F80FDF06B609A17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
951KB
Virtual Size
951KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wdc.dll.mun
- SHA256 db7e30c95f6f8fe79ae668ba608df19735453dce52d1e770503d88f3e2e7f905
- MD5 73bfe975bf3bf83d98f7c2a5abe105e7
- SHA1 c0e5c5aa0f876262b241d07517e67224026bde11
- SHA512 17d0e62f25d0b09ba1354b5010e1b5d1d755f94b7f35e146c12f92336a45b7937db6a6c9bcf801dc8dac0bb2599fedc130322ec7b93efbc4034cf0c05e45389b
- SSDEEP 6144:lK1z1r1p1yK1d1Yk7h6OWhqIo9s37iTK24UpDrbizCG0U9My5BhtyJDeUCuje+4:l07h6OWhqxs3Om24UdrsIU9wDJ7q
- TLSH T1ACE43913B2069C96C63A5071EC1F8EA40180BD53C416162E71A9FF9F5EF672670FBA1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
689KB
Virtual Size
689KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wiadefui.dll.mun
- SHA256 edb9bb9a711b048afaaa39a8c851b0025bdadb367c4a3989b02056d42c5a0cc7
- MD5 04afec25852ac2d9d009d988cd4f7b27
- SHA1 c88a801b5e1a1d83536a3ec7bb204a489d5c5264
- SHA512 c7989344b2761a1776b84ccfd0edb63942cfd065ae85bb95bfff69e5d9bd24555023b1c86b465ea5021a68ffd9a2a62207ab27b70607639fadc502f95420915c
- SSDEEP 3072:yqKc7JnhGhL5fGLbUXcyg6xMmLpTDqw2dcKbdDmBo65:ybc7Jnhafm3ynxMap3qwvM8D5
- TLSH T1B9343A1EF670C852D9BE03309AD7C8B52520BC02E9A4BA7662D27F3F5F336D2A84551D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
244KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wiashext.dll.mun
- SHA256 af7789cd19b57fa83e4b36794842355a6808c6b130db0d055ba7e02e20c3e42c
- MD5 8b79789fb2d1668d5fa95bfe6c041d46
- SHA1 ff5e72298788188f5ed5994a8872e95e80223c2e
- SHA512 3c9e8844a0ae957d006db17e7650f3662db0ceaceb250d6e0979fa26a49a66efb4a114650df8e9372b3e296a4680f33bc2b1d84efea649d3fa81f639bb10722f
- SSDEEP 3072:budyMQAhL5f2LbUXcy4mBo6Q1zwLTrjMrTJK53PrmBo6pmBo646xpU1cZ3XaykuD:qyMZfW3yzDQ1zEIrTJwPmDQDfxwQX
- TLSH T1B2843B12B714FC81D05E4D30883789641694FC13AA40AA7B33E2BF5FAEB23B2791D52D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
369KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/winrm/0419/winrm.ini
- SHA256 8d41da48aa36ab48897c06620354cbdcdd15e4b1b083aa0bf59fd84119845184
- MD5 b559bba8c9439c3eee7c72dae1a5c29d
- SHA1 dd85b22f9434b46509f40f4387afc76452f51487
- SHA512 ac69ede2b5bfd9bdc09c905160a403a34daa24ff46d454be63d0f3790adebabcf7171a551a220290aec0e1015aa79bb614624ba80b00c0df1501bbc156762461
- SSDEEP 1536:wVcI5HSPsVCx2m9eIEvdRiKi4QYQ/0Drh6z:TI5HSPs29eIEvdRiKi4QYQ/0Drh6z
- TLSH T16BA3182B72EC5404B0F69A50BDF585E3857BBBC16F5AC88E45CB2E2C009A531E931BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/SysWOW64/wlangpui.dll.mun
- SHA256 90932ecae0deb2baf3e665e6bdb831ee06961e04252192b701cb6da638d0273e
- MD5 a14df34607b574dde4d75aa36bdf02d1
- SHA1 df77ddaf017aafc5a1d2d618f43701cba109aed3
- SHA512 5184a6b521a09cf6bbf08fcb03ce9319a808d28d46abaa74115ad30f00ce7ef5389f52f8efe00c84b8cb8345e3937824c2f6f3cb193d571e0e4538ffbaf12009
- SSDEEP 768:HicAZe051Y3gBpXh3flBpXh3froxO25pQCBhWHpzY30DoCg2:CfwawgBpptBppAOFRDoc
- TLSH T15DB36E427E6CD960CC450079CC5F8EFC4AA6ECD1BD00969366E1BFAFE8B9390A417794
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wpdshext.dll.mun
- SHA256 f4c22c6f8cedfe76ea422d2b7ccf3e11de620d113c951754d9bfe30492ca8975
- MD5 0d7dbca91e0467824f2c142b78d19225
- SHA1 2360a8d37edafc38e95b643341550263d1bc108e
- SHA512 2f39e098ffe097ec8581aea5189fd8089e63bc8944d59d37f08256ce880ea5809407f4c05b00729bd7477bc85610ccb30d148d0fa216659cb522ac0e9d173032
- SSDEEP 12288:K1lWkUvhMgQVHj/XyBaPpTVID2ZyfKC7m0Jv7j6HRqU+XueYfie7AzNrIr:ylevh7QB/XdYKC7m0Jv7Qd6NK
- TLSH T1EA55DF66FB14D084C8AC0931CC27CAFA0EB57C36EC845A1B71E8FF1F3D71661A926659
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wscui.cpl.mun
- SHA256 269fe20506cd64fbabf51418781dfd33ff4f58ea4db987378be065fcaddf0744
- MD5 1c669611c690aaf1e55c5a5ffe6ba97b
- SHA1 b8ac5ba912322f9bdb48508a0b00af879f652bba
- SHA512 59d5c823883b1273249c11669db3c87e4e6222898a73cb7b2ab72e0c66d1c301b0ba36d6fa78787a391f631b8586ad05233dd1d043b8c9dda93331d73ea07672
- SSDEEP 12288:MjlmoRnJj0ZbC0XWNYacpXUAuX9V5LWYtwPnbGjI794ug0/zJHMed87sN+:MZmkR04XyXbM9V5LXtwPb7pfJ7dasN
- TLSH T11935E0C63728E552C45C4B328867D6E80A767C926D400B93FEB4F75EDA3E7B1251E20B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wsecedit.dll.mun
- SHA256 6746ce1ec3ede3308e1996b29568962eb7d585c6e5241e60c7ae999c2c27347b
- MD5 238b0ac509c74b4a8776f44295c23176
- SHA1 98fbc0a075ab3640908544f7d3c30196e14c23c8
- SHA512 727366e772a7043229821808d68509cf2e1f27d6ff756eb433bc38b4ef78cbfe1109286a2f2439eacebe4911def2e5ec187f2fd31ad795dc2efe4c27cd291127
- SSDEEP 12288:gNlUvb1WIp7rWAbbyMD+0h82eXBIkuJ2R23ykAx2MuVAa0:Jvhy482euhwU823Ab
- TLSH T13005CFC3E38196B4F8648536A12BCDF24E93BC369C904B1A23DDB6772C322479167D5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
782KB
Virtual Size
782KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/wuapi.dll.mun
- SHA256 e012a8dfa0ff39a9995c10887781fc62c0699fe1f6d40c76d0a899aae4201629
- MD5 6ba36dc767368cf779827cee5357cd4b
- SHA1 2634612687020d268d6838e0182b07e4515ae86f
- SHA512 0997fb90bb26a4984572a16ee7397aa1e08c305461bc70e96937f56042a2a6e8e801da854298f7f5d166a17d670c68f8a2445931b2040f6cae31d84d14fa9411
- SSDEEP 1536:/L5C6yHyYuCkb1efBhehVmJ7VQvm9ITC:/d7yHy1PeBhehkJCyT
- TLSH T186E33B75B14FB41AD45E033290AB642488CD7C670F9AC1293E7E738D5A7868C7CBA47B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/APHostRes.dll.mui
- SHA256 e8109526e5eb7d379e1703c4d1832f65fa52958a6667223ef8fe5b9ad88f3a01
- MD5 4716acc2062c4252d89fa28b5206ca2e
- SHA1 2c67b205550b1e12cef98ecfdcfc615cd14ecc2b
- SHA512 3ec07cc9c49a9a700c3d6812df6bb09adea31a589b12fb8821e4189b25a27b804cbb4af2000f04e8cd2c9baed7c1d628c21d3dde44eeebe76e5195ca3fb53202
- SSDEEP 192:TUeRYRKnXbDiONwfZ4FV7m96Mi5fMe1t1obCkzTWpLWf:wKOfZM4WpLWf
- TLSH T1F812220D57E7181AD8A5057583B390B6377928DBE47A86AFF6D4E23D74F08100D21BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/SyncRes.dll.mui
- SHA256 1019edf51f5058885e081d49792fa8426be8a2c9b36527c98b2925411a14bd76
- MD5 b683a78c1d0809c2f7cf8573b00b102d
- SHA1 9cd97168e877f39d98095f2a714f2b1f17643a91
- SHA512 5f394266d4801d2b2f4f55430c68e4fdf3121a99fbc0f7c73bd52c514b40fc3839581576632e221732a5979559a84b44dee69096512c21630096fcfaa2bda06a
- SSDEEP 192:SjjoKSU0qi3v1BjmwUgvnFdbkusTNEKWgFWg:SPsU0q+bXvCTNEKWgFWg
- TLSH T17B529206A2A00D56E1324F7185EB786577246A058D328F885584EC3D3DE8D67AFB4F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/cdosys.dll.mui
- SHA256 8ef4a011572b7a0f76d2edb36216ae17e02f89957356d793d1e9d9a57cef91d9
- MD5 79f17271a72cf3d7585e1572d2f777cb
- SHA1 e3caeb7c3236195ff6b2fe8e3acbb595f10e546a
- SHA512 d0c9e40aa109693c288831446c817e33638c946070d1e88a95ffb7c91d7478beca12f091fbe88c4b9cde3b5126cef1dc627ca9a54a3655a41e56c33d714437b1
- SSDEEP 768:uvPJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfxre8BVYhIAAInmVLHPSyzZ:uvPJ6ivyUcEsx7fNXjTV8PszW7yYszn/
- TLSH T15903EE2253FF4608F0F77B3958B615752E767C92E83CD2AC02E4911D58B2E869C61BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/comctl32.dll.mui
- SHA256 036a3019b44cf0cfad187b63f18716c7c6400adfa97e8ef91807f59c7f0c2ed1
- MD5 500e9caa7e2d4f04af074812e1bb1a33
- SHA1 e1ddda327c14bbce62a0917a8ae9918e65c509b1
- SHA512 b8025288ed3c5b03f87292ea02f75c5ef0d6279e7717d763b3b2cc8f8f0b872aec9829b863c95ab8bc16fad4f12482e5ccfb5df9188cbb8f74fcd1e0bbb10bae
- SSDEEP 48:yC5+zjGBo8U3cm/bp+TpypY8Xc0SPUfoIbjQ5TKPZW+5wT+y5Ww1t:7uB/bp+TpypPlfoIjfWptWw/
- TLSH T1E3B13F15D7E6493AF0AA063486F70B81373BE902672B9F1FDF4018AD2429225ED25F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/quickassist.exe.mui
- SHA256 c26cb7c51508a90b1a0889ac1d2cefc42df8c8a41e7d80e4834e778454be31db
- MD5 63ecd61b682c0c6f14ace83815901c31
- SHA1 15855e2ab1c5ba971276e7b52e26bbbf174ccf87
- SHA512 f024fd2a96b3638190996a1fdd4a53d507193a2ecb2b47154873be3507532dd658cfaa1656b9fb93791768a0fb24c1fbd5358a9f7b79783cfb39195be7444707
- TLSH T14051CC4567E71A6EF1BA0F704AF706A25A7E7C13A973962ECF40012D38606159AB0F72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-CN/windows.ui.xaml.dll.mui
- SHA256 73af6dd0fd360ff5e412f310e54cc901d22cc63e11b56796f55b19565f72c905
- MD5 33507e17381b39b42dfcdd2c4cbf5157
- SHA1 6acc31725d98c194d67b92140a4957b96a2dfcb6
- SHA512 5d5aa8c65cf11603402d7fb3878177830987cbb921f7563b116685128b80e3758bd38d614d479f8fce6ae1cd0d880cee93d1ec498a4b10585a1696fe0fa26bb9
- SSDEEP 192:76pjjAIBAZ/btGmkV+4BcFU8rBsozJ46E+Xe691WfVWw:un+/Ams+4OBbHuM1WfVWw
- TLSH T14D325105F7EA2A19F0B34B7467F3529167BCBCA76A02DB1E4A80701D2CE07505D90BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/APHostRes.dll.mui
- SHA256 de5c05df3fabefdf9c882c69834dd2f5c9de3d009f5828caadfa76bc2314df5a
- MD5 bb566bb70c232c347452932a5016e1af
- SHA1 f983f037ec2d9e09c26448d1f64c117faed06e1d
- SHA512 0bd16ba2ed9a76581d550b6359bf0bfb130dc150fa30bd5c0e0da4d475426a46a96688f65c5a0846f1ef81adf6bd084b816bbb31e10b0d13ab2a701c456a9b3f
- SSDEEP 96:yshISnwOF2dibwaJ0vyHIFwHa2Kz7GLLDH46uW3tYjNHIq/awtDXxnuksjU4gZWB:NISnwxmwB7ZamcONoqzluksojWBLWI
- TLSH T13412FE1A16E9182ADCA1153A867742367BB6B5CCC42DC40C3DD0E23F7CA4A109D57BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/SyncRes.dll.mui
- SHA256 318476c9fde53e5b7cac32c61d9a942342787d2e1d796490a704ac7cd1c0eb44
- MD5 ebe4661789c3c64f940d0d89db70ea08
- SHA1 1f65b31f062c18868a21c87c75970abc2e97e4c0
- SHA512 52954c2c69738f4aad266358e666d472553ed071cc2195821936f8fbc875ae3340623c74daf98dddcda519885018e88da08c928e9d5c25a372102e728d0add43
- SSDEEP 192:iTTHgnkck08smTtgTbN4JHsR9h129L2lSs8qG8UdK3OWNoB44/ThyCITTbYRWsFy:ivHYkhgTbN4JHp2Xa8UuD+nGTTyWsFWh
- TLSH T19B5283069AA60A10E1B25D7046E705337778BCA12EA2070E1A52ED1C7AF0B17EF78773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/cdosys.dll.mui
- SHA256 b40e77615873b0398f0b22dad716478e7f3deae132acc0246a477403b69c18c1
- MD5 f12c599d8c664c3784055b3b3e59786d
- SHA1 749ce00fb6ec050f24d3124a7ebc6dd35503b3a3
- SHA512 5b902e0ada27426c060035a08f506cb5dba561f1a7dcbb97bc6fc48025ed644a8fdbf8684dc7139998fcb689e08877cce2528ed5a512b4ecbfaed1708b6c1560
- SSDEEP 768:fMeykJ6iDjyUcEsx7fNXjTV8PszW7yYsznPy3IhWSzjfr+SAe8BVYhIAAInmVLHY:fM3kJ6ivyUcEsx7fNXjTV8PszW7yYsz/
- TLSH T1C303DE1253FF4A08F0F77B3958B615762E757C92E83CD2AC02E4911D58B2E859C25BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/comctl32.dll.mui
- SHA256 1f83cc9b0b88dd7e784777fb561672fae683dc809a04a53eb3261bb29a0cd06a
- MD5 60c26fc3b013bb97aef6b52a6078ec28
- SHA1 7e6b0fad3b6289d3b9d6b4c94aa070dd3b68d8bb
- SHA512 956261879ce99cd2fb37fec68a610b9a0d3bd214bed58fd478ff9351a59bf1e72c053e784165f1e2df21ed09241ae8769a275921df910518ddbcdce7bab6c355
- SSDEEP 48:yo5Sfv+eeAoRM78B6BULMTbYYpYpvNSlJKq1/OEk6pZyStOnZW3QwT+y5WwHgJ:1Hd76eLMTbYYpYpFeZ13GzZW7tWw6
- TLSH T130B13215D7E54A22F4A70B7881F70BA23B7BF9166725A70F8F80599D7438205EE24F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/quickassist.exe.mui
- SHA256 dcfe99a1a6dec9a5d3b06cb7189cf28a9c2e2df4cf29c353b2b641215a7fec6b
- MD5 c35ced8be75548b7bce16134953a4242
- SHA1 0c810e1c7d899c0655480b80a71681938d5b7054
- SHA512 1909cd3cc36f8cbb66969d2133619034b82f65174fd13f14b3da1869e360d3d598ba073402948c743466917fc968951867563db260c83f52645f3145ae816b76
- TLSH T18A518B0597AB176AF0FA4F704AE306B65A7D7C13BAB3A22FCF4041683860155D9B0F71
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zh-TW/windows.ui.xaml.dll.mui
- SHA256 e3660e02ee5430bf0424dadef0c867af9b76572e02b8dbd2e4339abec1069919
- MD5 489d4e10cf6eb12c12ab9289b74d6cfb
- SHA1 c360e57d169e2cd2a001a0184de96e68f257f6e3
- SHA512 e2acc5020e24dacf1100c339056e02a1248235c6920f117c647ff9d231e383b80a122b9e20ed0220b0af398aa78e9bba7406a86b65ee2a7274748c1c3e0a0435
- SSDEEP 192:w6TlOBMn/my9A0WjhlCV+reLrGH3g6E+Xe69ZWfVW2:bdmye0WjhQ+reLmHuMZWfVW2
- TLSH T1A7325156A7EA1905F0F35B7867F352A227BDBD937602C32E5B41A01E7CE07405C50BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/SysWOW64/zipfldr.dll.mun
- SHA256 26b9f8f4ac974b48552a8f5038debfd0aefa4f348ea63aac8a9315d65ed0c213
- MD5 c45dae96074be7064b12c335519b5400
- SHA1 5b9cc17b7dadbf4730b6433b1e323c6cc60dccb7
- SHA512 db990c1d7e2a07882d1989b29a9ba81dfd903c8cdbda7095cc408e05b81817137d616e6cdc85edda99efd55c81cc3281d9d61581ce6a16f90dfa0f879627f130
- SSDEEP 3072:KkKNXpU9ED7+ltVswrdmb8MyJ+8bDvLPpU9ED7+ltVswrdmb8MyJ+8bDvL:E3U9U7+ltVswBm428bDDRU9U7+ltVswB
- TLSH T18FB31B877A5881F9E87C6D737F83910E2B437CF49E028199A2D3F20719B16724D69A73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
apt/emacsen-common/docker/containerd/daemon/io.containerd.metadata.v1.bolt/meta.db
- SHA256 303a1f49d7d01b08053e33cfb119906af870aa4f768b37a5aa5f03d481ca720c
- MD5 1f95a02c47e7c550148eb602af05ee34
- SHA1 4eacc23cff307716c0c03195e073f54de216685a
- SHA512 6d55f0389c9965d4bfde81a197374f486e14c6989d375c67edb94e25f0dfe03a2daceac45956b41c97ee7d8d17062c7bd344c7a0ea4cd8607a3bb1d70d046570
- SSDEEP 3:RllMgXllxllKrllRssTcl5llMgXllxllllbKltDQXgl9lZlt8lwltrllElllll0i:+c2XFp7xKl//cmMl//ylsQao
- TLSH T1C5E20124CAA8A877E80C033898E392023A3080CE6FC793824588A170AD82B800CB4C68
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/emacsen-common/docker/image/overlay2/repositories.json
- SHA256 2dcdccde689624d7ae417866e9e1bb595fdcc3fb99b9a9ffdd93849aa8bac885
- MD5 823779ba1bfd97067713711637b7ba40
- SHA1 357fa21a05e6c1fc4e22c711f549ace9ce374b91
- SHA512 d747f1870badc025dd7940124228818e97ed981dea7d4c4eefc7e62a9a33e7e6fe3eb7f4653abc88273efc2978cf9b48868ed53668caf9b7cb52a46770b5f7b8
- MD5 SHA1 SHA512
apt/emacsen-common/docker/volumes/metadata.db
- SHA256 f64233fd2b8bb3a6705a5722905cc47061504fced8b150817def45679d04ce12
- MD5 2a0d679d9c7009f2f9d7c98b020b2fc6
- SHA1 49d959c791142b2fee53627e84913c98bae5bc95
- SHA512 495ac70ffbdd715fb5198fc1619ea6d8ca1fca0238688c23d9e3087d6c229f99c01d8e2afe209be5165f7538216d4b66a723157309490cb21e3ed02560a14951
- SSDEEP 3:RllMgXllxllKxO//01ltlUl5llMgXllxllllb4llghul/lnlZlt8lwltrllElllX:+W/c1ls21v7xKl//cql3uecu
- TLSH T13DE29B7DC5A4B933E80C033444D35104713050CDAFC7D313450C71707C467C509B2C14
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/extended_states
- SHA256 8dd640c03a6c0e68407231a932b0bf3aed26c499ee3cf3e0f8522e4ef7f8895d
- MD5 99b6b2590d782f237b29efb8c1587de0
- SHA1 d47e665adfeca6cd52917f22b26f68fc81711491
- SHA512 02f10c9212af5978b5a1f997454e78daef8a8f6104c1bff72b04dc933142d67da86cc0db7fbf69287e9ca7c5a4a9e86687b21495f0801ea83aaf59ea5133af26
- SSDEEP 768:k6Yvptg3XNvBVXhLrM1CeVIAwDATKgBnUNCs/:LYvUNd/M1CeeAAEKgmUo
- TLSH T1BA532033F3C1A239FA011E1A75FB9E6ED8166742743DC0F8BA82B58D198218A557D31F
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/ieee-data/.lastupdate
- SHA256 2ef215ec15c4ef65d102d547c2fc3012b16b66a17b1140b00a1cd82ca600273d
- MD5 6b3b7572bc2cf2ae808a025bd23d4cd9
- SHA1 e2ee073ce863c54cc38b56fbee3bede352479e0f
- SHA512 f3dfe12b696f48edcf99bd8f9b3653d21e4586178236f6a8cc3e1b904a3afd5be2c69c7c1ec05182daa077a204b1c8592e08c3ec15dd800959e0b7553779ba30
- MD5 SHA1 SHA512
apt/ieee-data/iab.csv
- SHA256 eaafc7e697c7c2caa4a5a373f076c77d939c71191009148a8f0480780c950dc7
- MD5 f616eae90eeddba55ac5a7a186f17df2
- SHA1 93662b545c5b30c2225f818465a10e57ac841192
- SHA512 434ba4353f20ffca0c461afa72d454a5af64dde8acd5a3804acd2e5b08a5130e939bfa1196ee9ae64d31bc4ebd6ef93f1ec85454c534ecd611d7d19e5e562e53
- MD5 SHA1 SHA512
apt/ieee-data/iab.txt
- SHA256 688fb302cad09fdcaf155da61c613c4c2c71b829ee0e544a3683dbd1aa0cf1f3
- MD5 23bec017c9bd62a7015bb3cd3b432b91
- SHA1 59c7c8a1d55ef752db927f81e22d56fdb2a9cc32
- SHA512 062a490ee41dc80d5e93869a1780fefdb7e9047d6946975c4a179e4a725dda4a81b16340d30bb2bfdd3d28f9b9a468bdcccecc5c79430b56d0298d8c8c86a46b
- MD5 SHA1 SHA512
apt/ieee-data/mam.csv
- SHA256 3a4aa6b61d87c37f240a2d631d14de1a19f0a11d7dc87d02383389ce87a82849
- MD5 bd3f953c6a8ef3e5fa9cf1bbfc2ae7ee
- SHA1 6fc6f435ec0377df24530fe9f692207dda07afe0
- SHA512 d02b1592c8d5b943210596de2116c5ae5caabc65388e9ea1c59251bea04d8fd152f441599eb3269d2b792c7fc73503d5cf2807f96953ac706aeb81672f976b1d
- MD5 SHA1 SHA512
apt/ieee-data/mam.txt
- SHA256 e44b8e9107922e9e3d53b978778568fb5623cd285260ee131cf2d38645fbd21d
- MD5 a4a09d17cb5840712603ad62718b70cf
- SHA1 ed9c8794f48892eb66efef1f6f49a3fc82903729
- SHA512 3f887bc715f97dc39170b6f332eb0a8b91ba12842ba7d33a00f5ccd454dda619d119b6d739b4cfd2fd575ef6d2b0f03d1879b6a780667400007c86938d345358
- MD5 SHA1 SHA512
apt/ieee-data/oui.csv
- SHA256 134cf20dd9c248c4c8de4e926961a7ad884865510401371d2549cb74e71922cd
- MD5 14fbb69d87e79c4677670febd1df04d4
- SHA1 de6aa84cd002db707949ef690244ea781ebc2040
- SHA512 0ffaf9dd719688883c3ada6ee67fef7d10656bdee79c669178e0bc344635d9600c0775f54ff646575db60beee79d65ef333771237921128fa61761496c3bef76
- MD5 SHA1 SHA512
apt/ieee-data/oui.txt
- SHA256 9780fc54372ca570c924c45713aa841c805451fc54686a7dbb35cda5794b98d1
- MD5 9cbfc03adc8133e54791beffd3edbbf2
- SHA1 7f15156311007b9a2cc3d8f748ad3270e418ebdb
- SHA512 95c60e390c64eb880b56428f5eb5e934c87efaa1736218db36685cce4b2daa3f85d0e04e68f057a017948dfcf90fcc5031b3c021d946b17b6e4be856985efad9
- MD5 SHA1 SHA512
apt/ieee-data/oui36.csv
- SHA256 4874244f60fa54310865244eabbfdcdeef67e4ea3a173bbaa4d185d5b4b664bc
- MD5 387c27ab603468e6e695a7d67a0315a5
- SHA1 cb65a3f1629b2d75042aaba9c65da9174a9905a2
- SHA512 07c4673c6942023dfdc9ed10cbfdf9d51e05d51c8aa3a8921a8b7bd39e7af093b8ee4583a11ee30bd8a848ea5705d60dfecf27f96060dfe935a093ed291307d8
- MD5 SHA1 SHA512
apt/ieee-data/oui36.txt
- SHA256 d0a602d90c5a379117760093e747bc9c7ef63e357a9ccf79cb4717cc1282f9ba
- MD5 80750b387df9c17763851792010cd549
- SHA1 66a464e18fb53f834aa0aec05e6988e6212a809a
- SHA512 1840221a3eb058295748088c375ab9f6d29a559a5c28c96204e8a3aaace0ebc63382a7a4b3371d065ec27430a07edc32011989c1b155f1dc5cf8f6bade17dd1c
- MD5 SHA1 SHA512
apt/lists/deb.i2p2.no_dists_unstable_InRelease
- SHA256 73a3fb48b600978ba3a35147618e8e02c5e197caae2e1f351c29bc60b1dc109c
- MD5 60ba65f568713c63a3d7b4c4c8e619fc
- SHA1 8d850293a1e84e7d7a04c54e98b5da083cf0bd11
- SHA512 b21c6f886a11afcd259ac23f0199398e1b2fb490207c8f2ed5269da8afae4d499a3bba4418a556e91ad9f5c89afba8e93a5ca42e037d376fd3910e7d26879b43
- SSDEEP 192:HdwFN8MVuumdN0TBehjkTIZLhuH3/L2LnZoY35FasKsBszMJKCrVRc6wRDPso4kH:H4eM0R0duj9tk6OY350e2wLQX
- TLSH T16992856C82E51F7A9E14CF3F7F7235A06C6EE021398110C425A4EA9742F2753B6E746E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/lists/deb.i2p2.no_dists_unstable_main_binary-amd64_Packages
- SHA256 5e2a3a3d1f3f782329b541d902923c2acd145da74a542ceb0ab10ba37455e4cc
- MD5 6b7ce27be8377e3e18b020417a2be71a
- SHA1 0e022f00df40487825470d077bcdeeb8c3183896
- SHA512 0aa9f4ea80c820245a8a305117e8d2f18ca6581d75b4710de4a4bdc3a1af0aaf9ee2ce6a5a636ad761fe6a0a806332b306ad076aa2b67a718c9ee7a1d57e64c8
- SSDEEP 192:XQ8BU5aLRXFBkMvPLCANaLhOEC4owLH4oNLM65Q4oFqLoGi4oAy+Y:HLRLPLHaLQV49LH48LM4/LoGi4dY
- TLSH T14612B91B5384BEB424A259BF3F3197208B7D1124723360BC1BD5D6CE1753A7A6333969
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/lists/http.kali.org_kali_dists_kali-rolling_InRelease
- SHA256 e739a7f60715aebe9567923836e2551a25d72bf987be5d27f6ea4143f2a99d52
- MD5 e31a24ee5de8de05bd770007efa4a16d
- SHA1 663dec4d84c9c9b348b70fdedbc1184c4b67ae9e
- SHA512 ed4a0c39db6221a2b4453bcca3638a2712f44825d46ba5058980ef137f5f13d2fbb93654a40194acd609a0ca38c0379c277328f7c5c3b32a6b586eae1df4da28
- SSDEEP 384:Hk3hahbiAltCMsZh7lx9GQmfZQ4iyE22Nv2yL2zbecP8Ar0g9kaVlexxBRPBRLB7:6S2mfVcoqcP8vpSyeDE5Oo
- TLSH T16FD2411C279417BBAF244EAFBFF375217C9DF131698015D52082BEA502FB257B2A341A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/lists/http.kali.org_kali_dists_kali-rolling_contrib_binary-amd64_Packages
- SHA256 c883c4566c62f33f5313ef4ece54a83619e039b19a2317e3990d32f07882b7f5
- MD5 2d50fd00c606845a38ff84b676632fef
- SHA1 c454401a544cda9b69c51fd6432532046f386420
- SHA512 08397d2c208d72a53babc55b7b56102fbcee5e405c3a76c8cf63454b6060a6362dfc741b5d5d99fe6289f408efed5f9bc91d766ca3049d8105dadf5d1c01187c
- SSDEEP 6144:WNHqpyVepEGqaded1b+TIKFEz4IzkgLzSuX6PjWFuv5SRsslEgZpV:Bdedh+TtnENff
- TLSH T155844B2BA74023B1BB53569B356AF7404F762220737341FC75A9029D63824AF7237E9B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/lists/http.kali.org_kali_dists_kali-rolling_non-free_binary-amd64_Packages
- SHA256 cc6597d622d28f46d84ca44988e4cc4068e888095c6ac6e072c75b740ebf9ba2
- MD5 3b3a033f4e3d79e7b4f912b67b18e4c3
- SHA1 33e8475fff90785050f2c3b78d57712d4a6f33e9
- SHA512 d00f0bc8c6ffb6163cd4f21c48f1b0a39c577170b7b8ad82ac39d3231688938add2b8d6c0d250cf89bba5400744c4b0b6c4509e9aa6d8457dc6859a339a31e25
- SSDEEP 12288:+ieYfeTaNEDHMZyi9Mg3fziQlE/DzAZknC6tSuvWePrXw+1unIElvwCjwGAWGcSC:+ieLElvwCjZC86TQqBBLaXHcFnvNM
- TLSH T142153B37AB842BB3B7571D8B3DEAFB005FB9D104727301B875DA426A23910EE732A515
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla
- SHA256 f3bdf040dd1988419d1563a412d3765df6bb19400545b5f25ae1583deedae17f
- MD5 8f4148a8e3f686b5cd07c4075175148f
- SHA1 b7f4a4b9b452e085cbb87b5bfe7fa2016d0e1ff1
- SHA512 ba1d7ed79e0798983bbff3f01fd447621bf84b3ed7357529a3492a61ac464a182956f426bfb9a1d38dbd8a8cd2fd1cd9aa21505c64db0e30f7b67ab08d6f1f89
- TLSH T108D05E6B4770A2286A340C46A476BD47A769AE12B6E94DF82FE48F141901D4913B9E28
- MD5 SHA1 SHA512 TLSH
apt/postgresql/13/main/PG_VERSION
- SHA256 1a252402972f6057fa53cc172b52b9ffca698e18311facd0f3b06ecaaef79e17
- MD5 aa6ed9e0f26a6eba784aae8267df1951
- SHA1 feee44ad365b6b1ec75c5621a0ad067371102854
- SHA512 01765ddfd925d70d41d53cabdba5f2588e678e534ef5d8840a813bc58d33198039006ce6395c6b95747a2e05d21ff3a47389638ba9405fd11ab1b0857f56426f
- MD5 SHA1 SHA512
apt/postgresql/13/main/base/1/112
- SHA256 5d6373e654ba29c8eee2f8ca1f6afff9d8ec05033c904e9ecb2821ffc5f6e418
- MD5 f3f65c70d64f914fdf0a3188935a7cb4
- SHA1 4d1b0976f91348cdca7afb2d542cb3c260e42f86
- SHA512 479979a28bf93632cfec1ba33ab26ad215d79a2b8611143d16f419768eb2d4bee7040ddf77b50b7aa2d4010e6639fc524692662bed52300eabff4f9a285919b9
- SSDEEP 3:1sfW6DZh//lKlvln:qfW6b/49
- TLSH T179F10437F404101DD33FC135447D0DF1D530104D001013000071113D145514015D5471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/113
- SHA256 5f728713e23d19402b40b1a12efa054ec74d4e50ca794618af539e873d86abff
- MD5 488c596551d129726321a12759c3bf81
- SHA1 d0d1b75dec5453606ae6535499aa05b29b9ac4b3
- SHA512 122feb59d92145588d051ad0c22fc273850fc650378f57688ab491cc73b72ae73ebd42daa7127449cbf210e3572719df2304c0d71accdd821d477ea650caaaf7
- SSDEEP 3:5tW6DZh//lKlvln:zW6b/49
- TLSH T1DBF10477F401311DD337C73504340D755534104D000017000073313D15551403555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1247
- SHA256 511654a103f8a72f44e45c7ea3e765634bbb4ef1131ba6541ebc5e689e5a1487
- MD5 afc1045c63ec25712868b6963c884129
- SHA1 53d41e6cf774132c48fabb5dfc3e6349d2c00307
- SHA512 75a864cef58536aea067e3b11a69394eff1269ea99f14400d3e32ca4e302b7a602feae41a338faa7520f35282a689b4aaf7e405cfc356deae7f727c56d2defb5
- SSDEEP 384:mVRrsOJRUipzLdhIVS+GeviyQinD3Gd4wupbsQ0DXHWIaFCkSrgTS1jBMrN/nwEF:mDsOzLXES+JQinkXnDmTFzwkgCN/nNF
- TLSH T13683B341B388E826C59C81783D8CC2EE47B2F509ED918F53B2ED176E9CE72592F16B10
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1247_fsm
- SHA256 ff66b5686911917ceb3c58ddee800018877760c3d849cd60d3a302ab074ab780
- MD5 93cbb27c60edc68eb5abca18d57e9f65
- SHA1 3a9b2cc843de747e4f1108dc6afa64f676efef2b
- SHA512 919559089e41f9b8d4b17794c24e4217d13763b911c02db2968fbe9617598f65f85861d6d66b6b0ed5c53d368296fd4fadd2c89db11469956c6382d8b1b606df
- SSDEEP 6:XFt2WWWWWWWWBFt2WWWWWWWWBFt2WWWWUl//qM0:X32WWWWWWWWB32WWWWWWWWB32WWWWUt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/1247_vm
- SHA256 0eead25e5fa44e5c85c2b3d0b28a8a4f46ba764be159b30be54bb8f9297aa9ff
- MD5 ffcdc628e5f9d2cc89cd35321ab02328
- SHA1 a46f1214d7f60240f8610d31edb56d72ac9b2968
- SHA512 373cdee07d949c43b93c7080da55c37e3953dd6546071e75925015957f51f4da199ff37c100ce653b4efe61b93aa0d0f76166e420452d55b9c6791dc55f38d08
- SSDEEP 3:6hNlGt:/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/1249
- SHA256 16f372ba4725a32be00a78220143073bc7d8860b8db95ba296cc0c3244abb00c
- MD5 db288732fb6e192c1672fcf7dcf29f8b
- SHA1 646211941dc12bea8b7a88bd253abb57b407b859
- SHA512 0dfcc66b2f325f1b40b9a907ff8a98142128e5f86053a186f1e9da9b9636aebfaccce0c678feb9f1b3ab11152373666f97eefc7965aab53a8781b32f25533385
- SSDEEP 1536:7/gv1ZOI4sjFNEfYLXnV0rBYre+aUMkqaTi/hkTBR8I:7OffE4+I
- TLSH T15894AA61BB85F922E280D63A3E14C7EB4312FE50AD438BEBB0C573DD3DB56968E14950
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1249_fsm
- SHA256 04188f277395b764ea98c75f7e17cdb7fa5e820714ecb0913f7dd07d2b312ffb
- MD5 7271686cb81ad715ce90f194d88fe3df
- SHA1 b1098db455fab6725e8a81e58a016525881870fd
- SHA512 63292e29e54ea5b0f23fdf232e19b7ff1735fc28a1d6de1ece4e79cd30678453ebc6cf92b424556ac086155d67013e2e18cb7b6855ef5f8041f0c0378a0935ea
- SSDEEP 3:nhNlbqmXoIIIIIIIINhNlbqmXoIIIIIIIINhNlbqmXoIIV/dxlXYlQulGslI:7oIIIIIIIIVoIIIIIIIIVoIIV/D1ndr
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/1249_vm
- SHA256 e1f8fe83a607b6b42257d3237e7f48d61f59704792f8e86356e04d58878859c2
- MD5 483d53eca72d72a0657a0b234d0e9fd1
- SHA1 7c7f1a9847cf7c4bc3f1b48fcb946518b5e15f6f
- SHA512 40c29448a8d8ae09d983c25821a6c0e3978f531a3eb5ffd5d20734e2473c81291f4e42155020c93d1c4b1011f75c7b13bd3f9c7ec8c217c9505777be44867fcb
- SSDEEP 3:kk3hNlpl//:kk31
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/1255
- SHA256 b3d5010da8432bf06a7b9548e2ba6a5953d0003659ad0d2df9c25f935123a3bd
- MD5 9c740baa60f04326d929bd05241f650b
- SHA1 4faf264c183d235f63bcc72ee91a1ab863e0e76f
- SHA512 c8107c356e6ede70a94cc9e0be86beaf805ecb4897aa4a19b224b2c416d10c84b1d6d4a66e625616ea1c7403e7ef725bf8e2655d2c82bbe4fca234969f8bb695
- SSDEEP 12288:6TWDdcpcfuUz+kKHtdNRHDyzMQ8ps5yMtERy1yhkRdmd9rjrRWQgfD:Y
- TLSH T108E45BC1D755666BD0FD497061CF0F95A772E5832EB38327E2A855787EC333A6A3A100
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1255_fsm
- SHA256 8985ace6008cb616b20b7b3575777d9717d35d5c2271e65ed5629e3bcd7ed074
- MD5 dfe95e72abac9084232674ab3b7eba87
- SHA1 cc7ef5427d63af38df7dac9f91266be43d41e9eb
- SHA512 09d81cb2fa8858bbb3dc40078b27aa3618446797cf90541b21e63a3f35a19a482f07ac11bf28f5d773f07fce6c2be21f44dfdff1ad626aeeb707cd147431d153
- SSDEEP 6:8c/T8amm6VZK2bY9imGyxllyb3sdnhqgfPyf:8CQfK99FGyxqzynh2f
- TLSH T1F4B2A73B75D19E50F0049131A8DF242316D3F18A043105863F6B4B52700322208B575E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1255_vm
- SHA256 f64110acb721ccfb56d56f5123e01db3cb73102f16208e1df8a0d00d4baf2a63
- MD5 ec6fac401a8ae81a7aaf3d985fb5def8
- SHA1 e6657cad4cedb6d8131fa63855b955a75a90cfbb
- SHA512 5a3c80878817125c83e515b23d6f96e1c5246f9039747b6d131fd36bd542278d2e38c9fb1a2c662e81c978fa20dfa035772db72340d51a43a4c90e831c8ab60e
- SSDEEP 3:Qkt1hNlpW//:QMl2
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/1259
- SHA256 23ef47e36fd5b9745859f8c186010e279716ced689b54b6b8810863335045bd7
- MD5 adc47daa2aa3e38591f5c9eb959a4ebc
- SHA1 2f346fdecafdffa37ab804718c545748f582ea72
- SHA512 ba5ad4985de377001400d5fdf45ca5e123cb0cd108e7de89fe90fcee1069b56af95cd62e6615ef405d8db1e1db42434e333800616777064bd1105650220cd192
- SSDEEP 768:9N9bKqC1yCCtLryCUI4wXU/RyLi6mKMjV2vB7/fIS:iu6IhEaBzfp
- TLSH T1FDA34D605F89E6D7C6AD8B3A19C2B712B3B3E69056E68BA3F1C483351DC33461E19C4D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1259_fsm
- SHA256 8acdc937fca22a496215056ed3960bff6d3319b9c45f3050e8edfc09d7085c27
- MD5 9a360591abd6ca7d3aca9b36ce19841d
- SHA1 1f3d3f59be3657821aa1f4f66ea9d16c5d545c2d
- SHA512 3ce5e0cb8db3beb16d254a01dfd7019931c1f30b9e5ba7341a95ba8b5db956a95e057a949c4934788c34bc1443f52b02fad93da5bd0ca7f06135927fc7d221a3
- SSDEEP 3:nhNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/t:8l3lZOaU
- TLSH T194B201A7EC628B05F1413E78702DA12D32FF07CD72634D08469F9121C5136144E0423C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/1259_vm
- SHA256 ebc71ed01b48e2db0f196e6753441f9acaf00bf77b7951f4aaa1663fcc1f23c6
- MD5 bafab730f516dbc8c96514f876ae75e7
- SHA1 43082163523a9674223cb4136ef9bbcc52a925c7
- SHA512 644ee404fe9dca42fb297771d08784c2482863969d6909681b5ab5854eb76977779975c6db750c5455ec05b063c54a44673c4b173ff205e87353c0ebd4c78cfa
- SSDEEP 3:bsthNld/:Ax
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13938
- SHA256 855be7372a4c9aa90fa561491efca6e0c13fc37d962dfc607d7518fea9cdd6fe
- MD5 f771ff5d3586e7ca20dbe55894765931
- SHA1 d8d4d9757fc5e4b1e7ac17fe3430a3ac8a61ab0b
- SHA512 e8651d0850cd2a6076d928887f5b8c5b850117fe9487fffac62410f0719cb3edb1296565fdfeea4b98e0f5a7fc433bae400811be15bfc28c6d32c1d4361df5a5
- SSDEEP 768:SLZCzSlTOfgjNH0uD46XjFiqwiRJMw19IB5rS:gQ7qwGTC5m
- TLSH T16053ED09A99A73C1E899B239C55982832333E1F5AF514B5B2A76C3F43C034DFE93D558
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13938_fsm
- SHA256 1026c5125dd766e9b5b35a9dc36622cb8b9e441fb4e6c9b62e65cb46566652cf
- MD5 c7cdb534af6bd29fb2c6e3ef3ed24526
- SHA1 490b58cb3588090289f7b18e33cb2691dc8fcacf
- SHA512 85f587aedfea35bad2857e9f7772bb72aef0ebd96c88f5c29f2bd32cf20dd07befd08ff4ac4eb11ad4d244a20d40be29ebb69815850b75d9bf0702f4e65ffc9a
- SSDEEP 6:TvAggggggggNvAggggggggNvAgggggrQkI:7AggggggggFAggggggggFAgggggNI
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13938_vm
- SHA256 21ac2d697ad4034c45e14677a73c8f1debcb50d38a1834133b89784eb833d6fe
- MD5 a564428c595b714f0874cb09d7d2098c
- SHA1 f5dab204ed1d452b07a0bbff9ba61ff6b3292302
- SHA512 d07a9cf3565513844e2f6eea6f28857f837a5f6db18fb5a2534dcb142453c545c256865ef113670daeb4392a76976eb01411ff32546195132d90e26a1278453d
- SSDEEP 3://91hNlXt://9Tt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13942
- SHA256 f7d74442eb367c1bf15aa3ee0aa3fd7748fb82e19b4cea9013acf21358f0b3de
- MD5 1f9dd7804caf508f9e1a10abc78a63a6
- SHA1 269a84f7618599f24d57d642ae280302adf85c1f
- SHA512 e2d0fa9ad7ff5986af90b2602f51ca77aaf29736ef446df71b204334c61be4139e986208d14087a2593cf3440b6f56ff284df311a3aea770ce6615b83a71d508
- SSDEEP 3:tMG6DZh//lKlvln:yG6b/49
- TLSH T12EF10437F40010DDF337C53515340F715530104D03001301137111351455140157D5F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13943
- SHA256 d8454296725fb592db11355b41a0b919e9dd9674d1eb7fff1aafba5ea01b2ec6
- MD5 949b44ba0000b0d9a8d43b983dc29d2c
- SHA1 70a1fd0ca10e3b840dfe5858dc702bdbbf12b5ab
- SHA512 036617bdd575109af04bcfde6f179aefd1530692940878b6d43b6c0fafcaa8bab1bb05609a2a8e675180c700388a716f13484e0563fdb57938e9a16c3e39cd60
- SSDEEP 24:OuiZCgnllcOzhALbgDuuAdwh/8g974zcg3z:BiZCGlcxLbgDuuAYp4ogD
- TLSH T1B2F1C22FD385F508CC1EFB740096A62133305812772B0B4F555AE9566C620C62B29661
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13943_fsm
- SHA256 8999be4c8f45903b0350765c126d8f82ff28720758703d11961228392b91980c
- MD5 961bd8a3993250eef0c8e379b0419d6e
- SHA1 7c0e5f850f02a3809d187fb30e89e7af710150b2
- SHA512 b624177c9f8d2ad5cf9ad63380b67c7c21e9a2d16843896b9e968ec3c9e2213c9234a689a917ffa506b393ad4c3b2473cd515f1dee86fe99e85d744fef106f68
- SSDEEP 24:H3ySSSSSSSSJ3ySSSSSSSSJ3ySSSSSSSS:XySSSSSSSSZySSSSSSSSZySSSSSSSS
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13943_vm
- SHA256 44104992a1a6b4a7616967775bfeffa2aea7465f213edfe25795f85b95dc41bc
- MD5 6e099631bf4c85468f51fc6e1a15578e
- SHA1 0f49586d5074610e3d326cba719a7072db28d786
- SHA512 660d02e8def0836a23021346bc0866e8ab8bfcf912a25f7b24f5c6cc5a84e9dc9b7b3931c4ebdb5b89d62bebec44f001ab28473a3e83a0e6508d0d4a8d815f08
- SSDEEP 3:tl91hNl:tl9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13947
- SHA256 0b33fc8aabd4e80f7e08286cb7af50712939282ae2081420f1d5e821775cde45
- MD5 1fff77c81d8431ca8581271a46f1582a
- SHA1 e0528cf5bb18c2b6d52b101068b91faabcb3e78f
- SHA512 331f01bc24fb29f50ce6fb57752435db01b0e33739526fa8ae178cc107cbdb945924ed6142e563157b017e356e707801415e6aa0cc0969c4c4e519d0c5b149f4
- SSDEEP 3:t/G6DZh//lKlvln:I6b/49
- TLSH T12DF10437F400101DD337C53505340DF55D30544D0000130014715135145D5C01575570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13948
- SHA256 222440f53bd8199fb60372e26dec17b81f7f3254278158ce1357947c37b5e2fd
- MD5 b16c358e92f6b236cbba1030b07ef970
- SHA1 7bbdc2bcf65acebe75721b17579b026e29e3702b
- SHA512 f58b84e2f13ceed937ce5f656295a5e6a37114f056d7bcdc6189cd18fa98f4def6ffc52670fdfb9e8a595ef2612fef9e6360b1760a87647ee799bfa0e3cf6efc
- SSDEEP 12:DAU5g8lqv0K0uVGuEVDmZ0ug8M4tIbcBNvpuNpSdAalLKvgQy8275XEoLvgO/o:kwfqMK0Vudeu0cn0tQODy82rLL/o
- TLSH T1F6F17B07FAED79D4CD658A72D07C1860AF33A604AE21078F4847D09A081B1B67E13A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13948_fsm
- SHA256 962a13e899d74c006af6764efbbc6901d740f1a9165dd8f79d1e9338bb3f18c7
- MD5 99d1debbe47a2018c43693c11dd06300
- SHA1 c341d19b9b9011c1dfda387a42b2764dfc44e2a3
- SHA512 f5ed0df7f76cf571d4e8d8a9efc53dd5588cfb78187c2fc914451a8d5eae3580d1e4004e59aaa52d7006aef2b746a4fc5f501185765a241824ac48e2cf438883
- SSDEEP 3:nhNl/YtmXe++++++++NhNl/YtmXe++++++++NhNl/YtmXe++++++++:fe++++++++xe++++++++xe++++++++
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13948_vm
- SHA256 537a7899300c2652cf28316f9475e54836dd1ea06e17fd18b0cfe6f889d5e29d
- MD5 3a520a0e0840c6d7b29897caf1027d70
- SHA1 1cb25d581a76453c49b2d791ff359f396cbb2f71
- SHA512 f4d3625a3e4fd8112c5cc51b671fd7ab8a8cdec7ecc720d72186bb69fce923fc78f4eaf65a9555c644111afc69a3dab7dbf6634339385a16b0d876c958ff3dce
- SSDEEP 3:Ok91hNl:Ok9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13952
- SHA256 089310217425e7772b9bfce6efd81d79c474aab12e0c118a9b1e160e27d9b979
- MD5 68d798aac3c1eb54b5f51211e858a48b
- SHA1 f86762d5ae574c37da3087a0ef5b7f73942e7e1e
- SHA512 955c15b36a401b47fc5b046e97144cd420047293eb3ee1091c99bc26d5afa7cb592a8b830a72db1dadc65eb9f4d4e968542abca8efae474940af1d33ee672d81
- SSDEEP 3:MY6DZh//lKlvln:MY6b/49
- TLSH T15DF10437F400103DD337C13504344C755530104D000013041073713514551C0155D470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13953
- SHA256 97ac07364592e34e50fc3c833b83542b951b4876be8f7f6439dd0619b98bec58
- MD5 c0d44b8b0ab6b86af07a886a38e7943e
- SHA1 7b3c11754b8c5d59eb8be421ad99f0b06b2d4314
- SHA512 da531bf689cf4a6a546c50a6b1a54a7ec652be0cd47f1216ccd317157ba07ffc49096a2c5a778329f3fae4b9892a1540898ab123ff932fd8976b39ce0f4b53ae
- SSDEEP 24:B7nGRz/E/sAubV4/G3WcxVlcpMim0MbZWg5KC2dNdQr4d3rFG6c6:lRaqw/oXmZJ5KMAQ6c6
- TLSH T1F1F1F903C099149BDCAB2B379D33831E83E0C15B9EA5C3772B2DBF942967E8459257B1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/13953_fsm
- SHA256 e6487cb255273862082dc782be7649aa6424f1e1e9e6b2abe6c5dcff47b065a9
- MD5 494e3d7e1d96d96b0f3805d131e2c185
- SHA1 74f6ef50b1ebbf7c81acecab381fd5e61327ab2e
- SHA512 e17a8db9868e65ae37e182cbe07664fc77da613dc26f4d29ba7a63084526d5b778448935d9c64dec1f20c0eadedafd69aed6b3fc63ad48f1c2b270e09bed135a
- SSDEEP 3:nhNlitkX2WWWWWWWWnhNlitkX2WWWWWWWWnhNlitkX2WWWWWWWW:Bss
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13953_vm
- SHA256 35a97c5ce6d1d2b7d1a0913d77209517755a04053a0ff639a3f11900e3d77ee9
- MD5 62b366885d77c83809cdfbd1a0b560fc
- SHA1 f35f1927e543ddf22c2dc44f0fd8cc79d3fcddff
- SHA512 a065aa68ffdcf035594dcf952629061e2353204a45956fa8603ed4aebf9ae15def4b37870febcb972f1f0a358ed26b108efe4ac543cae59a02cb2c1ce9d6dcf2
- SSDEEP 3:Nl91hNl:Nl9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/13957
- SHA256 ee6c43ccd3c13bb0940824ae33774b96f9b02372aad2a7b4642ac39349b51cec
- MD5 a513a54a06b5923554b5446227b4b2b3
- SHA1 5aa0f1f9b302fbd411f28ab146f76878dc6c7f85
- SHA512 fce5b50b04de835bc6d3f754fe1bce5122ce548eee530e6a8a3272f50a98eda8efee6b3a30878ae9b29be7185dfb51a75b880be2ffe82565d203e1ad5be461df
- SSDEEP 3:xlG6DZh//lKlvln:xlG6b/49
- TLSH T1D3F10437FC00545DD777C375043C4C715530104D013013001071113715551C01555C74
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/174
- SHA256 e983985cf3f0acbb553662a11c43e8dfa3eed80db7db34f254b788e6476a3614
- MD5 42c453602ff9fd395d49a12c449832da
- SHA1 44cfce9b139033c715937e7954f1641d67d59a50
- SHA512 e0b09a1195772e36c3007a6f19c1dfc015ef65d10e429d4eb9f4ce7dbcf6f5516b6afee8d522f00dfa8c783ea1cab3522f24ff54dd433b4af40890b6f9714fdd
- SSDEEP 3:wtW6DZh//lKlvln:YW6b/49
- TLSH T127F10437F400101DD37FC135043C0FF55530104D00011300CC73313D14D55C01555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/175
- SHA256 747e0360559c9cc4e42bca63e03a3e9fecf9ee86512c4a40f8ba08f7185cd194
- MD5 1bd254754cd28df042da25591a20e3c8
- SHA1 045e19cda5301493c5b52e2d38ead67ecb65e825
- SHA512 fe4405f652c7dd336581b0960a8d827b1f00ecee6fa2304eef3b46967218767696375aa41752fa0393b05f37623a1d51330ee9f2feb1d28421f9632a4049664e
- SSDEEP 3:OsttW6DZh//lKlvln:OkW6b/49
- TLSH T185F10437F440101DD737C13504740D71553010CD500013000071133514571401557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2187
- SHA256 eee84ec25667442108e38f863617e4b7e96924efe5600c5bbdf61fce735a0184
- MD5 94d742a3256e2f6458b95eabe5b1c43a
- SHA1 147e1643cc1c2f3a0756c44cf25b253d63c97901
- SHA512 1a81bec6be5a27e80b279cae4793e888936b6c770d3ec3733f916d5ae4cda656c856d8d3989f1f6b2678c396dea11e494f270dcd5175ee741514c0ee411cdd87
- SSDEEP 3:p/lw6DZh//lKlvln:p/lw6b/49
- TLSH T113F10437F400501DD737D17504340C71553030CD010013000477113514555C015F5473
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2337
- SHA256 cf3e0caff69b192dcccdc65598e508af847af9753a2e7d0d6e93cfb010d8c87e
- MD5 60d5b974f8b14335ecb00a75ff147f7e
- SHA1 80a25404e47bbe9011f88dfa3b3f89f2e93ce9c3
- SHA512 629d04849e90827efd5554c3e93503c2bf2903991c64438b6557a46817f33bd00521f7e3c7fd43cc61892b72317032ac746323c13d5ca737bb11c95bc497d55c
- SSDEEP 3:Z6DZh//lKlvln:Z6b/49
- TLSH T196F10437F400101DD337C13704341D715530314D45001300007111351C551D41575475
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2579
- SHA256 96bcd8dccba2d6861bab04d6be0e757fedd52c7f369b56386705e958a901f175
- MD5 8131cd7aea892643d0f2020b4186d373
- SHA1 e7d73aef73cd1c7af869d808c95e450fd665f13c
- SHA512 4910587ead6a5ceee49bf448ab3797aa221c6e15103fbe8647fa881818bc72acec7d1ad84c68dc448afbfee5f630e23c620973fc2baba6fda5381072bbdf59cc
- SSDEEP 3:0kg6DZh/stlslwlvlBktn68ltwKvllllllGllM:0kg6b/sXEQot6xq
- TLSH T1CC72113BEB00382AE23E83330A200FA20BB0E08822820B0200A200B08CB22800EA2020
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2600
- SHA256 5dab58223ef2baf2311df73a70a7f204e82a5cb0b244b320f336ed14ec2d2d20
- MD5 e5847f40721307e0df0ebef9c478f0bc
- SHA1 fa7514efd692660e7c2ebe4d331171429ae7dd73
- SHA512 3e7de7d464f6d79c4d3f2c355f7154dc1aa649c799b9391c8cd65eeaf66de7ff0e1b6eb854f3889d78d79128ff324b0c2c8f90e14f2efc49dec51b58f296545e
- SSDEEP 96:DcnaIFx0a3xpiqSEjOTdMgEV/5BzByihjYFM:Ax0fFTdzEV/X
- TLSH T1AE72C159C7B0DA3BEA80E9B556519FF3D714E859FE698F0333241362AC9205E0F421AF
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2600_fsm
- SHA256 2e23a97b5a8e2294cb7b583a1edfcf9102bbfe86f57ead234dca8ada3a2d12f2
- MD5 b1b0c39361cb51088b30b92d0bff141c
- SHA1 4d1d971c9637a1d9af7aad00492e5090d6c84b47
- SHA512 35f60ce53a78ea8735fc072a19d43c51458f5404b38bfec78f3926f0f415f1e26520ea2124c66d5b8449c997aac0e62ebb1732a2b8a5184848c48b2eb970e5ec
- SSDEEP 3:nhNlPlv/XV11111111/hNlPlv/XV11111111/hNlPlv/XV1111111ol/:s
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2600_vm
- SHA256 e669789b8fbe77c5aefb3aa7b08835792226951713d95362970e0a9a290741c0
- MD5 9c1dcbe565be30d93158b35ff63ed0aa
- SHA1 6afd6c000dd3f9e1ee67af7cc443fff795f933e2
- SHA512 ea46f73c582ff755b752f88e12dbe510c4610804caa58f4f1c58a5bdec9511cb9309363eea3dd1e2662d30205d61692da96b8d940afbb792fefc281d67af21f1
- SSDEEP 3:N/1hNl:N/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2601
- SHA256 8ac325c867de92e7c1dde398341862909932906c94d749d83b15a15810e0490c
- MD5 dbc4f3c37a43037af15a4a5b8080f2f4
- SHA1 afece8001a9e1d49394e48c0d500a368fdc8cede
- SHA512 98a44987e4c403955f32ef35ab00405f79d2da76c563fe39a01550ca70ef588a6b680d8278efcfa7aa26b1124e7bca817964fbf6d30351c7625223b82f5505a3
- SSDEEP 12:OYMSgBPP22wxRpftSb3eKI9Nxd/CFx/x:/2+Jli3epxd/m/
- TLSH T17FF122B293800CB2C7302B349403370E5712F26CC53DC3036DEE11994C2330C0C84848
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2601_fsm
- SHA256 962a13e899d74c006af6764efbbc6901d740f1a9165dd8f79d1e9338bb3f18c7
- MD5 99d1debbe47a2018c43693c11dd06300
- SHA1 c341d19b9b9011c1dfda387a42b2764dfc44e2a3
- SHA512 f5ed0df7f76cf571d4e8d8a9efc53dd5588cfb78187c2fc914451a8d5eae3580d1e4004e59aaa52d7006aef2b746a4fc5f501185765a241824ac48e2cf438883
- SSDEEP 3:nhNl/YtmXe++++++++NhNl/YtmXe++++++++NhNl/YtmXe++++++++:fe++++++++xe++++++++xe++++++++
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2601_vm
- SHA256 35fefb3e8c22ac4c47f9368c7f6960128b45b74fd888a1109a4b1d0e73ea7843
- MD5 f1dbb45ac939b9257447b9f00dffce70
- SHA1 ac12fa2d0aea80b33a1df7f9fe511a6aad09a5cb
- SHA512 d85566afc34e03d8d46f30544c97c9311ac642b66e0022a876049f005f93f9702e9bc7a74e2c86840295e01fd227aa0357c753eb6aee5ce66f4b4fc9bb4f81bf
- SSDEEP 3:slll3hNl:s/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2602
- SHA256 583b90249fb4100527ac1f3b7d1e73e539da3166178c3280d6f5bdfaf4d3e065
- MD5 65ed72ee43d285e5d8abc89f4a11880a
- SHA1 4e2f9a29fe6d7fff7b046f167d6e784163e9bbf3
- SHA512 ba002d84f44f2a0931810d55f7b6357a936f94c61fe8f21bcd72b53830dd15d69172167df94412aba3c0a467494e4985164a1de34a508e19b2724b726be0e79e
- SSDEEP 768:/PFZHzHlVS6a626l1l8qmMcNlHBqN9qnlPn1koe/Cb:/jTHlQ62ciMYQDqlPiob
- TLSH T14423DF32A3D19A32D8358C71D92F5B88876DF6CBDA5EFF03825C16292C62394DE1631D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2602_fsm
- SHA256 2215887a6155183a026c07d98f90df2e4fbf3bc16977c8977a288435aa6e5bc9
- MD5 a72202d7af56304e9bca4b6ca019336c
- SHA1 ff129784ccbe08b0b5a758ac74d10f836d627c84
- SHA512 d2cdc3f1c874331ab023abf81d56de4250662ccb135794df3b1bdd5dfd505960c1cdfb3b547b475c7a5836b1079c2ded2bb31530a6e0c699bfe87473c6ec0fbe
- SSDEEP 3:nhNl9R5lltlzlTlTlTlTlTlTlTlTl/hNl9R5lltlzlTlTlTlTlTlTlTlTl/hNl9L:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2602_vm
- SHA256 a9a664e5510e2df48aaf74d2690b4076517e2053336f3d4723fa5cbf90065d34
- MD5 6ace4195c08362892b71c85b0dc3bf8d
- SHA1 a470daa5fd7fd97fee6348000940714c441c022d
- SHA512 9a52928e56761e908a2032eb9fab821e05f1a48f25085b231708f32911b56b5754af431c03d7ac55a0c83b3dc6ed71283d88beb92bae800a3e0e0a57c479e434
- SSDEEP 3:Gkll/3hNl/:Gkt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2603
- SHA256 d5c099e4e867d1591fe29839b3009f1cf836c1a606ea6eac447f77ec1ac5b155
- MD5 d0426157a5ae3ccb2d32eb9533614f7b
- SHA1 3a264bf57cfb7dd6b55bd3130e618d0cfc7e79dc
- SHA512 7beb50769103d62d85246b26e1a10431579057cf08830d1462ffa65e09e151f0153685eb104435c756553f05e07cd308248bbb947f81a89b09f08f5ea6445433
- SSDEEP 384:Dwp2gatpYtwpU6pKBt37vwpVqdJLyopBN4BI:8/wB6Ro2DLyo77
- TLSH T186E2FF3693B5CA73CD7A023CD8BB07565BF6F180EBCF6B53629C5124ED423A01A1A11D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2603_fsm
- SHA256 597943e0aa8a6e4f77af1836d846f03822c5f787e6583962772dd3f42c246ac7
- MD5 1596ab8b14228bf457cea20d45858340
- SHA1 c783a39d9de91e61ca80ad54e7615fb304afdf0e
- SHA512 587bf4ea06d130105999e8bd2fdcc5d0cde600a5320250d54b01d1d6d44369cdf0f7aca121f74f9464077f17bd1fa1d1ab20f0ea949ae89b624bc4e5d8a9ed8a
- SSDEEP 3:nhNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/V:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2603_vm
- SHA256 873577d804dc8342a43ca558f5a1b9c0ba45b68ec0e9a31bf11cb69fd671e606
- MD5 5c90ff850789d839276f8f0f1d8eef9e
- SHA1 e1eb2c3a4beb1ad6860003e762271a7ebc787440
- SHA512 22daa870960892fb3ec78a9ac55c8290069ba464bc73d18889dc0511455662914a239dbbec6465e06f394ee8ee0dcf0b83ff4aaec06f57d2cd3e145fcb1a9f65
- SSDEEP 3:pll3hNlA:pllC
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2605
- SHA256 06b1a578d46430a073d41b2ffbe471811830bb27e8f13bc22b7f430f12036a02
- MD5 e50a4adc3961bd44a9ddf0f728e6254b
- SHA1 e1843e3d4b7dbdbd1718724a99bc88aa637c078a
- SHA512 20fb58393ba93e7c19a7e565412262fcba4b67fbfa7e3cd14feb973e4a330c81011ad216604d2af864e14241f35cce23ecb1cbde59c74d055af9b26dff33e130
- SSDEEP 96:u+SYlZd93WV6ImGS9srS0F1o8T6RScgF7idnRRAV7k22/5ywMnHIiNMov:uJK4opa528T6RmidRSV7k2g5TMnoijv
- TLSH T1787271369BB48E76CB85743C51374B4643CAF500E2FD23C3564FA139FD89284CEA685A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2605_fsm
- SHA256 46cee7f12204381b6c10d3be7da701c980f24e874bb783e9b6088367ac5f016e
- MD5 8cfdbc5f23b6f1fee8a9d69db323c0cb
- SHA1 7c80a4ca3ea9da8caae3f0f42196ea4a7a45d489
- SHA512 db5836ea8cda9b6cd1f167412863a2c217476657e19b0da1d44b39f0f2d7efa354ad74b9f05757e9d92bba81ffd16299cd2c25262c0daabf5908539f186bd73c
- SSDEEP 3:nhNlPdPl/lflflflflflflflflFhNlPdPl/lflflflflflflflflFhNlPdPl/lfl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2605_vm
- SHA256 b793dcd36aeab0015af1281fb0f4c77d67d6ce8196cb86a17e176476aa400d4d
- MD5 c49062d42873edf3ebe04a0580d3c342
- SHA1 ad966ec268a118fa72fee8ec4bd580fcd69e7435
- SHA512 8eb377e6945f590f4b1c35880593ce711ab2186de45e3a18a9301fd52d1eb43b2a5bf4eeca36bc711e9ee761dc0222dc795fca3d677736ad263c2d6af864b939
- SSDEEP 3:schNl:s
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2606
- SHA256 2d60364387caea6f93234e7a1fac20015fb6d7bd24dfae8e14abb648e987bf46
- MD5 ed4a8f04efaf4dc0865bfafa57ab42bf
- SHA1 a70ce871bddd8031979e75ff2cc7077c09d59322
- SHA512 260ab93be6ff1c5f2dd30225b517b6f2f86669842d42063b67415a19c89fdfcabfcc3a5bae1e7861504e8b3f9701643999755db500b04b645cdbc605ef607d6d
- SSDEEP 24:sxwok4NfBodlqKQeMTiaP3xlyot0ly4YcNWKQNK+k+q3/LbxLuqaLLK:sxsuBsluTiaP3xFihGmbxirLK
- TLSH T12DF1AFD18CB8B23CD9F7B7B2D6880105833BF38A3144D5C2761E96BD24119ABD79BB05
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2606_fsm
- SHA256 0a0a1c37dac8bdbef9df76487d9214197a94ea1595b3837fd5073653aab6097c
- MD5 9fca6a8d410b4c7ca3518b8465c96baf
- SHA1 a028be3b598b2f74ecb8af4c42f0c90ad36cedca
- SHA512 7e9a99774c5e125a71fbe353d0c5973be80202550b3a87664a6031302ac351c5064a3971134758d9bf9ad56dbe5174f2d9046a9749954e3c53d9fc47c6c7725d
- SSDEEP 3:nhNlLl4oX6aaaaaaaanhNlLl4oX6aaaaaaaanhNlLl4oX6aaaaaaaa:TlQlQl
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2606_vm
- SHA256 7a7950d11029d7179fc1fb1c4c966b4e692b248bcf77ad58d2f856a04894e64d
- MD5 c0faf2cc0ce1c420d4ee22f47f991c55
- SHA1 f4d55d490128aa5b251a06d2789b3068bdf03042
- SHA512 31deff76e353c240a1a0c22dcc76e5558674efebd1957eaea89ce4364a0a783abbaefcd3366128d06767fb4a3fef4f0e2a000b5216f8caea77b85a2358593bcd
- SSDEEP 3:Blll1hNl:B
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2607
- SHA256 ffc08008f5a9201e3e22b116b12a5ec22dbd36028d4a2167cd6b1f24eb20c055
- MD5 59902a3274f338e486e55a6d47cc03d8
- SHA1 c6fc59d28e96db19afd1cf51cfab9383ba067136
- SHA512 6072fee9499d763e41d9cb722adaf6e2d4a12a568ffbe285780fbef2c10b794ca15b096b7031d52c0684fe1ac539876f51f69b75cb84d7e9b2372fc53c362edf
- SSDEEP 96:Kujqc2pxsjKAQoELTDMNCudstQ6e2tO+nhn4zKsHDRzl//:qc2pOjK9JTzWFPMd4zJj
- TLSH T1E872CBB16B2CF171F3BD903546AA03221755E8D1D9BD13A34EC8787A1CD384ABE131E6
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2607_fsm
- SHA256 3184d8a5d01dd16a0ef31a9c1cbf372d22a3d49be67606a99f465326c2e1fc7e
- MD5 5d614904b11262f1ba4e00107d200e94
- SHA1 4970f70e4f566300f993291fd862fe5914a7908d
- SHA512 3d7223151e8929bd08463cbc3f8aa91e9239d0fdfd460e8d704498200fb4af5dc28329e4dcd8f176953fd7965c1de043adc355d5fd2e09b9df23ead3add33bbd
- SSDEEP 24:X3qKKKKKKKK53qKKKKKKKK53qKKKKKKK:Xkk
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2607_vm
- SHA256 391371404ef6a14fd8ee96c3527fc4bcd5d929607408df7e9b2f1df2ea6d6654
- MD5 e0c14f88f17a5e4e8ac196f217b503e8
- SHA1 2c8f8b7a49cb73452df9e9443ff8c6df6b7de2fe
- SHA512 6c38acc136c8a253456dc77e23930fea69a59b574950247be29052007f002f678a552f8b430caf5b9c7de532dca33ffa5369452190fbc81a7a3cc2bc40ed183c
- SSDEEP 3:qst3hNl:q
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2608
- SHA256 8022268f9d802e99f1a8ddf97fbc5ecf9cd59c9490201acc1be0180992eec68b
- MD5 ce3444360a142c17cc58a1210c21ff00
- SHA1 9582c4777fe77ff96025209864b414761bc8a61f
- SHA512 18765e212963a01633d6276847f212e77a63c1698b1ff70b6943241d41fb8d0ed1a5eb1b925e3cf12969845c30531959b7683178c9b20ad2e292a490960af990
- SSDEEP 1536:cQ1ap6gfS5tAV0+dElgklKXImz8XFdHbWiJbff9iLnZ4gHzFKNl1N4pY9wE:cXoXczg7pBf9iLZ3HzFKL1N4pY9wE
- TLSH T1CEA4BCCEBD05BF0CDA2C057288AD0297A31F9DB9FD250A56C16BA0F1394319D5893DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2608_fsm
- SHA256 305d2894e1c936c3750a5434ab765c94279554099238e95fb2b1aaff7d4ab007
- MD5 83cbdaa98086445ff47d94f2478c8e74
- SHA1 1841fba9924ceadd2e430c87507f49396afe5574
- SHA512 a3574489876cbb6e0db95f3c1877d91e1e469ed3a889346717834c60117c52a11554e4e7500c894c4b429752cda41d5692759493d715d129271d15ddf840d30f
- SSDEEP 12:Xe++++++++Re++++++++Re++g/llllzyo:7llll
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2608_vm
- SHA256 5f767037cd0a9b6e402a92a7f8457c325ec6dcf68b81d77694ab3527b1f57905
- MD5 897be13fd9d82fb839f9bbf934c57127
- SHA1 3df8f161e4049aabc535e76e204536ac8053d1a5
- SHA512 dcfdec6a255d4361346226e0a1c86a3134a5e6f0cf51b8491063fe0ae59c9062d2b753db7cb26c77eff18cfafb47589f0ec84842f1cf75223afee9c3d57242a8
- SSDEEP 3:ylfhNlpY//:ydY
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2609
- SHA256 3ff9f7bf2d9576586faa80e8ed1f7717ee131b9834c6204740e5146191e07783
- MD5 baa2165758a8138406ce78bb2aa93407
- SHA1 324548457db2acd67eb367c6aa29ab0d77c658ef
- SHA512 0dcb35ae1cede8e28f42476d5af32de171a7ef320731440470888d86cfca7cde7e2f279d962ec5523957b1a8b8c66dea4aecaa3982f96820f2fe0a4cec8ba005
- SSDEEP 6144:Gosz4W9Esv5PZMLdNQ0wAs04Ick/Z5RZk:psUW9lyQ0wAs04IckRW
- TLSH T153744E77F68824F0F87F7B7355BB1B2B5320C6A459411397262EA0743DA2A391B2ED1C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2609_fsm
- SHA256 98a240bdf39af511e98143cd68cf3773ff6c8f897b2f2c144c5dde15c87794dd
- MD5 6c281dfd695a7fec846d5af3da7f9187
- SHA1 2328450f6ba5fda86d6b8609d7c511084515c4f1
- SHA512 e5e7495f4d9b85e76ed1b195cd1d777cc5fadfe31820a6e8fcfce7dfaa99196797551e0e78f8208eaa23d02d895c0c1e4306da0369e1ad13793a838e18ec1290
- SSDEEP 3:nhNlflHlPlvlvlvlvlvlvlvlvlFhNlflHlPlvlvlvlvlvlvlvlvlFhNlflHlPlvK:ilpyAJzWslDjcltXQ9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2609_vm
- SHA256 14fb8ce43d7f2b5ff8166e640840b783d5e6fa497348152a0cef9736a59e2952
- MD5 7ea275e7cfdb7d56f4095d403e434f0d
- SHA1 8d6db886694f435ee5f59e8fb0a4928f4c3179d6
- SHA512 a9c5a0cba7999b9b1e2818416f02a780748bf0fa1f399aeecf5d5d9d01b6e78ac39b183bd69da16c2633e39997654d5099e1bee25069c0f84bb5ea8ead770030
- SSDEEP 3:tslfhNlpA//:idA
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2610
- SHA256 7f83e391144798f0556e5796324008275aba67810687773cbb63c424d8a24af0
- MD5 6dc2f4427b7b59f1fbf85761c63a6fbb
- SHA1 ad23aa7fafdd791d54c361a41fb837db8d6982d5
- SHA512 bae647389c83a4ad076bc9aaee85c610098b6b9a81a8799c7e1d2fc18f2aa9ad7f787462f1846aedfcf59aca9882415d5baaf3be60f781ea0629ad1d44826b85
- SSDEEP 768:Wn4BEvf8f88BDteuXVGOTMxFp0Hq5mkn0qqUrnEifbz1MzkG2PCPSRuHBOqzn:Wn4BEvf8U8BDteuXVGOTMxFp0HOmkn0N
- TLSH T16AE26387F781BA1AC89C4F7052BE8752673BD24263274783E12156345FEB3D94E3B288
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2610_fsm
- SHA256 ce432af889cc5e2d8efb9e6047fd1a890bbb2a0238f3d62df0a8039aff991604
- MD5 11c84beeb551ecccd480e7f12c6548bf
- SHA1 5885de5fe6a4dfbf4d3e789358c95ea24d6d1c44
- SHA512 08f8bcb7e2783680b6fd02f8ce42d72ea5923919fbd9d4d156e1428580f83b897ad35302d5d3ae31155212824a8f083f085314933afdeb6b4c7b9a0c6e6b71ed
- SSDEEP 3:nhNl/lV/o/I/I/I/I/I/I/I/I//hNl/lV/o/I/I/I/I/I/I/I/I//hNl/lV/o/IP:XwwF/p
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2610_vm
- SHA256 d36a9bdae93a9036b42e3617426a76f7617fca04e88286ed0d211b86690f82c6
- MD5 27fd7ba658aa81ed02f1fdd53f0bf519
- SHA1 1f603f72c567c084d4d5ac83f5dbe676d01fc2a4
- SHA512 d3d8b941c859d03c17d35195e83cac93a263d7540c9a12deaebe6ffc87cbe58b785328df345c0790ef165787fc1e81c91482303f76a7789057656f8e71c4dbce
- SSDEEP 3:BEfhNlA:f
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2612
- SHA256 53c3f13ca581559e5912c6f6eac8bde874a308aaddf5cedccf6e3b7463cb6fca
- MD5 f00459e7a04259f1f90fc179bcb14050
- SHA1 0b45d0bebea3fae36c11497fcbb5ac432e2f9b42
- SHA512 8bb9e0d181dc594a7b3be7f043c9bbc6f8a25da2447fa6930d02125ae5807387bb68436aa2c02b59b7bbc4c98629090332e37fc91f7ed7706b49b32765a41c0f
- SSDEEP 6:ENfjc//vuFBt0slkP2sk/v+16/uly/Tx/sT/WgLgB:EdjcXvuFBeJh1KvZsj0B
- TLSH T1C4F11246AB46D92EC498D13310C587F25361E932274A8F5523C3491A5CD71D01E53704
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2612_fsm
- SHA256 102d273dad9738c450fb1b02e377427c3602935eab39e93a9f8e3bae6c44e30d
- MD5 aea8f5edde98825ca5f51d06329e21d7
- SHA1 7f494cb602fb498b4951a18756270ce0f121a577
- SHA512 5171140fb36ce404d290a1fee40bd3c4f9052af7fd2a5e48c440fffe017a68011430c767e729fafc4983e7c82ac7aca2594ae7f44ebabce4b8358d2a87525fe0
- SSDEEP 12:6we++++++++cwe++++++++cwe++++++++:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2612_vm
- SHA256 8c1b042512a03976a1984962eafc72a5e289d5d40502e75e61ba1c1cfe145408
- MD5 43d05a5948ce0279e96c1cc27c2808da
- SHA1 105ea4a3d9b4b9e3401d146c738b5ee083f790c8
- SHA512 29e9e8ec43b748fd8e93783858e4ce0c3fdb557f7bdd21d7ce42b0e28901b92e65180d1dc17825e9b300683819b7b7c20c4d8a51f37d669bd9e235d5735f464e
- SSDEEP 3:glthNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2615
- SHA256 0a4c53a855ada3fdb4b4d4135b4ebe8e1939f1b7d825f7de6508c34124b4b5bf
- MD5 7736751aa692e816788db14eecb3c907
- SHA1 d62496cd5b78dc3f687158626c0e682feb0a9594
- SHA512 cce56a32413de187065d3caa671e136c8ec81ab23703212ad8c4e8e3c3417c7e5a05ae7b3f094c6c0198b877a86bc8efc78f5d837cf6691cf85890f0e53bc8a0
- SSDEEP 12:8LjI6wYxm1VO+uYGlg6GYxm19lulBem1sk:8XrM+wG7MHwt
- TLSH T165F19A96CF024CE1D86F8A3100C3160A37B9E9006049CB2FB8C84BB02CE77824F0A128
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2615_fsm
- SHA256 c924105da53ff3dba9d9c8df9d39f93e3bec42b6e44edf124b329d0642d731b4
- MD5 f4c0fce5bd26eef8fa877777f49ca3d1
- SHA1 2e918e23d7b033e9ac6ca03f2e2084b8e28084c8
- SHA512 b7c3fa2605c0c6d30219f0e77c1448c10cfdf91e05f914a9a56bcaa947130964bc15864344c70710062476108a16e1fa985412be7ffe9594f8fe4936d6d52324
- SSDEEP 6:TvAggggggggNvAggggggggNvAgggggggg:7AggggggggFAggggggggFAgggggggg
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2615_vm
- SHA256 1b7d466a651f86f5c09155577c10cd7b8db0c506549e8119d156346414418857
- MD5 4850e3b8900894980d4533672f4facce
- SHA1 5cc44513aa493dcd50b733244a254206080dc562
- SHA512 bb6827fad366acf2c3a885cba65e92203c0503ebfa0d9071c2c09cb4e573ef44decc7839afb9f7e20660f21e97364263cf5b18ede16e0b63589ac52466ac4adc
- SSDEEP 3:At1hNl:At
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2616
- SHA256 6a4cd3f74c8ad9d478b3077ed96bbe18236f5b6979ef0e374595ab4cf6718865
- MD5 a6a97a053343eef3f510cdb0f59d9ff1
- SHA1 19692cfa38f32ac4f1573aa440148ba9d9788183
- SHA512 9f4da9a952b985e5c6e7efd8bff1137a77a0ba1c3ee4e8b9c0e60d7caf1889bf66d746f2f83716db224f584e81a71ccb5aa9c2b06b49b10570dacd81d7dfb0d7
- SSDEEP 96:J5FleNKZlJh767QSH1cyi5DXL6Ehd7iOCw0vGNUwKF2d83:fwKjz67V3yXLbhd7iOCw0vPF2d83
- TLSH T1957295E543A8EA32E47D4032E67B2B905711FE42DE4E9F23C5E842785C93E117E17E4A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2616_fsm
- SHA256 f310d8b6a08739269466e860f296bb8685a209d226183490055596e72693a47d
- MD5 6b2a9f0a1111a5bca3521facb362e312
- SHA1 afb0bdde0d09b905db0eb71f7cec81f849bc5c6a
- SHA512 282b4c7426ce570bff83ae2d0d1342be35757d772d90754f48baa2823c12587435eef29f5060e2ab59bf14a3d20ad5782c15403f484ea6139498876973921490
- SSDEEP 3:nhNlEhNlEhNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2616_vm
- SHA256 476d05966c6daaae57d1926f657ee6b75ed657ddd674b6e4a77bfe57442965c6
- MD5 3ac9a41a95685e06e23d66a33d02ac9b
- SHA1 e52c60d41bfbdfa9aa67288ffd6b08320675bb23
- SHA512 46ea3a6b8aad402c7edaa1b07d15ed6d0c0aaed165571fb9169857e30831ec9352bd1922aeb1b383902e8282f9026d63d67f53501392381c0186e1f0ca78fe4e
- SSDEEP 3:CEfhNl:C
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2617
- SHA256 fd3855e7d57a1b2c973e6d69d7f399cc47ac20c3000fd726b2fdd89fe8639ebf
- MD5 1d237db4c71e87a621c0287aa507cf6c
- SHA1 db102642922898ac8c74fb1604f781332e0f1fdd
- SHA512 991e8a6eb7715a16d24e6054fa72c62d256602e35b77d9590627ab777d5d815405dff657e2e79a3d7765a81ebfbaf95692e0a82cf1ccb4ce30933ba40296ae2a
- SSDEEP 768:ZIaV+DxyflL5OvK3zMLAAZIi4cfwMaPTd75lcpVF:CamWlYK3zMLAYIiRpVF
- TLSH T135B3C76A9A8E7B37C86E51305C6A4392E368FC94B39D4F63179C95302DC33643DAF984
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2617_fsm
- SHA256 0992eccc48ecbcc0a08c97464986dff471618fc51bb319a2a54dce0e6cd971d7
- MD5 bf4b5210d5098a637a4e0da5433fe7d5
- SHA1 bfcdfb83067a5f9634ec404f6b9f076af82648e6
- SHA512 f0f3c0bf05c5c447948b069ba5b9374fb601d26ff499bb5a63653f4ecb4f09e76088d6bdaf89cde9758cc9590180ddf7e5fe41d3779a68a5ba0d31f3b4dd7244
- SSDEEP 3:nhNl8hNl8hNlklR/hstrft:iX4
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2617_vm
- SHA256 ed155a396e5eae53e071c8c93e171fca4aee285daeff4ec4dc200c4695be57a1
- MD5 ec33ab38a08a0bfecdedaa4a9ec4c03d
- SHA1 d8b1b082df97249400e692932f0301c5411d4f91
- SHA512 1cc6a2c6b060db4e71af4e433fd9aa2536caad708b877f5e6f3f1ac32448dab75fe284b86d3d3c282c9db62b14fa77db99b70429fd4c2a93836fccdebda27c5a
- SSDEEP 3:OchNlB/:O0
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2618
- SHA256 6df3e21821870b8972ec2003a2564c890290cda60ee552d18cdffd338bbbe645
- MD5 ea48548f0f69fe1a5d5c6cfed7894b92
- SHA1 3c57e55de05cfcf7f91ae82a63599cb8cf875e50
- SHA512 1f14e2735531ddb51869f21fbaf986b42d15b58b45a680372ac078531f088e81867994922cd4555759da9fb38e0eb346217df555ebfcddba8b40d665d3c303b4
- SSDEEP 1536:We54lel+epNe+PsZGailiGMB5jDPhWFnv+8prpxWgS9:W4Iel+eAriliGMLDJWFG8prpxWgm
- TLSH T19EA34D3D4E78FD19E32821B7EBCC33516F45C6A1301C87472ADD99B86CA17AE8724B19
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2618_fsm
- SHA256 8d93b01ba6d112b1c9a28916d2058e807d26dd8f6fbda2554417b2239fbcb3d6
- MD5 c7c5041e125113638038082bba12e415
- SHA1 60ede1c5170191b279f13d3156eeb7b66738ba6f
- SHA512 f757f8d09c6bd29324312d199ca6186ffeaea970f357c7c48b2c40b252e5b87d1c03252acd3340d4de42015a74f6416084334d33cf2d3ad1a943f10a9a7b1318
- SSDEEP 3:nhNlHxj/XpJJJJJJJJ/hNlHxj/XpJJJJJJJJ/hNlHxj/XpJJJJ+XWXaqollxOx1:ImKFm
- TLSH T1FDB2090AE0856B9EE038DF35A808604EA4CA12EC003B81620E3BA0170977609034C282
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2618_vm
- SHA256 ccdbbb3c1e84fd5458059269bf2420e28e780748fb137a763cfb5cc81f6357cf
- MD5 c82b7c9bc37073bbc367c4efce34fee3
- SHA1 c869c1c90ded6172ec35faf1b13601da354bad22
- SHA512 9758481cfb1e6c8873318652078a0a18ebd5d91b97bd89b5e765ec8d8a6fa77b76a4691bcf4ed64378345b4b262ff910078d6c5dcb9cbaaedbaba1192fc5012e
- SSDEEP 3:CM1hNlG/:CM6
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2619
- SHA256 89602472a38dc664c22f1c85fad33fc4fd573329b8517cffaa103763778ffe44
- MD5 e6ceb64f08139c098df6d0e0077f5b02
- SHA1 0af0af69d1574e37b85d6bcc142b84b6cdf9f871
- SHA512 041282f6e13ae19d1e512a9f694966a99fc7d3f5599dddc6927a02ae72650c31438f4a7764e124cf421126178b3e64732367ea7cddb0fc5f6a85cae1ebc488b9
- SSDEEP 3072:D7h6JvvdkyzrVkmS7dyNUgl6dVq84Q0/ZfnG5G:DwvvdkyzrVkNyNUgl6D94QKZfnG5G
- TLSH T103E38302BBC8AE07DA6B5F34C1674F21A336D142BBC94B832B5476347D833E95D960AC
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2619_fsm
- SHA256 43ad664e7b1badf23b19f1335f6ad2f73103b2f6db13cb77b3b32413bed719bf
- MD5 628b1dd2ac2d826243bdae2ea4f3dcc4
- SHA1 6473269ee19d9775b0ee79ecd5494a45f8ade9a4
- SHA512 3cc66d8d5889edd274ea8af9bb7773f19ecdf0b1b43f9637b20c88e944c1ccb699894dc78e3065a2182f15b5b8394d5b79a3b1bdff5ced987793d20315fabadf
- SSDEEP 3:nhNlghNlghNlrlt+t/b9//HkhkO/sXoKqll:Nlt6bF/Hk3sG/
- TLSH T1CFB201EAFD05DB01E81007B9E90A78D071CF22CA04314D4600CFC9A0049B36900D0240
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2619_vm
- SHA256 64e422322c92a154d10a968338ed98266c2c5e44de9ce82f65fa4f277b925e81
- MD5 fb51abefa3d3261ac2b8da2bfc78c7f6
- SHA1 f83d1f6d88a4b717941a2814622c4a67b582f457
- SHA512 c2cbe564ce5627aee56eb9c3a9c04ec08a2764e733628209a129659c524d104be2f5ff364a988435ad7369fa6b9ff39a7c385b8f2b85a6281263e0e3b6be8217
- SSDEEP 3:Tsll1hNlp6/:4/lK
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2650
- SHA256 80ad377789f3075de14daec9237a3e0c9ee3f1261c867eb954b9f4b5c41f9640
- MD5 8fb4074ca9b8766d5f14d185bdf7bb64
- SHA1 db57973c7d658a2983b00a2a4cf591c1d433c783
- SHA512 90dde72c9413dd4bd2ed44f7012e7dcc2c8218462bc015f6b6e1ccd40b5431d1f0d5dc9a475badc545ae330457881e2080a03079166f67f6556870de6eb8e6bd
- SSDEEP 24:rsxl010q+9+O92yy3maunjkWUTY3YiIzfHQQtdwiW38z:rsDcscGRiw8TWY3fldJ+8z
- TLSH T1AD72BFAA5B1628BDE9360FB5944897D271B3E069050C3B87103429FDED7B0E05E3ED36
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2651
- SHA256 0f8f4328b1e6709b9929422b70a56a6cc1bdb4dbdc31f5ad3464cccaf9bffccb
- MD5 840e8d582931f16765115953271d4bcb
- SHA1 067f56bf5a55fee2ac376b4c029978ab3c912342
- SHA512 21b3b106c5a4cca67b4467abac422c2e48555936e8eaaa6d9445e2699b0918c0cd0441549f1a9691950d2c37d2a896ea7cd36db8028f21c3d06cd5276a807689
- SSDEEP 6:rw6b/sXEQFoH6N63etl+l/UWlgCKX3/0Ki:rDEXEQFoH6N63eXa/UiHG/Bi
- TLSH T107728C96EE812897C2F2833758590ECA9673F1FC4C258F4241F111380C2A1A41F3EC45
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2652
- SHA256 5ee8d8581036fab45e4312ee636879b6ce997488df7e7638aad369ec7afa5731
- MD5 734b99d1a840df0c39e0eb6df7a0a35f
- SHA1 9580d96d7b80c234687cfdf8135217d1fcc67ec8
- SHA512 c88f1a05155fb0c296f8b0bd561f8430a647f0b025802c62f8306fc1fc4d2ad95b196bea1a01def6b26d86e846b7e892f9a2be1858cbcdc4c7e9445211c63cfd
- SSDEEP 3:Q//w6DZh/stlslwlvlMkXfwH6fF6fAXCXDqlTv//lHli/Hl2klX1:Q/w6b/sXEQukoH6N6/XDejZli/MsX1
- TLSH T150722B67DE803433E135833308380EC027B3F0AC48004F0740B1103C0C552D00C3A850
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2653
- SHA256 b72d25c52becefd5a0b469bb7ce87fb9fd495ff1a01278eab34f428ac2188813
- MD5 4f0651d0a78f5932c9f574bec54b6846
- SHA1 78038d3ed272f673bab42324cc480f416bb0a231
- SHA512 25127a46ef056c1032d96e7f90fbc5fcc1bc57bea856c62d39edc64992bb306132a1ef18e7def65026a85d4c187cb1231831be370edbc6ed6e44d3dd2f8eac7c
- SSDEEP 192:8nI0Pw+MLBqfpvtn8nRwJq03PUtqRUj2FOFtwetmnJJ6A7KAMV:8hP7MApvtn8RwJq01dFO4etmJJ6TAE
- TLSH T16403688AD7C59F13CE9B5735E8BB4B8BAAB9C18897039F075314A1353C417E82D6B12C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2654
- SHA256 b7913604d85454e1a729560dd9bfc2faafb70a0a9161110323ee4f216bbda0b6
- MD5 09f5e85410b743bfa1ec70f31ec6bf1c
- SHA1 41dc08182860e7860d73d2fe175776220af5251d
- SHA512 de6aac5f2bf48646f845f26706946ebe0b45429fb9b15d28e87de22e5d69be14a5abd2947097b636a4a90b69fe84cfebce8d746103f545331106ba1a2be29055
- SSDEEP 384:pweZZz7WH0iM2H5HRLxHhXDJQuEI1c77R7J6P1ZNJclr9GzaILf46wuxCU2kqI+9:517L5lr93N
- TLSH T11D03B7EE9A885B26D6682FB5D46B0ACB2675C45B3E439F1BC744E17B3E003859D3B10C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2655
- SHA256 b66b1b428afbef27ecb20f5d34837512cf2fc62538cef5fd1a4fd552d130d453
- MD5 bfa2143dfe98e3f0c7876359abbf7ccb
- SHA1 e0e29e882663487932f6210f941e25687fc8418b
- SHA512 c39788842390b495dca9ee5641afe2e5f6387c2958e52e403e84df5d396ad9b22d5de91d9292d5cbf94a88bf291cbed23e9163d2f43a4253684d568d7dc91405
- SSDEEP 192:X+nx3bJsLDq79a5/on/qNSSikdxDl2mJeot2e:X+ZVsLDq79a5/o+S3GcmJbt7
- TLSH T115E277CBC7C55F17CE8A6776E4BA4B8BAAB8D14897035F07536571343C827A82D2B12C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2656
- SHA256 6e71943f0202418987d490df80a12c56f25c2b32175ed43b35c9990b96d81f6f
- MD5 6be32f3fe0300d5f27827633852c1628
- SHA1 2f97956f2f821601b88204a9aa47d35c04cc22bf
- SHA512 be674b8764c1548532f8743bbb06c34cfef1435100bb10862ad59cfaa9bd74f72e9ea9ac6a2af7a1dadacf4e007564c268614a8aaa481a895cb11c536104ebc5
- SSDEEP 3:0slY6DZh//lKlvln:0J6b/49
- TLSH T125F10437F400101DD337C13504341C737570105D100413000071513514571441555473
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2657
- SHA256 9c753fed98cd9743beeab75d20b6c299747e0c3fa8ec13d5425c02bf182a64be
- MD5 469d21b17168bb79a4337ef0ce8c1fc2
- SHA1 ca738272270effbabed80863c5ab34232030247f
- SHA512 efaaaff11b047c20261cf86b36219a324f6c8e2d148c4f2ad01be16bb87228c831353511f49b69aad3e4ea5eab7cce65e269afc700fed0c86f876aaabc4b4f2f
- SSDEEP 3:56DZh//lKlvln:56b/49
- TLSH T13FF1043FF400101DD337C33514344C715530104D10001700407131351455150155D470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2658
- SHA256 950c7d63cf277f9e49ff3d660d6350f44fcb209552fdb672fd7c2e5d925bcffb
- MD5 fdcea0e9fcec883112f1b5925ec8cea2
- SHA1 51bf34dd5c26707b67375b9254bf3be67f6f083b
- SHA512 be3f0fb00dba2d4844aaf011124ecb1adcc40015bd5362ca278dea2a479bbbf13000df43fc860122b49329020c6603d90fd35785702509d33096c31015565539
- SSDEEP 1536:NVwVzmRahV5Ee1dhjyvxa+BgRdWcjcmV+KuwPIVUtuvVogVUqWan5SVPM:2fCDORzcmVw
- TLSH T193C393B167443F01E364EE377094002B92E3F525BE739654FEE8A28A584C5A12EFBF45
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2659
- SHA256 4535c89aeff350feec569fa441baf883d28006862b85bce13fd24c532b41b2a4
- MD5 4b84554017c29e2db2abf2af6ee9aec7
- SHA1 ba2cab95193fd0876e59376c607d86d089ede0af
- SHA512 59a486e619336fb1962b28a0289c80085f5569db589218bd5d2278d69328272a00f047c8cc80e10289084a1c31109a7f65eb9d65dfa50fca910efa82fedd7e88
- SSDEEP 768:znhRQYmjYNnHAGThnXgz5smfC2nb1/pnDkc69+n+5dm1A2oaECP19CnySOZrHn77:zbScH9esWCIpDk2+5dm19CuRHIa2Lq
- TLSH T1FE830DD3AB6B49BBD6240BB81089C3017373F029991F274137DBDD26BA7B119277BA05
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2660
- SHA256 aff7ba7d60b1977e07f2381481354dac1adff7c9fe897d872ca9f2acfd9247f3
- MD5 c09fd15a24f97b957de8c5d8b4f056f2
- SHA1 89197934ee9022f99e87d8343a942ad56e48df1e
- SHA512 09df114014ecbc890d5ddfd9f8854efaf239b77a7c610cc7924b7b5dfeaf39c4fe69ebde1e24a1534a9db9825f0250b874e662ee7f43627bf372b2239c3dcad0
- SSDEEP 48:yEDcscliSCyixd7CXnt4oZzxaEzRqAx6Ezi:yLHHWdmntbaEzR6Qi
- TLSH T1C472DC72EF1A19F5E5264EB0680D6B525067F43D31282683362C164CFDAE3B04E3BA39
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2661
- SHA256 9546b6e35bbc09a9cbd3972fd0d036c3d9ab733d5068c1e06e9959dff507c0c6
- MD5 5ae8d447b8b39c4902b34b13ac77cd25
- SHA1 af211966a7b4d7be4b517d69d385127618c1d9e8
- SHA512 6391e46bf4223fb3f838a7ce9981b9a10977149a1fe0b4a2da58fc6552895f2cc88159ca1db8d521aa20d94a2e2043ab050b5f9b2d351f8905df4845bb7c5d5c
- SSDEEP 48:FLDcscliSCyiWn13xv2sNKl90C/+mIT55/sYXB7Jm7eTnuKcHzBSyKluU8OVGam6:FsHHDtdZuK0YcrGv
- TLSH T124728923D751967AC4EE1AB4B01F8351606BC52997DA27074320B9B93FA93681F3F532
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2662
- SHA256 0b9105008e52cec68d2bae84386cc59c4426b78a2e280fa35808d61478837d1e
- MD5 57a7268f1240d61bf6b6a023d9382c5c
- SHA1 8d26f55731d5ed66d1a6c81f308000d2d5bf5d4c
- SHA512 68d984c8ca8795fd8f86fa637fed846f7d0b170fb0f6b209a6aa2347c7ec737373024287a7c2245d8c64d48a0fbca198da25dd9e6dc159443996ad48b1528f25
- SSDEEP 192:ln6HHXVU65XjbDVtebfbKwqXB7DK1F9nmqmLr:l6nt5XjbTebfbKwUBedir
- TLSH T18FE210D7DB6B9EBFC32C0BBA606612D077B31C2A1A1E9B4131327478B67B1602777641
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2663
- SHA256 a21666a44ce7439abe6084684fe30ee8fd1aad74d5146d3bd6a91bb931700e7b
- MD5 3a0e51c7cf5321b8aa9967fb93150728
- SHA1 3f6fc6db7ff855475a70dcac3cbd9b2dc5610a08
- SHA512 b770053020f41b353bfc867cc53b378b943f7eff702c097f5a3d203661f0f46e74f4c568affaa252451200b5eb5ea26a445da90c709588963c80366b2b18e02c
- SSDEEP 192:N6TJPJynPMu3M/8YjcZ+EjNLj2/PMznvbza1qsVQS/HQEWvoNL6:sSnPx3M/WZNj2/PYKpVQS/HQEWgx6
- TLSH T11223DD8D5E18AA82C83B523745EB9D1143E65D01ED8AC5019BF844AD14F37DF3EEEA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2664
- SHA256 1c591b5d754cde80e048ec5833adf6d9a49426df96b570b46ed3eb916323615c
- MD5 519c905bf7ac8ef44a52c169f0bf0ee8
- SHA1 9bc5acf41a38bac399c0da893db8434d505b0fb0
- SHA512 7d3f5dd3fff59737fbfc51d01cee8c06fb95e50acb2c42873135e37adefd53cb4c72ee6bb787921fcc888646d45bb99c772597aecd4b1b929e3679526f74edbe
- SSDEEP 3:O/G6DZh/stlslwlvl268lt/9NlzcjOTQtln+cHp85MjAZ/SXly:O/G6b/sXEQHshcyTQt9+2S7Z/SXE
- TLSH T161722B13D302F000C3E783314F200F204731E39BA7009B0210E040254D531E00CD30D0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2665
- SHA256 d2d2ad7a0ab98e4f73cea32fa364d458fad1608431b76ddcf70b98e6f8df6464
- MD5 36fe43feec01a2d52a97183b73b2c77c
- SHA1 eea5fdbe8657e301bfd2307eafe4f576a9c84567
- SHA512 cc593f1ad5d3abcee31ef22ad9352ecf87863b2c24018e73b0875d353ae67a7ae00657db8062867acb92e3d73da2cfe3325e02dbcd1b8f358d10d51e70d79428
- SSDEEP 3:Dle6DZh/stlslwlvlWM68lt/9NltRAhcjO/mtcIXBMFHp85MjAZ/K:Dg6b/sXEQg7sRAhcy//IR2S7Z/K
- TLSH T155728C13E301B400C3A643318E200A0046B7F2D77700630108A190298C122F00CC3090
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2666
- SHA256 35a282e5e56aa9caf546955948000e37500b7cf928230fa8885c294b41f725ab
- MD5 e91a90f04d5345fd6dbd3fb3bd9e22d2
- SHA1 acb6ce0ca36db492a5723b03e38d6c0ed142cb5a
- SHA512 4a1c0c5f7615ac2ea22aa641400a3e019ac99d7036641780f9e5038fb270ab69e52b0d40e93d468c018f0cfb2c445ab0a3568c3a1e9c21cfde5fc4cde80cf66d
- SSDEEP 3:k6DZh/stlslwlvlbF68ltwKvlgp1Stl/y:k6b/sXEQuxputlK
- TLSH T12572122BDF003829C326C3370D200E600770F1C670010B12003300314CF63900CA2430
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2667
- SHA256 fa9856f5dd93f9b0f63a8ef1fa217a50c097f8d5993b01d728cd9de782cfd3f3
- MD5 dc137211078146397d8655adf6572c5b
- SHA1 60edb18dc3f061597dfed08a4570dec1e8a352ea
- SHA512 541e4d4291d3be2509fc8c707bac17de01ce0b4d58cbcf88683d4c944fce507618f592bb31ec092ba77c820134003fbc33cc7bae315bb9b54d0b878bccc67094
- SSDEEP 3:Qlw6DZh/stlslwlvljl/n68ltwKvljTlll/ln/lly:QG6b/sXEQhoxEE
- TLSH T1E372127BEF023825D326833205600E7107F1E084A1000B02016600200CB12C00F66410
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2668
- SHA256 5c0877194eeb736548f1b6fe0b653962233ecf717877024e12b3d24421ca617a
- MD5 04b19de947e54e248d305b88af26f9f2
- SHA1 74c4a90079750286ef56725b5b8e524ee1823c4f
- SHA512 c5f93cedb930e649c0404e05dff91544e150d5f9d030941747238f3f947a68cc0248b17aaca93eac072ed758033c210911fb9ac1bece9c37cdfbc6ccf7c7fc3c
- SSDEEP 384:uQZC32ioZSTKEw5kpObhPgNLGnNXDG+jI3TOr2i89kEbWiTyTUBanJTQg5CrMjyY:Wq
- TLSH T1C1723E01A371D671CABC367DA5570B8F42B8CC8CEAC6272B430A7C903F8350A5C5B2B8
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2669
- SHA256 f669da64bd3d2d0ccf354493d22612cab44a80a35b0c3f17ebe53941b3a1b1e6
- MD5 cc5468c7a41cbb06c8cc70691c57c494
- SHA1 2be1c261e2746ca889713c6191ed0cf4636c814e
- SHA512 714c03531b6be8c9a4c4581bce8998f09f976ca307d2f03dfe73c7470951d3dc3a77688e1e0d1e5fe48c615296600369325d4f35051c3530eff1469bffbf7d06
- SSDEEP 96:iqpHk2aSGfcf/UU8ePgzEoWNwkx9AtlOGP4y3o3G8hM9E/dqeO7dsiqAvAcw/br:1k2HVZsL8hM9cDpn
- TLSH T1BD720A9D53C87575D8FE123256B6133325C2DD96C579A2C31CB1B0282CE388BDD692E7
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2670
- SHA256 f4cd2d9c20560c1b6d1c6a6951f8592c529b833727ad956215351c2c289243fd
- MD5 a258ddcbff2973b0991606cf38ac1cf3
- SHA1 8f2eabbdb3c220e72464fe7457e1ad87d7160c91
- SHA512 30ea635b1c8b10c06b66f9a6331fb681b5e96a14515e831be645cf22e9740ed0f941d85b4964d98d6be7bb5e20936bf5793909668f177bd94104a071ea2bac6a
- SSDEEP 24:ebxl010q+9+Id+QE0ltnFXdllXt2Y00ltXlntllX9ugE0lxFJ40xZ/c+ykzfseqt:ebDcsctQnHy6n/QGX/jygkp
- TLSH T1DE72AC2E9B2AC9F5FA7A4EF06005AF8EB1E7D015011C2BC711342A8D0D3A0905E7FD32
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2673
- SHA256 40b95a5ff27e3650318ea09c2fed79198033d3f81e7519e7be7de1a7dab3b826
- MD5 711624b0a264a370e9cc018cc0bb2e20
- SHA1 983fc15181eb96d7a5138c430a4488a4c9d4d47a
- SHA512 a4578be9acfb1f69e4a44bb31bc8b17d7b071ca3f18051e547322cb5943b4eaf9243d212c69d8a2fe07fe4c184b65f5eb5f2a0d2759a57b2781dd6c36f976288
- SSDEEP 768:OWKlTSwp+oWX0ZifRuF6tIiOFt0J1nF10MqB7SfnuLa1e+JVHjKV+v1YMSVU2c+H:2xMcM6hz+606MS22c+2l2+eWO
- TLSH T12A448586A50747E2C68C5839266D088F9AF89701F23F6F2E536DE1085FA35C6DC2F6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2674
- SHA256 f9f89a8dd50c540512327032769b5c028139f0734f6bcdf31fff8f075122f314
- MD5 694b1a3e0550168581eeea0a55e9377b
- SHA1 723fc0550037256d10e26fe7261f25dc3deab10a
- SHA512 d6ee009ac76c97d3edf19f8e8fbde549c13bec3b5ddff157f4305a68a8d0a6d59e08b0ef066631617493dab04e6dfb709056aa83e6a7e2407d9f6a5a9ec686a7
- SSDEEP 1536:T8Mzr/4euQXF/Lx2mOLdFgqXZ5aIWS9A9YleqnbLqaxMN/819dPM7Cz8vp5TkGn0:zV1QFdP8x5o
- TLSH T1937443C9A40DC761DE74C83765AC888B93AC6256F31B2B3D4325E1BD7E8313ADC86764
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2675
- SHA256 6ade4cd24116884dc8e5658a9e4311d36047bd0a78566e88ecbbd24ffdb0105e
- MD5 00789f70b4a492fd560ac0f34a1d7813
- SHA1 8baa6fa7e8e539d999a3f844aedea70adc50d738
- SHA512 aa433ccf4a23f626e087711eb23720af51b4aff5ec25cd18afd38b3f15d6b1b83456a0bdf3a6e8a0f40e6077773e15c9a42e1d97679bc4a03068f850c724edce
- SSDEEP 1536:Z2ERpcrUsgFUc+4W2TInNZFDxCyz1lV1ZeE2AgqdDyBW/dV0V6c9:Q6p6rgvI2TAlsyz4+TmBT
- TLSH T1BC14F04AF84CD1E5C6F84AB76DFF4BCB62F54488A913262F872D91783983319684B17C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2678
- SHA256 429d75c19cb06d54657ebc0578dce0907dfc585335cabaa337d27b9c47b1e24d
- MD5 8a72171f1d17a2bef68bd362682ac6d6
- SHA1 6de36484763198ea32c8056b4622335da9e4a046
- SHA512 85736434199eb154c424d89a241f0882c490881b571992cabe3385b3e59749c58c4c125acafaab004e567e4743806b7f328d0712066532870fab1878ce8ed27c
- SSDEEP 48:xmDcscwq3AzKXarNvhbTDsscUXMcnGypkF:xQHzKXarnb8hy+F
- TLSH T161727757DBA649B7D1390BFC146857507D77D0A81F0B6743122869B8FD3B3A01E3A836
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2679
- SHA256 b4dc0697ff04b3af93317b71d10bfac44f5e865fe582d7c241e86397fa503440
- MD5 bcbc78be9edb6e5c9ea3c003dcd17124
- SHA1 945ea33ce7fcbcf938ed8da1b1deb3469ce82ebc
- SHA512 7806c8969f481749360054af81321b7a64e47a9d143c09551cbf5252e9c59bce3cb4c086275561446bb5d1ba9b558dfffda22f66574dd57096fd8522454e7e5c
- SSDEEP 48:emDcscxX5SbM1U4+8BmhqQq7JLC02lnl9:eRX56GBTfVC0cl9
- TLSH T1B3729B579B724CB7D43C0BFD242553417DB3E0690B0B67832124A5B8EE2B3D01E7A836
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2680
- SHA256 9559d79873c0570b800998dbc64f4f1d08aaa2e8c866da55514395f596622728
- MD5 5fb3be9d998292f88359fa25940f92fd
- SHA1 0100801b807f72a636696c73d856ec99e73f9d94
- SHA512 8c61a397dfbde29afaf212f9361370450bb3d8459e98fec2abefe08f7c13cc341938977887c4131f84cba7dbd04339edf13d973995a7774ada9ca473e639c40c
- SSDEEP 3:5lllw6DZh//lKlvln:5lllw6b/49
- TLSH T1D3F10437F400101DF337D13504344C71573010CD0000530000F7113514551C01555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2681
- SHA256 f22d5e0617d7b07b18440ef4d25f99bf2e2b6c14446e3c168fb9432572d51183
- MD5 df15ae47ad0ea7595e2f70b99ea86462
- SHA1 c9da074247c34a6bea1033eecc06f2b573ab1544
- SHA512 3e8cbbb4bbbd6935773ecc8803921bca64eeca2f584582ead9834f936badbdde7a6532cf7c2f6873f2db24dbe9080462f3379eddf33133778635daacad8fa4f6
- SSDEEP 3:4lw6DZh/stlslwlvlcErVoaI4F1wFlt8rtfLmktlG1K:ow6b/sXEQiE6KIft8rtfDW1K
- TLSH T1DA729BBBFB505D0ED33B523504345ED14760A86907555B13445319240CD62DC5E79FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2682
- SHA256 0c541b4c323dda8f8d720b29cea346e4a2bfee5f80b7ef4eb2b494d4901940db
- MD5 8cb988ad5ddf79095e62e54d57d90b60
- SHA1 b2f0cb5a31a48f0f9c3a297344d5591e84dbd247
- SHA512 d67a1c96206bda2fe51b64b3914b4886d9d3c5a565135b254a86d6807f70eeb01bb285fba13aafa22830dc78a3a100fea55499db548022cad90eb55a1fcfed26
- SSDEEP 3:Jkg6DZh/stlslwlvlf/pwH6fXjqlolXgllM:36b/sXEQNKH6zlXB
- TLSH T15F7292E7EA813835DA3E927208780EE25B32B4A902956B0610A291201CB42E02D37055
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2683
- SHA256 48d280fe50ab935c340e433bd0eac6f4d2c42220649bcfad79e62ec2596f8603
- MD5 8bca76df125011bf594300fb4cc977ba
- SHA1 5e6d91a959fe6b1a688b57e2bf0797052e61f31b
- SHA512 fa62b273fe79cf65fb2c0945778742a917fa97a5f3c7628a76d7fd1530603d47563662fd621b62b1ee9b9dfa42ce698999f64def21e1a176fbf821af871664c2
- SSDEEP 3:PlG6DZh//lKlvln:PlG6b/49
- TLSH T199F10437F444151DD337C1F504350CF1553014CD000053005075113534551C01555571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2684
- SHA256 1687e1bf29e0b30df9b3221990aa151f3bfe81aaa3f878ce8d265ce6d15d8268
- MD5 1a3f12b8c1dd514d1afdcf5ea82bfa3e
- SHA1 e02f475f48d2be6156596f34ee2e6b9964d310de
- SHA512 9230c8635e60f78886ad8f7d649a1d373c208d1f93533edbdeb36ea80d741414d3cd47e24c234555b18c2b684ba0f1c59d6b98a91523e58dfc680c6b8f7ab990
- SSDEEP 3:vElG6DZh/stlslwlvlZVw96PwVu/t6LGMKLkNSZ/tldlohZt2piECl/llly:cY6b/sXEQ26oeILGMKYNkloLtYix/llE
- TLSH T1CE728CF7E701AD46D232433398204C021F30B04C0205C3B60CA802380C027815EB9892
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2685
- SHA256 6a4b22be564f453bebb35f0cd5c9002ef09019ef6c190cf2e5ebb1eca3a59264
- MD5 7cc681710a75675bfa97da6df1b6cb31
- SHA1 660046851c57c0d3a6b1f9c4dc6792a2cb0b9adb
- SHA512 905f801b85eb6c4b306566479a067013e0b525998801c98dc06382cd616231754c495ea73bfadb80ef13d89d31fb26270db06c1e5d341490df7b341c334792fb
- SSDEEP 3:T/G6DZh/stlslwlvlNEl5wH6fX4/lG/llGllll6:T/G6b/sXEQIMH6g/9l/E
- TLSH T1AF7292EBEE842839C23AC23608240EA15F32F45901504B0301A111390CA62D12DBA0A1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2686
- SHA256 27ac2336dde5557cec0a5be995840cf971540510a656851f58ee9ce9ad714b6e
- MD5 d74969f9327f2d877500b0c9622fab25
- SHA1 5c4db0fdbe58f94459228a7ca71d9618a0d30150
- SHA512 2feecd6861a26532058acbdaedc71b22f0f4f8ecd29dd3c3e1726704fa83bb0b3db7698b961918688a0f0a83736cdd6f089e971dc14efa6b3ac2a0c673604da7
- SSDEEP 48:qpQH25OCx5FABiVDbTYTbnVWnn57vyRES4UgcdtapeMirliF39E:q+H25OCpsaD8bVWnMOlwAiRi9S
- TLSH T1ED72DFCE23BB2922F07EA235EA76175151A6AEB0CC83E743E1BC425C9C63D513F24D48
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2687
- SHA256 b717052ad71c88e3cfc777ef82f3a20fecf60c5ff2c9e43b5964918387d65db2
- MD5 095d897261623be7c7edec86178c829c
- SHA1 829823f3c2c8c2bad15d246bbc77abd3532e3bbd
- SHA512 8780078640067d93eede6f38123b3a86b4df86e7177ba9b051fe5ce9df836024cfee47a10381c4a445003ac94a4c61a284583b22e5fe88e3e76940f9b825e123
- SSDEEP 48:OGDcsccjh9DvsG9b7zhoW1i/409XUbDYllN5:OcjhRvXhoC6DCb8L/
- TLSH T1E17289265B560CF9F6398EB46379AFC172A7E055045C2ACB11387A8D2E790A04F7FD32
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2688
- SHA256 529536d5013f06b78511c1e360f458fb9fb30b72d7dbb9d2799120a3e4647064
- MD5 26d52bb637ec9a0b3af85d60c95cecd3
- SHA1 f6cae114f69335ffc934127c1850888deba3686d
- SHA512 ab5d4d4d8263e810f4f8fd3272e1d58ab7365b3aea18e47dc78be7612edee2e4fd63b9dc5978f0c5d52021a4a66e0a709b9a5baacb8a68d90e7d1abb076b86a6
- SSDEEP 192:kbntHH9Iw5aCPMtBvTHRIV90LKOZbntHHpbn2HOmttsRjqHfCKBQ8d0OF8m:gtn95a3T+V90xltn0HOmtG21BRdWm
- TLSH T14303315ADEAA5F7DD4340A7940AE031077B3986E1D499B872358B5373CBF3A817B3A04
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2689
- SHA256 5c32ea2448852daed0c68879ae96180539e6cbc0b624e8d843db2002828ac915
- MD5 4a3211a51ee7e8053387446364840e46
- SHA1 9dc2e5fbfce84229c50ef72d0ecb013096424a9c
- SHA512 aa1bb9220fba6cb72221973e2cc54da80f4a9f394a9dffd6874c1a1a6471b7de9d38037743eb02e1ceb6f6e34824f9033c8f6b4c8e59a1a27bcf58d9e7b22d3f
- SSDEEP 192:+nVepVC4hxXaqCMnY/f4k/G+TfXlRCJQ8ljnFJLlzCk7Sw:+VepFhxXkM8EC+IkOw
- TLSH T19323990FD7999B17CA3F223694764D8F82B43C46975A637A2F4CA4387BCB3942DD6240
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2690
- SHA256 dbd6810083600b53b88fc5298666d814695170d1381ebd592a3cc31222c47fc1
- MD5 b5ffdebe3a0de153ff963fc2e034d4e5
- SHA1 c88953359d74fa48955b869782eb2a3413c1da1d
- SHA512 f4d0cf86b824a50a023ed54758a13c868c6a2e79e332ed7a8f6a15583240bbb1bf84397d125b7fde5e1157fc18c094f007ed7b02ceddebdff4528888f5845fe0
- SSDEEP 768:anTBfoWvFneKyh5b68Ph1nC1Ks5gC14GnhyXw4UEljTwJnrItJnWwDqFQY4nv/fU:adHt062CE3CpmlEJkJSGUReXW
- TLSH T19293B897AE295EF9D4380EB4506D060173B3507D1CA91B8A2B2CFD68BDBF0AC1777909
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2691
- SHA256 96d562c7698862f672408d1d03a47bb5fa31546c4f6949005aa6c70fda89178a
- MD5 089e76e37ffa305f3183c5b56548733e
- SHA1 54f78021cbe08099f1bc9ffb4cbaabd3dbc1b025
- SHA512 15acb7ff2a72d785e442579d909ac4e713e3b1de67ed1e9df918dd10616f6bf5a04c5e4bb04c23b44c1958c0525e92bce997aaeef65176d1b330e882941deed7
- SSDEEP 3072:XXXl1A1Pzm/2t/O3wL6KjgFRzAEP8MFMVyxXhj4hyQO:Xn0t/O3wL6PFRz3
- TLSH T1E344779EE764A91BC8FA2F71D5DF072BAB6EDC8317578702D69002282F677485B3D102
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2692
- SHA256 f9cfd642b140bd21b192fa7b4a82dedf2e465e12cd5e0c08b3c132487718478f
- MD5 b228dff6507fd982f9ce6f19b6882c8b
- SHA1 29fe019229fde01320e98f5f4a492eb28d42bd2e
- SHA512 39370f4d4d7fae88cf337d6b9f0d0218fe7b6bb44782199a6e52ed5ed12483f9c3b5db401a01c2d529959be03cd94567c00d254637e7af1f0ee61e53ce9532c6
- SSDEEP 24:U2exl010q+9+MrnRtkOWYi8HMGl/W9su6zKdXDKElsrDSlzS+/s1LQj0zkc/6DOM:UnDcscCnR6338HvFMsrGDTlsOf0y2uyM
- TLSH T150727AD5CB271EFFDB340BBA54A616E037B324115A1F9FD42533355818761E02F3AA92
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2693
- SHA256 315110bdd8dea0478a64f8e044c13541f5cf94d5c97be82448bf48dbfd2c5702
- MD5 140076df9f6a1e629145846a8294d276
- SHA1 11c05e8cb8cf43de9521500d72a20552cbf68c1f
- SHA512 c9cf00b6c763b218c48a1da2f6dea7bd1058865eb6cb090624f40a33d8fbe35b1d21fcc4e2fffad0e2f080d5ddf470ed512b7c86fb1cec75a7aa64fc6385e619
- SSDEEP 24:L+g8UME8qfcvh/MQNeL30ZNdKle3T/2Enp//RqYyvltHuN2Nu6X:L+gVfi/eL30TdKQ3T/npsYctHS8u6X
- TLSH T133723B1FCE48DA25C76DDA3B5C5204D72262788AB6B6965ACD17A070383304CEFD4ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2696
- SHA256 e0fb642833eeeae77c23d99ec60a87987e65a5e820e4d71b2c88a045c7a01023
- MD5 58bd9bd84522bd1d6b7911ae00eb9e12
- SHA1 6b426584e5ef3ada9dfb999d549b1d44ec3f078f
- SHA512 7c47eda6a864bbf17446cef94bbdeccaa14386c40ff6582a480111e685c101225df90a00f62082f751f4bb13d8a6109925773e77ef3e4e2f245150f337926e3b
- SSDEEP 96:VIDycH8ITzCQXElhyusSzuyt7l0n6o7e4P09VYcsvRcj:SycH5Tz3X0hyquUAP0AcKRcj
- TLSH T18C7202C3DF6E4A71C8280BB984F90220B33BA4666E5713425B94B434FDB72791B77D54
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2699
- SHA256 d42347ba741df2d95687d5b2bad03a35086d4e88305c2a1008bef6351f5b8ee3
- MD5 7dd26fcd9f58d1b5faa2f27cdb4a5dda
- SHA1 a4aa8606c795de4fc85f1f8b52fcd35c26149757
- SHA512 5ee7f5305355116264f5316914e86620cd3215b859555e5ed38a3667dabe8288366188a8161cea725de411899da93e2f6d7fe89e927ea0e474ebf2ac598fd184
- SSDEEP 3:zE/tW6DZh//lKlvln:QW6b/49
- TLSH T152F10437F440101FD337C13504741D715530104D500013000071133514551C01557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2701
- SHA256 d176274b4468d024901ee71384aed19b908295cb4bb756a55fe96515392d24ae
- MD5 4f69ab60cf501b55e6bfc7823a0f7978
- SHA1 3b816fe43ca49330dbab8986191455d3c1f6b0fc
- SHA512 54ce3cf1adedd5325056a9415f4e49eb43a4125b564567ecc00fcf203c78dde35909dfe24bfbe41e58419abc82d6410d62f801127c7879cd447cc80f146c0ca7
- SSDEEP 3:jktW6DZh//lKlvln:AW6b/49
- TLSH T133F10437F400101FD337C13504351D715530104D000113000071133514551405555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2702
- SHA256 097629102739fbc5fedfdea022ba17297c4ead42f3969cdc168fe5f7f7d7b7ea
- MD5 f6143a3fbb5133c8ab264be593da6bc9
- SHA1 3e539f6449c7139a73cc169ac8953bd60ea45a7c
- SHA512 3cd1cd2fe7e30cada657377e7a4c5adbb244a1143c99baa056a79b0c10d2cff84738e37494ee3fa18eb4f29f43cbe0676352c736c192b7172c43227e5bf89e27
- SSDEEP 3:L/tW6DZh//lKlvln:xW6b/49
- TLSH T158F1043FF400111DF337C13504340D715530105D0040130000F1113514551401D55470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2703
- SHA256 ec2f87625f3b991e8b759c38a53dd78d05dc22419cda6f1be01b1f8c623e1e95
- MD5 b1bd89f7b90ad3abcb465dcbaa30e5af
- SHA1 b5a71a3504a557b5cdc7d2c969b77ce3ce5f26df
- SHA512 19e002edb3f8cee23fa36e6a107e7336d64c5185870fdd5debb5ff779979a9d4edb72c08c261c7d44b6555c53412ce4d271f20ae1e1dc8af64cb792837dff72e
- SSDEEP 96:68lHHt8sH8XNGxevK8XfWi9KSodpou4et4uwMzCRYjowTK+pcqPa4270bGKefq:NntHHOkWV9podpVtHwMORnwTD7jei
- TLSH T1FEE221D6CBB70EBFC7680BBC905A07E1B5B398257EDED7821732B465197A2840B73450
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2704
- SHA256 eb8df84ff96406ceb947ade63c0423a3ce109264ed4a9200d0057e33d91a01c5
- MD5 cfed5bfd21e3a515b9dcd5122d1f60e9
- SHA1 7775f83ec5b8fd2626edacd0119528ea537f27ec
- SHA512 1d2e49e0fbf7152994a379af62022ea2eef72991ec6c2e6cf9a19dcb57b135ce22671c06a69e077f551a7dff2500daba29695095ddfaec0eec71dad8bb05b8a7
- SSDEEP 192:BfdzSmNxjpd3wr39yr7qmda8Er+I9D5OdhUGRHgcqpSzjApDDZnjnZeotZ6OcwX/:Ppdy8qmCy4DZnDZeoiObXo3a8Lfo44
- TLSH T1BF03FD8D9A4CFD82D93F123990E7861743B4AE40ED5BC7411FF460A928936E75FEA243
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2753
- SHA256 4ed796b4a53ecac3377c926db67b88625331a15ff6f8b29a4012c22d7a4c1a4d
- MD5 88ec009c90afc15a425259e5836c7766
- SHA1 9b57db0abeb46ca09bfcc640dcc25a52ff415b00
- SHA512 d1c8882539fbdee840682265e37f1e050a6c2b5960650fb73161b614df787fea9c9cc6667fd45009457640e905d275b9c93b8795d8390be94cfea07979a90da7
- SSDEEP 48:vKRLryW4+aoO+XoRyeEcNMLwzbBGROwFTBKC8ePScQlGiIMqyv+UekRxRsv:vK9ryW4UioJzMKlKwiRvxekRjY
- TLSH T194721DB6DBB92526E47E8271DD7813B06742FA50CC4FEA62D1E841B85CE3D503E47C89
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2753_fsm
- SHA256 dd5052bdf8cfd7963b0567a4a2d332cd253c36d20aa186404b7bc19ac6a3d965
- MD5 d8d7ffe8b727781f9499453cc0a56a90
- SHA1 7ad99ae233867a529960967a8a96e37f17746c58
- SHA512 ec5707914e08d9cf671e3fa1efaad7f594ef4623c030a60f67578a42c4a0e8fac6cc92b2ca8d77d35ed321bfc39ab6103baa2d1499274eaf996fb02f24cecf87
- SSDEEP 3:nhNlVrzthlBlBlBlBlBlBlBlBlFhNlVrzthlBlBlBlBlBlBlBlBlFhNlVrzthlBr:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2753_vm
- SHA256 a99f06a14115c4329215cc898cf0a3e0943ded4a1240b991602357e07a36e348
- MD5 c3883cc5c9d1f9f402979d9cd7fa8c64
- SHA1 e8174049815f6854f7d27d759764df7e3a539c86
- SHA512 c6a1d2b4d9d53ca788709b0fba2ae2086514dd2959f49da9562faba941ad80610ed5254e62fc1285ccadff84af39043e3ae82af0c0b7c74d60ab94483ae588ff
- SSDEEP 3:FhNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2754
- SHA256 a849c35250e9b4baf1d586b5021e781ce3eb2aabfd72a0d9f57bbbfad652cef3
- MD5 e1dfdf3522525a301574997fd4b0a28d
- SHA1 28d69500454025764683da68f02f9f2aaf7daad6
- SHA512 594a3de31597e71a73506148d7f1db70cec835ba0fe1f6322a8bcd903e12ed0fcfe6903f5d2c97d1daf804fa5799b046d9691e3a37f07e9ad123d00a3bebd264
- SSDEEP 48:FyaAH0SYCKiYDAfRnghPZYabMIe9JAK32iXb7RGcehi6E:FyDHrYn1SRn0PZ1b9vKdrEcehs
- TLSH T19B7206CE12BB2922F07EE235FA35175195A5ADB0CC83E757E5BC426C5C53C453F20948
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2755
- SHA256 8a4aacb907ad497e868e88c8df46474c6d0995d3e0e56cf2068eae38c1f7f615
- MD5 9d4e0379f402205c5ead895117933fb3
- SHA1 3e0d66dfa27179e99ea32c33f3847dccfadbd879
- SHA512 e00ba6c058eb027d05177606088f70838a82ec445551dc72de1bc5c33ec5a96423243ea68669f8c4896320ba41277f54a8cbb6f63d1a49bc6685ccaa0079f547
- SSDEEP 48:syKDcscaNpWCllvDZ+RllzG5r5/qDXuB5lT:szeSgR7G5r4z45V
- TLSH T1CA7257DE9B252DF9FA390EF1E4552BC066A3D05A15582F83103462E91D3A1E04F3F83E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2756
- SHA256 f0e89d584d7d332bbfb9f99d37bc6f3b37978499cb6d94a769f1fc69a127d1aa
- MD5 9a0840440665bc5a66b7ff178e61a81f
- SHA1 d13cef3ae3a2358fc829fac88faedf66d1be91fd
- SHA512 b21fa73c2a5d43c4e7d143b4fc2d4b1898863a544629368825811349750733df5e8d6c29200e21b44e717d068f617dd2561fff52c6a630a45bd564268f9d13f9
- SSDEEP 192:wbntHHAtWqtOtVGrH+0Fl+ntHH9dgLsbj3KYBPyz85qQS:UtnAtOtYr+kotn9dnn3tprG
- TLSH T130E27561ABB78CB7D321CB78523A1B8D5873AB2F1356F382163435281959EDF0E77920
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2757
- SHA256 168502abd758698223d6257c062b9c000b496b207b6bb0728759903db6c2c9cd
- MD5 469b5f55f45092558e711c6ae17a806f
- SHA1 1a96d9f8c6f0386db3577bddc017daeda62ef05d
- SHA512 93dcead4e70aa96594bde006ec32fc6326cfdc7fd2fb639fa38d0df2abe3660246315adbf94738cbb1640840efc284492d4092ead2de4998c340a751c56e3b6c
- SSDEEP 192:obntHHjg1dcf1/ZHf9KTU4lh5FXwEvezM:ctnk1dcf1B0o0TFXnL
- TLSH T1E9E22E6DAB26C8B7DD250FBC200817439C77E029175B76B33134557CAF6A3A90E3A931
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2831
- SHA256 1ca1f5f44cac8ff2913f4272ac4137cd14b8764ff8c9eb9b525005ff4a3a453f
- MD5 00bd83511669a39741ad5252befa3f63
- SHA1 4977d202cf8a51ba5d76cc94b0daec4a7d6bbb0f
- SHA512 c43c15fb04a77bea71d8b54e96674678b02848f997eb70b0c15737409310b2583eff0c171bb6680a0db7b89222b7228a7e74706f1b51be4e2387ce113361723b
- SSDEEP 3:t6DZh//lKlvln:t6b/49
- TLSH T195F10437F400131DD337C13704340C715570104D00401303007151355C5515417D5570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2833
- SHA256 93ba6bbd1a16fb0962d77f62fdf0664de5fcb81442b541831d7afd82aa6fa6aa
- MD5 04dde15f9a4c383cf9ff94b41e5f7eba
- SHA1 23cb25416b5e796b109fc323a4735548ef35f946
- SHA512 b74e0b7fc4c5bfbef8df808f1003ef82b706b715ecc6cc453c0a7061a29fb983f7156cd4cf61e2619ebadc158c333faf23643b89bf0d7c83cf096f65ec15eae4
- SSDEEP 3:Jse6DZh//lKlvln:36b/49
- TLSH T118F10437FC40111DF337D33704740C717570104D4000170000F111351C551541557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2835
- SHA256 6f89d9014b2e54c62d6798f3bec4687a28fb3a79d8dad148b74b9db4c97a3031
- MD5 6d7cca916fc017d14bcce555a896fe28
- SHA1 636052a005da9b65525265fdef1c08b0d12810a1
- SHA512 a72d491c4195cd9535cd381638e7f4306b0c36462e21c786eaac0944b66cc38fa259f909e195881d60a6913aead270785e02be2e9c8db41142a76146199c9bc2
- SSDEEP 3:Y6DZh//lKlvln:Y6b/49
- TLSH T15CF1043FF400111DF337C1770C340C715530104D0004130400F111351C5515C3555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2837
- SHA256 cb761d241b45bd34aae0df6c575e2d382a4988392987af554fd2f86a7bc2381a
- MD5 95263a6dbad9060a0e872cde150460e8
- SHA1 ba7e5c4f3d912caedb9b38c05ade5d9995ffa584
- SHA512 7ae90a6995863e51c4c8adc2314d465fe7faf44f717f70c49139b9631fa14c5fda3317da62ad8945e1f2fa0780e72b7c234ce3bbc1683a63420574746f630380
- SSDEEP 3:Fw6DZh//lKlvln:Fw6b/49
- TLSH T16AF10437FC00301FD337C73704340CF15534104D00001300007111771D551541555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2838
- SHA256 184d6e099305db5d605c738783c58f368f982d4bc6d8e7671a1fe760c94b282a
- MD5 3ef72b8cae126fc65f3128414363a6ab
- SHA1 a5590d6fa9355ca78dc8854f4cda5ac10fe16bc3
- SHA512 15aada0b0311273ceddfa675a8e39d6108f3f7a69db328b2c4ab4953308c7cf32b79394d516d2dac5f2f0ca943d75d4033e0d24a4cdcf06afd6ccca4fa710d78
- SSDEEP 6144:BsdVuTp/vglhLJ2mYiywwRV4QWimomKNXxKam7MXomfJ7498qumm565s:Bc0ThorJ7BwRJhFmKNXghMYm68quZ62
- TLSH T142A4BE3A8F377D78D6AB57B3ABDC13887F41C964524CCB17B6ADE9A11CA239C0538502
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2838_fsm
- SHA256 a2d3fc912d8b71444ffd9e82e6103b49fa49379ca15004489eaa6a6150b3dd4e
- MD5 b40bd7a48b5b514a234a77491ada9020
- SHA1 f0dcb45f74edcd7a09f9ce8cdbd0c2b810a17c2b
- SHA512 8b6940978a0c2d9df8a89332f902b8fb1127c6977427812d808287e0ee3eb5a7f445678bfdbdd488d9dece256fcfc689d640b4d9956b7760a7e55d3007b1c84e
- SSDEEP 6:CIe++++++++8Ie++++++++8Ie++RygagKcmXBESd0RHQp+lqcCoLl:C66Cg2JXBZ0E+lqy
- TLSH T109B21243F0B92B0EFA459675F5AB230119C6D39A0034318E4CAFF0961DDFE575161223
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2838_vm
- SHA256 6cc354b40d26b2b68e8cbcefc9d748d30e6afe2694444aac9af035106182d273
- MD5 da37569b437ee706d000d1fcfbf22914
- SHA1 9b0ad61f1436ac45c93119f09fad0fba52538677
- SHA512 c209f31602f2372be3d0ff5da5e20ec04791c4459763f1e7da9acb568a86138bb372a7e52f4a1410ffa03f6633c93ff840d08e4863beeb52ce3f1b341da2a8d3
- SSDEEP 3:h3hNlps//:h3sX
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2839
- SHA256 f015de7778603c25f1ddf1342d3867d5447ad19769d1cf24c281fb83addb1c48
- MD5 cc1f26bbc32010688955bae87e54fd5f
- SHA1 ce0042df6173256c046d0433ce6e6b8d21f67aef
- SHA512 97b6b8a2d4e3689b8f3c6416c325a2b6b4f1518544ff1fab0edfdfce13accb165c4fc4e092fc6eec8a628419b2e4041f225a755e807eddbe493478c94c84a0d0
- SSDEEP 48:a8DcscliSCyiNM2yLA/0MjMsiGQrdlVO4L60KjG2jlbhVK1486gwjzrZHmY:azHHukAPQp/BL6012Zb9gwjBmY
- TLSH T1F27267D1ABA30CBFD725077454A743817373B039139FAB89066B59183E7A2D82F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2840
- SHA256 0f6d28f8bd966afdcf161796e65bc2a0371ffb7641657795a877b6c838e8c978
- MD5 661e0bdab3979c5da34fb2c54906cc4b
- SHA1 55aa8178eb7dc2c106e1d724c63d1838f6df4081
- SHA512 a7334d7ac1c1cf3f3e37fd73596ea85c72b8b7eee3a2d3b06a74ffa97553bf7a68394a346e9beccf16e454a4b958ddca6cb2bfa4e714ac4af177c98f89ff585a
- SSDEEP 384:vXnSVIxo1yH7Nve6G+06wcU7tkCtwFLyYIjpXPrRxOs7IqoGF07VyLI:vSVBysLP7hkCGFLZ8lP9xOCIDpyLI
- TLSH T1C3B2C06AD3395CC9C8A7EB374029C317362FD5827931DBA06BE651882D07CDCBF49909
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2840_fsm
- SHA256 c811306be331459b524c9913ac06453b2cf1e7bc0fb408b7345f20c7a91eded9
- MD5 257a34a17dfc2b8b600038fe073c12df
- SHA1 73216dcf48c0b0b35ef3cd083045fc508c16842e
- SHA512 99a04c5cae9e7a37a66fa57e3d8c59893fcc9258d74c47669a573c02a938eeab9f3bda737eb9b90bb131556e033dffc2dee6a1334f75d9001661af2ff8959ce5
- SSDEEP 3:nhNl5Bl/lLlrlrlrlrlrlrlrlrlNhNl5Bl/lLlrlrlrlrlrlrlrlrlNhNl5Bl/lb:E
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2840_vm
- SHA256 647e5524021c28d524305d9eb3ec8693a062b67a84d8f790e8485c338eb81a39
- MD5 cf912531c56bb13bf6f0d7d9334ae36c
- SHA1 44b37cee2765528761075b2e1443f4eec27ea9f0
- SHA512 4bcd56398d6bd93798a6d4cc9f4d91c557c6f0e826f7beb4ca37eda54335596d253c756875bc2cbd703ecc66fdf0d551b45e86fea2a5a7c701b71a52da408139
- SSDEEP 3:n3hNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/2841
- SHA256 8b676d4006f6269c321de9154346c1576ec09b955e523b4b03246594ca51583c
- MD5 59a81ec6ee23a6800b61cd0ded38b298
- SHA1 c440ed17194f3f7e3a9b9c51d068ec2ed08de177
- SHA512 c4c067a14471cf49a09390a504b3f4f4f9589d55c2aa6fd329aa71907822aca648c3adb14090b7da9447470653fc1e09efce361ad2775a2cdc596ac4cd3f60da
- SSDEEP 6:OW6b/sXEQug6cH6N6HdaN/OliKW6+lvXl/llWutR/1TE2GTlXc:OFEXEQHH6N6HdaNmlir6a9llWut51Ehu
- TLSH T1AD72C952EB562C7ACA36C3373C920FD15B33F4551716BF77502141201CAB2C44E76670
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/2996
- SHA256 d101ace45d47f90840d839bf017215630870d4049631b13cf174a7ded762394e
- MD5 1c6f8631fb199e1167fda6ed63ccd077
- SHA1 22e967a1b919720f3f229745c13b5f7254a2d195
- SHA512 45a3b7a0d40d6beaba323d1f75c036a4806d6aa4c7f894f5fd8576efcb344cdddf6fe38a4313754f5f096c4e937e3794ae2c26cc23b72d94ce6fd056dbcce373
- SSDEEP 3:NG6DZh//lKlvln:NG6b/49
- TLSH T1C9F10437F404101DF337C17D05350C75553010CD0000530040751135D4551401555571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3079
- SHA256 af8078de539d9097f419d5b96071178b3e14b52db832e8259e631a40f5858f5e
- MD5 d83b95845b4658f570bdd4e5cecb2972
- SHA1 754d683790eb56478850170c9aeae1f806539753
- SHA512 3797c6d8df29f14fa3e7644ba648a1fbf06964dbfb322b27a9fc68775fdc0660370d20cad0895d20cb201b7893f22af97a084b6cd4705f45af352bf0aa9bd107
- SSDEEP 3:HpO/cl/m/lljTh2lt+l/P/:JO8e//v4t+l/P/
- TLSH T147F1228BFA802820C23C82BEC0C0AF30AAF3C8A03200AB0E008302A00CC30002F0C020
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3079_fsm
- SHA256 a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53
- MD5 2a3216a10d8aeed6ac8058c1f5f6cabb
- SHA1 6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a
- SHA512 ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264
- SSDEEP 24:33a6666666653a6666666653a66666666:3UU
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3079_vm
- SHA256 80c0de1acd0fed8f5301d15f3c9f509245d6be59bf6a26a861148c2de4778392
- MD5 99488971b2da0578a55e475bfa7a009d
- SHA1 ee6d9cecf0b25e3da880f2bfb722b76e7e71ce42
- SHA512 1c7aa2f0a89631820d98429e2b65698e07b3dc9c3081cd26f9ff10faf74854d379c279f76e1816fbdc4c859863e9ba3a92b6b5994e3d5bcdc0a075539979db9a
- SSDEEP 3:ql/91hNl:qP
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3080
- SHA256 ca9311ca60c14b23eab97635fdc7d69731a50cb3897988e3e0f1b51681629dfe
- MD5 21c8ecab7aa0bf770bea2e4e83b2db73
- SHA1 3f6e4c38a26f845e82f1624e1bc8615a9a837789
- SHA512 c4f1ac2bb997c5ed035d42f84f0976709d091af2d8b6f21fb0e2bf759632538d19213cff551051bc819fb2c44c391f5c153b092faabd3ca14814abd1afa88e87
- SSDEEP 3:4fW6DZh/stlslwlvlhtj5gtsy:4fW6b/sXEQTpqX
- TLSH T1257201ABEF513469D33AC33A08240E639BA1E57D0155771B216391292EFA2901DA79B4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3081
- SHA256 fc97bfff428f6ba11357020a2928cbf6d023726d1c34270e50f9ba9f2fea66e2
- MD5 653ae2325231c6075ef846d6a0847d28
- SHA1 0fa57ad06e727f2d5e7fd0ff85de3bf9ec8a22e9
- SHA512 d542db1d1948e7125e40d61ac144ba95ea2dffda2a8c66a953ec783dc8d5e4017ff7b8dfaf53ab8722e3dcb8368a0f4d7bba5d07159274653d59df672b6074fd
- SSDEEP 3:IkW6DZh/stlslwlvlZ/lj5gtnFlt0:IkW6b/sXEQrpq5ft0
- TLSH T1047211BBEB80280CC23AC33208300EA38B20A83C02003B0B002300280EFE2C00EB28B0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3085
- SHA256 9fdbc12730449b7ec5d3ebb48797aa5947738dfd2cd6161a91ce2ef1233480de
- MD5 cd7bd7ddb2e252817d7e6cd8086e6cdb
- SHA1 dfa458f6871aee58c6a4ffee73b795df9d7b429f
- SHA512 e5fbd5ead72cf188845eef89591f9eca6d9fae05242af6f064e3f33778ada051be5870013003692e83027eeaea8fe1bad898eefe9ecbaebd626f63f96b80422c
- SSDEEP 768:fn1cnJ2nBzsLh8KaBpnvqdDqAp/Ot6CxnSKtvroPL0:f7WivqBFpCSCt
- TLSH T161236392AF3A0DB5D117097C10CF50354B9F342AD5EB7F841A2B983852DA05BB2BB53B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3119
- SHA256 d7b1a7b6958b321c611d4f6fa4e9b4b1e44f33abb87ce68a18c6c0fc0947b10a
- MD5 f858d95db3085d0f67c54c606137c778
- SHA1 7b32151b70f5b85fcb5039685260b3043e589bd0
- SHA512 4c43f32a0486bcdcd0d0118c523f5790859ee58d88acd233dd7fba0d338d0be90482a9a01b5da8b1c699529107e1a505a28ad98895f057525223d94a83c7b594
- SSDEEP 3:esttW6DZh//lKlvln:ekW6b/49
- TLSH T12BF10437F400101DD737C13D04340D71553050CD000113000071113514551C05555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3164
- SHA256 d6f91edd1f91a70c2007435763f1630c297f407fc658be5163bf095dc143628d
- MD5 1f156c750bd0e51bcda2a9464e6ed2b6
- SHA1 d1d89b717cf47707454195dee8d6876dfe25205c
- SHA512 811f1f3160b91f3a1274ff990683464ab36ed5726eab9ea0e241399de512408f71a2934039353ff1463a62ef65304763a54aaa141fc127a80ae5a1367decf773
- SSDEEP 768:7DhWoSkwM7abl6abL0RaDnWtBz4FXyaecB2ibGTWTWiRBoZad:gost/uF4VfDbG0AZad
- TLSH T1AFA3C94EFCE8DFA2C07C427F5912C4D64A80F8074E62655FBA78B39D21BF1843A952D9
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3257
- SHA256 ec0ba535ee435f35f5191766890f781a21fe4e3d1536f19eda1b6c3cbb94c337
- MD5 b59af13a33fd30e33d5940c216af017d
- SHA1 2675ddf1203f7e1587b232a5ab49f040b57cb2dd
- SHA512 5392877e1dc3962ebec6baabb2ed92fe86bffb1fc4600bbcc6ab9cd614fa53918d0ce9b25e1c910c1c5d16cc9efbe1bb52455d8b48b904188a66adf28fcf2ab5
- SSDEEP 3:4sfW6DZh//lKlvln:4kW6b/49
- TLSH T13FF1043FF400111DD337C13504340F715530104D10001300117111371C5534015554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3258
- SHA256 4840c0456c9b0f4dcbb4ce494c4c28ef6fe304df5989811bcb755b5eb62e1734
- MD5 692966de1777ec7acd5f7be6cebd2653
- SHA1 553237c34dcfeaff2605e62da54974951eeb319d
- SHA512 44af1c6af8fdcf323852ca14c3fff213530580be6e7d75ed7e69d77efaf749616917a7030cec250cb8038c99764955696baa5b0abce029dbeaf7793c2fadc93b
- SSDEEP 3:IW6DZh//lKlvln:IW6b/49
- TLSH T1D8F10437F400101DD337D13504340D717530504D0000130401717137145D1401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3351
- SHA256 2a3187e094139444a261d96db49ee9ce9d6fba83ae7cdeaa16ca7cb1ce264014
- MD5 9a699ddb0eb8d12d3cd3d4dff67d4cf9
- SHA1 beb0969e7cc06adb198ca13e737b158ddd196256
- SHA512 7b7152713fc47fb0df807b03a82d1d4108331b199656a1543070ff135fd8cc4721a1b7f69e9ca3c606ff3882d6459e2112b89a713e83c13cda44f4185a8f3e66
- SSDEEP 3:5W6DZh//lKlvln:5W6b/49
- TLSH T1E9F10437F500541DF337D13504340D735530104D004053000071153514551401555570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3379
- SHA256 9e032900a7a8deb1ad9764a32e2af10800135f214ac63b9be624afe90fece91f
- MD5 f28b6b2c2fd0ccd2358a27eebc9f0507
- SHA1 d9884bac9d75a335ef70ca73927bce7bdd2a9e79
- SHA512 f44206e0f441ff2c1c2f5f857cb49f0692f8882a7089f2b8bce0f9290a326613bd2f53fffaedf25df32b3a919b8f44995e2e11ed4dabb9126bf1b89d339f46da
- SSDEEP 3:vW6DZh//lKlvln:vW6b/49
- TLSH T135F10437F500101DD337C13D44340D715D30104D410013100075113514575401575570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3380
- SHA256 753e7ba210e28190aa3e78603d374489c980dd1c2184b838872d96671782421a
- MD5 732f40314d6ee66250b0018f3ed8bfaf
- SHA1 6d535f2342807646465d77466b42e7490ca19415
- SHA512 779ce6b8d13dc037fbf07a9efae64137f1641f247adf1dfd89efb13897a56ffe88e3d2504278cf087773e86879500bee087182a5f1a4dc9a365b02ef495a8154
- SSDEEP 3:RElW6DZh//lKlvln:OW6b/49
- TLSH T1AFF10477F401101DF337C13504340D73553010CD0000530004F1113514D51401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3394
- SHA256 1f160670a07dc1e9488d4e32323d27b6ae4330e88fcfa84c20c969fb7b044909
- MD5 3a359a0aa736cfab0795b83ae4d5c788
- SHA1 ae73747f867bebc1cfdb4cb3d59b8d98369b31b1
- SHA512 78ff3011240b3a8f31a11d2fb83316ec4c2d7502044972f80d0265cef1511ab7dc41b1d5efc4e3adc7af29c9a5d4fa3632555ca6ecfb78fa7592db69309ae4f3
- SSDEEP 96:oIcB27gNiPXU5+Ve7msBteIeQSjseL8SPQaJjSsFe6Uixei8rO2LnSSzvvs+I+Lq:ikzVems7StKf0aUB
- TLSH T1EA7237A2DB5624A2E59CBB3725C7672137ACE505251A9F5F20DBBB7B3ED37422C0044C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3394_fsm
- SHA256 e82517b6664704c0b4e927cd587ecc55abef4d45b20989464168de769b219043
- MD5 017e55ee517273a1cdc8151f26329f62
- SHA1 1ad00508560b89964660fb35ad0e68c6b6393ac6
- SHA512 0e4dc5381079886b1d713f2de5482ba286edfb564dac87a673815d9ecbccef1db0437be1c24aedbddba35a1bf2d32ab0e3a8102f2febda5f5773c6215223e333
- SSDEEP 3:nhNlchNlchNlUl:6
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3394_vm
- SHA256 edd3bcfdd047929beb2df21a544440f6bb9b4432c727ca5fb091e454a979d6c3
- MD5 a742c18afbece5387edbb550a79a6205
- SHA1 57d0525241cbc81d018306870c07f0eb22712f10
- SHA512 10b9248b7ac47f7ab7fff57777ec967ab59b37def333b41fa552ae15bf2c9293ab750d3663b2353cae05920352f5b7697322cd27b8599f8b4b8723d15f7a16ad
- SSDEEP 3:S1hNl:S
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3395
- SHA256 82a6e136506d1b4ab09acd384cce533315894c8b4b2f08b8c6087da9d53ce798
- MD5 4026d020299d30c1272592b764ebfc2b
- SHA1 fadbe0ebac2100c25e165c3d95fa5b47451c7073
- SHA512 d3463ce9e065be8098570ad74d1c25d224e265540a771c9e8d5c9828f0d6d1a62bd56941c7dcedaf79bde25d1e99969de3dd30df91990566d78ee4ad6562d5bb
- SSDEEP 48:faVR6VQPvKvW8goPtzNuGSSfX/uuw+e8udxwH+p+EmarHZnMNrw:flWS+8x2uud9Zo8
- TLSH T158720C1AD76CA9D3F775BDB714988B7B4184D00DB1236F7B0709B1B83E520056F49758
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3431
- SHA256 5f88b0df13acca9ce9019c5d4afb06b09f036124ca9dffa8e6679faa29623610
- MD5 e23fcc2ac02d7a2efecdfc16dd7a4d0a
- SHA1 9c75d5853d732ad025028c340ad4e8345acdd57a
- SHA512 d5e5afe3f4752dd2aae4a428110b6ccf05c95af548422debd8b4fb2b2b48d7bef393c8fd25553c5a292f5f062d2a5d57070c775fcb9c67d69719255780ff799d
- SSDEEP 3:p6DZh//lKlvln:p6b/49
- TLSH T1E5F1043FF400101DF337C13704340C715530114D0400130000F111353C551541555474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3433
- SHA256 b3d73fd1f81ee06dcc53a191a1d877e1454ddbd7ae2f7f4da0b6ecc5efffdca9
- MD5 302b68b5890417548d25b8a551db57ab
- SHA1 0351c607863855f9ce5c1e0c52094fc30d0cfbb6
- SHA512 e0f29abf740b03872e9bb339ceb5068948f1e3f8eafe41c2096a85e8453d464b9dcd02c5c4ff5c4ff73094f5c6ec7043999bd46984bdbf02d04a8ddfce4b4d8a
- SSDEEP 3:MllW6DZh//lKlvln:MfW6b/49
- TLSH T1FEF10437F401101DD737C735043C0D71D531104D00501300047111351D751405755C70
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3440
- SHA256 93521598388e258f255e4bae9251e7c0393fa95306ebb6bc4005ecf0dc58fa79
- MD5 f535ed7b66f5d8f0ff6c6329e315c670
- SHA1 7d606dd7c6049e9b8fac2af4176690a7a21148df
- SHA512 17d3b17f3791f58b1b7f59801a0addc6f627f2f61751685b6b9e364a5586628c193696756616ca2363ec4e7c95db579d1415ca20d1f8ee51b03f7bae8b40b75e
- SSDEEP 3:ise6DZh//lKlvln:ise6b/49
- TLSH T1C1F10437F401101DD337C13704350C715530104D0001134C107115351C5D15715D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3455
- SHA256 f9fe48220a2858fc1c374fb1df1657cbd04ca27e699d8ce4ff03d0cb19e97310
- MD5 4bf145d26834bb2bb0f957a52a25ff84
- SHA1 38dc63de28d5a7a3633e871146a57b2e4774541a
- SHA512 6ec74445318f60583800fe2e24d7108ba4352b92accd3ddcdb2747b1de41dcc48f454eaa334d06f67aca073d148884aa66858da79af26db82b8e524c54ca2e48
- SSDEEP 96:O8tHHt8sH8MzkGF3hzoGFaUqePZZCv6SbbUkJoOKUMwt4KY:xntHH9H3B7aSaJbpKUV4r
- TLSH T19503BF12CE7E1E7EC96C0BB5146F061076B3586E6EDE9B891A30F1282D4B3E41B37554
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3456
- SHA256 7fc6197ec71aed76d6f80a0a5fd2b85577de33cef884f03a48b359f19a8aa374
- MD5 9cff19a6231f1dd180523461d3d59abd
- SHA1 5ac6d6a4db52c9725bb60543bccc5ce11e6c4943
- SHA512 ed02bf7f276dff0ed628af0146a6a7043940e38eef5643fc512694228ec0707f064e6c035939a3a1ad272b5c3e078b2b13f059a3d5c08f0dd917c95f305ce647
- SSDEEP 6144:oGVOK1LgvQ30RAXP4pNAZqzViqv6SBtuNCPN22yFi9mxeVVlGm+i2A4H0u1P0C3i:TXP4pNAZqzViqv6SBQNCPN22yFi9mxez
- TLSH T1E1743A62BCAC3D8AC1ECB2BB194A47482F15CA6B48D186F7C7E3537C40DB46A3F56449
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3456_fsm
- SHA256 1eb1558d209394c1efedca731c69425b4f891f44ac11be34705332cb065b26b2
- MD5 7f40c0c4f27d75b4be75050e9899b0fc
- SHA1 8a22b9828551ed5ce8dd6febd54c195c4e6ad4d4
- SHA512 00bbddebae2a28ab5eb3eb08824f11cc823a5bee7369f22594195aadedada5f7379a8d50de80178934078dba770a0acf8fe189b6efa00fbf0bc6190d46605585
- SSDEEP 3:nhNlH/fl/lHlnlnlnlnlnlnlnlnlNhNlH/fl/lHlnlnlnlnlnlnlnlnlNhNlH/fS:cBt8tItDtjt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3456_vm
- SHA256 932df30de2bc1bf03ec2010c40d3a821acb1224b14f99c120347a3b02b7c8d72
- MD5 217a7cb38602f2aee5d672a9e848a894
- SHA1 807d7af9d2eb6e3b1bddf4b7f43b5da5136f3e1f
- SHA512 cdb5b59642998aad87110989a7ff198f0266481abadc5dc129987ec30ac58042d34804422094ebab2bbc3fba3d009251b33bbc68cf47442539cb18782ba1f87d
- SSDEEP 3:tsP1hNlpT//:iPlD
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3467
- SHA256 e689e621eb5f41a98376f854904c5e9f6507ac50e74e6a95d4ab64792806e76a
- MD5 6ab757341b9459259907abe4b16475d2
- SHA1 0c68b8cc7747d6178fbb4d38b15466052f389193
- SHA512 4fac17c7e27e5058bcbbb2d15dac2226873d0752c2c84cc27e99630bb7f0790a6e47458fdcaec8c0b5405e58049b8bdcf67aec152af8ca4b193c80679c980639
- SSDEEP 3:TtW6DZh//lKlvln:hW6b/49
- TLSH T145F1043FF400111DD337C13504340D715530304D010013000071153D14551401F75471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3468
- SHA256 70d913ff288aa7216be6a8d4818de1a9266cbce42e0d0f98f4093cfdbd819c1a
- MD5 829c9920f38a8d77963bcc923ca9f88f
- SHA1 16443c21e244f5c4b51d6ee2b3028da6328a47be
- SHA512 c581eee6a7da6272a73783dc80e77354113072e0e4abe70faed5e9904a335b51760eb60db53ccf0d791e9ae0864e59740535aa80b12f7b9d5589acdfaf484418
- SSDEEP 3:ul/tW6DZh//lKlvln:ufW6b/49
- TLSH T19BF1043FFC00101DD337D13504740D715530104D1000330004751535145514017554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3502
- SHA256 bfb703155adfb2bb60db26b5864cd6eba597189742dd0f8ec4539958d9e049ac
- MD5 0536b7c6a4799a365f55d85aba1f3552
- SHA1 e8d38f119df647d5dd6ed701b731f91346234407
- SHA512 a9e74de91e851ed428e6c51c2fc14526d5e20941a60d2b529650ea71b90139e80a4f1808e8e17e5d09041037f4b0508c1ee5595f256b3767f211a775fa095f0e
- SSDEEP 3:UllG6DZh//lKlvln:8Y6b/49
- TLSH T18CF10437F400141DF337C13504341CF15730D0CD1000130010751D37145D1401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3503
- SHA256 62ffe899ea61e6e68d178595e8709a31688f506d48200c4de8eaba0ccc86edfb
- MD5 faa1821f7e8da853299dcbdeea4c19d0
- SHA1 ce1fe95d6efd2fdddc6428279b8d81d99041b783
- SHA512 dd58ccd64e368363bd16894eaf05964cdd1cced31e5a1631174fe335a28085539b6e0404f20d927337175554f0cc1dc8ec4fd1031be381faabccf48280328cee
- SSDEEP 3:E/G6DZh//lKlvln:h6b/49
- TLSH T1AAF10437F400141DD33FC13544340CF1753050CD000013003075153514555401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3534
- SHA256 8aa95c9c05d21e4326db1241f4740dc388e0ac69ea1269579f0b0269dddce378
- MD5 b122e32d0f4bdac3328dc0e61b946ce8
- SHA1 726b3442c6f6fc1e23fc53babc7c5ba5e1190bf9
- SHA512 4c686e4f01895ae857cd4feef6f457db81423ff817efa6456ecf76fc650c9c0d1a7b259411884fc9efa007a7249487e5563985398e8ab9a08dcf30beb6f0cf82
- SSDEEP 3:RlG6DZh//lKlvln:RlG6b/49
- TLSH T10CF10437F400541DD337C17D04340CF1553014CD010013001075113514D51C015D5571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3541
- SHA256 5f7ca17f6d04d5ee8abdf687d103c30c245e489f2ce70a927fc8dce2e3b77334
- MD5 2a888952db4a8f2ce1e53c59791357e3
- SHA1 e38767daaa120cdeca7601e79f60febb2a3be991
- SHA512 7a4d7325e63b7077735f991d95519da0a94f1ff3c0661f3f8a1008b0a265342d3ab66e02686039b15e5fc25fe658cdaa62d9d2c437977a9f9a89ac5d9b31a135
- SSDEEP 6:Sue6d6t4Cpq6dEtKa3bU95uzEdnolsMD/lb/G:Sue6d6t4CpBdsKEU95uGolsMrk
- TLSH T181F19275A6729270D042023CD9BB2BC503C4F917D4884F526A0E4031F8236615096254
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3541_fsm
- SHA256 67d088a0fd41731665976defa2106f56d5f9182514dfb37f147e17801b1f19c0
- MD5 bc2fc5353eb9c13148d53e64375ce721
- SHA1 97aded03a93705d9a07ff505e60f944bb1bf6fe7
- SHA512 2b9fd3b42c399e148345caa32a8e9feb5da59ead826da93044263c8800e4f835f95180257f29abcc2fe8db90857f12eff93f98186ad87df7091a59d0f1cbad6d
- SSDEEP 3:nhNlml/wtalt6lt6lt6lt6lt6lt6lt6lt6lt/hNlml/wtalt6lt6lt6lt6lt6lt9:DAggggggggVAggggggggVAgggggggg
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3541_vm
- SHA256 0c84355aa6874471a20704c19f52598c3bcae01a9f6c51b416183b5a7e15b75c
- MD5 2da40f08afc02eb921c838cacf7f50e4
- SHA1 cdebd4a3a09eb2cc3d7ffcf5a4edc54a891d322a
- SHA512 b82f023380d5cf7b4152cdfa37005f9eae7864b71a5263f82e87f262a036f837d9ee22de0d5f98014b38d7761de6cdad694500d48efc0d03466b8eb7e81a1719
- SSDEEP 3:hl91hNl:R
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3542
- SHA256 ba330788c7c8e36a751dcbfe119907a81bd3da28a2bc9c0113d891bb8d5eb941
- MD5 d0a4fa558f577c479dfae44c47205133
- SHA1 031b46d37e05a0b7cf75836be151404cd42f36bd
- SHA512 1f5093b2959c552b4d83a3bdffc713a9657ffa992afd15a43b2fff9bde32d7bcdca7e7f81d19dca7907aa5a814f9ad63a98579ab416c27ffdd6a80e38746c924
- SSDEEP 3:aW6DZh/stlslwlvlS26DwH6fV6Nllltltq/lQtRlnqlll/llE:aW6b/sXEQE26cH6d6N/BIQIl///E
- TLSH T17D729BEBDA50797EC1368B75C4344FE11673F06E05114F55415511F58DAC2800F36450
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3574
- SHA256 445ecd997e7330810b57ac9782ac04b45eb006a5bcd096e6fd5ca8ab5100f4dc
- MD5 c1cb877d52eb3a601ba13a5812fca03e
- SHA1 9b24d3522ca7c9b6004cacb57d16ed45e1a741d4
- SHA512 9784150d4896c7915e36a5e479c6bb947fae5e27a99160584877acdec0deef6fd0b920bb8141184f5991e005f3b16b8cd3c38e91f4131707788ed51e3dd0648c
- SSDEEP 3:6W6DZh//lKlvln:6W6b/49
- TLSH T187F10437F400171DD337C13504340D715530134F010013030471513534D51401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3575
- SHA256 aad5477a2e0bef3add5f5e64bc236064625093b703b98066456f90a378a4060b
- MD5 735dda2b3def82b2bbd1fe5bba946a3b
- SHA1 4709a3851f3703f5b1e4aca792c890031de7af35
- SHA512 725bfd5e0caedf8b577420527b37b59fa19a34f311111c9f748dbe5305a80dabcdc5fc7fafc60e1603b9c1ac49024d4ec328b1c44032e2a40e7ea4478b579e42
- SSDEEP 3:Dl/tW6DZh//lKlvln:7W6b/49
- TLSH T1F6F10437F400141DD37FD13514341FF55530104D000453004071113D14D51C41555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3597
- SHA256 61cd72e9a5354e80d0520fe4529c6a0da909dfe347200c62ad1c7000f5f3ec3f
- MD5 efd0856d0df301326d19fb0e5de09fc8
- SHA1 1009d626d4a4929f73afac63c56ea2d00bca0de4
- SHA512 8619c5078cd9764414506a8e964975f45324a0c3b0c90b5cf46e72e12d752234324aae6418401b9e7b68086efa12ae7af55ff3ca3189d230b5b7b7ed4165849b
- SSDEEP 3:vW6DZh//lKlvln:vW6b/49
- TLSH T1E3F10437F404301FD33FC13504340D715530104F0000130004711135145774415554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3599
- SHA256 3b497fd69b96aa68442ca9123b60800a9cffd3f5f1ae1ee8de3755386aa16cd9
- MD5 9e1bb5abc99974373bbeaad6b367b166
- SHA1 4da96363ce195cbd0a584eb6123203eb9460fcc1
- SHA512 8c767a8e7662bcebb049ae7bb7fa951655f7abb41fad74f25257db9616ed965cd5ada0235b3ff11a54273f17e2dbff3e6d364ce202cd60ad973dfee97692293d
- SSDEEP 3:f6DZh//lKlvln:f6b/49
- TLSH T12EF10437F400101DD33FC33704340CF15530104D004453000173113D1DD51D415D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3600
- SHA256 8d43627c0e4dd8c748334d7438c591da9566b479c533b12baf42261695ccca1c
- MD5 1b75dc9f6e52f57c4facb529d7420b30
- SHA1 a66858fe0d431f66ef6dc823323c04fc8452221b
- SHA512 e6bcbeca7af956e926f29087d10760cac94ef90dd5c248e6c1e53417d6ce1faf846dc0654a4406c4e11b7806b4af7e165a1e07c480931247722fa66a69daa67b
- SSDEEP 96:xhQEvmeyLrx4E+9CkosQc78ZL2nGaMS7SH6GIULYgh:nNuZiGhQg
- TLSH T119F1B25F40353827D26CB23CA1D95C41BB2A377A93456C5166FACB31DBC762BBC23928
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3600_fsm
- SHA256 5b7eaf4390699bbd73877aef79309162adb4023a29c2d7d91b1ad2a967dd0f54
- MD5 9c8c826ad6df53eca007367b61b862e2
- SHA1 1970a5d78f2273bfde19da2b9e5d7fd620a6369e
- SHA512 3b0779dfa9503a075d9cc0746bf084dd0912d29eb8a8d8fd25e4a8a95e8f84763f548aa58a1187d7089894493da330453fb659b1bff740aeb688c84a8171ae41
- SSDEEP 6:cOgAAAAAAAA6OgAAAAAAAA6OgAAAAAAAA:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3600_vm
- SHA256 29cc0ed4f77436ef442cec8d8058c54c3f9b09931878d749774ce21fdde26163
- MD5 c8a5956699378d2d46c6667197fdbb28
- SHA1 c59977db8abd4d4000c545b87bab1c47eac8b88c
- SHA512 ef2fcf6bfb99781704f877692c725cb6f94bdf2e30c60a6630a7fd95f117fc935ab884f6c7b2f37ec37754b8dcb9d1bebd63147fbb9e85e015a694efd0443cf4
- SSDEEP 3:plll1hNl:Lll
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3601
- SHA256 f97b3570a2ccae55a9b4f9441d9a6fd7a2d902481572fd0bd587cb346f0edd12
- MD5 8653700f1910bc0c8a8b3a099aa526a1
- SHA1 401ba07d8423e742136ca51e83ad8b9d913ab71e
- SHA512 7076a80f8f1b2e273a16d2013df9c89520a619a9fd319c39c92f37058bb6e4cad077916ee6230f8f15be7090f20f584eec84cd8eeb1c82e032bc34706bde56d3
- SSDEEP 3:tlhCbFtil//mlvzg/lmlq1QtxMl1:Ab2/aLglS6Qgv
- TLSH T1FFF1112BA2CC0C80C82CCAB0282C22A88B80AAA880222A03888200000802A803E0E2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3601_fsm
- SHA256 a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53
- MD5 2a3216a10d8aeed6ac8058c1f5f6cabb
- SHA1 6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a
- SHA512 ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264
- SSDEEP 24:33a6666666653a6666666653a66666666:3UU
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3601_vm
- SHA256 011432e22e7616709fb81d309ae4bae2f1f416d5669263f4b86cec7b36da620a
- MD5 2874cc77f26a654f71062704b6716327
- SHA1 171a267f0a7a6cc99d063443e5bc1b6966c3e7b5
- SHA512 8ed201f7dc8b1ed3bd95cdbbfc845d8f8d60e1ee2444400cc770a2e91b0876b7ef95638c5b6d24ea66538ae02b73ee05030ffcafda2b1f6aa75ad7d34cb95631
- SSDEEP 3:LfhNl:L
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3602
- SHA256 17b8e3beafd51008862f33d7a30d111007800202ccf253109d79598547e6f2e5
- MD5 79edf08c4e3b7471563aa65f58e3b59f
- SHA1 204d2e91a720bc1a5d89987e2bbc997d3d2d0166
- SHA512 94e63ef25b1e5ada6e019f21cf39c052a32cc13337bc4c2c38b47da14a14ab0dd6437f58a624f115f666e6e41728a1973e6d6e96914224231fb194d5d3544993
- SSDEEP 24:aB+5jhKgayT6uSAnRy9hy0H/qlmapiKkCxvDOiyc6bZcKu3SEK9p:BmRwMKHsp5L
- TLSH T158F11E97DC1CB861C23C82F5CCDA5038A7609D90E563296DAADBD7A62ADB0103E5750D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3602_fsm
- SHA256 379f6be469b2ebdfc6a6db6a0d57039c7cc4515086a06fac364d31e1a5958870
- MD5 5eb3063bf4b81ac55334944d5bf28740
- SHA1 f1775adb3d4fb050bef20a0af532f4246d40f18c
- SHA512 91e83a3ddf6a3260617530dbf96391f22878bfa864acf0c7481dacac43af2a48fe1f69b77f2a36eeb27e3dcada493ee36644b656713304ec6662e806bc0bdc0b
- SSDEEP 3:nhNlLOSXU00000000NhNlLOSXU00000000NhNlLOSXU00000000:DU00000000FU00000000FU00000000
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3602_vm
- SHA256 3f0e0eb3141f032e34ab3b1c1d46e74a1108f9dca23d43b08f202b611f76c952
- MD5 0fc08e88cb04aff1232e5d2efd675133
- SHA1 ff7738a761781d1cbece37ba16d60e3e4a353def
- SHA512 3c02a6cc5a6349445d28493772ec51679fbcf4fa8b849c15db84b94c3a0f25aa9606ceeb31a4449da7406142a1191ff4790cc96247a0362ded3498f44ece5867
- SSDEEP 3:33hNl:3
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3603
- SHA256 a5f769c807b79725f199902659f28facbde9b036580985b698729f24b6733b60
- MD5 bbac254c9bc479beb2607a819f93ae7c
- SHA1 b4270d1c3cc57a1faf79e00153fb7d78075ac3b0
- SHA512 a495abff7224f235e8197c936b06715999153a75bf4a9357eb01f8f9830a92a550503c89a7f6e93cce2e65fb3504f3e90034edaaaac9ab28dce380282b2c36b7
- SSDEEP 96:2gSftcuCdLoxy8kDewk/PN0u8+sIi8jXiW3eWC2gSftBqrx8Y3V+vq0W0apg1AWy:27/4LT8kD8hD7grP+vq0W0aW0tKT/KVp
- TLSH T19DB2D7830B4474E2C16C97F5B7AF1B6483A9E352DA9323034D5B27114CE21E67AFE19E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3603_fsm
- SHA256 cadfdc3c0accfb56c633f8fe6749e8515cfc1d20bb6b0e76e09b2132336f6a92
- MD5 ef791ef2f215614dc70d1e41e8e8d280
- SHA1 70479bef80d8362d16f57632ec69c7a15e03a3c2
- SHA512 6d6c130098d5dc69206517fade2fd22e9104d83e5e26d335b6660a0ed30317a6f6b08face42060b194632e1552f22e6f383e48b7484c50b8f0d333919cb6e119
- SSDEEP 3:nhNlHlCm/c/8/8/8/8/8/8/8/8//hNlHlCm/c/8/8/8/8/8/8/8/8//hNlHlCm/G:H88
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3603_vm
- SHA256 57ece504e4597d7f014eeb3bd9d5bd833d7ba4513271dc2186117398e7fd6dcf
- MD5 bcaeed5190ce8b66a3b72f9ed911943a
- SHA1 0d7fc0833f9662ca9a6bb36a44f8fcb4f3001d4c
- SHA512 0ebf530ecf6361fcb03661fdac7a82d2a41f56ecf780fc73b5d122778fef367e15175718995fd6dd6c04e0f5e25399b05f99875098317925c3405ccbcb976e7c
- SSDEEP 3:c1hNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3604
- SHA256 ea4a01f166021f8a4baa6b510d37629d264e58dae801cc82fe87ece772d4a805
- MD5 a11c779c1901eb0e38abe7c8ea0903ad
- SHA1 caf60c7500c986330a8842b55335ece8e7cccd2b
- SHA512 b4cef1eabd6794c9e6a57dddace3cacfd0750229a6cb756c181ab37c4a36bf0c5d6c0eef89e3555a56be3fe9d2ac24c419f01e81ca88a9b8e0b7428ef721f1e0
- SSDEEP 12:LFEXEQ8j+e1VO6QIuIjfE9QJOx1zmMAb2L9mSJgQctto:ptfEGu1z8GM4gQctq
- TLSH T13472AF5EE70A28AFCB39017E582F0C5302AE3D7910008661BEF4CA15FA1BE433EB4824
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3605
- SHA256 89817386857bbe5279ccb0cd73d8e305d032b3cdbf9fae0f6a50cfda44ddc681
- MD5 af14b8617984149b64b76246f864ec04
- SHA1 713108b4446500c4c54c5c4ea66a83925ef770eb
- SHA512 0bbf23777bd93b8dc8f870714f89329004bc6f39c81fc47e6737bf6d09a09a01b246488ebb62d733e94345c29718fbf0d412558180a2396ad49c1179f066d919
- SSDEEP 12:IFEXEQ0GH6N6Hdata9Bi4WcYlbA8oSMAlfK:Icaxlc8lbfK
- TLSH T15972CD62DF951F36C1154D7200590DF0473F5459C51D5FC219D061180CFA25757FA511
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3606
- SHA256 6bb5f393fc96f8ea356d0c3c7a69e1837912f7173f3e4606770ecaf98b1e1f73
- MD5 4957741179e9af00970effdc878f6f7f
- SHA1 d2d1819ccfcf35e75b0160d8f770f8d16435ca85
- SHA512 368c3bb6abd3c7efbad26bcb8026aa5f70f029b20a8bc5bfe61430e723fc57617b076ae0dc20b17118887b9c92c99c70fb40d7a6467a9401b510b0b3444c1bda
- SSDEEP 3:rlll3W6DZh/stlslwlvlCtjbV4nalKYR0ll/M:r9W6b/sXEQItjqnuX7
- TLSH T15A72123FF2447818D73AC13208248F969310995D000023A714F2012C0C631840C9A564
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3607
- SHA256 1acbe15d5a46f43ea6ea2fa9679d1c9b263c1d3c1065964212394d3a9d9d4233
- MD5 1810cf10000f26f97f2f50fbc23e650b
- SHA1 f21a2d5dc889269c5d97dba0d498f3f17673b852
- SHA512 c574a0a9b20da000cfeab4048b0b24bc811d575dadcd560c5be06ba0784727bdb3e1c088feb4989ff7ec2a07ddc64155fa04836d1f1be72b154e1eed3891a92e
- SSDEEP 3:q/l3W6DZh/stlslwlvlsktl55AqX8U:qt3W6b/sXEQ6kpKY
- TLSH T100721227DA043018C336C37304200FA06360944E00010B0B012210240C912501D734A0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3608
- SHA256 0490bf455ef2afb256a469f5e5be0e42d615f99341585c275c577a101df5e9f5
- MD5 7d6591076add91f3160d2e15dd93f420
- SHA1 a0292313afb552b9cf182db2b2b9b44ea8bee3c4
- SHA512 94dbe8e9cfa47fb80e86dc51374b4548d90108cc313d74ddddfc4deadd79c669c70431ce1be8d41c08c291059f3961b328f4a87fae3f8d095d76c3191ffc958f
- SSDEEP 12:efFEXEQIj+WOme2uGR+RVq/gG/+tmD07WgySCBQ8bkILzto:uL18Iqtmo7cS4pbVLzq
- TLSH T1F772205FE9057D6ACB7C477A8016CE9387F59C9C262247B29EDB275A0A1F40403F1EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3609
- SHA256 07daec5b6d2be21830e22d9a9d3490a75bca6641fe9725502edeca0c26aa67c7
- MD5 e4e1cbf656c3ed727bcd063a7a2f9640
- SHA1 ae290f180e0b05d9f6afd0fdefd59939937da480
- SHA512 10370dc3f5b7844b15e9dd8e18cf968fde2bf7dc998577df6d77e26fb1c8b965e4914ce04da6739cc7616cf57c34a70a36f5fcbccdaf135be9cffe0ac269e683
- SSDEEP 384:lJQRrTF9U0Q7tp5senyqn+dN+I9QM2ygKdB95eC:lCgv7P5senyqngN+ICM2ygKdB+C
- TLSH T12AE27A422F45A4A3C260B63BE1630B0F53B0E56DD6B723174255A7103DD2B0B9DD76AF
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3712
- SHA256 589e7a7a4b1da5257a54edfdf05778fee187329f6eaf5c2680f9043f3287e95e
- MD5 43318b817ab6693f5bd5f73fc2d323c6
- SHA1 b55645828462af42d457c31639ca89fdeb09f8c4
- SHA512 895ac687668e78a9536d5cf28a9d1fa7d591acbb650b20890229e0b9f92fe81da886517f834895688c90599f8047a71e03707b68493a3f1507fd632b7b7efebb
- SSDEEP 12:/FEXEQgGH6N6Hdata9BiOwdT/jyr3C2whfDv26:tQtE+ry2QDO6
- TLSH T1E072C243AFA81ABBC2211DB640590DF597BF2066D91D4FD14692521408DB5530AFA196
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3764
- SHA256 0c2ecd002eb6a7b3c4e34a9cfaa814af4b1cf337ae1d28a6cb75ec771a3e9252
- MD5 4c72e65f948933e4931be5d487f4355d
- SHA1 84626650f1b81b20a184abcbf6e537b5e81e0098
- SHA512 485d27faff4797adbcf8ef09cd46b8a505e5bcad3a2d00fd08b8a1fa45b97b20e8b0a985a3a5bc53c1d3b4ebf0ef9814d3069d3fc3745824ea9dfa0dfcb1c4bd
- SSDEEP 6:4z2PHrDEHaHZXRxsyl0aIAalqtEsqXil4xAtM6IPl3EmX:4zWLDFHpNl0aIAalOEsqXetM6IPNEq
- TLSH T16EF1A773CF8E74A1C43CC2B45C1E17B1F394BE00E25F0304196A4112684B1543025618
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3764_fsm
- SHA256 51e01e110ad6394a405d1cd7d0f18be9e1566302d54d545ff703c30cee71f5b0
- MD5 461ce67a44bad8aa641f0f8ac7f750a3
- SHA1 8839d3ce467b401c60f851183bfd7841ce7c0770
- SHA512 f8ed6ec80bb7a0b2b396d7fd99a12718a78aacc0215418434549c2e95c2fb9f0daf0340855ff2923c7cd143cc92f3112841c5dc65bfc4f955fb698ef765c66ac
- SSDEEP 3:nhNlrtD/JppppppppnhNlrtD/JppppppppnhNlrtD/Jpppppppp:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3764_vm
- SHA256 50f2fee0071bf57ed91a8dc0ceff4a59488f2e0e9cc42c8aa33b4ec333ac2c0e
- MD5 39cdf730686e4b5606c6b9992bf0d419
- SHA1 de16fdcefdc5fb81947ba39c1fd6fd93cd058b27
- SHA512 2929e177558a888636e3f4bc52123ee35251e79b954890f0d3aab90903376639ba98d84065743d7d67206481fb427686d20c68617cde5ec07e9f611236e3d66e
- SSDEEP 3:UsthNl:Us
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/1/3766
- SHA256 3143c73dc158c0d4345d6a0c2ccbd15f144af495e629bcccbca5b2a5c1a2b452
- MD5 28e563283339d23678abf997e48dc847
- SHA1 38ccf232bea2bae75f8749fd33cfb17daefa4653
- SHA512 5d8f30d8f99045955820696d7979ae54d1b2fdc6816dbbc76e2aa2418cc529ade4576dfd81ee4b9d5f03d3754f606ba76985e8d108a2d9b09b6366cd129b56f1
- SSDEEP 6:3W6b/sXEQckkx/WG+ueLdq4MAy6wktYxi:3FEXEQckkZWG+ulVx6wktsi
- TLSH T113728C2EC74E38D9D33EA2B244690D6363E8AC8C530603720CB1106548CB6410AF2DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3767
- SHA256 b28bf9ff18db4bd676a889d02f2b10a21d2adb412f247ba0d509623639c1bdaf
- MD5 1ccb42ecd8ede4670a2b6c2bc4f8d5c8
- SHA1 0e7b6f535b52d9954bfe026f2f2b1d241dcf8537
- SHA512 8d5a57ef967c7a94afabe259603c580b95ec1256b7b666de2eda10d0fdaeb1d9a9be5e5d51915111404e9c2e12952cd7f700e62a309a63ca7f6166875ceaa113
- SSDEEP 3:isttW6DZh/stlslwlvlHR68ltwH6fgglaQXx/dl3rtn/E:ikW6b/sXEQ2xH6PaQ8
- TLSH T10E72926BEE806876C23682F2083D0FE03B33B86D80274F020061F0204CA83D2BFBA050
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/3997
- SHA256 0090c9dc550f4498e902fd9c4f3d39df3900040215b60a27ef4e0ce801cb535d
- MD5 af24aaf9932f2422903f164a518f6f37
- SHA1 adb37067fa68e9a548e9bf50e1a0922f0ebc3821
- SHA512 a995d864230fd21d7a23539ff412442463ea61487eba2eab1c9230171a7e9d1861d25de0d2b48c034b2236a91c65df5aa4359e4a1249c57279bab16b3b5e664e
- SSDEEP 3:BkW6DZh//lKlvln:+W6b/49
- TLSH T10CF10437F400101DD337C13504744D735530104F000013100071113514D51401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4144
- SHA256 a730212878ba025eb5bccc939233323d52e0e7f9878aa98e223c1fa9116f6aec
- MD5 ec372f6d8f38d99e0e1fb32655efa9ef
- SHA1 19f702803b5e643ad7d7946a97a14c1e17dac4c7
- SHA512 39298a227dbd25bf9a3b079cb115f3c2173f6f85cc9decd36d7a3296277c7657aeadd61c025756398b79ac539911ce6736741e6ef2fcde66977dae9a7321e96e
- SSDEEP 3:5se6DZh//lKlvln:H6b/49
- TLSH T1CFF10437FC41151DD337C13704340C717570104D0001170010F111351C5D1551555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4146
- SHA256 2aa8f505c22652d7be513c740735dca16e181bb55a815247b843bebcfa628e01
- MD5 5361c82a05d964d912bb07a14641da59
- SHA1 39f2819ab7712dd32fed1d1bbf28e8fcd617bf82
- SHA512 397bcaac9a6c5b632e2fcb4419b21f182edfa476c75c6eaa811f961e85d897ef5b7fbe761ae924c4a5d6bbe7363fa4b59ba36ae038a54a21790c294e0da4b9d4
- SSDEEP 3:o6DZh//lKlvln:o6b/49
- TLSH T149F10437F400111DD337C13704341C715530304D01001304007111351C551DC3575471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4148
- SHA256 96913cf602df9f2c6137e8edebc889f03e8c2eef3d210dcf2843abb1cbbac910
- MD5 4f847897c792fa3fca64f6632817382d
- SHA1 072a92e15c424e9886cd58d280a8a36077d98cab
- SHA512 9010790b965ca017bcacd383c3ae576a80326e50ccea2b3607e236f8d404f3187313aefa3845b1d4d47fa093f3fa1cd08e7ef06fb2489345c334f56e9942f2c8
- SSDEEP 3:x6DZh//lKlvln:x6b/49
- TLSH T164F10437FC00101DD337C13F04745C715530104D40001301407533355C575541755474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4150
- SHA256 c314cb56e798b04270fe07ba4d851b98e5cb3f638efccbd441baeff34f3ccfc6
- MD5 f6a0e414ee0f6cdb44b1e5890b338aaf
- SHA1 99f3568c0db4afcd09b3e1cacdbb21989ceb6c50
- SHA512 3320b906ec839eb3422c74157a5919051e0ef6a1b0b1325b975855bef642fd51dbb4a499edb7cf1354daa6506662a3475440aadb9486655baba9e99116053875
- SSDEEP 3:B6DZh//lKlvln:B6b/49
- TLSH T174F10437F400101DD377C13F04344C715530104D00001300407133351C5755C15554F4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4152
- SHA256 f18ce0e3cc3760239becd1b5440eeb48856a18b6deca7082de704ee8ed1b8cf6
- MD5 a7afa8c187c09b1cc267ead265b3de32
- SHA1 5f13f35400deaa6cc78b791fe24504ea7fbb72d7
- SHA512 518d27984d5a1903712a8dfd7acdbcc10c3b03a6943b60d49f2382386f50be6ae709b4cce5e16db2e51c2a5e037eee8aa3a8d4cda31fa6fd1b3844e80ea9527d
- SSDEEP 3:Qse6DZh//lKlvln:Qse6b/49
- TLSH T167F1047FF401111DF33FC13704740C71553010CD0000130000F111355C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4154
- SHA256 48e02c18aa0ba0bf5c6b563898a22f9571aeaa7b978ad83e11b24eba9ea93a98
- MD5 3620e3b48674ec2074848bfa351fc699
- SHA1 fb8a748651b6099297018552f304e35338d0c770
- SHA512 8f8ccb10206acefd741c5c6a418f1b8186f9a800229727070b75ee23cd328dea950868fb9a7125d9a3bf4e84f3406e292e4315d22401964090dada9ab35e3cd1
- SSDEEP 3:Ase6DZh//lKlvln:Ase6b/49
- TLSH T107F1043FF440111DD33FC1770CFC0C715530504D00001300007111355C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4156
- SHA256 9240aefbf1081e9e5aedd8b694e718cf07f4c0951ed40e9f666a3b529e716f88
- MD5 54811aa1ba4013195d5e9eeaf0c836d0
- SHA1 7e0d5ff7288223b9a7cf3b15cbcce19c2fafa278
- SHA512 b6d84c841dcb3c81f44f13183ec365896b4db8980585ecd86cc692b4089aefdda62265fbd52d104fb05c0590fade5b95bcb10f5bc842b52622e06f3708844716
- SSDEEP 3:+w6DZh//lKlvln:+w6b/49
- TLSH T1F3F1043FF400141DD337C13704340C717531104D01005300007311351C5F1741555474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4158
- SHA256 3b2b73a0bbe39500f970a055ca2aae41080db93f43eeadea13943fc37beb3fa9
- MD5 1d23c3804323f0ac2ba807fabb60528b
- SHA1 7af99b57c5bee2683a4357b6380ceb70153a3533
- SHA512 2a994a8d16304337b0580da4b0ad2360a4a2b46bd8833790646208aa7da567a69ad4ff1ef46269cc501030dc35bbe87cc1ea12ade9ecd027dfde50629c86fa69
- SSDEEP 3:jw6DZh//lKlvln:jw6b/49
- TLSH T1F0F10437F400141DD337C3370C3C1C7157701C4D01103300007511351D551741555C70
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4160
- SHA256 389264fec0d1c0e4392fdce065a4870d3c5106557febf2ce3f07dbee80722977
- MD5 1173a80aaad39ba147a0d78b9df19c4f
- SHA1 c0354bcacdd9be4638f0ff59bb2d132c6613c2f7
- SHA512 4b167b85131314a91990a160befe029ab5ae6e441a76f39b5e3ec58e7a4e9c362468edcc423e6a20d8108646d7910cc041e9df2cc6fc3004b5d9daa02ae323f5
- SSDEEP 3:d6DZh//lKlvln:d6b/49
- TLSH T174F10437F400311DD337C73704344C755534104D00001300007311355D551541F55570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4162
- SHA256 643db2d87e3ae7aa952217f80bd07a702f7c1300b1e49197fdc22884e7a77815
- MD5 76606fb9a757bedf604f5fc1e5fede57
- SHA1 f75876fc4c732153427719a23514adcffbf4c059
- SHA512 d28f1f755fbd1a8c41e258cb53a45758000815c5e64c1f432f0300e825bfa8b61eadd425e2b724c65841570d64d15b0fab75f781df3710982b3493eee1f99bed
- SSDEEP 3:u6DZh//lKlvln:u6b/49
- TLSH T150F10226E400101AD23E813A046408A155201049000053004071112918961941696560
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4164
- SHA256 2e3456b41aef99069803b60800a4ad7cbbf225b8c299ed2d2ab3e7745a3ddb3b
- MD5 2bc50e2983b1d3d2ef7acb50dc5863f2
- SHA1 75458da85b69d3df23e84a6c68367f3bc9c6239a
- SHA512 7f53d828b1d05c9830de175d017bba2df4d6b96d4fc2f1c412de554edd9380f447d434f2033f244002d05f92f408159785457f40cad683348ffee6fc8d9ef00c
- SSDEEP 3:zw6DZh//lKlvln:zw6b/49
- TLSH T1B7F10437F400153DD337C13F0C340C715770144F01001300007D11351C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4166
- SHA256 a8f213a5ac4616bd997e11cd2a39c06fb4c462f80aa070b17de56305c3d73abe
- MD5 1e61aa8da2a1a4cdda5e2c16f5ebd382
- SHA1 ca66538567cd764c1de62b3f438dece12d7eb6c1
- SHA512 e2dfcec0462a645b3a4c26db4efa47f856f5662d028da5b7580803066c2a732154e95a85b289e46cbf5df0850a610ee8a5529dcac77109b9d98046f28f6a82dc
- SSDEEP 3:Lstw6DZh//lKlvln:Qw6b/49
- TLSH T1BFF10437F414101DD337D17704340CF15530104D000413040075113F1C5515515D54F1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4168
- SHA256 e0e9bda552618b3fe219035da7e74538b7dd22641504e4355308284b8ffd531f
- MD5 67fa10a47cf23e24d71911e730095102
- SHA1 bd3fb9e5fb3f97ea59bef263d0a6b5db502bcc1c
- SHA512 9b913b88c317743f60114470556dce688224c5f35dba506b00faaba200c122376c8ad08a9127c5bb4cc730d0c885d152f99c7e6216e9e191bf9c0a9a794bf8dd
- SSDEEP 3:7stw6DZh//lKlvln:gw6b/49
- TLSH T1C4F10437F400101DD337D57744340C715530104D000013000075117F1C5535415754F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4170
- SHA256 0d1068f356e1f616cecae80386cfa9783db3dd209cb37960184e243114b3e210
- MD5 d9235ed26c8d707741eb29998d696524
- SHA1 d1516ae7e3eab1eceb1c84df3f34e29d6cf97a78
- SHA512 ebeddbc92b0371ff2cf0e67726ec27f72ccf3215a513656dfcdb7df42baf225ec2bbcbf2df11a80dcbf5723dc2ed5bbdf1ac63192b0661b55633bc833581089f
- SSDEEP 3:66DZh//lKlvln:66b/49
- TLSH T173F10437FD00101DF337C13F04F40C715570104D40001300007511755C551541757474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4172
- SHA256 8703b02a900620452e53b7f1eeffda04c5536c0abe9b8c095bd509c8eb86dadf
- MD5 b5ee2394f1bae74686908b0f463e46fe
- SHA1 56d1a4e943e20f082384c51c69f123a5444bcf8f
- SHA512 9a5e4a52d51609e407a40acd44fd166ed4a541747b367db841352e5a3d67378bf162a408a9b66ec9cfe65e07fc4e5e9f0aa7cdabe805464937bda2cfc54af651
- SSDEEP 3:q6DZh//lKlvln:q6b/49
- TLSH T1EAF10437F500101DD337C13704740C715530104D00001300007111751C571DC15574F4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/4174
- SHA256 3e5f8daa9394b009f658495b0304a7892e70dda89812c8dc4318a06f686d2459
- MD5 a63412b58a46923fa4b275a6fa90af66
- SHA1 a861e4f9c0e304fc52d8fa40b061f04be1bc8cc4
- SHA512 bc9ef6c20f680441744d225ad195422fc15b53a472a8cb62bb39bda1b6815e4bfb72124ef9c1d7b25d79404ad26655660be02603ef93b2d87c5bd2d522c991e6
- SSDEEP 3:9se6DZh//lKlvln:T6b/49
- TLSH T19AF10477F441101DF33FC13704340C71553010CD0010130000F111351C553541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/5002
- SHA256 5b3570c5655f78397824412766920c1528dfe284e1410241044b08852f3e709b
- MD5 aea7c1a3bcb4ec8af887afdd369c52f5
- SHA1 93086994913d38106f03d4459bc338829cd55a52
- SHA512 d7daaaf8febe08c5daa17a4677fc33296a7b678ceaeec8f74d09ca0b995560de85cca0db8c8fdc37b05ddd60a4cd1edb00510fa8016936ea425dd326b7b2e2be
- SSDEEP 3:wlW6DZh//lKlvln:YW6b/49
- TLSH T1FDF10437FC00101DF337C13515340DF15D30304D0000130000F1113534751411555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/548
- SHA256 77b1091bebde42e22cecfc62783b42af31661421472f434305692638f2ea3151
- MD5 acfc245901cb4bbccea075871cb233c7
- SHA1 2c1c9e652bfe69e97042d19de64f088ab28d2efd
- SHA512 3c12c8ec30996b9f4746ecf11be57260e449231a78c9ad7b1f6549815a47e9ffe3819794e9fd054488497c9a92cd3b3c8b5368590bf12ed0145b7d50ba12eaa0
- SSDEEP 3:lsfW6DZh//lKlvln:afW6b/49
- TLSH T192F1047FF410101DD33FC13544740D715730114D001013001071117514553501555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/549
- SHA256 298936e27c99f4f08c3abbaead3fcea134fc027b1bc797da58d48720dbfffa1c
- MD5 01908efd3cf36cb4e6a69a8470c96cd7
- SHA1 35cbc890d0359f7735a83a5bba2f0949e8337ae6
- SHA512 2ff9772a206a4cd1909e1f2cd708a709b9a1fa74c10a42ce2911ff7a329db3419b6de93956565052ade8c19cbb7374e141dd89d9b1c58b8c9cb252f3ffe18279
- SSDEEP 3:ptW6DZh//lKlvln:DW6b/49
- TLSH T1F5F10477F400171DD337C13504340D715530114D004013030071513D34551445555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/6110
- SHA256 450c055829dd3550b738f29a4ac9b132d5bb746f7cfbdfd1ac9acee9c13d23be
- MD5 0044d19a30de0bc228636a6c0f14e7f5
- SHA1 0240c38c4b71c1621aaa2da8a1f13c309c35fa60
- SHA512 f165138457521f9b7fa35422e8589035af3b0dec1ce2e9fa2d10fcb7c417408c2f75b31a6286ca5d2d17cacd01ffe898b6316a775286a44cd908b1ba8eb93495
- SSDEEP 3:BsfW6DZh//lKlvln:WfW6b/49
- TLSH T12CF10437F400101DD337C1350C3C0D715530144D00001700107111353455140D555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/6111
- SHA256 296732ba95435d7370f6150c08e689683aa25e01e0819d37c5f45e1f76edc0b7
- MD5 db16561c12fbc6660d1d0aa49a0447ef
- SHA1 197da5bfc9e9339f882466f810dae4d20c407ea6
- SHA512 deccd6e7745ad4e3314e7122261952f87b17374e20824a841e576461111b21154a30675d9f69f68b30181f14bfe35b05c7788ae63f3f72fc9d7421089283c467
- SSDEEP 3:RsfW6DZh//lKlvln:mfW6b/49
- TLSH T1D1F10437F400101DD337C13504350D7155F0145D000013005071113534571401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/6112
- SHA256 5d146ee314c533412a27ce0b9bac8ca8d61102354ba4d5cb0e8322ef84ff7e6b
- MD5 1e1485c23320c0d131e41d6604aa3bbf
- SHA1 1764f43a019fa1cf79b4d1bd8662359ad324096c
- SHA512 98a7858bdd5421ec9050906e79a69dc8ad6816c93596b503514f0054a1fb874a5e4c646598189af8336216f4e103c9e0a82499433526cae009b1322690629cfa
- SSDEEP 3:ttW6DZh//lKlvln:fW6b/49
- TLSH T11CF1043FF441141DD337C13D04341D715530104D0000530000713135345F1401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/6113
- SHA256 507b84c4e4ad4d65e93e58acad35c2373cebc91d0222429d6fc3bfafe3ef201d
- MD5 f68b176f635d2c03034ada6515e7513e
- SHA1 90d6969510368498043b0117652f9f602e57fc91
- SHA512 cef5bd1b157272cb94b4379f9ee0f1844ec0b3600fb0d55a8df3313ce9eff015fe295d96f91564e401ac0240bdea93a78e136191df81db1919f0dcce850e93da
- SSDEEP 3:dtW6DZh//lKlvln:vW6b/49
- TLSH T17DF10437F441141DD337C13D04340F715530104D000053000071113514571C01D55470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/6117
- SHA256 5364b74413923a3f51f265e1c031c9b3f7a1921aba3c1af5d169d8a22f3959bd
- MD5 3deff01492485c4e66fda46c11d8f4dd
- SHA1 35364978a3b2b3458a046144333d40ae6d4eb432
- SHA512 89655e2ed94b516df8d8335cc6f19c5f2b558200b1be40427292602932b0b50fe3f6ab3c0858117c8b4cce612be86995914fb370766f173773b8660d442d38a2
- SSDEEP 3:asttW6DZh//lKlvln:akW6b/49
- TLSH T16BF10437F400101DD337C135043D1D715730504D00001301407111351C551401D57470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/827
- SHA256 8fb45d5328547ffb3cbcb92b3ed42b56be2215dc1533f862e5f291b9f9a516fb
- MD5 0bb80e72b5f5907eb9c1603c58a28d4f
- SHA1 8d1832bafda4cd8cc66c0d53dc8f2ac35e14bb43
- SHA512 7bb5bc8dbcd64abd1fa4276adbf0259bb820427876ac68df5f157a756e5066453d232689dbec6f65ff4b84a30926966166d49f5338f580f9b89e495ab0861e3c
- SSDEEP 3:ytW6DZh//lKlvln:+W6b/49
- TLSH T188F10437F400111DF337C13504340D735530104F0000130000F1113534551401755470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/828
- SHA256 7ddbc0c516a7619db15b22c822472dfdc5730c65f88ea7f57f8031ee8cde316f
- MD5 97da2160793858bd82c29db296e59c86
- SHA1 f066b4746c982f9884a6b92bd0f78e94f39848ae
- SHA512 4d3eafd89a313eadd01d8d32d5d436ac2edb763117ff51648b883c2fa1d95723c8f24a6db102caea3ccdc1dbd3b2a72c216c57a8cdee3938e04584f30e738876
- SSDEEP 3:itW6DZh//lKlvln:OW6b/49
- TLSH T121F10437F500111DD337C13504340D715530304F0100130400F11D3534551401775471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/1/PG_VERSION
- SHA256 1a252402972f6057fa53cc172b52b9ffca698e18311facd0f3b06ecaaef79e17
- MD5 aa6ed9e0f26a6eba784aae8267df1951
- SHA1 feee44ad365b6b1ec75c5621a0ad067371102854
- SHA512 01765ddfd925d70d41d53cabdba5f2588e678e534ef5d8840a813bc58d33198039006ce6395c6b95747a2e05d21ff3a47389638ba9405fd11ab1b0857f56426f
- MD5 SHA1 SHA512
apt/postgresql/13/main/base/1/pg_filenode.map
- SHA256 bd78612b717923886dbf861661f8a8e0dd592f94a2a2ef331a4672130752c1e8
- MD5 30aed6efde53aa050ecc4d371f5cbea8
- SHA1 65f1291616eeae5fc60cb96b90d327a93e6a0680
- SHA512 9bc7d03aaa577492dfcb5442657356de130ae26a61568808e185a853e087585dd190308b39102d75d7c191ea6ba6cdeeb72a87e3a6341651ff2f5bdcc80e7f81
- TLSH T10FF0920C48936330C43E353684E28136155C52A85A280D61BA225070A7C797E88966B7
- MD5 SHA1 SHA512 TLSH
apt/postgresql/13/main/base/14088/112
- SHA256 5d6373e654ba29c8eee2f8ca1f6afff9d8ec05033c904e9ecb2821ffc5f6e418
- MD5 f3f65c70d64f914fdf0a3188935a7cb4
- SHA1 4d1b0976f91348cdca7afb2d542cb3c260e42f86
- SHA512 479979a28bf93632cfec1ba33ab26ad215d79a2b8611143d16f419768eb2d4bee7040ddf77b50b7aa2d4010e6639fc524692662bed52300eabff4f9a285919b9
- SSDEEP 3:1sfW6DZh//lKlvln:qfW6b/49
- TLSH T179F10437F404101DD33FC135447D0DF1D530104D001013000071113D145514015D5471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/113
- SHA256 5f728713e23d19402b40b1a12efa054ec74d4e50ca794618af539e873d86abff
- MD5 488c596551d129726321a12759c3bf81
- SHA1 d0d1b75dec5453606ae6535499aa05b29b9ac4b3
- SHA512 122feb59d92145588d051ad0c22fc273850fc650378f57688ab491cc73b72ae73ebd42daa7127449cbf210e3572719df2304c0d71accdd821d477ea650caaaf7
- SSDEEP 3:5tW6DZh//lKlvln:zW6b/49
- TLSH T1DBF10477F401311DD337C73504340D755534104D000017000073313D15551403555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1247
- SHA256 511654a103f8a72f44e45c7ea3e765634bbb4ef1131ba6541ebc5e689e5a1487
- MD5 afc1045c63ec25712868b6963c884129
- SHA1 53d41e6cf774132c48fabb5dfc3e6349d2c00307
- SHA512 75a864cef58536aea067e3b11a69394eff1269ea99f14400d3e32ca4e302b7a602feae41a338faa7520f35282a689b4aaf7e405cfc356deae7f727c56d2defb5
- SSDEEP 384:mVRrsOJRUipzLdhIVS+GeviyQinD3Gd4wupbsQ0DXHWIaFCkSrgTS1jBMrN/nwEF:mDsOzLXES+JQinkXnDmTFzwkgCN/nNF
- TLSH T13683B341B388E826C59C81783D8CC2EE47B2F509ED918F53B2ED176E9CE72592F16B10
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1247_fsm
- SHA256 ff66b5686911917ceb3c58ddee800018877760c3d849cd60d3a302ab074ab780
- MD5 93cbb27c60edc68eb5abca18d57e9f65
- SHA1 3a9b2cc843de747e4f1108dc6afa64f676efef2b
- SHA512 919559089e41f9b8d4b17794c24e4217d13763b911c02db2968fbe9617598f65f85861d6d66b6b0ed5c53d368296fd4fadd2c89db11469956c6382d8b1b606df
- SSDEEP 6:XFt2WWWWWWWWBFt2WWWWWWWWBFt2WWWWUl//qM0:X32WWWWWWWWB32WWWWWWWWB32WWWWUt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/1247_vm
- SHA256 0eead25e5fa44e5c85c2b3d0b28a8a4f46ba764be159b30be54bb8f9297aa9ff
- MD5 ffcdc628e5f9d2cc89cd35321ab02328
- SHA1 a46f1214d7f60240f8610d31edb56d72ac9b2968
- SHA512 373cdee07d949c43b93c7080da55c37e3953dd6546071e75925015957f51f4da199ff37c100ce653b4efe61b93aa0d0f76166e420452d55b9c6791dc55f38d08
- SSDEEP 3:6hNlGt:/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/1249
- SHA256 16f372ba4725a32be00a78220143073bc7d8860b8db95ba296cc0c3244abb00c
- MD5 db288732fb6e192c1672fcf7dcf29f8b
- SHA1 646211941dc12bea8b7a88bd253abb57b407b859
- SHA512 0dfcc66b2f325f1b40b9a907ff8a98142128e5f86053a186f1e9da9b9636aebfaccce0c678feb9f1b3ab11152373666f97eefc7965aab53a8781b32f25533385
- SSDEEP 1536:7/gv1ZOI4sjFNEfYLXnV0rBYre+aUMkqaTi/hkTBR8I:7OffE4+I
- TLSH T15894AA61BB85F922E280D63A3E14C7EB4312FE50AD438BEBB0C573DD3DB56968E14950
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1249_fsm
- SHA256 04188f277395b764ea98c75f7e17cdb7fa5e820714ecb0913f7dd07d2b312ffb
- MD5 7271686cb81ad715ce90f194d88fe3df
- SHA1 b1098db455fab6725e8a81e58a016525881870fd
- SHA512 63292e29e54ea5b0f23fdf232e19b7ff1735fc28a1d6de1ece4e79cd30678453ebc6cf92b424556ac086155d67013e2e18cb7b6855ef5f8041f0c0378a0935ea
- SSDEEP 3:nhNlbqmXoIIIIIIIINhNlbqmXoIIIIIIIINhNlbqmXoIIV/dxlXYlQulGslI:7oIIIIIIIIVoIIIIIIIIVoIIV/D1ndr
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/1249_vm
- SHA256 e1f8fe83a607b6b42257d3237e7f48d61f59704792f8e86356e04d58878859c2
- MD5 483d53eca72d72a0657a0b234d0e9fd1
- SHA1 7c7f1a9847cf7c4bc3f1b48fcb946518b5e15f6f
- SHA512 40c29448a8d8ae09d983c25821a6c0e3978f531a3eb5ffd5d20734e2473c81291f4e42155020c93d1c4b1011f75c7b13bd3f9c7ec8c217c9505777be44867fcb
- SSDEEP 3:kk3hNlpl//:kk31
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/1255
- SHA256 b3d5010da8432bf06a7b9548e2ba6a5953d0003659ad0d2df9c25f935123a3bd
- MD5 9c740baa60f04326d929bd05241f650b
- SHA1 4faf264c183d235f63bcc72ee91a1ab863e0e76f
- SHA512 c8107c356e6ede70a94cc9e0be86beaf805ecb4897aa4a19b224b2c416d10c84b1d6d4a66e625616ea1c7403e7ef725bf8e2655d2c82bbe4fca234969f8bb695
- SSDEEP 12288:6TWDdcpcfuUz+kKHtdNRHDyzMQ8ps5yMtERy1yhkRdmd9rjrRWQgfD:Y
- TLSH T108E45BC1D755666BD0FD497061CF0F95A772E5832EB38327E2A855787EC333A6A3A100
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1255_fsm
- SHA256 8985ace6008cb616b20b7b3575777d9717d35d5c2271e65ed5629e3bcd7ed074
- MD5 dfe95e72abac9084232674ab3b7eba87
- SHA1 cc7ef5427d63af38df7dac9f91266be43d41e9eb
- SHA512 09d81cb2fa8858bbb3dc40078b27aa3618446797cf90541b21e63a3f35a19a482f07ac11bf28f5d773f07fce6c2be21f44dfdff1ad626aeeb707cd147431d153
- SSDEEP 6:8c/T8amm6VZK2bY9imGyxllyb3sdnhqgfPyf:8CQfK99FGyxqzynh2f
- TLSH T1F4B2A73B75D19E50F0049131A8DF242316D3F18A043105863F6B4B52700322208B575E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1255_vm
- SHA256 f64110acb721ccfb56d56f5123e01db3cb73102f16208e1df8a0d00d4baf2a63
- MD5 ec6fac401a8ae81a7aaf3d985fb5def8
- SHA1 e6657cad4cedb6d8131fa63855b955a75a90cfbb
- SHA512 5a3c80878817125c83e515b23d6f96e1c5246f9039747b6d131fd36bd542278d2e38c9fb1a2c662e81c978fa20dfa035772db72340d51a43a4c90e831c8ab60e
- SSDEEP 3:Qkt1hNlpW//:QMl2
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/1259
- SHA256 23ef47e36fd5b9745859f8c186010e279716ced689b54b6b8810863335045bd7
- MD5 adc47daa2aa3e38591f5c9eb959a4ebc
- SHA1 2f346fdecafdffa37ab804718c545748f582ea72
- SHA512 ba5ad4985de377001400d5fdf45ca5e123cb0cd108e7de89fe90fcee1069b56af95cd62e6615ef405d8db1e1db42434e333800616777064bd1105650220cd192
- SSDEEP 768:9N9bKqC1yCCtLryCUI4wXU/RyLi6mKMjV2vB7/fIS:iu6IhEaBzfp
- TLSH T1FDA34D605F89E6D7C6AD8B3A19C2B712B3B3E69056E68BA3F1C483351DC33461E19C4D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1259_fsm
- SHA256 8acdc937fca22a496215056ed3960bff6d3319b9c45f3050e8edfc09d7085c27
- MD5 9a360591abd6ca7d3aca9b36ce19841d
- SHA1 1f3d3f59be3657821aa1f4f66ea9d16c5d545c2d
- SHA512 3ce5e0cb8db3beb16d254a01dfd7019931c1f30b9e5ba7341a95ba8b5db956a95e057a949c4934788c34bc1443f52b02fad93da5bd0ca7f06135927fc7d221a3
- SSDEEP 3:nhNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/t:8l3lZOaU
- TLSH T194B201A7EC628B05F1413E78702DA12D32FF07CD72634D08469F9121C5136144E0423C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/1259_vm
- SHA256 ebc71ed01b48e2db0f196e6753441f9acaf00bf77b7951f4aaa1663fcc1f23c6
- MD5 bafab730f516dbc8c96514f876ae75e7
- SHA1 43082163523a9674223cb4136ef9bbcc52a925c7
- SHA512 644ee404fe9dca42fb297771d08784c2482863969d6909681b5ab5854eb76977779975c6db750c5455ec05b063c54a44673c4b173ff205e87353c0ebd4c78cfa
- SSDEEP 3:bsthNld/:Ax
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13938
- SHA256 855be7372a4c9aa90fa561491efca6e0c13fc37d962dfc607d7518fea9cdd6fe
- MD5 f771ff5d3586e7ca20dbe55894765931
- SHA1 d8d4d9757fc5e4b1e7ac17fe3430a3ac8a61ab0b
- SHA512 e8651d0850cd2a6076d928887f5b8c5b850117fe9487fffac62410f0719cb3edb1296565fdfeea4b98e0f5a7fc433bae400811be15bfc28c6d32c1d4361df5a5
- SSDEEP 768:SLZCzSlTOfgjNH0uD46XjFiqwiRJMw19IB5rS:gQ7qwGTC5m
- TLSH T16053ED09A99A73C1E899B239C55982832333E1F5AF514B5B2A76C3F43C034DFE93D558
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13938_fsm
- SHA256 1026c5125dd766e9b5b35a9dc36622cb8b9e441fb4e6c9b62e65cb46566652cf
- MD5 c7cdb534af6bd29fb2c6e3ef3ed24526
- SHA1 490b58cb3588090289f7b18e33cb2691dc8fcacf
- SHA512 85f587aedfea35bad2857e9f7772bb72aef0ebd96c88f5c29f2bd32cf20dd07befd08ff4ac4eb11ad4d244a20d40be29ebb69815850b75d9bf0702f4e65ffc9a
- SSDEEP 6:TvAggggggggNvAggggggggNvAgggggrQkI:7AggggggggFAggggggggFAgggggNI
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13938_vm
- SHA256 21ac2d697ad4034c45e14677a73c8f1debcb50d38a1834133b89784eb833d6fe
- MD5 a564428c595b714f0874cb09d7d2098c
- SHA1 f5dab204ed1d452b07a0bbff9ba61ff6b3292302
- SHA512 d07a9cf3565513844e2f6eea6f28857f837a5f6db18fb5a2534dcb142453c545c256865ef113670daeb4392a76976eb01411ff32546195132d90e26a1278453d
- SSDEEP 3://91hNlXt://9Tt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13942
- SHA256 f7d74442eb367c1bf15aa3ee0aa3fd7748fb82e19b4cea9013acf21358f0b3de
- MD5 1f9dd7804caf508f9e1a10abc78a63a6
- SHA1 269a84f7618599f24d57d642ae280302adf85c1f
- SHA512 e2d0fa9ad7ff5986af90b2602f51ca77aaf29736ef446df71b204334c61be4139e986208d14087a2593cf3440b6f56ff284df311a3aea770ce6615b83a71d508
- SSDEEP 3:tMG6DZh//lKlvln:yG6b/49
- TLSH T12EF10437F40010DDF337C53515340F715530104D03001301137111351455140157D5F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13943
- SHA256 d8454296725fb592db11355b41a0b919e9dd9674d1eb7fff1aafba5ea01b2ec6
- MD5 949b44ba0000b0d9a8d43b983dc29d2c
- SHA1 70a1fd0ca10e3b840dfe5858dc702bdbbf12b5ab
- SHA512 036617bdd575109af04bcfde6f179aefd1530692940878b6d43b6c0fafcaa8bab1bb05609a2a8e675180c700388a716f13484e0563fdb57938e9a16c3e39cd60
- SSDEEP 24:OuiZCgnllcOzhALbgDuuAdwh/8g974zcg3z:BiZCGlcxLbgDuuAYp4ogD
- TLSH T1B2F1C22FD385F508CC1EFB740096A62133305812772B0B4F555AE9566C620C62B29661
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13943_fsm
- SHA256 8999be4c8f45903b0350765c126d8f82ff28720758703d11961228392b91980c
- MD5 961bd8a3993250eef0c8e379b0419d6e
- SHA1 7c0e5f850f02a3809d187fb30e89e7af710150b2
- SHA512 b624177c9f8d2ad5cf9ad63380b67c7c21e9a2d16843896b9e968ec3c9e2213c9234a689a917ffa506b393ad4c3b2473cd515f1dee86fe99e85d744fef106f68
- SSDEEP 24:H3ySSSSSSSSJ3ySSSSSSSSJ3ySSSSSSSS:XySSSSSSSSZySSSSSSSSZySSSSSSSS
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13943_vm
- SHA256 44104992a1a6b4a7616967775bfeffa2aea7465f213edfe25795f85b95dc41bc
- MD5 6e099631bf4c85468f51fc6e1a15578e
- SHA1 0f49586d5074610e3d326cba719a7072db28d786
- SHA512 660d02e8def0836a23021346bc0866e8ab8bfcf912a25f7b24f5c6cc5a84e9dc9b7b3931c4ebdb5b89d62bebec44f001ab28473a3e83a0e6508d0d4a8d815f08
- SSDEEP 3:tl91hNl:tl9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13947
- SHA256 0b33fc8aabd4e80f7e08286cb7af50712939282ae2081420f1d5e821775cde45
- MD5 1fff77c81d8431ca8581271a46f1582a
- SHA1 e0528cf5bb18c2b6d52b101068b91faabcb3e78f
- SHA512 331f01bc24fb29f50ce6fb57752435db01b0e33739526fa8ae178cc107cbdb945924ed6142e563157b017e356e707801415e6aa0cc0969c4c4e519d0c5b149f4
- SSDEEP 3:t/G6DZh//lKlvln:I6b/49
- TLSH T12DF10437F400101DD337C53505340DF55D30544D0000130014715135145D5C01575570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13948
- SHA256 222440f53bd8199fb60372e26dec17b81f7f3254278158ce1357947c37b5e2fd
- MD5 b16c358e92f6b236cbba1030b07ef970
- SHA1 7bbdc2bcf65acebe75721b17579b026e29e3702b
- SHA512 f58b84e2f13ceed937ce5f656295a5e6a37114f056d7bcdc6189cd18fa98f4def6ffc52670fdfb9e8a595ef2612fef9e6360b1760a87647ee799bfa0e3cf6efc
- SSDEEP 12:DAU5g8lqv0K0uVGuEVDmZ0ug8M4tIbcBNvpuNpSdAalLKvgQy8275XEoLvgO/o:kwfqMK0Vudeu0cn0tQODy82rLL/o
- TLSH T1F6F17B07FAED79D4CD658A72D07C1860AF33A604AE21078F4847D09A081B1B67E13A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13948_fsm
- SHA256 962a13e899d74c006af6764efbbc6901d740f1a9165dd8f79d1e9338bb3f18c7
- MD5 99d1debbe47a2018c43693c11dd06300
- SHA1 c341d19b9b9011c1dfda387a42b2764dfc44e2a3
- SHA512 f5ed0df7f76cf571d4e8d8a9efc53dd5588cfb78187c2fc914451a8d5eae3580d1e4004e59aaa52d7006aef2b746a4fc5f501185765a241824ac48e2cf438883
- SSDEEP 3:nhNl/YtmXe++++++++NhNl/YtmXe++++++++NhNl/YtmXe++++++++:fe++++++++xe++++++++xe++++++++
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13948_vm
- SHA256 537a7899300c2652cf28316f9475e54836dd1ea06e17fd18b0cfe6f889d5e29d
- MD5 3a520a0e0840c6d7b29897caf1027d70
- SHA1 1cb25d581a76453c49b2d791ff359f396cbb2f71
- SHA512 f4d3625a3e4fd8112c5cc51b671fd7ab8a8cdec7ecc720d72186bb69fce923fc78f4eaf65a9555c644111afc69a3dab7dbf6634339385a16b0d876c958ff3dce
- SSDEEP 3:Ok91hNl:Ok9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13952
- SHA256 089310217425e7772b9bfce6efd81d79c474aab12e0c118a9b1e160e27d9b979
- MD5 68d798aac3c1eb54b5f51211e858a48b
- SHA1 f86762d5ae574c37da3087a0ef5b7f73942e7e1e
- SHA512 955c15b36a401b47fc5b046e97144cd420047293eb3ee1091c99bc26d5afa7cb592a8b830a72db1dadc65eb9f4d4e968542abca8efae474940af1d33ee672d81
- SSDEEP 3:MY6DZh//lKlvln:MY6b/49
- TLSH T15DF10437F400103DD337C13504344C755530104D000013041073713514551C0155D470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13953
- SHA256 97ac07364592e34e50fc3c833b83542b951b4876be8f7f6439dd0619b98bec58
- MD5 c0d44b8b0ab6b86af07a886a38e7943e
- SHA1 7b3c11754b8c5d59eb8be421ad99f0b06b2d4314
- SHA512 da531bf689cf4a6a546c50a6b1a54a7ec652be0cd47f1216ccd317157ba07ffc49096a2c5a778329f3fae4b9892a1540898ab123ff932fd8976b39ce0f4b53ae
- SSDEEP 24:B7nGRz/E/sAubV4/G3WcxVlcpMim0MbZWg5KC2dNdQr4d3rFG6c6:lRaqw/oXmZJ5KMAQ6c6
- TLSH T1F1F1F903C099149BDCAB2B379D33831E83E0C15B9EA5C3772B2DBF942967E8459257B1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/13953_fsm
- SHA256 e6487cb255273862082dc782be7649aa6424f1e1e9e6b2abe6c5dcff47b065a9
- MD5 494e3d7e1d96d96b0f3805d131e2c185
- SHA1 74f6ef50b1ebbf7c81acecab381fd5e61327ab2e
- SHA512 e17a8db9868e65ae37e182cbe07664fc77da613dc26f4d29ba7a63084526d5b778448935d9c64dec1f20c0eadedafd69aed6b3fc63ad48f1c2b270e09bed135a
- SSDEEP 3:nhNlitkX2WWWWWWWWnhNlitkX2WWWWWWWWnhNlitkX2WWWWWWWW:Bss
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13953_vm
- SHA256 35a97c5ce6d1d2b7d1a0913d77209517755a04053a0ff639a3f11900e3d77ee9
- MD5 62b366885d77c83809cdfbd1a0b560fc
- SHA1 f35f1927e543ddf22c2dc44f0fd8cc79d3fcddff
- SHA512 a065aa68ffdcf035594dcf952629061e2353204a45956fa8603ed4aebf9ae15def4b37870febcb972f1f0a358ed26b108efe4ac543cae59a02cb2c1ce9d6dcf2
- SSDEEP 3:Nl91hNl:Nl9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/13957
- SHA256 ee6c43ccd3c13bb0940824ae33774b96f9b02372aad2a7b4642ac39349b51cec
- MD5 a513a54a06b5923554b5446227b4b2b3
- SHA1 5aa0f1f9b302fbd411f28ab146f76878dc6c7f85
- SHA512 fce5b50b04de835bc6d3f754fe1bce5122ce548eee530e6a8a3272f50a98eda8efee6b3a30878ae9b29be7185dfb51a75b880be2ffe82565d203e1ad5be461df
- SSDEEP 3:xlG6DZh//lKlvln:xlG6b/49
- TLSH T1D3F10437FC00545DD777C375043C4C715530104D013013001071113715551C01555C74
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/174
- SHA256 e983985cf3f0acbb553662a11c43e8dfa3eed80db7db34f254b788e6476a3614
- MD5 42c453602ff9fd395d49a12c449832da
- SHA1 44cfce9b139033c715937e7954f1641d67d59a50
- SHA512 e0b09a1195772e36c3007a6f19c1dfc015ef65d10e429d4eb9f4ce7dbcf6f5516b6afee8d522f00dfa8c783ea1cab3522f24ff54dd433b4af40890b6f9714fdd
- SSDEEP 3:wtW6DZh//lKlvln:YW6b/49
- TLSH T127F10437F400101DD37FC135043C0FF55530104D00011300CC73313D14D55C01555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/175
- SHA256 747e0360559c9cc4e42bca63e03a3e9fecf9ee86512c4a40f8ba08f7185cd194
- MD5 1bd254754cd28df042da25591a20e3c8
- SHA1 045e19cda5301493c5b52e2d38ead67ecb65e825
- SHA512 fe4405f652c7dd336581b0960a8d827b1f00ecee6fa2304eef3b46967218767696375aa41752fa0393b05f37623a1d51330ee9f2feb1d28421f9632a4049664e
- SSDEEP 3:OsttW6DZh//lKlvln:OkW6b/49
- TLSH T185F10437F440101DD737C13504740D71553010CD500013000071133514571401557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2187
- SHA256 eee84ec25667442108e38f863617e4b7e96924efe5600c5bbdf61fce735a0184
- MD5 94d742a3256e2f6458b95eabe5b1c43a
- SHA1 147e1643cc1c2f3a0756c44cf25b253d63c97901
- SHA512 1a81bec6be5a27e80b279cae4793e888936b6c770d3ec3733f916d5ae4cda656c856d8d3989f1f6b2678c396dea11e494f270dcd5175ee741514c0ee411cdd87
- SSDEEP 3:p/lw6DZh//lKlvln:p/lw6b/49
- TLSH T113F10437F400501DD737D17504340C71553030CD010013000477113514555C015F5473
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2337
- SHA256 cf3e0caff69b192dcccdc65598e508af847af9753a2e7d0d6e93cfb010d8c87e
- MD5 60d5b974f8b14335ecb00a75ff147f7e
- SHA1 80a25404e47bbe9011f88dfa3b3f89f2e93ce9c3
- SHA512 629d04849e90827efd5554c3e93503c2bf2903991c64438b6557a46817f33bd00521f7e3c7fd43cc61892b72317032ac746323c13d5ca737bb11c95bc497d55c
- SSDEEP 3:Z6DZh//lKlvln:Z6b/49
- TLSH T196F10437F400101DD337C13704341D715530314D45001300007111351C551D41575475
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2579
- SHA256 96bcd8dccba2d6861bab04d6be0e757fedd52c7f369b56386705e958a901f175
- MD5 8131cd7aea892643d0f2020b4186d373
- SHA1 e7d73aef73cd1c7af869d808c95e450fd665f13c
- SHA512 4910587ead6a5ceee49bf448ab3797aa221c6e15103fbe8647fa881818bc72acec7d1ad84c68dc448afbfee5f630e23c620973fc2baba6fda5381072bbdf59cc
- SSDEEP 3:0kg6DZh/stlslwlvlBktn68ltwKvllllllGllM:0kg6b/sXEQot6xq
- TLSH T1CC72113BEB00382AE23E83330A200FA20BB0E08822820B0200A200B08CB22800EA2020
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2600
- SHA256 5dab58223ef2baf2311df73a70a7f204e82a5cb0b244b320f336ed14ec2d2d20
- MD5 e5847f40721307e0df0ebef9c478f0bc
- SHA1 fa7514efd692660e7c2ebe4d331171429ae7dd73
- SHA512 3e7de7d464f6d79c4d3f2c355f7154dc1aa649c799b9391c8cd65eeaf66de7ff0e1b6eb854f3889d78d79128ff324b0c2c8f90e14f2efc49dec51b58f296545e
- SSDEEP 96:DcnaIFx0a3xpiqSEjOTdMgEV/5BzByihjYFM:Ax0fFTdzEV/X
- TLSH T1AE72C159C7B0DA3BEA80E9B556519FF3D714E859FE698F0333241362AC9205E0F421AF
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2600_fsm
- SHA256 2e23a97b5a8e2294cb7b583a1edfcf9102bbfe86f57ead234dca8ada3a2d12f2
- MD5 b1b0c39361cb51088b30b92d0bff141c
- SHA1 4d1d971c9637a1d9af7aad00492e5090d6c84b47
- SHA512 35f60ce53a78ea8735fc072a19d43c51458f5404b38bfec78f3926f0f415f1e26520ea2124c66d5b8449c997aac0e62ebb1732a2b8a5184848c48b2eb970e5ec
- SSDEEP 3:nhNlPlv/XV11111111/hNlPlv/XV11111111/hNlPlv/XV1111111ol/:s
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2600_vm
- SHA256 e669789b8fbe77c5aefb3aa7b08835792226951713d95362970e0a9a290741c0
- MD5 9c1dcbe565be30d93158b35ff63ed0aa
- SHA1 6afd6c000dd3f9e1ee67af7cc443fff795f933e2
- SHA512 ea46f73c582ff755b752f88e12dbe510c4610804caa58f4f1c58a5bdec9511cb9309363eea3dd1e2662d30205d61692da96b8d940afbb792fefc281d67af21f1
- SSDEEP 3:N/1hNl:N/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2601
- SHA256 8ac325c867de92e7c1dde398341862909932906c94d749d83b15a15810e0490c
- MD5 dbc4f3c37a43037af15a4a5b8080f2f4
- SHA1 afece8001a9e1d49394e48c0d500a368fdc8cede
- SHA512 98a44987e4c403955f32ef35ab00405f79d2da76c563fe39a01550ca70ef588a6b680d8278efcfa7aa26b1124e7bca817964fbf6d30351c7625223b82f5505a3
- SSDEEP 12:OYMSgBPP22wxRpftSb3eKI9Nxd/CFx/x:/2+Jli3epxd/m/
- TLSH T17FF122B293800CB2C7302B349403370E5712F26CC53DC3036DEE11994C2330C0C84848
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2601_fsm
- SHA256 962a13e899d74c006af6764efbbc6901d740f1a9165dd8f79d1e9338bb3f18c7
- MD5 99d1debbe47a2018c43693c11dd06300
- SHA1 c341d19b9b9011c1dfda387a42b2764dfc44e2a3
- SHA512 f5ed0df7f76cf571d4e8d8a9efc53dd5588cfb78187c2fc914451a8d5eae3580d1e4004e59aaa52d7006aef2b746a4fc5f501185765a241824ac48e2cf438883
- SSDEEP 3:nhNl/YtmXe++++++++NhNl/YtmXe++++++++NhNl/YtmXe++++++++:fe++++++++xe++++++++xe++++++++
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2601_vm
- SHA256 35fefb3e8c22ac4c47f9368c7f6960128b45b74fd888a1109a4b1d0e73ea7843
- MD5 f1dbb45ac939b9257447b9f00dffce70
- SHA1 ac12fa2d0aea80b33a1df7f9fe511a6aad09a5cb
- SHA512 d85566afc34e03d8d46f30544c97c9311ac642b66e0022a876049f005f93f9702e9bc7a74e2c86840295e01fd227aa0357c753eb6aee5ce66f4b4fc9bb4f81bf
- SSDEEP 3:slll3hNl:s/
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2602
- SHA256 583b90249fb4100527ac1f3b7d1e73e539da3166178c3280d6f5bdfaf4d3e065
- MD5 65ed72ee43d285e5d8abc89f4a11880a
- SHA1 4e2f9a29fe6d7fff7b046f167d6e784163e9bbf3
- SHA512 ba002d84f44f2a0931810d55f7b6357a936f94c61fe8f21bcd72b53830dd15d69172167df94412aba3c0a467494e4985164a1de34a508e19b2724b726be0e79e
- SSDEEP 768:/PFZHzHlVS6a626l1l8qmMcNlHBqN9qnlPn1koe/Cb:/jTHlQ62ciMYQDqlPiob
- TLSH T14423DF32A3D19A32D8358C71D92F5B88876DF6CBDA5EFF03825C16292C62394DE1631D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2602_fsm
- SHA256 2215887a6155183a026c07d98f90df2e4fbf3bc16977c8977a288435aa6e5bc9
- MD5 a72202d7af56304e9bca4b6ca019336c
- SHA1 ff129784ccbe08b0b5a758ac74d10f836d627c84
- SHA512 d2cdc3f1c874331ab023abf81d56de4250662ccb135794df3b1bdd5dfd505960c1cdfb3b547b475c7a5836b1079c2ded2bb31530a6e0c699bfe87473c6ec0fbe
- SSDEEP 3:nhNl9R5lltlzlTlTlTlTlTlTlTlTl/hNl9R5lltlzlTlTlTlTlTlTlTlTl/hNl9L:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2602_vm
- SHA256 a9a664e5510e2df48aaf74d2690b4076517e2053336f3d4723fa5cbf90065d34
- MD5 6ace4195c08362892b71c85b0dc3bf8d
- SHA1 a470daa5fd7fd97fee6348000940714c441c022d
- SHA512 9a52928e56761e908a2032eb9fab821e05f1a48f25085b231708f32911b56b5754af431c03d7ac55a0c83b3dc6ed71283d88beb92bae800a3e0e0a57c479e434
- SSDEEP 3:Gkll/3hNl/:Gkt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2603
- SHA256 d5c099e4e867d1591fe29839b3009f1cf836c1a606ea6eac447f77ec1ac5b155
- MD5 d0426157a5ae3ccb2d32eb9533614f7b
- SHA1 3a264bf57cfb7dd6b55bd3130e618d0cfc7e79dc
- SHA512 7beb50769103d62d85246b26e1a10431579057cf08830d1462ffa65e09e151f0153685eb104435c756553f05e07cd308248bbb947f81a89b09f08f5ea6445433
- SSDEEP 384:Dwp2gatpYtwpU6pKBt37vwpVqdJLyopBN4BI:8/wB6Ro2DLyo77
- TLSH T186E2FF3693B5CA73CD7A023CD8BB07565BF6F180EBCF6B53629C5124ED423A01A1A11D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2603_fsm
- SHA256 597943e0aa8a6e4f77af1836d846f03822c5f787e6583962772dd3f42c246ac7
- MD5 1596ab8b14228bf457cea20d45858340
- SHA1 c783a39d9de91e61ca80ad54e7615fb304afdf0e
- SHA512 587bf4ea06d130105999e8bd2fdcc5d0cde600a5320250d54b01d1d6d44369cdf0f7aca121f74f9464077f17bd1fa1d1ab20f0ea949ae89b624bc4e5d8a9ed8a
- SSDEEP 3:nhNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/V:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2603_vm
- SHA256 873577d804dc8342a43ca558f5a1b9c0ba45b68ec0e9a31bf11cb69fd671e606
- MD5 5c90ff850789d839276f8f0f1d8eef9e
- SHA1 e1eb2c3a4beb1ad6860003e762271a7ebc787440
- SHA512 22daa870960892fb3ec78a9ac55c8290069ba464bc73d18889dc0511455662914a239dbbec6465e06f394ee8ee0dcf0b83ff4aaec06f57d2cd3e145fcb1a9f65
- SSDEEP 3:pll3hNlA:pllC
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2605
- SHA256 06b1a578d46430a073d41b2ffbe471811830bb27e8f13bc22b7f430f12036a02
- MD5 e50a4adc3961bd44a9ddf0f728e6254b
- SHA1 e1843e3d4b7dbdbd1718724a99bc88aa637c078a
- SHA512 20fb58393ba93e7c19a7e565412262fcba4b67fbfa7e3cd14feb973e4a330c81011ad216604d2af864e14241f35cce23ecb1cbde59c74d055af9b26dff33e130
- SSDEEP 96:u+SYlZd93WV6ImGS9srS0F1o8T6RScgF7idnRRAV7k22/5ywMnHIiNMov:uJK4opa528T6RmidRSV7k2g5TMnoijv
- TLSH T1787271369BB48E76CB85743C51374B4643CAF500E2FD23C3564FA139FD89284CEA685A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2605_fsm
- SHA256 46cee7f12204381b6c10d3be7da701c980f24e874bb783e9b6088367ac5f016e
- MD5 8cfdbc5f23b6f1fee8a9d69db323c0cb
- SHA1 7c80a4ca3ea9da8caae3f0f42196ea4a7a45d489
- SHA512 db5836ea8cda9b6cd1f167412863a2c217476657e19b0da1d44b39f0f2d7efa354ad74b9f05757e9d92bba81ffd16299cd2c25262c0daabf5908539f186bd73c
- SSDEEP 3:nhNlPdPl/lflflflflflflflflFhNlPdPl/lflflflflflflflflFhNlPdPl/lfl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2605_vm
- SHA256 b793dcd36aeab0015af1281fb0f4c77d67d6ce8196cb86a17e176476aa400d4d
- MD5 c49062d42873edf3ebe04a0580d3c342
- SHA1 ad966ec268a118fa72fee8ec4bd580fcd69e7435
- SHA512 8eb377e6945f590f4b1c35880593ce711ab2186de45e3a18a9301fd52d1eb43b2a5bf4eeca36bc711e9ee761dc0222dc795fca3d677736ad263c2d6af864b939
- SSDEEP 3:schNl:s
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2606
- SHA256 2d60364387caea6f93234e7a1fac20015fb6d7bd24dfae8e14abb648e987bf46
- MD5 ed4a8f04efaf4dc0865bfafa57ab42bf
- SHA1 a70ce871bddd8031979e75ff2cc7077c09d59322
- SHA512 260ab93be6ff1c5f2dd30225b517b6f2f86669842d42063b67415a19c89fdfcabfcc3a5bae1e7861504e8b3f9701643999755db500b04b645cdbc605ef607d6d
- SSDEEP 24:sxwok4NfBodlqKQeMTiaP3xlyot0ly4YcNWKQNK+k+q3/LbxLuqaLLK:sxsuBsluTiaP3xFihGmbxirLK
- TLSH T12DF1AFD18CB8B23CD9F7B7B2D6880105833BF38A3144D5C2761E96BD24119ABD79BB05
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2606_fsm
- SHA256 0a0a1c37dac8bdbef9df76487d9214197a94ea1595b3837fd5073653aab6097c
- MD5 9fca6a8d410b4c7ca3518b8465c96baf
- SHA1 a028be3b598b2f74ecb8af4c42f0c90ad36cedca
- SHA512 7e9a99774c5e125a71fbe353d0c5973be80202550b3a87664a6031302ac351c5064a3971134758d9bf9ad56dbe5174f2d9046a9749954e3c53d9fc47c6c7725d
- SSDEEP 3:nhNlLl4oX6aaaaaaaanhNlLl4oX6aaaaaaaanhNlLl4oX6aaaaaaaa:TlQlQl
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2606_vm
- SHA256 7a7950d11029d7179fc1fb1c4c966b4e692b248bcf77ad58d2f856a04894e64d
- MD5 c0faf2cc0ce1c420d4ee22f47f991c55
- SHA1 f4d55d490128aa5b251a06d2789b3068bdf03042
- SHA512 31deff76e353c240a1a0c22dcc76e5558674efebd1957eaea89ce4364a0a783abbaefcd3366128d06767fb4a3fef4f0e2a000b5216f8caea77b85a2358593bcd
- SSDEEP 3:Blll1hNl:B
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2607
- SHA256 ffc08008f5a9201e3e22b116b12a5ec22dbd36028d4a2167cd6b1f24eb20c055
- MD5 59902a3274f338e486e55a6d47cc03d8
- SHA1 c6fc59d28e96db19afd1cf51cfab9383ba067136
- SHA512 6072fee9499d763e41d9cb722adaf6e2d4a12a568ffbe285780fbef2c10b794ca15b096b7031d52c0684fe1ac539876f51f69b75cb84d7e9b2372fc53c362edf
- SSDEEP 96:Kujqc2pxsjKAQoELTDMNCudstQ6e2tO+nhn4zKsHDRzl//:qc2pOjK9JTzWFPMd4zJj
- TLSH T1E872CBB16B2CF171F3BD903546AA03221755E8D1D9BD13A34EC8787A1CD384ABE131E6
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2607_fsm
- SHA256 3184d8a5d01dd16a0ef31a9c1cbf372d22a3d49be67606a99f465326c2e1fc7e
- MD5 5d614904b11262f1ba4e00107d200e94
- SHA1 4970f70e4f566300f993291fd862fe5914a7908d
- SHA512 3d7223151e8929bd08463cbc3f8aa91e9239d0fdfd460e8d704498200fb4af5dc28329e4dcd8f176953fd7965c1de043adc355d5fd2e09b9df23ead3add33bbd
- SSDEEP 24:X3qKKKKKKKK53qKKKKKKKK53qKKKKKKK:Xkk
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2607_vm
- SHA256 391371404ef6a14fd8ee96c3527fc4bcd5d929607408df7e9b2f1df2ea6d6654
- MD5 e0c14f88f17a5e4e8ac196f217b503e8
- SHA1 2c8f8b7a49cb73452df9e9443ff8c6df6b7de2fe
- SHA512 6c38acc136c8a253456dc77e23930fea69a59b574950247be29052007f002f678a552f8b430caf5b9c7de532dca33ffa5369452190fbc81a7a3cc2bc40ed183c
- SSDEEP 3:qst3hNl:q
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2608
- SHA256 8022268f9d802e99f1a8ddf97fbc5ecf9cd59c9490201acc1be0180992eec68b
- MD5 ce3444360a142c17cc58a1210c21ff00
- SHA1 9582c4777fe77ff96025209864b414761bc8a61f
- SHA512 18765e212963a01633d6276847f212e77a63c1698b1ff70b6943241d41fb8d0ed1a5eb1b925e3cf12969845c30531959b7683178c9b20ad2e292a490960af990
- SSDEEP 1536:cQ1ap6gfS5tAV0+dElgklKXImz8XFdHbWiJbff9iLnZ4gHzFKNl1N4pY9wE:cXoXczg7pBf9iLZ3HzFKL1N4pY9wE
- TLSH T1CEA4BCCEBD05BF0CDA2C057288AD0297A31F9DB9FD250A56C16BA0F1394319D5893DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2608_fsm
- SHA256 305d2894e1c936c3750a5434ab765c94279554099238e95fb2b1aaff7d4ab007
- MD5 83cbdaa98086445ff47d94f2478c8e74
- SHA1 1841fba9924ceadd2e430c87507f49396afe5574
- SHA512 a3574489876cbb6e0db95f3c1877d91e1e469ed3a889346717834c60117c52a11554e4e7500c894c4b429752cda41d5692759493d715d129271d15ddf840d30f
- SSDEEP 12:Xe++++++++Re++++++++Re++g/llllzyo:7llll
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2608_vm
- SHA256 5f767037cd0a9b6e402a92a7f8457c325ec6dcf68b81d77694ab3527b1f57905
- MD5 897be13fd9d82fb839f9bbf934c57127
- SHA1 3df8f161e4049aabc535e76e204536ac8053d1a5
- SHA512 dcfdec6a255d4361346226e0a1c86a3134a5e6f0cf51b8491063fe0ae59c9062d2b753db7cb26c77eff18cfafb47589f0ec84842f1cf75223afee9c3d57242a8
- SSDEEP 3:ylfhNlpY//:ydY
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2609
- SHA256 3ff9f7bf2d9576586faa80e8ed1f7717ee131b9834c6204740e5146191e07783
- MD5 baa2165758a8138406ce78bb2aa93407
- SHA1 324548457db2acd67eb367c6aa29ab0d77c658ef
- SHA512 0dcb35ae1cede8e28f42476d5af32de171a7ef320731440470888d86cfca7cde7e2f279d962ec5523957b1a8b8c66dea4aecaa3982f96820f2fe0a4cec8ba005
- SSDEEP 6144:Gosz4W9Esv5PZMLdNQ0wAs04Ick/Z5RZk:psUW9lyQ0wAs04IckRW
- TLSH T153744E77F68824F0F87F7B7355BB1B2B5320C6A459411397262EA0743DA2A391B2ED1C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2609_fsm
- SHA256 98a240bdf39af511e98143cd68cf3773ff6c8f897b2f2c144c5dde15c87794dd
- MD5 6c281dfd695a7fec846d5af3da7f9187
- SHA1 2328450f6ba5fda86d6b8609d7c511084515c4f1
- SHA512 e5e7495f4d9b85e76ed1b195cd1d777cc5fadfe31820a6e8fcfce7dfaa99196797551e0e78f8208eaa23d02d895c0c1e4306da0369e1ad13793a838e18ec1290
- SSDEEP 3:nhNlflHlPlvlvlvlvlvlvlvlvlFhNlflHlPlvlvlvlvlvlvlvlvlFhNlflHlPlvK:ilpyAJzWslDjcltXQ9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2609_vm
- SHA256 14fb8ce43d7f2b5ff8166e640840b783d5e6fa497348152a0cef9736a59e2952
- MD5 7ea275e7cfdb7d56f4095d403e434f0d
- SHA1 8d6db886694f435ee5f59e8fb0a4928f4c3179d6
- SHA512 a9c5a0cba7999b9b1e2818416f02a780748bf0fa1f399aeecf5d5d9d01b6e78ac39b183bd69da16c2633e39997654d5099e1bee25069c0f84bb5ea8ead770030
- SSDEEP 3:tslfhNlpA//:idA
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2610
- SHA256 7f83e391144798f0556e5796324008275aba67810687773cbb63c424d8a24af0
- MD5 6dc2f4427b7b59f1fbf85761c63a6fbb
- SHA1 ad23aa7fafdd791d54c361a41fb837db8d6982d5
- SHA512 bae647389c83a4ad076bc9aaee85c610098b6b9a81a8799c7e1d2fc18f2aa9ad7f787462f1846aedfcf59aca9882415d5baaf3be60f781ea0629ad1d44826b85
- SSDEEP 768:Wn4BEvf8f88BDteuXVGOTMxFp0Hq5mkn0qqUrnEifbz1MzkG2PCPSRuHBOqzn:Wn4BEvf8U8BDteuXVGOTMxFp0HOmkn0N
- TLSH T16AE26387F781BA1AC89C4F7052BE8752673BD24263274783E12156345FEB3D94E3B288
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2610_fsm
- SHA256 ce432af889cc5e2d8efb9e6047fd1a890bbb2a0238f3d62df0a8039aff991604
- MD5 11c84beeb551ecccd480e7f12c6548bf
- SHA1 5885de5fe6a4dfbf4d3e789358c95ea24d6d1c44
- SHA512 08f8bcb7e2783680b6fd02f8ce42d72ea5923919fbd9d4d156e1428580f83b897ad35302d5d3ae31155212824a8f083f085314933afdeb6b4c7b9a0c6e6b71ed
- SSDEEP 3:nhNl/lV/o/I/I/I/I/I/I/I/I//hNl/lV/o/I/I/I/I/I/I/I/I//hNl/lV/o/IP:XwwF/p
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2610_vm
- SHA256 d36a9bdae93a9036b42e3617426a76f7617fca04e88286ed0d211b86690f82c6
- MD5 27fd7ba658aa81ed02f1fdd53f0bf519
- SHA1 1f603f72c567c084d4d5ac83f5dbe676d01fc2a4
- SHA512 d3d8b941c859d03c17d35195e83cac93a263d7540c9a12deaebe6ffc87cbe58b785328df345c0790ef165787fc1e81c91482303f76a7789057656f8e71c4dbce
- SSDEEP 3:BEfhNlA:f
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2612
- SHA256 53c3f13ca581559e5912c6f6eac8bde874a308aaddf5cedccf6e3b7463cb6fca
- MD5 f00459e7a04259f1f90fc179bcb14050
- SHA1 0b45d0bebea3fae36c11497fcbb5ac432e2f9b42
- SHA512 8bb9e0d181dc594a7b3be7f043c9bbc6f8a25da2447fa6930d02125ae5807387bb68436aa2c02b59b7bbc4c98629090332e37fc91f7ed7706b49b32765a41c0f
- SSDEEP 6:ENfjc//vuFBt0slkP2sk/v+16/uly/Tx/sT/WgLgB:EdjcXvuFBeJh1KvZsj0B
- TLSH T1C4F11246AB46D92EC498D13310C587F25361E932274A8F5523C3491A5CD71D01E53704
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2612_fsm
- SHA256 102d273dad9738c450fb1b02e377427c3602935eab39e93a9f8e3bae6c44e30d
- MD5 aea8f5edde98825ca5f51d06329e21d7
- SHA1 7f494cb602fb498b4951a18756270ce0f121a577
- SHA512 5171140fb36ce404d290a1fee40bd3c4f9052af7fd2a5e48c440fffe017a68011430c767e729fafc4983e7c82ac7aca2594ae7f44ebabce4b8358d2a87525fe0
- SSDEEP 12:6we++++++++cwe++++++++cwe++++++++:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2612_vm
- SHA256 8c1b042512a03976a1984962eafc72a5e289d5d40502e75e61ba1c1cfe145408
- MD5 43d05a5948ce0279e96c1cc27c2808da
- SHA1 105ea4a3d9b4b9e3401d146c738b5ee083f790c8
- SHA512 29e9e8ec43b748fd8e93783858e4ce0c3fdb557f7bdd21d7ce42b0e28901b92e65180d1dc17825e9b300683819b7b7c20c4d8a51f37d669bd9e235d5735f464e
- SSDEEP 3:glthNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2615
- SHA256 0a4c53a855ada3fdb4b4d4135b4ebe8e1939f1b7d825f7de6508c34124b4b5bf
- MD5 7736751aa692e816788db14eecb3c907
- SHA1 d62496cd5b78dc3f687158626c0e682feb0a9594
- SHA512 cce56a32413de187065d3caa671e136c8ec81ab23703212ad8c4e8e3c3417c7e5a05ae7b3f094c6c0198b877a86bc8efc78f5d837cf6691cf85890f0e53bc8a0
- SSDEEP 12:8LjI6wYxm1VO+uYGlg6GYxm19lulBem1sk:8XrM+wG7MHwt
- TLSH T165F19A96CF024CE1D86F8A3100C3160A37B9E9006049CB2FB8C84BB02CE77824F0A128
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2615_fsm
- SHA256 c924105da53ff3dba9d9c8df9d39f93e3bec42b6e44edf124b329d0642d731b4
- MD5 f4c0fce5bd26eef8fa877777f49ca3d1
- SHA1 2e918e23d7b033e9ac6ca03f2e2084b8e28084c8
- SHA512 b7c3fa2605c0c6d30219f0e77c1448c10cfdf91e05f914a9a56bcaa947130964bc15864344c70710062476108a16e1fa985412be7ffe9594f8fe4936d6d52324
- SSDEEP 6:TvAggggggggNvAggggggggNvAgggggggg:7AggggggggFAggggggggFAgggggggg
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2615_vm
- SHA256 1b7d466a651f86f5c09155577c10cd7b8db0c506549e8119d156346414418857
- MD5 4850e3b8900894980d4533672f4facce
- SHA1 5cc44513aa493dcd50b733244a254206080dc562
- SHA512 bb6827fad366acf2c3a885cba65e92203c0503ebfa0d9071c2c09cb4e573ef44decc7839afb9f7e20660f21e97364263cf5b18ede16e0b63589ac52466ac4adc
- SSDEEP 3:At1hNl:At
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2616
- SHA256 6a4cd3f74c8ad9d478b3077ed96bbe18236f5b6979ef0e374595ab4cf6718865
- MD5 a6a97a053343eef3f510cdb0f59d9ff1
- SHA1 19692cfa38f32ac4f1573aa440148ba9d9788183
- SHA512 9f4da9a952b985e5c6e7efd8bff1137a77a0ba1c3ee4e8b9c0e60d7caf1889bf66d746f2f83716db224f584e81a71ccb5aa9c2b06b49b10570dacd81d7dfb0d7
- SSDEEP 96:J5FleNKZlJh767QSH1cyi5DXL6Ehd7iOCw0vGNUwKF2d83:fwKjz67V3yXLbhd7iOCw0vPF2d83
- TLSH T1957295E543A8EA32E47D4032E67B2B905711FE42DE4E9F23C5E842785C93E117E17E4A
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2616_fsm
- SHA256 f310d8b6a08739269466e860f296bb8685a209d226183490055596e72693a47d
- MD5 6b2a9f0a1111a5bca3521facb362e312
- SHA1 afb0bdde0d09b905db0eb71f7cec81f849bc5c6a
- SHA512 282b4c7426ce570bff83ae2d0d1342be35757d772d90754f48baa2823c12587435eef29f5060e2ab59bf14a3d20ad5782c15403f484ea6139498876973921490
- SSDEEP 3:nhNlEhNlEhNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2616_vm
- SHA256 476d05966c6daaae57d1926f657ee6b75ed657ddd674b6e4a77bfe57442965c6
- MD5 3ac9a41a95685e06e23d66a33d02ac9b
- SHA1 e52c60d41bfbdfa9aa67288ffd6b08320675bb23
- SHA512 46ea3a6b8aad402c7edaa1b07d15ed6d0c0aaed165571fb9169857e30831ec9352bd1922aeb1b383902e8282f9026d63d67f53501392381c0186e1f0ca78fe4e
- SSDEEP 3:CEfhNl:C
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2617
- SHA256 fd3855e7d57a1b2c973e6d69d7f399cc47ac20c3000fd726b2fdd89fe8639ebf
- MD5 1d237db4c71e87a621c0287aa507cf6c
- SHA1 db102642922898ac8c74fb1604f781332e0f1fdd
- SHA512 991e8a6eb7715a16d24e6054fa72c62d256602e35b77d9590627ab777d5d815405dff657e2e79a3d7765a81ebfbaf95692e0a82cf1ccb4ce30933ba40296ae2a
- SSDEEP 768:ZIaV+DxyflL5OvK3zMLAAZIi4cfwMaPTd75lcpVF:CamWlYK3zMLAYIiRpVF
- TLSH T135B3C76A9A8E7B37C86E51305C6A4392E368FC94B39D4F63179C95302DC33643DAF984
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2617_fsm
- SHA256 0992eccc48ecbcc0a08c97464986dff471618fc51bb319a2a54dce0e6cd971d7
- MD5 bf4b5210d5098a637a4e0da5433fe7d5
- SHA1 bfcdfb83067a5f9634ec404f6b9f076af82648e6
- SHA512 f0f3c0bf05c5c447948b069ba5b9374fb601d26ff499bb5a63653f4ecb4f09e76088d6bdaf89cde9758cc9590180ddf7e5fe41d3779a68a5ba0d31f3b4dd7244
- SSDEEP 3:nhNl8hNl8hNlklR/hstrft:iX4
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2617_vm
- SHA256 ed155a396e5eae53e071c8c93e171fca4aee285daeff4ec4dc200c4695be57a1
- MD5 ec33ab38a08a0bfecdedaa4a9ec4c03d
- SHA1 d8b1b082df97249400e692932f0301c5411d4f91
- SHA512 1cc6a2c6b060db4e71af4e433fd9aa2536caad708b877f5e6f3f1ac32448dab75fe284b86d3d3c282c9db62b14fa77db99b70429fd4c2a93836fccdebda27c5a
- SSDEEP 3:OchNlB/:O0
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2618
- SHA256 6df3e21821870b8972ec2003a2564c890290cda60ee552d18cdffd338bbbe645
- MD5 ea48548f0f69fe1a5d5c6cfed7894b92
- SHA1 3c57e55de05cfcf7f91ae82a63599cb8cf875e50
- SHA512 1f14e2735531ddb51869f21fbaf986b42d15b58b45a680372ac078531f088e81867994922cd4555759da9fb38e0eb346217df555ebfcddba8b40d665d3c303b4
- SSDEEP 1536:We54lel+epNe+PsZGailiGMB5jDPhWFnv+8prpxWgS9:W4Iel+eAriliGMLDJWFG8prpxWgm
- TLSH T19EA34D3D4E78FD19E32821B7EBCC33516F45C6A1301C87472ADD99B86CA17AE8724B19
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2618_fsm
- SHA256 8d93b01ba6d112b1c9a28916d2058e807d26dd8f6fbda2554417b2239fbcb3d6
- MD5 c7c5041e125113638038082bba12e415
- SHA1 60ede1c5170191b279f13d3156eeb7b66738ba6f
- SHA512 f757f8d09c6bd29324312d199ca6186ffeaea970f357c7c48b2c40b252e5b87d1c03252acd3340d4de42015a74f6416084334d33cf2d3ad1a943f10a9a7b1318
- SSDEEP 3:nhNlHxj/XpJJJJJJJJ/hNlHxj/XpJJJJJJJJ/hNlHxj/XpJJJJ+XWXaqollxOx1:ImKFm
- TLSH T1FDB2090AE0856B9EE038DF35A808604EA4CA12EC003B81620E3BA0170977609034C282
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2618_vm
- SHA256 ccdbbb3c1e84fd5458059269bf2420e28e780748fb137a763cfb5cc81f6357cf
- MD5 c82b7c9bc37073bbc367c4efce34fee3
- SHA1 c869c1c90ded6172ec35faf1b13601da354bad22
- SHA512 9758481cfb1e6c8873318652078a0a18ebd5d91b97bd89b5e765ec8d8a6fa77b76a4691bcf4ed64378345b4b262ff910078d6c5dcb9cbaaedbaba1192fc5012e
- SSDEEP 3:CM1hNlG/:CM6
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2619
- SHA256 89602472a38dc664c22f1c85fad33fc4fd573329b8517cffaa103763778ffe44
- MD5 e6ceb64f08139c098df6d0e0077f5b02
- SHA1 0af0af69d1574e37b85d6bcc142b84b6cdf9f871
- SHA512 041282f6e13ae19d1e512a9f694966a99fc7d3f5599dddc6927a02ae72650c31438f4a7764e124cf421126178b3e64732367ea7cddb0fc5f6a85cae1ebc488b9
- SSDEEP 3072:D7h6JvvdkyzrVkmS7dyNUgl6dVq84Q0/ZfnG5G:DwvvdkyzrVkNyNUgl6D94QKZfnG5G
- TLSH T103E38302BBC8AE07DA6B5F34C1674F21A336D142BBC94B832B5476347D833E95D960AC
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2619_fsm
- SHA256 43ad664e7b1badf23b19f1335f6ad2f73103b2f6db13cb77b3b32413bed719bf
- MD5 628b1dd2ac2d826243bdae2ea4f3dcc4
- SHA1 6473269ee19d9775b0ee79ecd5494a45f8ade9a4
- SHA512 3cc66d8d5889edd274ea8af9bb7773f19ecdf0b1b43f9637b20c88e944c1ccb699894dc78e3065a2182f15b5b8394d5b79a3b1bdff5ced987793d20315fabadf
- SSDEEP 3:nhNlghNlghNlrlt+t/b9//HkhkO/sXoKqll:Nlt6bF/Hk3sG/
- TLSH T1CFB201EAFD05DB01E81007B9E90A78D071CF22CA04314D4600CFC9A0049B36900D0240
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2619_vm
- SHA256 64e422322c92a154d10a968338ed98266c2c5e44de9ce82f65fa4f277b925e81
- MD5 fb51abefa3d3261ac2b8da2bfc78c7f6
- SHA1 f83d1f6d88a4b717941a2814622c4a67b582f457
- SHA512 c2cbe564ce5627aee56eb9c3a9c04ec08a2764e733628209a129659c524d104be2f5ff364a988435ad7369fa6b9ff39a7c385b8f2b85a6281263e0e3b6be8217
- SSDEEP 3:Tsll1hNlp6/:4/lK
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2650
- SHA256 80ad377789f3075de14daec9237a3e0c9ee3f1261c867eb954b9f4b5c41f9640
- MD5 8fb4074ca9b8766d5f14d185bdf7bb64
- SHA1 db57973c7d658a2983b00a2a4cf591c1d433c783
- SHA512 90dde72c9413dd4bd2ed44f7012e7dcc2c8218462bc015f6b6e1ccd40b5431d1f0d5dc9a475badc545ae330457881e2080a03079166f67f6556870de6eb8e6bd
- SSDEEP 24:rsxl010q+9+O92yy3maunjkWUTY3YiIzfHQQtdwiW38z:rsDcscGRiw8TWY3fldJ+8z
- TLSH T1AD72BFAA5B1628BDE9360FB5944897D271B3E069050C3B87103429FDED7B0E05E3ED36
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2651
- SHA256 0f8f4328b1e6709b9929422b70a56a6cc1bdb4dbdc31f5ad3464cccaf9bffccb
- MD5 840e8d582931f16765115953271d4bcb
- SHA1 067f56bf5a55fee2ac376b4c029978ab3c912342
- SHA512 21b3b106c5a4cca67b4467abac422c2e48555936e8eaaa6d9445e2699b0918c0cd0441549f1a9691950d2c37d2a896ea7cd36db8028f21c3d06cd5276a807689
- SSDEEP 6:rw6b/sXEQFoH6N63etl+l/UWlgCKX3/0Ki:rDEXEQFoH6N63eXa/UiHG/Bi
- TLSH T107728C96EE812897C2F2833758590ECA9673F1FC4C258F4241F111380C2A1A41F3EC45
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2652
- SHA256 5ee8d8581036fab45e4312ee636879b6ce997488df7e7638aad369ec7afa5731
- MD5 734b99d1a840df0c39e0eb6df7a0a35f
- SHA1 9580d96d7b80c234687cfdf8135217d1fcc67ec8
- SHA512 c88f1a05155fb0c296f8b0bd561f8430a647f0b025802c62f8306fc1fc4d2ad95b196bea1a01def6b26d86e846b7e892f9a2be1858cbcdc4c7e9445211c63cfd
- SSDEEP 3:Q//w6DZh/stlslwlvlMkXfwH6fF6fAXCXDqlTv//lHli/Hl2klX1:Q/w6b/sXEQukoH6N6/XDejZli/MsX1
- TLSH T150722B67DE803433E135833308380EC027B3F0AC48004F0740B1103C0C552D00C3A850
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2653
- SHA256 b72d25c52becefd5a0b469bb7ce87fb9fd495ff1a01278eab34f428ac2188813
- MD5 4f0651d0a78f5932c9f574bec54b6846
- SHA1 78038d3ed272f673bab42324cc480f416bb0a231
- SHA512 25127a46ef056c1032d96e7f90fbc5fcc1bc57bea856c62d39edc64992bb306132a1ef18e7def65026a85d4c187cb1231831be370edbc6ed6e44d3dd2f8eac7c
- SSDEEP 192:8nI0Pw+MLBqfpvtn8nRwJq03PUtqRUj2FOFtwetmnJJ6A7KAMV:8hP7MApvtn8RwJq01dFO4etmJJ6TAE
- TLSH T16403688AD7C59F13CE9B5735E8BB4B8BAAB9C18897039F075314A1353C417E82D6B12C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2654
- SHA256 b7913604d85454e1a729560dd9bfc2faafb70a0a9161110323ee4f216bbda0b6
- MD5 09f5e85410b743bfa1ec70f31ec6bf1c
- SHA1 41dc08182860e7860d73d2fe175776220af5251d
- SHA512 de6aac5f2bf48646f845f26706946ebe0b45429fb9b15d28e87de22e5d69be14a5abd2947097b636a4a90b69fe84cfebce8d746103f545331106ba1a2be29055
- SSDEEP 384:pweZZz7WH0iM2H5HRLxHhXDJQuEI1c77R7J6P1ZNJclr9GzaILf46wuxCU2kqI+9:517L5lr93N
- TLSH T11D03B7EE9A885B26D6682FB5D46B0ACB2675C45B3E439F1BC744E17B3E003859D3B10C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2655
- SHA256 b66b1b428afbef27ecb20f5d34837512cf2fc62538cef5fd1a4fd552d130d453
- MD5 bfa2143dfe98e3f0c7876359abbf7ccb
- SHA1 e0e29e882663487932f6210f941e25687fc8418b
- SHA512 c39788842390b495dca9ee5641afe2e5f6387c2958e52e403e84df5d396ad9b22d5de91d9292d5cbf94a88bf291cbed23e9163d2f43a4253684d568d7dc91405
- SSDEEP 192:X+nx3bJsLDq79a5/on/qNSSikdxDl2mJeot2e:X+ZVsLDq79a5/o+S3GcmJbt7
- TLSH T115E277CBC7C55F17CE8A6776E4BA4B8BAAB8D14897035F07536571343C827A82D2B12C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2656
- SHA256 6e71943f0202418987d490df80a12c56f25c2b32175ed43b35c9990b96d81f6f
- MD5 6be32f3fe0300d5f27827633852c1628
- SHA1 2f97956f2f821601b88204a9aa47d35c04cc22bf
- SHA512 be674b8764c1548532f8743bbb06c34cfef1435100bb10862ad59cfaa9bd74f72e9ea9ac6a2af7a1dadacf4e007564c268614a8aaa481a895cb11c536104ebc5
- SSDEEP 3:0slY6DZh//lKlvln:0J6b/49
- TLSH T125F10437F400101DD337C13504341C737570105D100413000071513514571441555473
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2657
- SHA256 9c753fed98cd9743beeab75d20b6c299747e0c3fa8ec13d5425c02bf182a64be
- MD5 469d21b17168bb79a4337ef0ce8c1fc2
- SHA1 ca738272270effbabed80863c5ab34232030247f
- SHA512 efaaaff11b047c20261cf86b36219a324f6c8e2d148c4f2ad01be16bb87228c831353511f49b69aad3e4ea5eab7cce65e269afc700fed0c86f876aaabc4b4f2f
- SSDEEP 3:56DZh//lKlvln:56b/49
- TLSH T13FF1043FF400101DD337C33514344C715530104D10001700407131351455150155D470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2658
- SHA256 950c7d63cf277f9e49ff3d660d6350f44fcb209552fdb672fd7c2e5d925bcffb
- MD5 fdcea0e9fcec883112f1b5925ec8cea2
- SHA1 51bf34dd5c26707b67375b9254bf3be67f6f083b
- SHA512 be3f0fb00dba2d4844aaf011124ecb1adcc40015bd5362ca278dea2a479bbbf13000df43fc860122b49329020c6603d90fd35785702509d33096c31015565539
- SSDEEP 1536:NVwVzmRahV5Ee1dhjyvxa+BgRdWcjcmV+KuwPIVUtuvVogVUqWan5SVPM:2fCDORzcmVw
- TLSH T193C393B167443F01E364EE377094002B92E3F525BE739654FEE8A28A584C5A12EFBF45
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2659
- SHA256 4535c89aeff350feec569fa441baf883d28006862b85bce13fd24c532b41b2a4
- MD5 4b84554017c29e2db2abf2af6ee9aec7
- SHA1 ba2cab95193fd0876e59376c607d86d089ede0af
- SHA512 59a486e619336fb1962b28a0289c80085f5569db589218bd5d2278d69328272a00f047c8cc80e10289084a1c31109a7f65eb9d65dfa50fca910efa82fedd7e88
- SSDEEP 768:znhRQYmjYNnHAGThnXgz5smfC2nb1/pnDkc69+n+5dm1A2oaECP19CnySOZrHn77:zbScH9esWCIpDk2+5dm19CuRHIa2Lq
- TLSH T1FE830DD3AB6B49BBD6240BB81089C3017373F029991F274137DBDD26BA7B119277BA05
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2660
- SHA256 aff7ba7d60b1977e07f2381481354dac1adff7c9fe897d872ca9f2acfd9247f3
- MD5 c09fd15a24f97b957de8c5d8b4f056f2
- SHA1 89197934ee9022f99e87d8343a942ad56e48df1e
- SHA512 09df114014ecbc890d5ddfd9f8854efaf239b77a7c610cc7924b7b5dfeaf39c4fe69ebde1e24a1534a9db9825f0250b874e662ee7f43627bf372b2239c3dcad0
- SSDEEP 48:yEDcscliSCyixd7CXnt4oZzxaEzRqAx6Ezi:yLHHWdmntbaEzR6Qi
- TLSH T1C472DC72EF1A19F5E5264EB0680D6B525067F43D31282683362C164CFDAE3B04E3BA39
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2661
- SHA256 9546b6e35bbc09a9cbd3972fd0d036c3d9ab733d5068c1e06e9959dff507c0c6
- MD5 5ae8d447b8b39c4902b34b13ac77cd25
- SHA1 af211966a7b4d7be4b517d69d385127618c1d9e8
- SHA512 6391e46bf4223fb3f838a7ce9981b9a10977149a1fe0b4a2da58fc6552895f2cc88159ca1db8d521aa20d94a2e2043ab050b5f9b2d351f8905df4845bb7c5d5c
- SSDEEP 48:FLDcscliSCyiWn13xv2sNKl90C/+mIT55/sYXB7Jm7eTnuKcHzBSyKluU8OVGam6:FsHHDtdZuK0YcrGv
- TLSH T124728923D751967AC4EE1AB4B01F8351606BC52997DA27074320B9B93FA93681F3F532
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2662
- SHA256 0b9105008e52cec68d2bae84386cc59c4426b78a2e280fa35808d61478837d1e
- MD5 57a7268f1240d61bf6b6a023d9382c5c
- SHA1 8d26f55731d5ed66d1a6c81f308000d2d5bf5d4c
- SHA512 68d984c8ca8795fd8f86fa637fed846f7d0b170fb0f6b209a6aa2347c7ec737373024287a7c2245d8c64d48a0fbca198da25dd9e6dc159443996ad48b1528f25
- SSDEEP 192:ln6HHXVU65XjbDVtebfbKwqXB7DK1F9nmqmLr:l6nt5XjbTebfbKwUBedir
- TLSH T18FE210D7DB6B9EBFC32C0BBA606612D077B31C2A1A1E9B4131327478B67B1602777641
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2663
- SHA256 a21666a44ce7439abe6084684fe30ee8fd1aad74d5146d3bd6a91bb931700e7b
- MD5 3a0e51c7cf5321b8aa9967fb93150728
- SHA1 3f6fc6db7ff855475a70dcac3cbd9b2dc5610a08
- SHA512 b770053020f41b353bfc867cc53b378b943f7eff702c097f5a3d203661f0f46e74f4c568affaa252451200b5eb5ea26a445da90c709588963c80366b2b18e02c
- SSDEEP 192:N6TJPJynPMu3M/8YjcZ+EjNLj2/PMznvbza1qsVQS/HQEWvoNL6:sSnPx3M/WZNj2/PYKpVQS/HQEWgx6
- TLSH T11223DD8D5E18AA82C83B523745EB9D1143E65D01ED8AC5019BF844AD14F37DF3EEEA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2664
- SHA256 1c591b5d754cde80e048ec5833adf6d9a49426df96b570b46ed3eb916323615c
- MD5 519c905bf7ac8ef44a52c169f0bf0ee8
- SHA1 9bc5acf41a38bac399c0da893db8434d505b0fb0
- SHA512 7d3f5dd3fff59737fbfc51d01cee8c06fb95e50acb2c42873135e37adefd53cb4c72ee6bb787921fcc888646d45bb99c772597aecd4b1b929e3679526f74edbe
- SSDEEP 3:O/G6DZh/stlslwlvl268lt/9NlzcjOTQtln+cHp85MjAZ/SXly:O/G6b/sXEQHshcyTQt9+2S7Z/SXE
- TLSH T161722B13D302F000C3E783314F200F204731E39BA7009B0210E040254D531E00CD30D0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2665
- SHA256 d2d2ad7a0ab98e4f73cea32fa364d458fad1608431b76ddcf70b98e6f8df6464
- MD5 36fe43feec01a2d52a97183b73b2c77c
- SHA1 eea5fdbe8657e301bfd2307eafe4f576a9c84567
- SHA512 cc593f1ad5d3abcee31ef22ad9352ecf87863b2c24018e73b0875d353ae67a7ae00657db8062867acb92e3d73da2cfe3325e02dbcd1b8f358d10d51e70d79428
- SSDEEP 3:Dle6DZh/stlslwlvlWM68lt/9NltRAhcjO/mtcIXBMFHp85MjAZ/K:Dg6b/sXEQg7sRAhcy//IR2S7Z/K
- TLSH T155728C13E301B400C3A643318E200A0046B7F2D77700630108A190298C122F00CC3090
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2666
- SHA256 35a282e5e56aa9caf546955948000e37500b7cf928230fa8885c294b41f725ab
- MD5 e91a90f04d5345fd6dbd3fb3bd9e22d2
- SHA1 acb6ce0ca36db492a5723b03e38d6c0ed142cb5a
- SHA512 4a1c0c5f7615ac2ea22aa641400a3e019ac99d7036641780f9e5038fb270ab69e52b0d40e93d468c018f0cfb2c445ab0a3568c3a1e9c21cfde5fc4cde80cf66d
- SSDEEP 3:k6DZh/stlslwlvlbF68ltwKvlgp1Stl/y:k6b/sXEQuxputlK
- TLSH T12572122BDF003829C326C3370D200E600770F1C670010B12003300314CF63900CA2430
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2667
- SHA256 fa9856f5dd93f9b0f63a8ef1fa217a50c097f8d5993b01d728cd9de782cfd3f3
- MD5 dc137211078146397d8655adf6572c5b
- SHA1 60edb18dc3f061597dfed08a4570dec1e8a352ea
- SHA512 541e4d4291d3be2509fc8c707bac17de01ce0b4d58cbcf88683d4c944fce507618f592bb31ec092ba77c820134003fbc33cc7bae315bb9b54d0b878bccc67094
- SSDEEP 3:Qlw6DZh/stlslwlvljl/n68ltwKvljTlll/ln/lly:QG6b/sXEQhoxEE
- TLSH T1E372127BEF023825D326833205600E7107F1E084A1000B02016600200CB12C00F66410
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2668
- SHA256 5c0877194eeb736548f1b6fe0b653962233ecf717877024e12b3d24421ca617a
- MD5 04b19de947e54e248d305b88af26f9f2
- SHA1 74c4a90079750286ef56725b5b8e524ee1823c4f
- SHA512 c5f93cedb930e649c0404e05dff91544e150d5f9d030941747238f3f947a68cc0248b17aaca93eac072ed758033c210911fb9ac1bece9c37cdfbc6ccf7c7fc3c
- SSDEEP 384:uQZC32ioZSTKEw5kpObhPgNLGnNXDG+jI3TOr2i89kEbWiTyTUBanJTQg5CrMjyY:Wq
- TLSH T1C1723E01A371D671CABC367DA5570B8F42B8CC8CEAC6272B430A7C903F8350A5C5B2B8
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2669
- SHA256 f669da64bd3d2d0ccf354493d22612cab44a80a35b0c3f17ebe53941b3a1b1e6
- MD5 cc5468c7a41cbb06c8cc70691c57c494
- SHA1 2be1c261e2746ca889713c6191ed0cf4636c814e
- SHA512 714c03531b6be8c9a4c4581bce8998f09f976ca307d2f03dfe73c7470951d3dc3a77688e1e0d1e5fe48c615296600369325d4f35051c3530eff1469bffbf7d06
- SSDEEP 96:iqpHk2aSGfcf/UU8ePgzEoWNwkx9AtlOGP4y3o3G8hM9E/dqeO7dsiqAvAcw/br:1k2HVZsL8hM9cDpn
- TLSH T1BD720A9D53C87575D8FE123256B6133325C2DD96C579A2C31CB1B0282CE388BDD692E7
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2670
- SHA256 f4cd2d9c20560c1b6d1c6a6951f8592c529b833727ad956215351c2c289243fd
- MD5 a258ddcbff2973b0991606cf38ac1cf3
- SHA1 8f2eabbdb3c220e72464fe7457e1ad87d7160c91
- SHA512 30ea635b1c8b10c06b66f9a6331fb681b5e96a14515e831be645cf22e9740ed0f941d85b4964d98d6be7bb5e20936bf5793909668f177bd94104a071ea2bac6a
- SSDEEP 24:ebxl010q+9+Id+QE0ltnFXdllXt2Y00ltXlntllX9ugE0lxFJ40xZ/c+ykzfseqt:ebDcsctQnHy6n/QGX/jygkp
- TLSH T1DE72AC2E9B2AC9F5FA7A4EF06005AF8EB1E7D015011C2BC711342A8D0D3A0905E7FD32
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2673
- SHA256 40b95a5ff27e3650318ea09c2fed79198033d3f81e7519e7be7de1a7dab3b826
- MD5 711624b0a264a370e9cc018cc0bb2e20
- SHA1 983fc15181eb96d7a5138c430a4488a4c9d4d47a
- SHA512 a4578be9acfb1f69e4a44bb31bc8b17d7b071ca3f18051e547322cb5943b4eaf9243d212c69d8a2fe07fe4c184b65f5eb5f2a0d2759a57b2781dd6c36f976288
- SSDEEP 768:OWKlTSwp+oWX0ZifRuF6tIiOFt0J1nF10MqB7SfnuLa1e+JVHjKV+v1YMSVU2c+H:2xMcM6hz+606MS22c+2l2+eWO
- TLSH T12A448586A50747E2C68C5839266D088F9AF89701F23F6F2E536DE1085FA35C6DC2F6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2674
- SHA256 f9f89a8dd50c540512327032769b5c028139f0734f6bcdf31fff8f075122f314
- MD5 694b1a3e0550168581eeea0a55e9377b
- SHA1 723fc0550037256d10e26fe7261f25dc3deab10a
- SHA512 d6ee009ac76c97d3edf19f8e8fbde549c13bec3b5ddff157f4305a68a8d0a6d59e08b0ef066631617493dab04e6dfb709056aa83e6a7e2407d9f6a5a9ec686a7
- SSDEEP 1536:T8Mzr/4euQXF/Lx2mOLdFgqXZ5aIWS9A9YleqnbLqaxMN/819dPM7Cz8vp5TkGn0:zV1QFdP8x5o
- TLSH T1937443C9A40DC761DE74C83765AC888B93AC6256F31B2B3D4325E1BD7E8313ADC86764
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2675
- SHA256 6ade4cd24116884dc8e5658a9e4311d36047bd0a78566e88ecbbd24ffdb0105e
- MD5 00789f70b4a492fd560ac0f34a1d7813
- SHA1 8baa6fa7e8e539d999a3f844aedea70adc50d738
- SHA512 aa433ccf4a23f626e087711eb23720af51b4aff5ec25cd18afd38b3f15d6b1b83456a0bdf3a6e8a0f40e6077773e15c9a42e1d97679bc4a03068f850c724edce
- SSDEEP 1536:Z2ERpcrUsgFUc+4W2TInNZFDxCyz1lV1ZeE2AgqdDyBW/dV0V6c9:Q6p6rgvI2TAlsyz4+TmBT
- TLSH T1BC14F04AF84CD1E5C6F84AB76DFF4BCB62F54488A913262F872D91783983319684B17C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2678
- SHA256 429d75c19cb06d54657ebc0578dce0907dfc585335cabaa337d27b9c47b1e24d
- MD5 8a72171f1d17a2bef68bd362682ac6d6
- SHA1 6de36484763198ea32c8056b4622335da9e4a046
- SHA512 85736434199eb154c424d89a241f0882c490881b571992cabe3385b3e59749c58c4c125acafaab004e567e4743806b7f328d0712066532870fab1878ce8ed27c
- SSDEEP 48:xmDcscwq3AzKXarNvhbTDsscUXMcnGypkF:xQHzKXarnb8hy+F
- TLSH T161727757DBA649B7D1390BFC146857507D77D0A81F0B6743122869B8FD3B3A01E3A836
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2679
- SHA256 b4dc0697ff04b3af93317b71d10bfac44f5e865fe582d7c241e86397fa503440
- MD5 bcbc78be9edb6e5c9ea3c003dcd17124
- SHA1 945ea33ce7fcbcf938ed8da1b1deb3469ce82ebc
- SHA512 7806c8969f481749360054af81321b7a64e47a9d143c09551cbf5252e9c59bce3cb4c086275561446bb5d1ba9b558dfffda22f66574dd57096fd8522454e7e5c
- SSDEEP 48:emDcscxX5SbM1U4+8BmhqQq7JLC02lnl9:eRX56GBTfVC0cl9
- TLSH T1B3729B579B724CB7D43C0BFD242553417DB3E0690B0B67832124A5B8EE2B3D01E7A836
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2680
- SHA256 9559d79873c0570b800998dbc64f4f1d08aaa2e8c866da55514395f596622728
- MD5 5fb3be9d998292f88359fa25940f92fd
- SHA1 0100801b807f72a636696c73d856ec99e73f9d94
- SHA512 8c61a397dfbde29afaf212f9361370450bb3d8459e98fec2abefe08f7c13cc341938977887c4131f84cba7dbd04339edf13d973995a7774ada9ca473e639c40c
- SSDEEP 3:5lllw6DZh//lKlvln:5lllw6b/49
- TLSH T1D3F10437F400101DF337D13504344C71573010CD0000530000F7113514551C01555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2681
- SHA256 f22d5e0617d7b07b18440ef4d25f99bf2e2b6c14446e3c168fb9432572d51183
- MD5 df15ae47ad0ea7595e2f70b99ea86462
- SHA1 c9da074247c34a6bea1033eecc06f2b573ab1544
- SHA512 3e8cbbb4bbbd6935773ecc8803921bca64eeca2f584582ead9834f936badbdde7a6532cf7c2f6873f2db24dbe9080462f3379eddf33133778635daacad8fa4f6
- SSDEEP 3:4lw6DZh/stlslwlvlcErVoaI4F1wFlt8rtfLmktlG1K:ow6b/sXEQiE6KIft8rtfDW1K
- TLSH T1DA729BBBFB505D0ED33B523504345ED14760A86907555B13445319240CD62DC5E79FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2682
- SHA256 0c541b4c323dda8f8d720b29cea346e4a2bfee5f80b7ef4eb2b494d4901940db
- MD5 8cb988ad5ddf79095e62e54d57d90b60
- SHA1 b2f0cb5a31a48f0f9c3a297344d5591e84dbd247
- SHA512 d67a1c96206bda2fe51b64b3914b4886d9d3c5a565135b254a86d6807f70eeb01bb285fba13aafa22830dc78a3a100fea55499db548022cad90eb55a1fcfed26
- SSDEEP 3:Jkg6DZh/stlslwlvlf/pwH6fXjqlolXgllM:36b/sXEQNKH6zlXB
- TLSH T15F7292E7EA813835DA3E927208780EE25B32B4A902956B0610A291201CB42E02D37055
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2683
- SHA256 48d280fe50ab935c340e433bd0eac6f4d2c42220649bcfad79e62ec2596f8603
- MD5 8bca76df125011bf594300fb4cc977ba
- SHA1 5e6d91a959fe6b1a688b57e2bf0797052e61f31b
- SHA512 fa62b273fe79cf65fb2c0945778742a917fa97a5f3c7628a76d7fd1530603d47563662fd621b62b1ee9b9dfa42ce698999f64def21e1a176fbf821af871664c2
- SSDEEP 3:PlG6DZh//lKlvln:PlG6b/49
- TLSH T199F10437F444151DD337C1F504350CF1553014CD000053005075113534551C01555571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2684
- SHA256 1687e1bf29e0b30df9b3221990aa151f3bfe81aaa3f878ce8d265ce6d15d8268
- MD5 1a3f12b8c1dd514d1afdcf5ea82bfa3e
- SHA1 e02f475f48d2be6156596f34ee2e6b9964d310de
- SHA512 9230c8635e60f78886ad8f7d649a1d373c208d1f93533edbdeb36ea80d741414d3cd47e24c234555b18c2b684ba0f1c59d6b98a91523e58dfc680c6b8f7ab990
- SSDEEP 3:vElG6DZh/stlslwlvlZVw96PwVu/t6LGMKLkNSZ/tldlohZt2piECl/llly:cY6b/sXEQ26oeILGMKYNkloLtYix/llE
- TLSH T1CE728CF7E701AD46D232433398204C021F30B04C0205C3B60CA802380C027815EB9892
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2685
- SHA256 6a4b22be564f453bebb35f0cd5c9002ef09019ef6c190cf2e5ebb1eca3a59264
- MD5 7cc681710a75675bfa97da6df1b6cb31
- SHA1 660046851c57c0d3a6b1f9c4dc6792a2cb0b9adb
- SHA512 905f801b85eb6c4b306566479a067013e0b525998801c98dc06382cd616231754c495ea73bfadb80ef13d89d31fb26270db06c1e5d341490df7b341c334792fb
- SSDEEP 3:T/G6DZh/stlslwlvlNEl5wH6fX4/lG/llGllll6:T/G6b/sXEQIMH6g/9l/E
- TLSH T1AF7292EBEE842839C23AC23608240EA15F32F45901504B0301A111390CA62D12DBA0A1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2686
- SHA256 27ac2336dde5557cec0a5be995840cf971540510a656851f58ee9ce9ad714b6e
- MD5 d74969f9327f2d877500b0c9622fab25
- SHA1 5c4db0fdbe58f94459228a7ca71d9618a0d30150
- SHA512 2feecd6861a26532058acbdaedc71b22f0f4f8ecd29dd3c3e1726704fa83bb0b3db7698b961918688a0f0a83736cdd6f089e971dc14efa6b3ac2a0c673604da7
- SSDEEP 48:qpQH25OCx5FABiVDbTYTbnVWnn57vyRES4UgcdtapeMirliF39E:q+H25OCpsaD8bVWnMOlwAiRi9S
- TLSH T1ED72DFCE23BB2922F07EA235EA76175151A6AEB0CC83E743E1BC425C9C63D513F24D48
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2687
- SHA256 b717052ad71c88e3cfc777ef82f3a20fecf60c5ff2c9e43b5964918387d65db2
- MD5 095d897261623be7c7edec86178c829c
- SHA1 829823f3c2c8c2bad15d246bbc77abd3532e3bbd
- SHA512 8780078640067d93eede6f38123b3a86b4df86e7177ba9b051fe5ce9df836024cfee47a10381c4a445003ac94a4c61a284583b22e5fe88e3e76940f9b825e123
- SSDEEP 48:OGDcsccjh9DvsG9b7zhoW1i/409XUbDYllN5:OcjhRvXhoC6DCb8L/
- TLSH T1E17289265B560CF9F6398EB46379AFC172A7E055045C2ACB11387A8D2E790A04F7FD32
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2688
- SHA256 529536d5013f06b78511c1e360f458fb9fb30b72d7dbb9d2799120a3e4647064
- MD5 26d52bb637ec9a0b3af85d60c95cecd3
- SHA1 f6cae114f69335ffc934127c1850888deba3686d
- SHA512 ab5d4d4d8263e810f4f8fd3272e1d58ab7365b3aea18e47dc78be7612edee2e4fd63b9dc5978f0c5d52021a4a66e0a709b9a5baacb8a68d90e7d1abb076b86a6
- SSDEEP 192:kbntHH9Iw5aCPMtBvTHRIV90LKOZbntHHpbn2HOmttsRjqHfCKBQ8d0OF8m:gtn95a3T+V90xltn0HOmtG21BRdWm
- TLSH T14303315ADEAA5F7DD4340A7940AE031077B3986E1D499B872358B5373CBF3A817B3A04
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2689
- SHA256 5c32ea2448852daed0c68879ae96180539e6cbc0b624e8d843db2002828ac915
- MD5 4a3211a51ee7e8053387446364840e46
- SHA1 9dc2e5fbfce84229c50ef72d0ecb013096424a9c
- SHA512 aa1bb9220fba6cb72221973e2cc54da80f4a9f394a9dffd6874c1a1a6471b7de9d38037743eb02e1ceb6f6e34824f9033c8f6b4c8e59a1a27bcf58d9e7b22d3f
- SSDEEP 192:+nVepVC4hxXaqCMnY/f4k/G+TfXlRCJQ8ljnFJLlzCk7Sw:+VepFhxXkM8EC+IkOw
- TLSH T19323990FD7999B17CA3F223694764D8F82B43C46975A637A2F4CA4387BCB3942DD6240
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2690
- SHA256 dbd6810083600b53b88fc5298666d814695170d1381ebd592a3cc31222c47fc1
- MD5 b5ffdebe3a0de153ff963fc2e034d4e5
- SHA1 c88953359d74fa48955b869782eb2a3413c1da1d
- SHA512 f4d0cf86b824a50a023ed54758a13c868c6a2e79e332ed7a8f6a15583240bbb1bf84397d125b7fde5e1157fc18c094f007ed7b02ceddebdff4528888f5845fe0
- SSDEEP 768:anTBfoWvFneKyh5b68Ph1nC1Ks5gC14GnhyXw4UEljTwJnrItJnWwDqFQY4nv/fU:adHt062CE3CpmlEJkJSGUReXW
- TLSH T19293B897AE295EF9D4380EB4506D060173B3507D1CA91B8A2B2CFD68BDBF0AC1777909
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2691
- SHA256 96d562c7698862f672408d1d03a47bb5fa31546c4f6949005aa6c70fda89178a
- MD5 089e76e37ffa305f3183c5b56548733e
- SHA1 54f78021cbe08099f1bc9ffb4cbaabd3dbc1b025
- SHA512 15acb7ff2a72d785e442579d909ac4e713e3b1de67ed1e9df918dd10616f6bf5a04c5e4bb04c23b44c1958c0525e92bce997aaeef65176d1b330e882941deed7
- SSDEEP 3072:XXXl1A1Pzm/2t/O3wL6KjgFRzAEP8MFMVyxXhj4hyQO:Xn0t/O3wL6PFRz3
- TLSH T1E344779EE764A91BC8FA2F71D5DF072BAB6EDC8317578702D69002282F677485B3D102
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2692
- SHA256 f9cfd642b140bd21b192fa7b4a82dedf2e465e12cd5e0c08b3c132487718478f
- MD5 b228dff6507fd982f9ce6f19b6882c8b
- SHA1 29fe019229fde01320e98f5f4a492eb28d42bd2e
- SHA512 39370f4d4d7fae88cf337d6b9f0d0218fe7b6bb44782199a6e52ed5ed12483f9c3b5db401a01c2d529959be03cd94567c00d254637e7af1f0ee61e53ce9532c6
- SSDEEP 24:U2exl010q+9+MrnRtkOWYi8HMGl/W9su6zKdXDKElsrDSlzS+/s1LQj0zkc/6DOM:UnDcscCnR6338HvFMsrGDTlsOf0y2uyM
- TLSH T150727AD5CB271EFFDB340BBA54A616E037B324115A1F9FD42533355818761E02F3AA92
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2693
- SHA256 315110bdd8dea0478a64f8e044c13541f5cf94d5c97be82448bf48dbfd2c5702
- MD5 140076df9f6a1e629145846a8294d276
- SHA1 11c05e8cb8cf43de9521500d72a20552cbf68c1f
- SHA512 c9cf00b6c763b218c48a1da2f6dea7bd1058865eb6cb090624f40a33d8fbe35b1d21fcc4e2fffad0e2f080d5ddf470ed512b7c86fb1cec75a7aa64fc6385e619
- SSDEEP 24:L+g8UME8qfcvh/MQNeL30ZNdKle3T/2Enp//RqYyvltHuN2Nu6X:L+gVfi/eL30TdKQ3T/npsYctHS8u6X
- TLSH T133723B1FCE48DA25C76DDA3B5C5204D72262788AB6B6965ACD17A070383304CEFD4ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2696
- SHA256 e0fb642833eeeae77c23d99ec60a87987e65a5e820e4d71b2c88a045c7a01023
- MD5 58bd9bd84522bd1d6b7911ae00eb9e12
- SHA1 6b426584e5ef3ada9dfb999d549b1d44ec3f078f
- SHA512 7c47eda6a864bbf17446cef94bbdeccaa14386c40ff6582a480111e685c101225df90a00f62082f751f4bb13d8a6109925773e77ef3e4e2f245150f337926e3b
- SSDEEP 96:VIDycH8ITzCQXElhyusSzuyt7l0n6o7e4P09VYcsvRcj:SycH5Tz3X0hyquUAP0AcKRcj
- TLSH T18C7202C3DF6E4A71C8280BB984F90220B33BA4666E5713425B94B434FDB72791B77D54
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2699
- SHA256 d42347ba741df2d95687d5b2bad03a35086d4e88305c2a1008bef6351f5b8ee3
- MD5 7dd26fcd9f58d1b5faa2f27cdb4a5dda
- SHA1 a4aa8606c795de4fc85f1f8b52fcd35c26149757
- SHA512 5ee7f5305355116264f5316914e86620cd3215b859555e5ed38a3667dabe8288366188a8161cea725de411899da93e2f6d7fe89e927ea0e474ebf2ac598fd184
- SSDEEP 3:zE/tW6DZh//lKlvln:QW6b/49
- TLSH T152F10437F440101FD337C13504741D715530104D500013000071133514551C01557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2701
- SHA256 d176274b4468d024901ee71384aed19b908295cb4bb756a55fe96515392d24ae
- MD5 4f69ab60cf501b55e6bfc7823a0f7978
- SHA1 3b816fe43ca49330dbab8986191455d3c1f6b0fc
- SHA512 54ce3cf1adedd5325056a9415f4e49eb43a4125b564567ecc00fcf203c78dde35909dfe24bfbe41e58419abc82d6410d62f801127c7879cd447cc80f146c0ca7
- SSDEEP 3:jktW6DZh//lKlvln:AW6b/49
- TLSH T133F10437F400101FD337C13504351D715530104D000113000071133514551405555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2702
- SHA256 097629102739fbc5fedfdea022ba17297c4ead42f3969cdc168fe5f7f7d7b7ea
- MD5 f6143a3fbb5133c8ab264be593da6bc9
- SHA1 3e539f6449c7139a73cc169ac8953bd60ea45a7c
- SHA512 3cd1cd2fe7e30cada657377e7a4c5adbb244a1143c99baa056a79b0c10d2cff84738e37494ee3fa18eb4f29f43cbe0676352c736c192b7172c43227e5bf89e27
- SSDEEP 3:L/tW6DZh//lKlvln:xW6b/49
- TLSH T158F1043FF400111DF337C13504340D715530105D0040130000F1113514551401D55470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2703
- SHA256 ec2f87625f3b991e8b759c38a53dd78d05dc22419cda6f1be01b1f8c623e1e95
- MD5 b1bd89f7b90ad3abcb465dcbaa30e5af
- SHA1 b5a71a3504a557b5cdc7d2c969b77ce3ce5f26df
- SHA512 19e002edb3f8cee23fa36e6a107e7336d64c5185870fdd5debb5ff779979a9d4edb72c08c261c7d44b6555c53412ce4d271f20ae1e1dc8af64cb792837dff72e
- SSDEEP 96:68lHHt8sH8XNGxevK8XfWi9KSodpou4et4uwMzCRYjowTK+pcqPa4270bGKefq:NntHHOkWV9podpVtHwMORnwTD7jei
- TLSH T1FEE221D6CBB70EBFC7680BBC905A07E1B5B398257EDED7821732B465197A2840B73450
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2704
- SHA256 eb8df84ff96406ceb947ade63c0423a3ce109264ed4a9200d0057e33d91a01c5
- MD5 cfed5bfd21e3a515b9dcd5122d1f60e9
- SHA1 7775f83ec5b8fd2626edacd0119528ea537f27ec
- SHA512 1d2e49e0fbf7152994a379af62022ea2eef72991ec6c2e6cf9a19dcb57b135ce22671c06a69e077f551a7dff2500daba29695095ddfaec0eec71dad8bb05b8a7
- SSDEEP 192:BfdzSmNxjpd3wr39yr7qmda8Er+I9D5OdhUGRHgcqpSzjApDDZnjnZeotZ6OcwX/:Ppdy8qmCy4DZnDZeoiObXo3a8Lfo44
- TLSH T1BF03FD8D9A4CFD82D93F123990E7861743B4AE40ED5BC7411FF460A928936E75FEA243
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2753
- SHA256 4ed796b4a53ecac3377c926db67b88625331a15ff6f8b29a4012c22d7a4c1a4d
- MD5 88ec009c90afc15a425259e5836c7766
- SHA1 9b57db0abeb46ca09bfcc640dcc25a52ff415b00
- SHA512 d1c8882539fbdee840682265e37f1e050a6c2b5960650fb73161b614df787fea9c9cc6667fd45009457640e905d275b9c93b8795d8390be94cfea07979a90da7
- SSDEEP 48:vKRLryW4+aoO+XoRyeEcNMLwzbBGROwFTBKC8ePScQlGiIMqyv+UekRxRsv:vK9ryW4UioJzMKlKwiRvxekRjY
- TLSH T194721DB6DBB92526E47E8271DD7813B06742FA50CC4FEA62D1E841B85CE3D503E47C89
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2753_fsm
- SHA256 dd5052bdf8cfd7963b0567a4a2d332cd253c36d20aa186404b7bc19ac6a3d965
- MD5 d8d7ffe8b727781f9499453cc0a56a90
- SHA1 7ad99ae233867a529960967a8a96e37f17746c58
- SHA512 ec5707914e08d9cf671e3fa1efaad7f594ef4623c030a60f67578a42c4a0e8fac6cc92b2ca8d77d35ed321bfc39ab6103baa2d1499274eaf996fb02f24cecf87
- SSDEEP 3:nhNlVrzthlBlBlBlBlBlBlBlBlFhNlVrzthlBlBlBlBlBlBlBlBlFhNlVrzthlBr:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2753_vm
- SHA256 a99f06a14115c4329215cc898cf0a3e0943ded4a1240b991602357e07a36e348
- MD5 c3883cc5c9d1f9f402979d9cd7fa8c64
- SHA1 e8174049815f6854f7d27d759764df7e3a539c86
- SHA512 c6a1d2b4d9d53ca788709b0fba2ae2086514dd2959f49da9562faba941ad80610ed5254e62fc1285ccadff84af39043e3ae82af0c0b7c74d60ab94483ae588ff
- SSDEEP 3:FhNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2754
- SHA256 a849c35250e9b4baf1d586b5021e781ce3eb2aabfd72a0d9f57bbbfad652cef3
- MD5 e1dfdf3522525a301574997fd4b0a28d
- SHA1 28d69500454025764683da68f02f9f2aaf7daad6
- SHA512 594a3de31597e71a73506148d7f1db70cec835ba0fe1f6322a8bcd903e12ed0fcfe6903f5d2c97d1daf804fa5799b046d9691e3a37f07e9ad123d00a3bebd264
- SSDEEP 48:FyaAH0SYCKiYDAfRnghPZYabMIe9JAK32iXb7RGcehi6E:FyDHrYn1SRn0PZ1b9vKdrEcehs
- TLSH T19B7206CE12BB2922F07EE235FA35175195A5ADB0CC83E757E5BC426C5C53C453F20948
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2755
- SHA256 8a4aacb907ad497e868e88c8df46474c6d0995d3e0e56cf2068eae38c1f7f615
- MD5 9d4e0379f402205c5ead895117933fb3
- SHA1 3e0d66dfa27179e99ea32c33f3847dccfadbd879
- SHA512 e00ba6c058eb027d05177606088f70838a82ec445551dc72de1bc5c33ec5a96423243ea68669f8c4896320ba41277f54a8cbb6f63d1a49bc6685ccaa0079f547
- SSDEEP 48:syKDcscaNpWCllvDZ+RllzG5r5/qDXuB5lT:szeSgR7G5r4z45V
- TLSH T1CA7257DE9B252DF9FA390EF1E4552BC066A3D05A15582F83103462E91D3A1E04F3F83E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2756
- SHA256 f0e89d584d7d332bbfb9f99d37bc6f3b37978499cb6d94a769f1fc69a127d1aa
- MD5 9a0840440665bc5a66b7ff178e61a81f
- SHA1 d13cef3ae3a2358fc829fac88faedf66d1be91fd
- SHA512 b21fa73c2a5d43c4e7d143b4fc2d4b1898863a544629368825811349750733df5e8d6c29200e21b44e717d068f617dd2561fff52c6a630a45bd564268f9d13f9
- SSDEEP 192:wbntHHAtWqtOtVGrH+0Fl+ntHH9dgLsbj3KYBPyz85qQS:UtnAtOtYr+kotn9dnn3tprG
- TLSH T130E27561ABB78CB7D321CB78523A1B8D5873AB2F1356F382163435281959EDF0E77920
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2757
- SHA256 168502abd758698223d6257c062b9c000b496b207b6bb0728759903db6c2c9cd
- MD5 469b5f55f45092558e711c6ae17a806f
- SHA1 1a96d9f8c6f0386db3577bddc017daeda62ef05d
- SHA512 93dcead4e70aa96594bde006ec32fc6326cfdc7fd2fb639fa38d0df2abe3660246315adbf94738cbb1640840efc284492d4092ead2de4998c340a751c56e3b6c
- SSDEEP 192:obntHHjg1dcf1/ZHf9KTU4lh5FXwEvezM:ctnk1dcf1B0o0TFXnL
- TLSH T1E9E22E6DAB26C8B7DD250FBC200817439C77E029175B76B33134557CAF6A3A90E3A931
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2831
- SHA256 1ca1f5f44cac8ff2913f4272ac4137cd14b8764ff8c9eb9b525005ff4a3a453f
- MD5 00bd83511669a39741ad5252befa3f63
- SHA1 4977d202cf8a51ba5d76cc94b0daec4a7d6bbb0f
- SHA512 c43c15fb04a77bea71d8b54e96674678b02848f997eb70b0c15737409310b2583eff0c171bb6680a0db7b89222b7228a7e74706f1b51be4e2387ce113361723b
- SSDEEP 3:t6DZh//lKlvln:t6b/49
- TLSH T195F10437F400131DD337C13704340C715570104D00401303007151355C5515417D5570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2833
- SHA256 93ba6bbd1a16fb0962d77f62fdf0664de5fcb81442b541831d7afd82aa6fa6aa
- MD5 04dde15f9a4c383cf9ff94b41e5f7eba
- SHA1 23cb25416b5e796b109fc323a4735548ef35f946
- SHA512 b74e0b7fc4c5bfbef8df808f1003ef82b706b715ecc6cc453c0a7061a29fb983f7156cd4cf61e2619ebadc158c333faf23643b89bf0d7c83cf096f65ec15eae4
- SSDEEP 3:Jse6DZh//lKlvln:36b/49
- TLSH T118F10437FC40111DF337D33704740C717570104D4000170000F111351C551541557470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2835
- SHA256 6f89d9014b2e54c62d6798f3bec4687a28fb3a79d8dad148b74b9db4c97a3031
- MD5 6d7cca916fc017d14bcce555a896fe28
- SHA1 636052a005da9b65525265fdef1c08b0d12810a1
- SHA512 a72d491c4195cd9535cd381638e7f4306b0c36462e21c786eaac0944b66cc38fa259f909e195881d60a6913aead270785e02be2e9c8db41142a76146199c9bc2
- SSDEEP 3:Y6DZh//lKlvln:Y6b/49
- TLSH T15CF1043FF400111DF337C1770C340C715530104D0004130400F111351C5515C3555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2837
- SHA256 cb761d241b45bd34aae0df6c575e2d382a4988392987af554fd2f86a7bc2381a
- MD5 95263a6dbad9060a0e872cde150460e8
- SHA1 ba7e5c4f3d912caedb9b38c05ade5d9995ffa584
- SHA512 7ae90a6995863e51c4c8adc2314d465fe7faf44f717f70c49139b9631fa14c5fda3317da62ad8945e1f2fa0780e72b7c234ce3bbc1683a63420574746f630380
- SSDEEP 3:Fw6DZh//lKlvln:Fw6b/49
- TLSH T16AF10437FC00301FD337C73704340CF15534104D00001300007111771D551541555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2838
- SHA256 184d6e099305db5d605c738783c58f368f982d4bc6d8e7671a1fe760c94b282a
- MD5 3ef72b8cae126fc65f3128414363a6ab
- SHA1 a5590d6fa9355ca78dc8854f4cda5ac10fe16bc3
- SHA512 15aada0b0311273ceddfa675a8e39d6108f3f7a69db328b2c4ab4953308c7cf32b79394d516d2dac5f2f0ca943d75d4033e0d24a4cdcf06afd6ccca4fa710d78
- SSDEEP 6144:BsdVuTp/vglhLJ2mYiywwRV4QWimomKNXxKam7MXomfJ7498qumm565s:Bc0ThorJ7BwRJhFmKNXghMYm68quZ62
- TLSH T142A4BE3A8F377D78D6AB57B3ABDC13887F41C964524CCB17B6ADE9A11CA239C0538502
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2838_fsm
- SHA256 a2d3fc912d8b71444ffd9e82e6103b49fa49379ca15004489eaa6a6150b3dd4e
- MD5 b40bd7a48b5b514a234a77491ada9020
- SHA1 f0dcb45f74edcd7a09f9ce8cdbd0c2b810a17c2b
- SHA512 8b6940978a0c2d9df8a89332f902b8fb1127c6977427812d808287e0ee3eb5a7f445678bfdbdd488d9dece256fcfc689d640b4d9956b7760a7e55d3007b1c84e
- SSDEEP 6:CIe++++++++8Ie++++++++8Ie++RygagKcmXBESd0RHQp+lqcCoLl:C66Cg2JXBZ0E+lqy
- TLSH T109B21243F0B92B0EFA459675F5AB230119C6D39A0034318E4CAFF0961DDFE575161223
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2838_vm
- SHA256 6cc354b40d26b2b68e8cbcefc9d748d30e6afe2694444aac9af035106182d273
- MD5 da37569b437ee706d000d1fcfbf22914
- SHA1 9b0ad61f1436ac45c93119f09fad0fba52538677
- SHA512 c209f31602f2372be3d0ff5da5e20ec04791c4459763f1e7da9acb568a86138bb372a7e52f4a1410ffa03f6633c93ff840d08e4863beeb52ce3f1b341da2a8d3
- SSDEEP 3:h3hNlps//:h3sX
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2839
- SHA256 f015de7778603c25f1ddf1342d3867d5447ad19769d1cf24c281fb83addb1c48
- MD5 cc1f26bbc32010688955bae87e54fd5f
- SHA1 ce0042df6173256c046d0433ce6e6b8d21f67aef
- SHA512 97b6b8a2d4e3689b8f3c6416c325a2b6b4f1518544ff1fab0edfdfce13accb165c4fc4e092fc6eec8a628419b2e4041f225a755e807eddbe493478c94c84a0d0
- SSDEEP 48:a8DcscliSCyiNM2yLA/0MjMsiGQrdlVO4L60KjG2jlbhVK1486gwjzrZHmY:azHHukAPQp/BL6012Zb9gwjBmY
- TLSH T1F27267D1ABA30CBFD725077454A743817373B039139FAB89066B59183E7A2D82F7B906
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2840
- SHA256 0f6d28f8bd966afdcf161796e65bc2a0371ffb7641657795a877b6c838e8c978
- MD5 661e0bdab3979c5da34fb2c54906cc4b
- SHA1 55aa8178eb7dc2c106e1d724c63d1838f6df4081
- SHA512 a7334d7ac1c1cf3f3e37fd73596ea85c72b8b7eee3a2d3b06a74ffa97553bf7a68394a346e9beccf16e454a4b958ddca6cb2bfa4e714ac4af177c98f89ff585a
- SSDEEP 384:vXnSVIxo1yH7Nve6G+06wcU7tkCtwFLyYIjpXPrRxOs7IqoGF07VyLI:vSVBysLP7hkCGFLZ8lP9xOCIDpyLI
- TLSH T1C3B2C06AD3395CC9C8A7EB374029C317362FD5827931DBA06BE651882D07CDCBF49909
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2840_fsm
- SHA256 c811306be331459b524c9913ac06453b2cf1e7bc0fb408b7345f20c7a91eded9
- MD5 257a34a17dfc2b8b600038fe073c12df
- SHA1 73216dcf48c0b0b35ef3cd083045fc508c16842e
- SHA512 99a04c5cae9e7a37a66fa57e3d8c59893fcc9258d74c47669a573c02a938eeab9f3bda737eb9b90bb131556e033dffc2dee6a1334f75d9001661af2ff8959ce5
- SSDEEP 3:nhNl5Bl/lLlrlrlrlrlrlrlrlrlNhNl5Bl/lLlrlrlrlrlrlrlrlrlNhNl5Bl/lb:E
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2840_vm
- SHA256 647e5524021c28d524305d9eb3ec8693a062b67a84d8f790e8485c338eb81a39
- MD5 cf912531c56bb13bf6f0d7d9334ae36c
- SHA1 44b37cee2765528761075b2e1443f4eec27ea9f0
- SHA512 4bcd56398d6bd93798a6d4cc9f4d91c557c6f0e826f7beb4ca37eda54335596d253c756875bc2cbd703ecc66fdf0d551b45e86fea2a5a7c701b71a52da408139
- SSDEEP 3:n3hNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/2841
- SHA256 8b676d4006f6269c321de9154346c1576ec09b955e523b4b03246594ca51583c
- MD5 59a81ec6ee23a6800b61cd0ded38b298
- SHA1 c440ed17194f3f7e3a9b9c51d068ec2ed08de177
- SHA512 c4c067a14471cf49a09390a504b3f4f4f9589d55c2aa6fd329aa71907822aca648c3adb14090b7da9447470653fc1e09efce361ad2775a2cdc596ac4cd3f60da
- SSDEEP 6:OW6b/sXEQug6cH6N6HdaN/OliKW6+lvXl/llWutR/1TE2GTlXc:OFEXEQHH6N6HdaNmlir6a9llWut51Ehu
- TLSH T1AD72C952EB562C7ACA36C3373C920FD15B33F4551716BF77502141201CAB2C44E76670
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/2996
- SHA256 d101ace45d47f90840d839bf017215630870d4049631b13cf174a7ded762394e
- MD5 1c6f8631fb199e1167fda6ed63ccd077
- SHA1 22e967a1b919720f3f229745c13b5f7254a2d195
- SHA512 45a3b7a0d40d6beaba323d1f75c036a4806d6aa4c7f894f5fd8576efcb344cdddf6fe38a4313754f5f096c4e937e3794ae2c26cc23b72d94ce6fd056dbcce373
- SSDEEP 3:NG6DZh//lKlvln:NG6b/49
- TLSH T1C9F10437F404101DF337C17D05350C75553010CD0000530040751135D4551401555571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3079
- SHA256 af8078de539d9097f419d5b96071178b3e14b52db832e8259e631a40f5858f5e
- MD5 d83b95845b4658f570bdd4e5cecb2972
- SHA1 754d683790eb56478850170c9aeae1f806539753
- SHA512 3797c6d8df29f14fa3e7644ba648a1fbf06964dbfb322b27a9fc68775fdc0660370d20cad0895d20cb201b7893f22af97a084b6cd4705f45af352bf0aa9bd107
- SSDEEP 3:HpO/cl/m/lljTh2lt+l/P/:JO8e//v4t+l/P/
- TLSH T147F1228BFA802820C23C82BEC0C0AF30AAF3C8A03200AB0E008302A00CC30002F0C020
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3079_fsm
- SHA256 a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53
- MD5 2a3216a10d8aeed6ac8058c1f5f6cabb
- SHA1 6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a
- SHA512 ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264
- SSDEEP 24:33a6666666653a6666666653a66666666:3UU
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3079_vm
- SHA256 80c0de1acd0fed8f5301d15f3c9f509245d6be59bf6a26a861148c2de4778392
- MD5 99488971b2da0578a55e475bfa7a009d
- SHA1 ee6d9cecf0b25e3da880f2bfb722b76e7e71ce42
- SHA512 1c7aa2f0a89631820d98429e2b65698e07b3dc9c3081cd26f9ff10faf74854d379c279f76e1816fbdc4c859863e9ba3a92b6b5994e3d5bcdc0a075539979db9a
- SSDEEP 3:ql/91hNl:qP
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3080
- SHA256 ca9311ca60c14b23eab97635fdc7d69731a50cb3897988e3e0f1b51681629dfe
- MD5 21c8ecab7aa0bf770bea2e4e83b2db73
- SHA1 3f6e4c38a26f845e82f1624e1bc8615a9a837789
- SHA512 c4f1ac2bb997c5ed035d42f84f0976709d091af2d8b6f21fb0e2bf759632538d19213cff551051bc819fb2c44c391f5c153b092faabd3ca14814abd1afa88e87
- SSDEEP 3:4fW6DZh/stlslwlvlhtj5gtsy:4fW6b/sXEQTpqX
- TLSH T1257201ABEF513469D33AC33A08240E639BA1E57D0155771B216391292EFA2901DA79B4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3081
- SHA256 fc97bfff428f6ba11357020a2928cbf6d023726d1c34270e50f9ba9f2fea66e2
- MD5 653ae2325231c6075ef846d6a0847d28
- SHA1 0fa57ad06e727f2d5e7fd0ff85de3bf9ec8a22e9
- SHA512 d542db1d1948e7125e40d61ac144ba95ea2dffda2a8c66a953ec783dc8d5e4017ff7b8dfaf53ab8722e3dcb8368a0f4d7bba5d07159274653d59df672b6074fd
- SSDEEP 3:IkW6DZh/stlslwlvlZ/lj5gtnFlt0:IkW6b/sXEQrpq5ft0
- TLSH T1047211BBEB80280CC23AC33208300EA38B20A83C02003B0B002300280EFE2C00EB28B0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3085
- SHA256 9fdbc12730449b7ec5d3ebb48797aa5947738dfd2cd6161a91ce2ef1233480de
- MD5 cd7bd7ddb2e252817d7e6cd8086e6cdb
- SHA1 dfa458f6871aee58c6a4ffee73b795df9d7b429f
- SHA512 e5fbd5ead72cf188845eef89591f9eca6d9fae05242af6f064e3f33778ada051be5870013003692e83027eeaea8fe1bad898eefe9ecbaebd626f63f96b80422c
- SSDEEP 768:fn1cnJ2nBzsLh8KaBpnvqdDqAp/Ot6CxnSKtvroPL0:f7WivqBFpCSCt
- TLSH T161236392AF3A0DB5D117097C10CF50354B9F342AD5EB7F841A2B983852DA05BB2BB53B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3119
- SHA256 d7b1a7b6958b321c611d4f6fa4e9b4b1e44f33abb87ce68a18c6c0fc0947b10a
- MD5 f858d95db3085d0f67c54c606137c778
- SHA1 7b32151b70f5b85fcb5039685260b3043e589bd0
- SHA512 4c43f32a0486bcdcd0d0118c523f5790859ee58d88acd233dd7fba0d338d0be90482a9a01b5da8b1c699529107e1a505a28ad98895f057525223d94a83c7b594
- SSDEEP 3:esttW6DZh//lKlvln:ekW6b/49
- TLSH T12BF10437F400101DD737C13D04340D71553050CD000113000071113514551C05555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3164
- SHA256 d6f91edd1f91a70c2007435763f1630c297f407fc658be5163bf095dc143628d
- MD5 1f156c750bd0e51bcda2a9464e6ed2b6
- SHA1 d1d89b717cf47707454195dee8d6876dfe25205c
- SHA512 811f1f3160b91f3a1274ff990683464ab36ed5726eab9ea0e241399de512408f71a2934039353ff1463a62ef65304763a54aaa141fc127a80ae5a1367decf773
- SSDEEP 768:7DhWoSkwM7abl6abL0RaDnWtBz4FXyaecB2ibGTWTWiRBoZad:gost/uF4VfDbG0AZad
- TLSH T1AFA3C94EFCE8DFA2C07C427F5912C4D64A80F8074E62655FBA78B39D21BF1843A952D9
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3257
- SHA256 ec0ba535ee435f35f5191766890f781a21fe4e3d1536f19eda1b6c3cbb94c337
- MD5 b59af13a33fd30e33d5940c216af017d
- SHA1 2675ddf1203f7e1587b232a5ab49f040b57cb2dd
- SHA512 5392877e1dc3962ebec6baabb2ed92fe86bffb1fc4600bbcc6ab9cd614fa53918d0ce9b25e1c910c1c5d16cc9efbe1bb52455d8b48b904188a66adf28fcf2ab5
- SSDEEP 3:4sfW6DZh//lKlvln:4kW6b/49
- TLSH T13FF1043FF400111DD337C13504340F715530104D10001300117111371C5534015554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3258
- SHA256 4840c0456c9b0f4dcbb4ce494c4c28ef6fe304df5989811bcb755b5eb62e1734
- MD5 692966de1777ec7acd5f7be6cebd2653
- SHA1 553237c34dcfeaff2605e62da54974951eeb319d
- SHA512 44af1c6af8fdcf323852ca14c3fff213530580be6e7d75ed7e69d77efaf749616917a7030cec250cb8038c99764955696baa5b0abce029dbeaf7793c2fadc93b
- SSDEEP 3:IW6DZh//lKlvln:IW6b/49
- TLSH T1D8F10437F400101DD337D13504340D717530504D0000130401717137145D1401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3351
- SHA256 2a3187e094139444a261d96db49ee9ce9d6fba83ae7cdeaa16ca7cb1ce264014
- MD5 9a699ddb0eb8d12d3cd3d4dff67d4cf9
- SHA1 beb0969e7cc06adb198ca13e737b158ddd196256
- SHA512 7b7152713fc47fb0df807b03a82d1d4108331b199656a1543070ff135fd8cc4721a1b7f69e9ca3c606ff3882d6459e2112b89a713e83c13cda44f4185a8f3e66
- SSDEEP 3:5W6DZh//lKlvln:5W6b/49
- TLSH T1E9F10437F500541DF337D13504340D735530104D004053000071153514551401555570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3379
- SHA256 9e032900a7a8deb1ad9764a32e2af10800135f214ac63b9be624afe90fece91f
- MD5 f28b6b2c2fd0ccd2358a27eebc9f0507
- SHA1 d9884bac9d75a335ef70ca73927bce7bdd2a9e79
- SHA512 f44206e0f441ff2c1c2f5f857cb49f0692f8882a7089f2b8bce0f9290a326613bd2f53fffaedf25df32b3a919b8f44995e2e11ed4dabb9126bf1b89d339f46da
- SSDEEP 3:vW6DZh//lKlvln:vW6b/49
- TLSH T135F10437F500101DD337C13D44340D715D30104D410013100075113514575401575570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3380
- SHA256 753e7ba210e28190aa3e78603d374489c980dd1c2184b838872d96671782421a
- MD5 732f40314d6ee66250b0018f3ed8bfaf
- SHA1 6d535f2342807646465d77466b42e7490ca19415
- SHA512 779ce6b8d13dc037fbf07a9efae64137f1641f247adf1dfd89efb13897a56ffe88e3d2504278cf087773e86879500bee087182a5f1a4dc9a365b02ef495a8154
- SSDEEP 3:RElW6DZh//lKlvln:OW6b/49
- TLSH T1AFF10477F401101DF337C13504340D73553010CD0000530004F1113514D51401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3394
- SHA256 1f160670a07dc1e9488d4e32323d27b6ae4330e88fcfa84c20c969fb7b044909
- MD5 3a359a0aa736cfab0795b83ae4d5c788
- SHA1 ae73747f867bebc1cfdb4cb3d59b8d98369b31b1
- SHA512 78ff3011240b3a8f31a11d2fb83316ec4c2d7502044972f80d0265cef1511ab7dc41b1d5efc4e3adc7af29c9a5d4fa3632555ca6ecfb78fa7592db69309ae4f3
- SSDEEP 96:oIcB27gNiPXU5+Ve7msBteIeQSjseL8SPQaJjSsFe6Uixei8rO2LnSSzvvs+I+Lq:ikzVems7StKf0aUB
- TLSH T1EA7237A2DB5624A2E59CBB3725C7672137ACE505251A9F5F20DBBB7B3ED37422C0044C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3394_fsm
- SHA256 e82517b6664704c0b4e927cd587ecc55abef4d45b20989464168de769b219043
- MD5 017e55ee517273a1cdc8151f26329f62
- SHA1 1ad00508560b89964660fb35ad0e68c6b6393ac6
- SHA512 0e4dc5381079886b1d713f2de5482ba286edfb564dac87a673815d9ecbccef1db0437be1c24aedbddba35a1bf2d32ab0e3a8102f2febda5f5773c6215223e333
- SSDEEP 3:nhNlchNlchNlUl:6
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3394_vm
- SHA256 edd3bcfdd047929beb2df21a544440f6bb9b4432c727ca5fb091e454a979d6c3
- MD5 a742c18afbece5387edbb550a79a6205
- SHA1 57d0525241cbc81d018306870c07f0eb22712f10
- SHA512 10b9248b7ac47f7ab7fff57777ec967ab59b37def333b41fa552ae15bf2c9293ab750d3663b2353cae05920352f5b7697322cd27b8599f8b4b8723d15f7a16ad
- SSDEEP 3:S1hNl:S
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3395
- SHA256 82a6e136506d1b4ab09acd384cce533315894c8b4b2f08b8c6087da9d53ce798
- MD5 4026d020299d30c1272592b764ebfc2b
- SHA1 fadbe0ebac2100c25e165c3d95fa5b47451c7073
- SHA512 d3463ce9e065be8098570ad74d1c25d224e265540a771c9e8d5c9828f0d6d1a62bd56941c7dcedaf79bde25d1e99969de3dd30df91990566d78ee4ad6562d5bb
- SSDEEP 48:faVR6VQPvKvW8goPtzNuGSSfX/uuw+e8udxwH+p+EmarHZnMNrw:flWS+8x2uud9Zo8
- TLSH T158720C1AD76CA9D3F775BDB714988B7B4184D00DB1236F7B0709B1B83E520056F49758
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3431
- SHA256 5f88b0df13acca9ce9019c5d4afb06b09f036124ca9dffa8e6679faa29623610
- MD5 e23fcc2ac02d7a2efecdfc16dd7a4d0a
- SHA1 9c75d5853d732ad025028c340ad4e8345acdd57a
- SHA512 d5e5afe3f4752dd2aae4a428110b6ccf05c95af548422debd8b4fb2b2b48d7bef393c8fd25553c5a292f5f062d2a5d57070c775fcb9c67d69719255780ff799d
- SSDEEP 3:p6DZh//lKlvln:p6b/49
- TLSH T1E5F1043FF400101DF337C13704340C715530114D0400130000F111353C551541555474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3433
- SHA256 b3d73fd1f81ee06dcc53a191a1d877e1454ddbd7ae2f7f4da0b6ecc5efffdca9
- MD5 302b68b5890417548d25b8a551db57ab
- SHA1 0351c607863855f9ce5c1e0c52094fc30d0cfbb6
- SHA512 e0f29abf740b03872e9bb339ceb5068948f1e3f8eafe41c2096a85e8453d464b9dcd02c5c4ff5c4ff73094f5c6ec7043999bd46984bdbf02d04a8ddfce4b4d8a
- SSDEEP 3:MllW6DZh//lKlvln:MfW6b/49
- TLSH T1FEF10437F401101DD737C735043C0D71D531104D00501300047111351D751405755C70
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3440
- SHA256 93521598388e258f255e4bae9251e7c0393fa95306ebb6bc4005ecf0dc58fa79
- MD5 f535ed7b66f5d8f0ff6c6329e315c670
- SHA1 7d606dd7c6049e9b8fac2af4176690a7a21148df
- SHA512 17d3b17f3791f58b1b7f59801a0addc6f627f2f61751685b6b9e364a5586628c193696756616ca2363ec4e7c95db579d1415ca20d1f8ee51b03f7bae8b40b75e
- SSDEEP 3:ise6DZh//lKlvln:ise6b/49
- TLSH T1C1F10437F401101DD337C13704350C715530104D0001134C107115351C5D15715D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3455
- SHA256 f9fe48220a2858fc1c374fb1df1657cbd04ca27e699d8ce4ff03d0cb19e97310
- MD5 4bf145d26834bb2bb0f957a52a25ff84
- SHA1 38dc63de28d5a7a3633e871146a57b2e4774541a
- SHA512 6ec74445318f60583800fe2e24d7108ba4352b92accd3ddcdb2747b1de41dcc48f454eaa334d06f67aca073d148884aa66858da79af26db82b8e524c54ca2e48
- SSDEEP 96:O8tHHt8sH8MzkGF3hzoGFaUqePZZCv6SbbUkJoOKUMwt4KY:xntHH9H3B7aSaJbpKUV4r
- TLSH T19503BF12CE7E1E7EC96C0BB5146F061076B3586E6EDE9B891A30F1282D4B3E41B37554
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3456
- SHA256 7fc6197ec71aed76d6f80a0a5fd2b85577de33cef884f03a48b359f19a8aa374
- MD5 9cff19a6231f1dd180523461d3d59abd
- SHA1 5ac6d6a4db52c9725bb60543bccc5ce11e6c4943
- SHA512 ed02bf7f276dff0ed628af0146a6a7043940e38eef5643fc512694228ec0707f064e6c035939a3a1ad272b5c3e078b2b13f059a3d5c08f0dd917c95f305ce647
- SSDEEP 6144:oGVOK1LgvQ30RAXP4pNAZqzViqv6SBtuNCPN22yFi9mxeVVlGm+i2A4H0u1P0C3i:TXP4pNAZqzViqv6SBQNCPN22yFi9mxez
- TLSH T1E1743A62BCAC3D8AC1ECB2BB194A47482F15CA6B48D186F7C7E3537C40DB46A3F56449
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3456_fsm
- SHA256 1eb1558d209394c1efedca731c69425b4f891f44ac11be34705332cb065b26b2
- MD5 7f40c0c4f27d75b4be75050e9899b0fc
- SHA1 8a22b9828551ed5ce8dd6febd54c195c4e6ad4d4
- SHA512 00bbddebae2a28ab5eb3eb08824f11cc823a5bee7369f22594195aadedada5f7379a8d50de80178934078dba770a0acf8fe189b6efa00fbf0bc6190d46605585
- SSDEEP 3:nhNlH/fl/lHlnlnlnlnlnlnlnlnlNhNlH/fl/lHlnlnlnlnlnlnlnlnlNhNlH/fS:cBt8tItDtjt
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3456_vm
- SHA256 932df30de2bc1bf03ec2010c40d3a821acb1224b14f99c120347a3b02b7c8d72
- MD5 217a7cb38602f2aee5d672a9e848a894
- SHA1 807d7af9d2eb6e3b1bddf4b7f43b5da5136f3e1f
- SHA512 cdb5b59642998aad87110989a7ff198f0266481abadc5dc129987ec30ac58042d34804422094ebab2bbc3fba3d009251b33bbc68cf47442539cb18782ba1f87d
- SSDEEP 3:tsP1hNlpT//:iPlD
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3467
- SHA256 e689e621eb5f41a98376f854904c5e9f6507ac50e74e6a95d4ab64792806e76a
- MD5 6ab757341b9459259907abe4b16475d2
- SHA1 0c68b8cc7747d6178fbb4d38b15466052f389193
- SHA512 4fac17c7e27e5058bcbbb2d15dac2226873d0752c2c84cc27e99630bb7f0790a6e47458fdcaec8c0b5405e58049b8bdcf67aec152af8ca4b193c80679c980639
- SSDEEP 3:TtW6DZh//lKlvln:hW6b/49
- TLSH T145F1043FF400111DD337C13504340D715530304D010013000071153D14551401F75471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3468
- SHA256 70d913ff288aa7216be6a8d4818de1a9266cbce42e0d0f98f4093cfdbd819c1a
- MD5 829c9920f38a8d77963bcc923ca9f88f
- SHA1 16443c21e244f5c4b51d6ee2b3028da6328a47be
- SHA512 c581eee6a7da6272a73783dc80e77354113072e0e4abe70faed5e9904a335b51760eb60db53ccf0d791e9ae0864e59740535aa80b12f7b9d5589acdfaf484418
- SSDEEP 3:ul/tW6DZh//lKlvln:ufW6b/49
- TLSH T19BF1043FFC00101DD337D13504740D715530104D1000330004751535145514017554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3502
- SHA256 bfb703155adfb2bb60db26b5864cd6eba597189742dd0f8ec4539958d9e049ac
- MD5 0536b7c6a4799a365f55d85aba1f3552
- SHA1 e8d38f119df647d5dd6ed701b731f91346234407
- SHA512 a9e74de91e851ed428e6c51c2fc14526d5e20941a60d2b529650ea71b90139e80a4f1808e8e17e5d09041037f4b0508c1ee5595f256b3767f211a775fa095f0e
- SSDEEP 3:UllG6DZh//lKlvln:8Y6b/49
- TLSH T18CF10437F400141DF337C13504341CF15730D0CD1000130010751D37145D1401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3503
- SHA256 62ffe899ea61e6e68d178595e8709a31688f506d48200c4de8eaba0ccc86edfb
- MD5 faa1821f7e8da853299dcbdeea4c19d0
- SHA1 ce1fe95d6efd2fdddc6428279b8d81d99041b783
- SHA512 dd58ccd64e368363bd16894eaf05964cdd1cced31e5a1631174fe335a28085539b6e0404f20d927337175554f0cc1dc8ec4fd1031be381faabccf48280328cee
- SSDEEP 3:E/G6DZh//lKlvln:h6b/49
- TLSH T1AAF10437F400141DD33FC13544340CF1753050CD000013003075153514555401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3534
- SHA256 8aa95c9c05d21e4326db1241f4740dc388e0ac69ea1269579f0b0269dddce378
- MD5 b122e32d0f4bdac3328dc0e61b946ce8
- SHA1 726b3442c6f6fc1e23fc53babc7c5ba5e1190bf9
- SHA512 4c686e4f01895ae857cd4feef6f457db81423ff817efa6456ecf76fc650c9c0d1a7b259411884fc9efa007a7249487e5563985398e8ab9a08dcf30beb6f0cf82
- SSDEEP 3:RlG6DZh//lKlvln:RlG6b/49
- TLSH T10CF10437F400541DD337C17D04340CF1553014CD010013001075113514D51C015D5571
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3541
- SHA256 5f7ca17f6d04d5ee8abdf687d103c30c245e489f2ce70a927fc8dce2e3b77334
- MD5 2a888952db4a8f2ce1e53c59791357e3
- SHA1 e38767daaa120cdeca7601e79f60febb2a3be991
- SHA512 7a4d7325e63b7077735f991d95519da0a94f1ff3c0661f3f8a1008b0a265342d3ab66e02686039b15e5fc25fe658cdaa62d9d2c437977a9f9a89ac5d9b31a135
- SSDEEP 6:Sue6d6t4Cpq6dEtKa3bU95uzEdnolsMD/lb/G:Sue6d6t4CpBdsKEU95uGolsMrk
- TLSH T181F19275A6729270D042023CD9BB2BC503C4F917D4884F526A0E4031F8236615096254
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3541_fsm
- SHA256 67d088a0fd41731665976defa2106f56d5f9182514dfb37f147e17801b1f19c0
- MD5 bc2fc5353eb9c13148d53e64375ce721
- SHA1 97aded03a93705d9a07ff505e60f944bb1bf6fe7
- SHA512 2b9fd3b42c399e148345caa32a8e9feb5da59ead826da93044263c8800e4f835f95180257f29abcc2fe8db90857f12eff93f98186ad87df7091a59d0f1cbad6d
- SSDEEP 3:nhNlml/wtalt6lt6lt6lt6lt6lt6lt6lt6lt/hNlml/wtalt6lt6lt6lt6lt6lt9:DAggggggggVAggggggggVAgggggggg
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3541_vm
- SHA256 0c84355aa6874471a20704c19f52598c3bcae01a9f6c51b416183b5a7e15b75c
- MD5 2da40f08afc02eb921c838cacf7f50e4
- SHA1 cdebd4a3a09eb2cc3d7ffcf5a4edc54a891d322a
- SHA512 b82f023380d5cf7b4152cdfa37005f9eae7864b71a5263f82e87f262a036f837d9ee22de0d5f98014b38d7761de6cdad694500d48efc0d03466b8eb7e81a1719
- SSDEEP 3:hl91hNl:R
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3542
- SHA256 ba330788c7c8e36a751dcbfe119907a81bd3da28a2bc9c0113d891bb8d5eb941
- MD5 d0a4fa558f577c479dfae44c47205133
- SHA1 031b46d37e05a0b7cf75836be151404cd42f36bd
- SHA512 1f5093b2959c552b4d83a3bdffc713a9657ffa992afd15a43b2fff9bde32d7bcdca7e7f81d19dca7907aa5a814f9ad63a98579ab416c27ffdd6a80e38746c924
- SSDEEP 3:aW6DZh/stlslwlvlS26DwH6fV6Nllltltq/lQtRlnqlll/llE:aW6b/sXEQE26cH6d6N/BIQIl///E
- TLSH T17D729BEBDA50797EC1368B75C4344FE11673F06E05114F55415511F58DAC2800F36450
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3574
- SHA256 445ecd997e7330810b57ac9782ac04b45eb006a5bcd096e6fd5ca8ab5100f4dc
- MD5 c1cb877d52eb3a601ba13a5812fca03e
- SHA1 9b24d3522ca7c9b6004cacb57d16ed45e1a741d4
- SHA512 9784150d4896c7915e36a5e479c6bb947fae5e27a99160584877acdec0deef6fd0b920bb8141184f5991e005f3b16b8cd3c38e91f4131707788ed51e3dd0648c
- SSDEEP 3:6W6DZh//lKlvln:6W6b/49
- TLSH T187F10437F400171DD337C13504340D715530134F010013030471513534D51401555471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3575
- SHA256 aad5477a2e0bef3add5f5e64bc236064625093b703b98066456f90a378a4060b
- MD5 735dda2b3def82b2bbd1fe5bba946a3b
- SHA1 4709a3851f3703f5b1e4aca792c890031de7af35
- SHA512 725bfd5e0caedf8b577420527b37b59fa19a34f311111c9f748dbe5305a80dabcdc5fc7fafc60e1603b9c1ac49024d4ec328b1c44032e2a40e7ea4478b579e42
- SSDEEP 3:Dl/tW6DZh//lKlvln:7W6b/49
- TLSH T1F6F10437F400141DD37FD13514341FF55530104D000453004071113D14D51C41555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3597
- SHA256 61cd72e9a5354e80d0520fe4529c6a0da909dfe347200c62ad1c7000f5f3ec3f
- MD5 efd0856d0df301326d19fb0e5de09fc8
- SHA1 1009d626d4a4929f73afac63c56ea2d00bca0de4
- SHA512 8619c5078cd9764414506a8e964975f45324a0c3b0c90b5cf46e72e12d752234324aae6418401b9e7b68086efa12ae7af55ff3ca3189d230b5b7b7ed4165849b
- SSDEEP 3:vW6DZh//lKlvln:vW6b/49
- TLSH T1E3F10437F404301FD33FC13504340D715530104F0000130004711135145774415554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3599
- SHA256 3b497fd69b96aa68442ca9123b60800a9cffd3f5f1ae1ee8de3755386aa16cd9
- MD5 9e1bb5abc99974373bbeaad6b367b166
- SHA1 4da96363ce195cbd0a584eb6123203eb9460fcc1
- SHA512 8c767a8e7662bcebb049ae7bb7fa951655f7abb41fad74f25257db9616ed965cd5ada0235b3ff11a54273f17e2dbff3e6d364ce202cd60ad973dfee97692293d
- SSDEEP 3:f6DZh//lKlvln:f6b/49
- TLSH T12EF10437F400101DD33FC33704340CF15530104D004453000173113D1DD51D415D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3600
- SHA256 8d43627c0e4dd8c748334d7438c591da9566b479c533b12baf42261695ccca1c
- MD5 1b75dc9f6e52f57c4facb529d7420b30
- SHA1 a66858fe0d431f66ef6dc823323c04fc8452221b
- SHA512 e6bcbeca7af956e926f29087d10760cac94ef90dd5c248e6c1e53417d6ce1faf846dc0654a4406c4e11b7806b4af7e165a1e07c480931247722fa66a69daa67b
- SSDEEP 96:xhQEvmeyLrx4E+9CkosQc78ZL2nGaMS7SH6GIULYgh:nNuZiGhQg
- TLSH T119F1B25F40353827D26CB23CA1D95C41BB2A377A93456C5166FACB31DBC762BBC23928
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3600_fsm
- SHA256 5b7eaf4390699bbd73877aef79309162adb4023a29c2d7d91b1ad2a967dd0f54
- MD5 9c8c826ad6df53eca007367b61b862e2
- SHA1 1970a5d78f2273bfde19da2b9e5d7fd620a6369e
- SHA512 3b0779dfa9503a075d9cc0746bf084dd0912d29eb8a8d8fd25e4a8a95e8f84763f548aa58a1187d7089894493da330453fb659b1bff740aeb688c84a8171ae41
- SSDEEP 6:cOgAAAAAAAA6OgAAAAAAAA6OgAAAAAAAA:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3600_vm
- SHA256 29cc0ed4f77436ef442cec8d8058c54c3f9b09931878d749774ce21fdde26163
- MD5 c8a5956699378d2d46c6667197fdbb28
- SHA1 c59977db8abd4d4000c545b87bab1c47eac8b88c
- SHA512 ef2fcf6bfb99781704f877692c725cb6f94bdf2e30c60a6630a7fd95f117fc935ab884f6c7b2f37ec37754b8dcb9d1bebd63147fbb9e85e015a694efd0443cf4
- SSDEEP 3:plll1hNl:Lll
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3601
- SHA256 f97b3570a2ccae55a9b4f9441d9a6fd7a2d902481572fd0bd587cb346f0edd12
- MD5 8653700f1910bc0c8a8b3a099aa526a1
- SHA1 401ba07d8423e742136ca51e83ad8b9d913ab71e
- SHA512 7076a80f8f1b2e273a16d2013df9c89520a619a9fd319c39c92f37058bb6e4cad077916ee6230f8f15be7090f20f584eec84cd8eeb1c82e032bc34706bde56d3
- SSDEEP 3:tlhCbFtil//mlvzg/lmlq1QtxMl1:Ab2/aLglS6Qgv
- TLSH T1FFF1112BA2CC0C80C82CCAB0282C22A88B80AAA880222A03888200000802A803E0E2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3601_fsm
- SHA256 a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53
- MD5 2a3216a10d8aeed6ac8058c1f5f6cabb
- SHA1 6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a
- SHA512 ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264
- SSDEEP 24:33a6666666653a6666666653a66666666:3UU
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3601_vm
- SHA256 011432e22e7616709fb81d309ae4bae2f1f416d5669263f4b86cec7b36da620a
- MD5 2874cc77f26a654f71062704b6716327
- SHA1 171a267f0a7a6cc99d063443e5bc1b6966c3e7b5
- SHA512 8ed201f7dc8b1ed3bd95cdbbfc845d8f8d60e1ee2444400cc770a2e91b0876b7ef95638c5b6d24ea66538ae02b73ee05030ffcafda2b1f6aa75ad7d34cb95631
- SSDEEP 3:LfhNl:L
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3602
- SHA256 17b8e3beafd51008862f33d7a30d111007800202ccf253109d79598547e6f2e5
- MD5 79edf08c4e3b7471563aa65f58e3b59f
- SHA1 204d2e91a720bc1a5d89987e2bbc997d3d2d0166
- SHA512 94e63ef25b1e5ada6e019f21cf39c052a32cc13337bc4c2c38b47da14a14ab0dd6437f58a624f115f666e6e41728a1973e6d6e96914224231fb194d5d3544993
- SSDEEP 24:aB+5jhKgayT6uSAnRy9hy0H/qlmapiKkCxvDOiyc6bZcKu3SEK9p:BmRwMKHsp5L
- TLSH T158F11E97DC1CB861C23C82F5CCDA5038A7609D90E563296DAADBD7A62ADB0103E5750D
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3602_fsm
- SHA256 379f6be469b2ebdfc6a6db6a0d57039c7cc4515086a06fac364d31e1a5958870
- MD5 5eb3063bf4b81ac55334944d5bf28740
- SHA1 f1775adb3d4fb050bef20a0af532f4246d40f18c
- SHA512 91e83a3ddf6a3260617530dbf96391f22878bfa864acf0c7481dacac43af2a48fe1f69b77f2a36eeb27e3dcada493ee36644b656713304ec6662e806bc0bdc0b
- SSDEEP 3:nhNlLOSXU00000000NhNlLOSXU00000000NhNlLOSXU00000000:DU00000000FU00000000FU00000000
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3602_vm
- SHA256 3f0e0eb3141f032e34ab3b1c1d46e74a1108f9dca23d43b08f202b611f76c952
- MD5 0fc08e88cb04aff1232e5d2efd675133
- SHA1 ff7738a761781d1cbece37ba16d60e3e4a353def
- SHA512 3c02a6cc5a6349445d28493772ec51679fbcf4fa8b849c15db84b94c3a0f25aa9606ceeb31a4449da7406142a1191ff4790cc96247a0362ded3498f44ece5867
- SSDEEP 3:33hNl:3
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3603
- SHA256 a5f769c807b79725f199902659f28facbde9b036580985b698729f24b6733b60
- MD5 bbac254c9bc479beb2607a819f93ae7c
- SHA1 b4270d1c3cc57a1faf79e00153fb7d78075ac3b0
- SHA512 a495abff7224f235e8197c936b06715999153a75bf4a9357eb01f8f9830a92a550503c89a7f6e93cce2e65fb3504f3e90034edaaaac9ab28dce380282b2c36b7
- SSDEEP 96:2gSftcuCdLoxy8kDewk/PN0u8+sIi8jXiW3eWC2gSftBqrx8Y3V+vq0W0apg1AWy:27/4LT8kD8hD7grP+vq0W0aW0tKT/KVp
- TLSH T19DB2D7830B4474E2C16C97F5B7AF1B6483A9E352DA9323034D5B27114CE21E67AFE19E
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3603_fsm
- SHA256 cadfdc3c0accfb56c633f8fe6749e8515cfc1d20bb6b0e76e09b2132336f6a92
- MD5 ef791ef2f215614dc70d1e41e8e8d280
- SHA1 70479bef80d8362d16f57632ec69c7a15e03a3c2
- SHA512 6d6c130098d5dc69206517fade2fd22e9104d83e5e26d335b6660a0ed30317a6f6b08face42060b194632e1552f22e6f383e48b7484c50b8f0d333919cb6e119
- SSDEEP 3:nhNlHlCm/c/8/8/8/8/8/8/8/8//hNlHlCm/c/8/8/8/8/8/8/8/8//hNlHlCm/G:H88
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3603_vm
- SHA256 57ece504e4597d7f014eeb3bd9d5bd833d7ba4513271dc2186117398e7fd6dcf
- MD5 bcaeed5190ce8b66a3b72f9ed911943a
- SHA1 0d7fc0833f9662ca9a6bb36a44f8fcb4f3001d4c
- SHA512 0ebf530ecf6361fcb03661fdac7a82d2a41f56ecf780fc73b5d122778fef367e15175718995fd6dd6c04e0f5e25399b05f99875098317925c3405ccbcb976e7c
- SSDEEP 3:c1hNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3604
- SHA256 ea4a01f166021f8a4baa6b510d37629d264e58dae801cc82fe87ece772d4a805
- MD5 a11c779c1901eb0e38abe7c8ea0903ad
- SHA1 caf60c7500c986330a8842b55335ece8e7cccd2b
- SHA512 b4cef1eabd6794c9e6a57dddace3cacfd0750229a6cb756c181ab37c4a36bf0c5d6c0eef89e3555a56be3fe9d2ac24c419f01e81ca88a9b8e0b7428ef721f1e0
- SSDEEP 12:LFEXEQ8j+e1VO6QIuIjfE9QJOx1zmMAb2L9mSJgQctto:ptfEGu1z8GM4gQctq
- TLSH T13472AF5EE70A28AFCB39017E582F0C5302AE3D7910008661BEF4CA15FA1BE433EB4824
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3605
- SHA256 89817386857bbe5279ccb0cd73d8e305d032b3cdbf9fae0f6a50cfda44ddc681
- MD5 af14b8617984149b64b76246f864ec04
- SHA1 713108b4446500c4c54c5c4ea66a83925ef770eb
- SHA512 0bbf23777bd93b8dc8f870714f89329004bc6f39c81fc47e6737bf6d09a09a01b246488ebb62d733e94345c29718fbf0d412558180a2396ad49c1179f066d919
- SSDEEP 12:IFEXEQ0GH6N6Hdata9Bi4WcYlbA8oSMAlfK:Icaxlc8lbfK
- TLSH T15972CD62DF951F36C1154D7200590DF0473F5459C51D5FC219D061180CFA25757FA511
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3606
- SHA256 6bb5f393fc96f8ea356d0c3c7a69e1837912f7173f3e4606770ecaf98b1e1f73
- MD5 4957741179e9af00970effdc878f6f7f
- SHA1 d2d1819ccfcf35e75b0160d8f770f8d16435ca85
- SHA512 368c3bb6abd3c7efbad26bcb8026aa5f70f029b20a8bc5bfe61430e723fc57617b076ae0dc20b17118887b9c92c99c70fb40d7a6467a9401b510b0b3444c1bda
- SSDEEP 3:rlll3W6DZh/stlslwlvlCtjbV4nalKYR0ll/M:r9W6b/sXEQItjqnuX7
- TLSH T15A72123FF2447818D73AC13208248F969310995D000023A714F2012C0C631840C9A564
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3607
- SHA256 1acbe15d5a46f43ea6ea2fa9679d1c9b263c1d3c1065964212394d3a9d9d4233
- MD5 1810cf10000f26f97f2f50fbc23e650b
- SHA1 f21a2d5dc889269c5d97dba0d498f3f17673b852
- SHA512 c574a0a9b20da000cfeab4048b0b24bc811d575dadcd560c5be06ba0784727bdb3e1c088feb4989ff7ec2a07ddc64155fa04836d1f1be72b154e1eed3891a92e
- SSDEEP 3:q/l3W6DZh/stlslwlvlsktl55AqX8U:qt3W6b/sXEQ6kpKY
- TLSH T100721227DA043018C336C37304200FA06360944E00010B0B012210240C912501D734A0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3608
- SHA256 0490bf455ef2afb256a469f5e5be0e42d615f99341585c275c577a101df5e9f5
- MD5 7d6591076add91f3160d2e15dd93f420
- SHA1 a0292313afb552b9cf182db2b2b9b44ea8bee3c4
- SHA512 94dbe8e9cfa47fb80e86dc51374b4548d90108cc313d74ddddfc4deadd79c669c70431ce1be8d41c08c291059f3961b328f4a87fae3f8d095d76c3191ffc958f
- SSDEEP 12:efFEXEQIj+WOme2uGR+RVq/gG/+tmD07WgySCBQ8bkILzto:uL18Iqtmo7cS4pbVLzq
- TLSH T1F772205FE9057D6ACB7C477A8016CE9387F59C9C262247B29EDB275A0A1F40403F1EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3609
- SHA256 07daec5b6d2be21830e22d9a9d3490a75bca6641fe9725502edeca0c26aa67c7
- MD5 e4e1cbf656c3ed727bcd063a7a2f9640
- SHA1 ae290f180e0b05d9f6afd0fdefd59939937da480
- SHA512 10370dc3f5b7844b15e9dd8e18cf968fde2bf7dc998577df6d77e26fb1c8b965e4914ce04da6739cc7616cf57c34a70a36f5fcbccdaf135be9cffe0ac269e683
- SSDEEP 384:lJQRrTF9U0Q7tp5senyqn+dN+I9QM2ygKdB95eC:lCgv7P5senyqngN+ICM2ygKdB+C
- TLSH T12AE27A422F45A4A3C260B63BE1630B0F53B0E56DD6B723174255A7103DD2B0B9DD76AF
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3712
- SHA256 589e7a7a4b1da5257a54edfdf05778fee187329f6eaf5c2680f9043f3287e95e
- MD5 43318b817ab6693f5bd5f73fc2d323c6
- SHA1 b55645828462af42d457c31639ca89fdeb09f8c4
- SHA512 895ac687668e78a9536d5cf28a9d1fa7d591acbb650b20890229e0b9f92fe81da886517f834895688c90599f8047a71e03707b68493a3f1507fd632b7b7efebb
- SSDEEP 12:/FEXEQgGH6N6Hdata9BiOwdT/jyr3C2whfDv26:tQtE+ry2QDO6
- TLSH T1E072C243AFA81ABBC2211DB640590DF597BF2066D91D4FD14692521408DB5530AFA196
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3764
- SHA256 0c2ecd002eb6a7b3c4e34a9cfaa814af4b1cf337ae1d28a6cb75ec771a3e9252
- MD5 4c72e65f948933e4931be5d487f4355d
- SHA1 84626650f1b81b20a184abcbf6e537b5e81e0098
- SHA512 485d27faff4797adbcf8ef09cd46b8a505e5bcad3a2d00fd08b8a1fa45b97b20e8b0a985a3a5bc53c1d3b4ebf0ef9814d3069d3fc3745824ea9dfa0dfcb1c4bd
- SSDEEP 6:4z2PHrDEHaHZXRxsyl0aIAalqtEsqXil4xAtM6IPl3EmX:4zWLDFHpNl0aIAalOEsqXetM6IPNEq
- TLSH T16EF1A773CF8E74A1C43CC2B45C1E17B1F394BE00E25F0304196A4112684B1543025618
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3764_fsm
- SHA256 51e01e110ad6394a405d1cd7d0f18be9e1566302d54d545ff703c30cee71f5b0
- MD5 461ce67a44bad8aa641f0f8ac7f750a3
- SHA1 8839d3ce467b401c60f851183bfd7841ce7c0770
- SHA512 f8ed6ec80bb7a0b2b396d7fd99a12718a78aacc0215418434549c2e95c2fb9f0daf0340855ff2923c7cd143cc92f3112841c5dc65bfc4f955fb698ef765c66ac
- SSDEEP 3:nhNlrtD/JppppppppnhNlrtD/JppppppppnhNlrtD/Jpppppppp:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3764_vm
- SHA256 50f2fee0071bf57ed91a8dc0ceff4a59488f2e0e9cc42c8aa33b4ec333ac2c0e
- MD5 39cdf730686e4b5606c6b9992bf0d419
- SHA1 de16fdcefdc5fb81947ba39c1fd6fd93cd058b27
- SHA512 2929e177558a888636e3f4bc52123ee35251e79b954890f0d3aab90903376639ba98d84065743d7d67206481fb427686d20c68617cde5ec07e9f611236e3d66e
- SSDEEP 3:UsthNl:Us
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/base/14088/3766
- SHA256 3143c73dc158c0d4345d6a0c2ccbd15f144af495e629bcccbca5b2a5c1a2b452
- MD5 28e563283339d23678abf997e48dc847
- SHA1 38ccf232bea2bae75f8749fd33cfb17daefa4653
- SHA512 5d8f30d8f99045955820696d7979ae54d1b2fdc6816dbbc76e2aa2418cc529ade4576dfd81ee4b9d5f03d3754f606ba76985e8d108a2d9b09b6366cd129b56f1
- SSDEEP 6:3W6b/sXEQckkx/WG+ueLdq4MAy6wktYxi:3FEXEQckkZWG+ulVx6wktsi
- TLSH T113728C2EC74E38D9D33EA2B244690D6363E8AC8C530603720CB1106548CB6410AF2DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3767
- SHA256 b28bf9ff18db4bd676a889d02f2b10a21d2adb412f247ba0d509623639c1bdaf
- MD5 1ccb42ecd8ede4670a2b6c2bc4f8d5c8
- SHA1 0e7b6f535b52d9954bfe026f2f2b1d241dcf8537
- SHA512 8d5a57ef967c7a94afabe259603c580b95ec1256b7b666de2eda10d0fdaeb1d9a9be5e5d51915111404e9c2e12952cd7f700e62a309a63ca7f6166875ceaa113
- SSDEEP 3:isttW6DZh/stlslwlvlHR68ltwH6fgglaQXx/dl3rtn/E:ikW6b/sXEQ2xH6PaQ8
- TLSH T10E72926BEE806876C23682F2083D0FE03B33B86D80274F020061F0204CA83D2BFBA050
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/3997
- SHA256 0090c9dc550f4498e902fd9c4f3d39df3900040215b60a27ef4e0ce801cb535d
- MD5 af24aaf9932f2422903f164a518f6f37
- SHA1 adb37067fa68e9a548e9bf50e1a0922f0ebc3821
- SHA512 a995d864230fd21d7a23539ff412442463ea61487eba2eab1c9230171a7e9d1861d25de0d2b48c034b2236a91c65df5aa4359e4a1249c57279bab16b3b5e664e
- SSDEEP 3:BkW6DZh//lKlvln:+W6b/49
- TLSH T10CF10437F400101DD337C13504744D735530104F000013100071113514D51401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4144
- SHA256 a730212878ba025eb5bccc939233323d52e0e7f9878aa98e223c1fa9116f6aec
- MD5 ec372f6d8f38d99e0e1fb32655efa9ef
- SHA1 19f702803b5e643ad7d7946a97a14c1e17dac4c7
- SHA512 39298a227dbd25bf9a3b079cb115f3c2173f6f85cc9decd36d7a3296277c7657aeadd61c025756398b79ac539911ce6736741e6ef2fcde66977dae9a7321e96e
- SSDEEP 3:5se6DZh//lKlvln:H6b/49
- TLSH T1CFF10437FC41151DD337C13704340C717570104D0001170010F111351C5D1551555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4146
- SHA256 2aa8f505c22652d7be513c740735dca16e181bb55a815247b843bebcfa628e01
- MD5 5361c82a05d964d912bb07a14641da59
- SHA1 39f2819ab7712dd32fed1d1bbf28e8fcd617bf82
- SHA512 397bcaac9a6c5b632e2fcb4419b21f182edfa476c75c6eaa811f961e85d897ef5b7fbe761ae924c4a5d6bbe7363fa4b59ba36ae038a54a21790c294e0da4b9d4
- SSDEEP 3:o6DZh//lKlvln:o6b/49
- TLSH T149F10437F400111DD337C13704341C715530304D01001304007111351C551DC3575471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4148
- SHA256 96913cf602df9f2c6137e8edebc889f03e8c2eef3d210dcf2843abb1cbbac910
- MD5 4f847897c792fa3fca64f6632817382d
- SHA1 072a92e15c424e9886cd58d280a8a36077d98cab
- SHA512 9010790b965ca017bcacd383c3ae576a80326e50ccea2b3607e236f8d404f3187313aefa3845b1d4d47fa093f3fa1cd08e7ef06fb2489345c334f56e9942f2c8
- SSDEEP 3:x6DZh//lKlvln:x6b/49
- TLSH T164F10437FC00101DD337C13F04745C715530104D40001301407533355C575541755474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4150
- SHA256 c314cb56e798b04270fe07ba4d851b98e5cb3f638efccbd441baeff34f3ccfc6
- MD5 f6a0e414ee0f6cdb44b1e5890b338aaf
- SHA1 99f3568c0db4afcd09b3e1cacdbb21989ceb6c50
- SHA512 3320b906ec839eb3422c74157a5919051e0ef6a1b0b1325b975855bef642fd51dbb4a499edb7cf1354daa6506662a3475440aadb9486655baba9e99116053875
- SSDEEP 3:B6DZh//lKlvln:B6b/49
- TLSH T174F10437F400101DD377C13F04344C715530104D00001300407133351C5755C15554F4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4152
- SHA256 f18ce0e3cc3760239becd1b5440eeb48856a18b6deca7082de704ee8ed1b8cf6
- MD5 a7afa8c187c09b1cc267ead265b3de32
- SHA1 5f13f35400deaa6cc78b791fe24504ea7fbb72d7
- SHA512 518d27984d5a1903712a8dfd7acdbcc10c3b03a6943b60d49f2382386f50be6ae709b4cce5e16db2e51c2a5e037eee8aa3a8d4cda31fa6fd1b3844e80ea9527d
- SSDEEP 3:Qse6DZh//lKlvln:Qse6b/49
- TLSH T167F1047FF401111DF33FC13704740C71553010CD0000130000F111355C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4154
- SHA256 48e02c18aa0ba0bf5c6b563898a22f9571aeaa7b978ad83e11b24eba9ea93a98
- MD5 3620e3b48674ec2074848bfa351fc699
- SHA1 fb8a748651b6099297018552f304e35338d0c770
- SHA512 8f8ccb10206acefd741c5c6a418f1b8186f9a800229727070b75ee23cd328dea950868fb9a7125d9a3bf4e84f3406e292e4315d22401964090dada9ab35e3cd1
- SSDEEP 3:Ase6DZh//lKlvln:Ase6b/49
- TLSH T107F1043FF440111DD33FC1770CFC0C715530504D00001300007111355C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4156
- SHA256 9240aefbf1081e9e5aedd8b694e718cf07f4c0951ed40e9f666a3b529e716f88
- MD5 54811aa1ba4013195d5e9eeaf0c836d0
- SHA1 7e0d5ff7288223b9a7cf3b15cbcce19c2fafa278
- SHA512 b6d84c841dcb3c81f44f13183ec365896b4db8980585ecd86cc692b4089aefdda62265fbd52d104fb05c0590fade5b95bcb10f5bc842b52622e06f3708844716
- SSDEEP 3:+w6DZh//lKlvln:+w6b/49
- TLSH T1F3F1043FF400141DD337C13704340C717531104D01005300007311351C5F1741555474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4158
- SHA256 3b2b73a0bbe39500f970a055ca2aae41080db93f43eeadea13943fc37beb3fa9
- MD5 1d23c3804323f0ac2ba807fabb60528b
- SHA1 7af99b57c5bee2683a4357b6380ceb70153a3533
- SHA512 2a994a8d16304337b0580da4b0ad2360a4a2b46bd8833790646208aa7da567a69ad4ff1ef46269cc501030dc35bbe87cc1ea12ade9ecd027dfde50629c86fa69
- SSDEEP 3:jw6DZh//lKlvln:jw6b/49
- TLSH T1F0F10437F400141DD337C3370C3C1C7157701C4D01103300007511351D551741555C70
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4160
- SHA256 389264fec0d1c0e4392fdce065a4870d3c5106557febf2ce3f07dbee80722977
- MD5 1173a80aaad39ba147a0d78b9df19c4f
- SHA1 c0354bcacdd9be4638f0ff59bb2d132c6613c2f7
- SHA512 4b167b85131314a91990a160befe029ab5ae6e441a76f39b5e3ec58e7a4e9c362468edcc423e6a20d8108646d7910cc041e9df2cc6fc3004b5d9daa02ae323f5
- SSDEEP 3:d6DZh//lKlvln:d6b/49
- TLSH T174F10437F400311DD337C73704344C755534104D00001300007311355D551541F55570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4162
- SHA256 643db2d87e3ae7aa952217f80bd07a702f7c1300b1e49197fdc22884e7a77815
- MD5 76606fb9a757bedf604f5fc1e5fede57
- SHA1 f75876fc4c732153427719a23514adcffbf4c059
- SHA512 d28f1f755fbd1a8c41e258cb53a45758000815c5e64c1f432f0300e825bfa8b61eadd425e2b724c65841570d64d15b0fab75f781df3710982b3493eee1f99bed
- SSDEEP 3:u6DZh//lKlvln:u6b/49
- TLSH T150F10226E400101AD23E813A046408A155201049000053004071112918961941696560
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4164
- SHA256 2e3456b41aef99069803b60800a4ad7cbbf225b8c299ed2d2ab3e7745a3ddb3b
- MD5 2bc50e2983b1d3d2ef7acb50dc5863f2
- SHA1 75458da85b69d3df23e84a6c68367f3bc9c6239a
- SHA512 7f53d828b1d05c9830de175d017bba2df4d6b96d4fc2f1c412de554edd9380f447d434f2033f244002d05f92f408159785457f40cad683348ffee6fc8d9ef00c
- SSDEEP 3:zw6DZh//lKlvln:zw6b/49
- TLSH T1B7F10437F400153DD337C13F0C340C715770144F01001300007D11351C551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4166
- SHA256 a8f213a5ac4616bd997e11cd2a39c06fb4c462f80aa070b17de56305c3d73abe
- MD5 1e61aa8da2a1a4cdda5e2c16f5ebd382
- SHA1 ca66538567cd764c1de62b3f438dece12d7eb6c1
- SHA512 e2dfcec0462a645b3a4c26db4efa47f856f5662d028da5b7580803066c2a732154e95a85b289e46cbf5df0850a610ee8a5529dcac77109b9d98046f28f6a82dc
- SSDEEP 3:Lstw6DZh//lKlvln:Qw6b/49
- TLSH T1BFF10437F414101DD337D17704340CF15530104D000413040075113F1C5515515D54F1
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4168
- SHA256 e0e9bda552618b3fe219035da7e74538b7dd22641504e4355308284b8ffd531f
- MD5 67fa10a47cf23e24d71911e730095102
- SHA1 bd3fb9e5fb3f97ea59bef263d0a6b5db502bcc1c
- SHA512 9b913b88c317743f60114470556dce688224c5f35dba506b00faaba200c122376c8ad08a9127c5bb4cc730d0c885d152f99c7e6216e9e191bf9c0a9a794bf8dd
- SSDEEP 3:7stw6DZh//lKlvln:gw6b/49
- TLSH T1C4F10437F400101DD337D57744340C715530104D000013000075117F1C5535415754F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4170
- SHA256 0d1068f356e1f616cecae80386cfa9783db3dd209cb37960184e243114b3e210
- MD5 d9235ed26c8d707741eb29998d696524
- SHA1 d1516ae7e3eab1eceb1c84df3f34e29d6cf97a78
- SHA512 ebeddbc92b0371ff2cf0e67726ec27f72ccf3215a513656dfcdb7df42baf225ec2bbcbf2df11a80dcbf5723dc2ed5bbdf1ac63192b0661b55633bc833581089f
- SSDEEP 3:66DZh//lKlvln:66b/49
- TLSH T173F10437FD00101DF337C13F04F40C715570104D40001300007511755C551541757474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4172
- SHA256 8703b02a900620452e53b7f1eeffda04c5536c0abe9b8c095bd509c8eb86dadf
- MD5 b5ee2394f1bae74686908b0f463e46fe
- SHA1 56d1a4e943e20f082384c51c69f123a5444bcf8f
- SHA512 9a5e4a52d51609e407a40acd44fd166ed4a541747b367db841352e5a3d67378bf162a408a9b66ec9cfe65e07fc4e5e9f0aa7cdabe805464937bda2cfc54af651
- SSDEEP 3:q6DZh//lKlvln:q6b/49
- TLSH T1EAF10437F500101DD337C13704740C715530104D00001300007111751C571DC15574F4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/4174
- SHA256 3e5f8daa9394b009f658495b0304a7892e70dda89812c8dc4318a06f686d2459
- MD5 a63412b58a46923fa4b275a6fa90af66
- SHA1 a861e4f9c0e304fc52d8fa40b061f04be1bc8cc4
- SHA512 bc9ef6c20f680441744d225ad195422fc15b53a472a8cb62bb39bda1b6815e4bfb72124ef9c1d7b25d79404ad26655660be02603ef93b2d87c5bd2d522c991e6
- SSDEEP 3:9se6DZh//lKlvln:T6b/49
- TLSH T19AF10477F441101DF33FC13704340C71553010CD0010130000F111351C553541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/5002
- SHA256 5b3570c5655f78397824412766920c1528dfe284e1410241044b08852f3e709b
- MD5 aea7c1a3bcb4ec8af887afdd369c52f5
- SHA1 93086994913d38106f03d4459bc338829cd55a52
- SHA512 d7daaaf8febe08c5daa17a4677fc33296a7b678ceaeec8f74d09ca0b995560de85cca0db8c8fdc37b05ddd60a4cd1edb00510fa8016936ea425dd326b7b2e2be
- SSDEEP 3:wlW6DZh//lKlvln:YW6b/49
- TLSH T1FDF10437FC00101DF337C13515340DF15D30304D0000130000F1113534751411555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/548
- SHA256 77b1091bebde42e22cecfc62783b42af31661421472f434305692638f2ea3151
- MD5 acfc245901cb4bbccea075871cb233c7
- SHA1 2c1c9e652bfe69e97042d19de64f088ab28d2efd
- SHA512 3c12c8ec30996b9f4746ecf11be57260e449231a78c9ad7b1f6549815a47e9ffe3819794e9fd054488497c9a92cd3b3c8b5368590bf12ed0145b7d50ba12eaa0
- SSDEEP 3:lsfW6DZh//lKlvln:afW6b/49
- TLSH T192F1047FF410101DD33FC13544740D715730114D001013001071117514553501555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/549
- SHA256 298936e27c99f4f08c3abbaead3fcea134fc027b1bc797da58d48720dbfffa1c
- MD5 01908efd3cf36cb4e6a69a8470c96cd7
- SHA1 35cbc890d0359f7735a83a5bba2f0949e8337ae6
- SHA512 2ff9772a206a4cd1909e1f2cd708a709b9a1fa74c10a42ce2911ff7a329db3419b6de93956565052ade8c19cbb7374e141dd89d9b1c58b8c9cb252f3ffe18279
- SSDEEP 3:ptW6DZh//lKlvln:DW6b/49
- TLSH T1F5F10477F400171DD337C13504340D715530114D004013030071513D34551445555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/6110
- SHA256 450c055829dd3550b738f29a4ac9b132d5bb746f7cfbdfd1ac9acee9c13d23be
- MD5 0044d19a30de0bc228636a6c0f14e7f5
- SHA1 0240c38c4b71c1621aaa2da8a1f13c309c35fa60
- SHA512 f165138457521f9b7fa35422e8589035af3b0dec1ce2e9fa2d10fcb7c417408c2f75b31a6286ca5d2d17cacd01ffe898b6316a775286a44cd908b1ba8eb93495
- SSDEEP 3:BsfW6DZh//lKlvln:WfW6b/49
- TLSH T12CF10437F400101DD337C1350C3C0D715530144D00001700107111353455140D555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/6111
- SHA256 296732ba95435d7370f6150c08e689683aa25e01e0819d37c5f45e1f76edc0b7
- MD5 db16561c12fbc6660d1d0aa49a0447ef
- SHA1 197da5bfc9e9339f882466f810dae4d20c407ea6
- SHA512 deccd6e7745ad4e3314e7122261952f87b17374e20824a841e576461111b21154a30675d9f69f68b30181f14bfe35b05c7788ae63f3f72fc9d7421089283c467
- SSDEEP 3:RsfW6DZh//lKlvln:mfW6b/49
- TLSH T1D1F10437F400101DD337C13504350D7155F0145D000013005071113534571401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/6112
- SHA256 5d146ee314c533412a27ce0b9bac8ca8d61102354ba4d5cb0e8322ef84ff7e6b
- MD5 1e1485c23320c0d131e41d6604aa3bbf
- SHA1 1764f43a019fa1cf79b4d1bd8662359ad324096c
- SHA512 98a7858bdd5421ec9050906e79a69dc8ad6816c93596b503514f0054a1fb874a5e4c646598189af8336216f4e103c9e0a82499433526cae009b1322690629cfa
- SSDEEP 3:ttW6DZh//lKlvln:fW6b/49
- TLSH T11CF1043FF441141DD337C13D04341D715530104D0000530000713135345F1401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/6113
- SHA256 507b84c4e4ad4d65e93e58acad35c2373cebc91d0222429d6fc3bfafe3ef201d
- MD5 f68b176f635d2c03034ada6515e7513e
- SHA1 90d6969510368498043b0117652f9f602e57fc91
- SHA512 cef5bd1b157272cb94b4379f9ee0f1844ec0b3600fb0d55a8df3313ce9eff015fe295d96f91564e401ac0240bdea93a78e136191df81db1919f0dcce850e93da
- SSDEEP 3:dtW6DZh//lKlvln:vW6b/49
- TLSH T17DF10437F441141DD337C13D04340F715530104D000053000071113514571C01D55470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/6117
- SHA256 5364b74413923a3f51f265e1c031c9b3f7a1921aba3c1af5d169d8a22f3959bd
- MD5 3deff01492485c4e66fda46c11d8f4dd
- SHA1 35364978a3b2b3458a046144333d40ae6d4eb432
- SHA512 89655e2ed94b516df8d8335cc6f19c5f2b558200b1be40427292602932b0b50fe3f6ab3c0858117c8b4cce612be86995914fb370766f173773b8660d442d38a2
- SSDEEP 3:asttW6DZh//lKlvln:akW6b/49
- TLSH T16BF10437F400101DD337C135043D1D715730504D00001301407111351C551401D57470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/827
- SHA256 8fb45d5328547ffb3cbcb92b3ed42b56be2215dc1533f862e5f291b9f9a516fb
- MD5 0bb80e72b5f5907eb9c1603c58a28d4f
- SHA1 8d1832bafda4cd8cc66c0d53dc8f2ac35e14bb43
- SHA512 7bb5bc8dbcd64abd1fa4276adbf0259bb820427876ac68df5f157a756e5066453d232689dbec6f65ff4b84a30926966166d49f5338f580f9b89e495ab0861e3c
- SSDEEP 3:ytW6DZh//lKlvln:+W6b/49
- TLSH T188F10437F400111DF337C13504340D735530104F0000130000F1113534551401755470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/828
- SHA256 7ddbc0c516a7619db15b22c822472dfdc5730c65f88ea7f57f8031ee8cde316f
- MD5 97da2160793858bd82c29db296e59c86
- SHA1 f066b4746c982f9884a6b92bd0f78e94f39848ae
- SHA512 4d3eafd89a313eadd01d8d32d5d436ac2edb763117ff51648b883c2fa1d95723c8f24a6db102caea3ccdc1dbd3b2a72c216c57a8cdee3938e04584f30e738876
- SSDEEP 3:itW6DZh//lKlvln:OW6b/49
- TLSH T121F10437F500111DD337C13504340D715530304F0100130400F11D3534551401775471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/base/14088/PG_VERSION
- SHA256 1a252402972f6057fa53cc172b52b9ffca698e18311facd0f3b06ecaaef79e17
- MD5 aa6ed9e0f26a6eba784aae8267df1951
- SHA1 feee44ad365b6b1ec75c5621a0ad067371102854
- SHA512 01765ddfd925d70d41d53cabdba5f2588e678e534ef5d8840a813bc58d33198039006ce6395c6b95747a2e05d21ff3a47389638ba9405fd11ab1b0857f56426f
- MD5 SHA1 SHA512
apt/postgresql/13/main/base/14088/pg_filenode.map
- SHA256 bd78612b717923886dbf861661f8a8e0dd592f94a2a2ef331a4672130752c1e8
- MD5 30aed6efde53aa050ecc4d371f5cbea8
- SHA1 65f1291616eeae5fc60cb96b90d327a93e6a0680
- SHA512 9bc7d03aaa577492dfcb5442657356de130ae26a61568808e185a853e087585dd190308b39102d75d7c191ea6ba6cdeeb72a87e3a6341651ff2f5bdcc80e7f81
- TLSH T10FF0920C48936330C43E353684E28136155C52A85A280D61BA225070A7C797E88966B7
- MD5 SHA1 SHA512 TLSH
apt/postgresql/13/main/global/1213
- SHA256 88733aef12aeaef6efcdc13d462debbfbe989463f227cda6472898953b7aacd0
- MD5 3a6a7105456084629198f052f061a360
- SHA1 90a2a0f7e9ceac6128bc10adcbb6e41f177053d8
- SHA512 7e128d5c4e19a518152535c51af830cf95ea004f7e0ea85ecff69b2896a39a886d8191dbc48a7f4854cd4217e7111f2350ad1b9b4e6242bad7713f4cad188bc6
- SSDEEP 3:tlhKGOlllclilni7PC1jull/lji4mEg/l/:V+yilniDC4lXjihl/
- TLSH T1BEF11213FB105879C40C013C09933B203361AA0352D82912008531300C87F228F38340
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1213_fsm
- SHA256 2ba0fd8e3a0fd642e314ed33550f6241fa7aa4ddf78564863fd7cb65128865ed
- MD5 eb274b5ad231b8e332690616737529dd
- SHA1 193f49c71b0c58a9a7234d7fbd93acd3f2d446fc
- SHA512 ef1497d86808b36fed7a6e21769fc7d98847104e6897ada487bed492400f2a238f038cbec1875a823f4f82edad975437ffa02ecf9f7b246a8e2cbb03b9ff0d83
- SSDEEP 3:nhNl3VtVl1l1l1l1l1l1l1l1lFhNl3VtVl1l1l1l1l1l1l1l1lFhNl3VtVl1l1ln:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1213_vm
- SHA256 9d75b274539019c113712b7c2097360d68b943d2ecf91206469c3d0012f4bd36
- MD5 f58b8ba926936827d3d0e5fc48382cd8
- SHA1 61bb8f7b0fdd03bf4edf7d23f21fb28493e92569
- SHA512 e4cdc88d2f49506c8afcfd3c59d1a5694e880d049befaa5ec87a065ffcf2884e5d97e91e2c1c5cb5a0d8ec7328c3a13a3c3cf0ca6eb4c4afffd295cd181eceac
- SSDEEP 3:zthNl:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1214
- SHA256 1e95b0cd093d241b3434a89c21e8a9d0bc8ff75734c579ce9d015d69c9704579
- MD5 b936398b2058afc17b730bc2d72eaae0
- SHA1 ee1be87dbc6bacf8dbf015772058e05cbef4bb4f
- SHA512 ef2028ce1deff3958cba0198241fb0f93f453f48b66e3c16ce3badccd5386d7404fdbbccf6783bcf7c5a1dac28dddc25dec7b24f0eb89a48139a20256470ff93
- SSDEEP 3:Rk97fRclwHEIf7Fnl+X1llVXll5lKlludk0d//ll5lUl0ln/ll5ldm0/Pl/ll5lB:C8iHTlvM//lnoUPlbmUL4lVMeWlECYk
- TLSH T180F14EDAF609FF0FC82A0D7018EDF883976E08A5EC082A40848331F338820A02403C3B
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1214_fsm
- SHA256 51e01e110ad6394a405d1cd7d0f18be9e1566302d54d545ff703c30cee71f5b0
- MD5 461ce67a44bad8aa641f0f8ac7f750a3
- SHA1 8839d3ce467b401c60f851183bfd7841ce7c0770
- SHA512 f8ed6ec80bb7a0b2b396d7fd99a12718a78aacc0215418434549c2e95c2fb9f0daf0340855ff2923c7cd143cc92f3112841c5dc65bfc4f955fb698ef765c66ac
- SSDEEP 3:nhNlrtD/JppppppppnhNlrtD/JppppppppnhNlrtD/Jpppppppp:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1214_vm
- SHA256 183ca8ce544ebd1ecd093f655ba446c56f95e1e7e5e000c613a96d9adab95b2b
- MD5 47050aa877c50d46ac41155c0535270c
- SHA1 c2d4c6bcad1aca23e2fd04042babbe7316a1dd8e
- SHA512 eb9bdce21fb1061e6e6e0a829fb1d6e7b243d55b8e08ba36717b5cdcee567ede0825fcab2f58ed33e991d14da9e40acdbb92753bc059396477606219c9702836
- SSDEEP 3:KHhNl:K
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1232
- SHA256 1ee7d64ad57039a049491f2f4c07885a0cb1b46f36c3d8a6428707137faa610a
- MD5 3f28c7a31437c2f95a7ecdfe35ba5c67
- SHA1 7f86dc64c77bd37194312f80c9a2005f7817dc7f
- SHA512 f0e35a853a3d30cc429a9287e41d0f184a820f67cedc604b70e160d35854fefdedb1d802b6fbfeaaed4c0fa8c72293c63e8effcde8fc62eb023c4fd0312a4932
- SSDEEP 3:UklllG6DZh/stlslwlvls16D4/aNa1adaFataVa9alWlqllJSltjllOlsla:Ukg6b/sXEQa160/G+WOme2u7KTa
- TLSH T14772922BDB427DAED32E837B887D4E631770E35C4208977A026133342F512801926C90
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1233
- SHA256 4f97f6e90ab330f01097f3adf7df50cc6b886eb60299634702c4d8225dce3c54
- MD5 873ec95ae48e6e66fae29852922500ff
- SHA1 f4d2f3eefe02ad4b6130f08af13dc0f1a08e3d60
- SHA512 68a316fa573136507bef8056ffee567268febdaf7ef8ea19a9da1240313c6cf81615c4372a566a5c118c548dbfdd8178ca4d3810002a1fc95ad33e4eabed255d
- SSDEEP 3:f6DZh/stlslwlvlFtK6DwH6fle6fw/MlnllltllJhllLttu8l1hl///wlJh/x155:f6b/sXEQvk6cH6Ne6F/lp/ovLjllD7H
- TLSH T1B3721217DA8EE975C62B52734C344ED6ABB360ED1D004F4B0751B2300C771C02D3A448
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1260
- SHA256 d63c44196e431c2f26250331ef780382bc0d4f14a852af42c2bc8bf579675820
- MD5 91ce6b044e5a2de9dff1ad5d28ff1f65
- SHA1 6bbd15effa492bf9bc6fb6a89f655b79b5c92860
- SHA512 bbc838de7e80c03c2b6530b7a756afe59d8e0fda7a2505d2d99d50b12cc2b89d73ac2e891d348c32cf39d2f38c01c4475c018d0468e0f991a23e33f5306c7108
- SSDEEP 12:P7d65OzLsglSvqlM9hNgGlllaM8+v5qoTSbyJ2:DCBXj9nTgz
- TLSH T1C8F15805BB08FC29CC98E4F61823F7C60742B2227C1B8F033555A30EBCAF342990E585
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1260_fsm
- SHA256 311c006fceae50c657aedb0693ad2ffc99ac1410ff176f8da2cad9f430168837
- MD5 06bfda1194f7f55c5a2af0231b272616
- SHA1 28ff58f29e11cbb22ef16207836b1e9e88d935d8
- SHA512 9b25e5bb3ffe52119f533f502490fa4addf1d901d549a7f485b504a16cf903705b809f5b6d83d2f2695145a48fe87f0fd1cf34fd54fb568fc59f36289a81bc78
- SSDEEP 3:nhNlThlltljlDlDlDlDlDlDlDlDl/hNlThlltljlDlDlDlDlDlDlDlDl/hNlThlL:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1260_vm
- SHA256 190510f6c1e68673f8a248dad81fba20c114963430d0461e79e0544b630f93c3
- MD5 f9e5aac6f03023b2560dfc5821c61aac
- SHA1 60de9cf024372d698af1b3c1ed197a7cad256c88
- SHA512 e86d0614c12dd496f898bc415944da94990eed08475e97ad8df9276a286f9eae89738afd414a36fa494e0da9c8b79da1108b7bc5c8a31f8b6abb9cd37801a57d
- SSDEEP 3:gll1hNl:g
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1261
- SHA256 a0bd9360ef376e4505a07d11b743200bf690a3aa0fcf79b8b39aa30a25599dee
- MD5 ac594a5d22d60d7bfd58dcdc4f93ae02
- SHA1 d7d9e1fb69c17dc320bbbf5e9e80ae6783438e8d
- SHA512 5a75c09171d75549254e4e42306d570f3fe52a703e73bd15342e6200ad52f70b55722a49ef1227408bfe38c8de80652a72d125b601b88f43aac49f02e85d95f3
- SSDEEP 3:Y16fTtMZl3HlfFBvtl3slDllu9y2tl3RKZtl:YwCP/kq95xm
- TLSH T11EF1922C826CA002D00003F11D521E207B7050C62D2B0B0E00CF03F02C433500C2504C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1261_fsm
- SHA256 a0551e864782ad52e08fb6d723a01d381d7c16a18009bb83025faba4e8179e53
- MD5 2a3216a10d8aeed6ac8058c1f5f6cabb
- SHA1 6a01bfc3f8c7c15a5624300cbd6047c5dcfa9a4a
- SHA512 ece4efb1d1bc5910c8c967290760a8ee27a1d8dec39a137566c374f946bff14d6a190ba4aa90af6983dceec4f5684d53714ec53242bc8f586c07fe82cede8264
- SSDEEP 24:33a6666666653a6666666653a66666666:3UU
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1261_vm
- SHA256 71c45ed6e52bf981766e3698b4c0c52f10ff6c82e0aeb042b3d11e085315ebb9
- MD5 63aa98e080d9bdd40ec27ddf44d25790
- SHA1 8de089889747b07215922f1f6b04bc3c84cf5a6f
- SHA512 90f12349beb1366685d18af855869c9d38e463f53240d0ec8a8bce35ce17583fa493c0c9936fa03a068e5c8ddf35c1448f8e3b85dfd0d4fe10a0b29ff53b5cc2
- SSDEEP 3:bkllfhNl:Al
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1262
- SHA256 cdd5290cfb5e298ebcdc42308ae9148c9e5f6aee806f2cf31b96a3ad0062e76c
- MD5 2016c2a6a0f8ba060924c8b05ca34952
- SHA1 d35ee7211443236f99435ccc01c3976f6ba4ff5e
- SHA512 ad8ac4270c92d83929624718f143f4636eaccf27e6fa5334a17659acba94a7377a9a6608c99755ff14221f4d426a199de7a910af2ba7fa4f1c11a42e347de733
- SSDEEP 12:K4FkC6RBhvLg5g6Rz8aEvL7LY6RI9ocO6RgEGC6RBhvLg5g6Rz8aEvL:K4FkCKE5gK4aHKIMKgBCKE5gK4a
- TLSH T16AF1BB11AE564E90C4A5C8BE48D3D3497BF8D0A94DC6970B1EC5AB3C1DD31539F0A786
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/1262_fsm
- SHA256 afcae4638268060d2c1773a6742e0407352d211a7d7a16273dac23e490cd8ce6
- MD5 9a343d058dfb158cb760d4051abbc45d
- SHA1 059ee0025c220b3ef4734d3a8d78cd27aad31e5d
- SHA512 c1815a865a4cbfe95ad0da0b59a87131d5dc76fab35b75197d42c2a6be3a12aca65538e4c5ec148ab86f236ab51f82ed966980a10a3f4bbeb43f02d9acf6817a
- SSDEEP 3:nhNlU8/U/0/0/0/0/0/0/0/0//hNlU8/U/0/0/0/0/0/0/0/0//hNl1OU8/U/0/U:jO
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/1262_vm
- SHA256 3d0a2c84d4a0dabfbf4522d629b723d6bfb3c121fa4dc7f67076550990c1b034
- MD5 7ad21010e1fee3aff3ab9d5d84f53c87
- SHA1 a88e3f1fed817d30753c72733521f6b9923e32a6
- SHA512 3a4472ffa5d363720707239e7dd0c0bc6e52093dcda7c43bdd9689d566d077790f1e20c3e9ea38791f3cc85d5feed88fa37be98ea36a351fcb2322875cd8e3f0
- SSDEEP 3:/lt91hNl:tt9
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/2396
- SHA256 9bc971d141c74d28f20d4943d9888af1f8d169e639e0c69d48da151d8e2d9387
- MD5 78ed7c25445da1038c3fad10dbb05d75
- SHA1 83201b912f2c60d7c64ca7012141a476e8df189d
- SHA512 67f936850e4f57fdb832f3a5d18c79c6914bc573674fd628f63d0a98b75ea279cc7733ed4e0c783baacd6010af2ddc01c1ddd8e6b1d0ae7297c756a0f5c4c6ec
- SSDEEP 3:e/JaR4DlXlodiDpEg+zbRxveB0EktEslP3PlOAFtVFuE8tlFs9lMLh/j9frKmOG0:OJ0gDqhbHskTlvpVFL8XW9lMVrZSGxin
- TLSH T1F9F122803B309E61C20B6EB010521B00CB74F2192110BB320AE9C30E0C263B03B3F6E4
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2396_fsm
- SHA256 849969194bf9c772294a80d27b05489e88d5378e69f7604c2dcdb9bd2a8bf789
- MD5 0b3913d4973b2e822bba7bd35cb00246
- SHA1 0c85954b264607567df0f1cb8d72bdb0d27d5494
- SHA512 fcb43f2a65accc1f8dc04fe3269cedc1b2e3ea17bcc06ffd197a8195b508f06ca0ea0b592b4f59e6ad9fbc4f9bf1b9fc6f2a9db663056cd99d36425918c4642c
- SSDEEP 3:nhNlVDtbXzTTTTTTTTNhNlVDtbXzTTTTTTTTNhNlVDtbXzTTTTTTTT:
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/2396_vm
- SHA256 301003677747266fb11c43f82b4ac0803444799b20827ff8f547213ad609d78d
- MD5 9ca5ad36c32cb102319fba2132c3afa0
- SHA1 1dfd851e02cf34f705c2c1e7997c2e5d0e48ae08
- SHA512 4e1d9f4130f2cb5cfcd21b4c9b92c6b26413b1256fbec4699d40c1fe7febe959e987c1058e148ced8ee2430a02156c0fc7a8ef4d372015bc108fb052a04d8e2d
- SSDEEP 3:Dlt3hNl:5t
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/global/2397
- SHA256 ed5e51a74e00c0e4f354fda662b0e82efd9c0d99f20e4adaeb307b80a5bbc51d
- MD5 82efbd70caad190dc696275fa9f54f7c
- SHA1 9b92894c1d998c1c4708b0e6932465cc2f98277b
- SHA512 4f737c979fb847c3fe70d6d0262ce89e57c815cd2aa782bacff1ee48024d332a1f1c48b4d329fb56ca7e47233e763b8f75c9b517ba89c4bb93992f199353a532
- SSDEEP 3:w6DZh/stlslwlvlj/lBG6Dw3lllFtvlic1/XC:w6b/sXEQV/lBG6c3/OKK
- TLSH T149729227EA802C65E23AC2320C201E905B35B15701206B16015219756CAF7A01D3F0E0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2671
- SHA256 3c2672c949adb64f667ad9f802cc2868834d4ab652602a99f5584578cdca6ef7
- MD5 a98dfa3821fc18ded50fc152a3723e21
- SHA1 11ee0b8a58b522092a99dad9d6e25e590645c9b1
- SHA512 dd750f075961c2ed5619399b99430135829db942e38a678d2f645f261607f2827c5b787611ee0597062958abf6d0aa44982001f9120be95da0e88744f340189e
- SSDEEP 3:zg6DZh/stlslwlvlsElbu6DI/a9alCkQW1lPlmIxotxc/K:zg6b/sXEQOElbu6k/2uju2/K
- TLSH T1B1729B26DAA5A555C3B7877984601D52967C915C0601537308F2172D0F557C10DAFC20
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2672
- SHA256 df03d8b36786bb25a98e1599c3edb06ff1b60a30ecf50c0d0d64901e19f2d557
- MD5 14d3e3bb791d03f6d52592f55da9ed32
- SHA1 3046521d6dd0e3f699067162aa3385f76a3dc20b
- SHA512 e39b0d66166dfa556dddf399df62e647205e92c1793267870351e9582fcc593570611685f8c01d94c3ad66c5fac196ed8eb0b894664b7cb298cf83f330f54dfd
- SSDEEP 3:Nkg6DZh/stlslwlvl/zG6Dw3lllFXfli2lvK:2g6b/sXEQxzG6c3/829K
- TLSH T1C1721227EA802C79D23AC3322C200FA05B31F01501206B3303F111300CAB3C00D371F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2676
- SHA256 068519014eaa5af76f75f1f4543d53400c3b66dfc74188e46de9d479c7034ddc
- MD5 d674bbe9fa8c41ed0eb3783f89916c4f
- SHA1 aae42a4d62c545c9d54289ee016c603f0a511d0b
- SHA512 91d961e32b7411502639fc7fe9d575c80389d86477adcaf697174587a8f6f802972382cc021f5d827b080f7b442c5b4f618a8f6a72f240372d8b944c84ae00c9
- SSDEEP 12:iDEXEQMb6YdRBrl0gGlll9CqlOiFmF5RI:2LmCMFmFPI
- TLSH T1A1727D5ADE4C2D1EC612B67414371F6103B04009BC1EC73295F5C2130C4B48711C4553
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2677
- SHA256 e55771225e65a55cb7b255d7ce89214a195df4d879c33aed855cbfc7c7154785
- MD5 78d6f96f4a5137ad2ac2a91972f2a7f5
- SHA1 2f8a336e36c2a87bfd5ed8e5aa4696e9f7dd461d
- SHA512 35a586fabe1efad339bc68c07d2e37162f6c035cc394a133f551bf56039ff412d43f5c3b6ba4a03e1daf891403e5b8d4fc90514cccefb9fef370f97c13791307
- SSDEEP 6:96b/sXEQX6cH6N6Hte/sW7l/jUol//pXI4t3:gEXEQbH6N6Hteka/1lz3
- TLSH T17C728C5FDF83EA79C23A82768C390EE61FB3B0DE0D04AF012261D0300C682921E3A848
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2694
- SHA256 11f9237e994edeaf1aaaea6479b91006cba2f6ad3ca81dd114f9d80a3a527a44
- MD5 54aa0722e8e9b7cc997d30ab29377761
- SHA1 5ec79516eb223c53eef41c8f193a7c9bfc0993b9
- SHA512 0e1f83ca83b5a65489d9e68ebb07b7d47878019e40cce4f43c6407e17d0fa7cc6e9bde041241efe627e4d2a0ebe6cb4db7bdb0eac8e147cbfbb67606475d8845
- SSDEEP 3:0W6DZh/stlslwlvlJEJG6Dw3llll4tXlKo/lEoa:0W6b/sXEQEG6c3/EAolRa
- TLSH T1CB72923ADA487839C22683B20C302EE05AB1A0DF2C006F12215212740CA52904EB642F
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2695
- SHA256 089582f793fb63a93a02fd3582e1d1c5a408f6089d9fcd4752eaf9dae8d41f4c
- MD5 9e0c60d6574172ae8946ae93da83ccaa
- SHA1 3ad3f0b290242286e397b3e0284efdc529265ce8
- SHA512 44b2c70df8f910956e8d698925cf40848b2cfcc88ad33dfb15d2453290a2f6b2e4e97e61b720cecfc6652522aec6d3972b06b9d89e1d223548184a7582763449
- SSDEEP 3:N/tW6DZh/stlslwlvlNG6Dw3lll0H/tVlIol9l/0O/y:HW6b/sXEQvG6c3/qH/tw49t0z
- TLSH T1CF729226DE5968BAD22683B34C342EA09BB1B0ED0C04AF12216241B00CB63A04D6AC1C
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2697
- SHA256 16305fbfcd00f5482e2c4663fb880d216bdc57804e2fefbefdffce7ec529c740
- MD5 cb2250db4c73c2bb2bdaa9139446790c
- SHA1 78a572e8c04e90bf63f0c39530e55f901ca09355
- SHA512 cb768394cffd40c6356079d435a968e85e4b189c1f1eff714cd56672671c5da1a9a0f6659e410efea71fcdf60ceb00ab76c6078ba6fcd79053de9df0554ee9ec
- SSDEEP 3:8fW6DZh/stlslwlvl6ENv68ltwN/lljv3lly:8fW6b/sXEQcMixRK
- TLSH T1D7721237DB003425C2268333043F0FD49B71A04A00100B1A022160284C723C00EA3110
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2698
- SHA256 109f980a517b37f024fdd620c99f3f0e2d2a7447112081352c902ea2ecaf3f7b
- MD5 13abc58e2adabc62652b1fcc1121cad6
- SHA1 80f5fda852aa623c0c312fdf85c748f27868ed3c
- SHA512 f243e2d3dc0df96af9d4bec8bf0414913cd1653ac6887d407c0d244e2d2e1e1a70e7e2687e930125e0fe43d1d8ac6ab2abbe7398c296ddadd633566d96ffc1e9
- SSDEEP 3:9W6DZh/stlslwlvlFs3/684/alal1lonKkjsoYg/lM:9W6b/sXEQs3yx/uuQjlM
- TLSH T17272922AE341A4C9EA2AA23988680F531230A44E8214B76209A51024082AA404DF6B11
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2847
- SHA256 8d15810d2615a493e6d9d7d41fdff769c56f97a242e2a366e8251a94aef9742d
- MD5 7891ba38d3a0e31026226ed9726ce4d2
- SHA1 6988e0c898e7aa7e941dc2baa2c5c661f7e32cf6
- SHA512 c697aead2b283101ddc0df53c2e8babb039ede138fdde079b6b87586a5983f1b79f4a5254e6007f56520ecdc0018c2401e14b7dcff7e07d5fc6a2efa0a5e6065
- SSDEEP 3:0se6DZh//lKlvln:0se6b/49
- TLSH T11EF10437F415101DD337C33704340CF1D530504D000413000171113D1D5515415D5471
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2965
- SHA256 9490ed53afcf757d86ecef4175c1bbdb28d8b695ba9295764b0b516e508ebd0b
- MD5 38f5931d70c8d44f509139bb7d10da46
- SHA1 04203ace4876d91020e16d9568db2f61c232548b
- SHA512 f2c9ba9e4850516b8b24e30ccf5701312356e55702bcf3c2bfb7d1632c2dc93c7dcc844d4cca469be066c9c23276bbbfc3fc6145a9ed8f815e3a034334e4b015
- SSDEEP 3:fW6DZh//lKlvln:fW6b/49
- TLSH T1F5F10437FC04301FD33FC13504740D715530104D000033000475113514571401755D70
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/2967
- SHA256 6feec0030ee22a4e0a9b8d6936fa44099b29df1d6e7ee7c2ce5a2cc8d09f9a13
- MD5 ab1857afe83ba48947590e39b793e91d
- SHA1 3e9ec06ae28149201ea22f81ab13e7ccec21ebd4
- SHA512 291e457e0970ec5bfcf24c9c9b2231ddd94bdd1fd8e5f2636b7faaed2720cfd20fd7911cbabb9fc1682a9348045fe2a80f8d5be7f319f5635cb449e17d9cce3c
- SSDEEP 3:N6DZh//lKlvln:N6b/49
- TLSH T10CF10437F400141DD337C337053C1C715530504D00101300007111351D553741575470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/3593
- SHA256 09da07546411792ef525488ca342d22ae5618fffeeedc7f4c92cc08aa4ff379d
- MD5 22cb5610ce611d0c8773ec828089eb93
- SHA1 e987d10fafa6d02e47d2f7a71433918facec5e5b
- SHA512 42b2947845dd162792ae4cfa359dbb50ca31760e8f443ff05b0da7dc4d443e9b4bf9ecf9f101ee1d28a08def9f49a2b20699c8c4a7b34aab262c76f2c3714984
- SSDEEP 3:nsfW6DZh//lKlvln:sfW6b/49
- TLSH T10DF1047FFC01101DF337C13504340D71753011CD0010130100F1313D34551401555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4061
- SHA256 49d784ff09275e6d7e7582e1dd58b0e383aa7a94819a65cc64136a1f27390b87
- MD5 14fc6cd3933802a92eea30907822a138
- SHA1 6c7cde81f41b7f4d50abd0ce6c24d461ef4f5b6e
- SHA512 83a0f41cfd38a71a9de8cb29377c8afbde4d815de5258fd9856713aa0a15993bf828ab78fc9338ebff603b4fd4b8e3d575d34e8ce77915849c49c302c6df56d7
- SSDEEP 3:Ese6DZh//lKlvln:Ese6b/49
- TLSH T158F10437F400101DD337C73744340C715530504D00001300017111751F5535415754F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4176
- SHA256 09049e20af9d024f639a34f4961f9967330d8b234d814fcbbc22acc05b54dfe9
- MD5 17974a33f4d7c296fcbcd53196642982
- SHA1 0b8d206f6c96f969778e40d6662b773cfe109397
- SHA512 2acb09db5fb904747c5a9171faa55b6cec2d00b5c335ead4f4f7e6c3676c907d6a98b002e0fdd4816c4a23b42bb6fb21982589abdb6a4091d1866bbbbc17b1de
- SSDEEP 3:Nse6DZh//lKlvln:D6b/49
- TLSH T177F10437F440101DD33FC1770CF40C715530104D00101300007111351C553541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4178
- SHA256 07bca060622b6264e4364d4e11cd99dc86e2a3198c73f32322bdcdd913fd95c7
- MD5 636c19f17d2c71a3f793886c6be81973
- SHA1 dce53e348a3bc22f76a7554f2f30ab98d94f243f
- SHA512 f3d04f062963b9376cb5b643d3432c93b51ea757b1f9d8c41c960acfc67555c6ca3c1ba21ddab05c717da2bfc49aaa5b3439b6a21306e4e7aabcf6ce18ff6db0
- SSDEEP 3:U6DZh//lKlvln:U6b/49
- TLSH T18CF10437FC40103DD337C13704340C755534104D00001300047111751C571541555474
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4182
- SHA256 d98e40ed0fd53d0b1eda8ff90cb32741b9ba731edf0e6ac980845b0dc2211a72
- MD5 1dd104e5674b7e4333f1eb942d81f730
- SHA1 bd4de80614244bf4d13d11512f983a7d1a466a7b
- SHA512 32e2a77d68f64b3b3d198117946a7b7270f0041c71baf00b1e6ef67188b72fb2e27c71803bb1887567d99f7ff152df0452715236a4c44b85ca2846a606d48cf8
- SSDEEP 3:96DZh//lKlvln:96b/49
- TLSH T170F10437F400153DD337C13F04350C715530504F00401300007511351C55354157D470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4184
- SHA256 0bea6ebe730ea065f6c314e757e8b7d5cde20a8689a9f2e3862455731d6257b4
- MD5 54cad163c904e17b83d241ce7a969017
- SHA1 6fe8c5266120837700fea8862cb6244a22039cf2
- SHA512 c56db79d5f2f0cd30e095c1a591ba2debbd8f957b79c7579a470288692194480229b64088cb902c4a7563f3d58e45686cb73a6bb071d10651d162cbe8a6f884a
- SSDEEP 3:Kw6DZh//lKlvln:Kw6b/49
- TLSH T107F10437F404301DD337C73704341C715535104D44001340047111351D551541555470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/4186
- SHA256 fd89feaffeec955df7f4b7cb9472bd1103279ce97ba45c0fd26c585b54148ed4
- MD5 d6a34ff42c2660eb5bfe39ebd67811cb
- SHA1 950dc1156d72e5a872da29ca8019b902ad9c2a02
- SHA512 a84ff86640a0e7ae85b47f66e37aaa458f4a15c3cde409f776439dd0733f0936348742b657b208fc0d40dca62914d086d2d1c23c15db8a328b5ebe581a98a01d
- SSDEEP 3:6w6DZh//lKlvln:6w6b/49
- TLSH T1BCF10437F404111DD377C17704340C71D531104F04001303047151351C5515415D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/6001
- SHA256 056af904238f008646015321f2a9a98ba336d05436e73eabbab8e0cab0ab7f47
- MD5 ae15c25ced218b01bc948b58b76083fc
- SHA1 fc27f7887862e2e715736783cbab433d56028bc3
- SHA512 0f92fe5f6b6d2764d604ed3aef9c1ba4856cc3f60ed87c151134a4090a436fee37e710653ccd323b3104fbc9ea4f68a8164f6aa48908917f60ebd6e604897e1f
- SSDEEP 3:YW6DZh//lKlvln:YW6b/49
- TLSH T137F10437F400101DD337D13544340D717530104D000413000171713714D514015554F0
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/6002
- SHA256 e5ac00e014cddd3a6d56bdf3ab2f96a6f7dce0e34f04cf8b508391d92c2ce2cd
- MD5 efae44265daf270d33c0575a4264a165
- SHA1 ad18a4cb726e6fa5cf05ac8aeab2d901e307b343
- SHA512 03e4917a479cdbc176c6fc820b5c3a2344e1bd276d1d409e68253f7a8f6fb0c388428cf98dd75e79319836f2404ff4eb7c03505437670578183c0a78cba23420
- SSDEEP 3:pW6DZh//lKlvln:pW6b/49
- TLSH T17FF10477FC00541DD337C13504350DF15530144D000053001071133514551C01575570
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/6114
- SHA256 18681c8d4c7791f796dc4b0a009464241e168074278c471213eadce9f1316844
- MD5 6aec87a2dc46e4c7b54bfc5d9ef2fab6
- SHA1 77acbdd040de404fd3250beecff156c3624516b8
- SHA512 09395f781f994cbea4ce0efc29aba01285f385d1787cad6e051cdbc2b6b478d3617303be92312fd95ffa75b08c4878e09fa87cd8ba0dccdd83b315aaef0c3a0f
- SSDEEP 3:ktW6DZh//lKlvln:kW6b/49
- TLSH T17DF10437F500101FD337C13704340D735531114D0100534100711135545534415D5470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/6115
- SHA256 0047efd53450a7f5775c5ee05851a6b8ed7a45aa2cc2bac55bf684c4699fb175
- MD5 9bcf3c866f2306bf3e26c17387cded34
- SHA1 8ffe814afb0f92a02ec89a018d21474572e222a4
- SHA512 a4bd74d269dfae94fb4e84a866ab424d896d8123a1caf0f10d8006098fcf212840054a4fc48481037fccc95fcac37710bff8643abc0ba2ec87011f0acf093c71
- SSDEEP 3:KsttW6DZh//lKlvln:KkW6b/49
- TLSH T100F10437FC00101DD337C13D04340D715730505D00001301047111351CD51401F55470
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/pg_control
- SHA256 61f9c12e75d1d06e22b39e07674f97124f3cc9a1a5a6ab644e3db98492d6afa6
- MD5 9cf5bf842d5820a4614b7d0e87fc2f19
- SHA1 adf05dca5e74c8f00de49dc3dabaa1310fecedb7
- SHA512 4ad15af60d5d9249e8498de32b9114831d2e39ee65cb6b07fc8bb6023b35949850765c81c81b5b7bde1707315d46c7e422fffcc5bca41d614a366fb335619b94
- SSDEEP 6:+Cpk18r/l1t/llW1Bt2tB+W188/KPf/Ci+t/ZkHyQw/:K18ZZcBg788SfiZkSQ
- TLSH T100F18C227B450A80E220233384960F44C363E2304079A70BA6A0406A0ECB7A10D87ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/global/pg_filenode.map
- SHA256 5b8b0b17f71e6d8f59d6bcb99d6059649227f0a393ffb6e7e5ec3392bc7f315d
- MD5 8208b6c1fef5dbcbcf5bd80c801196f9
- SHA1 7a20775609a2e44ce384b5ea8a9881347df2a6f8
- SHA512 f56f6b03cedc729c138eec5776f327602226319328f750fbd092dfaea1a85ccb86aaebdc15b2d4c5d36bbbbbfa87a1eb4faac0af51ffc4eacae83b69d5ce8dc2
- TLSH T138F01213788BC58AE0BCB534A3C54412695F38990450ED026FBCB4D8371B0356CD93A1
- MD5 SHA1 SHA512 TLSH
apt/postgresql/13/main/pg_logical/replorigin_checkpoint
- SHA256 957feab4ef91b10e52e5acbd739c8adf6d15c25e8f445ec5eab9ef1e9fc26859
- MD5 93411360797ed1ec30887214f88109ec
- SHA1 347fc8f2df71bd4436e38bd1516ccd7ea0d46532
- SHA512 9b8e8da60f712008764c2e6cbcc6fea1298cefc417c0fc6a8e1eec02bb13893b1ffa7eb2cdfacaa7800de2baeeee6a75f218bbde5c9c657cf054a1df51fd6640
- MD5 SHA1 SHA512
apt/postgresql/13/main/pg_multixact/members/0000
- SHA256 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47
- MD5 0829f71740aab1ab98b33eae21dee122
- SHA1 0631457264ff7f8d5fb1edc2c0211992a67c73e6
- SHA512 18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/pg_multixact/offsets/0000
- SHA256 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47
- MD5 0829f71740aab1ab98b33eae21dee122
- SHA1 0631457264ff7f8d5fb1edc2c0211992a67c73e6
- SHA512 18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/pg_subtrans/0000
- SHA256 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47
- MD5 0829f71740aab1ab98b33eae21dee122
- SHA1 0631457264ff7f8d5fb1edc2c0211992a67c73e6
- SHA512 18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/pg_wal/000000010000000000000001
- SHA256 7e21c53ad99d2b4f421090ca1fe68ec78bc3c30d8004177ee3583a161f46ed4b
- MD5 5a56cbb6ba25e5b11d9cffbe00738fb8
- SHA1 6593cda47f95f19557048e54734279146bc11c99
- SHA512 5888f52ed85b4e532ce22a147eab6423a0c92071710f6e78de6f2e6ec3c56a1ec3026023cff87cb9729bb1e011a8759dabe2ddfac5482259349c22e441f8fb4e
- SSDEEP 49152:ELfClXlO+j4410YhgOnX5wEDtCLpZkZz2+DA4o86ltt:EWlXlOc4W0YhgOnXZtCLpZkZz26nUt
- TLSH T18FF6824BAF08BB26C87D5936949F83523337E955FB024F025B94E1782E833771EB6819
- MD5 SHA1 SHA512 SSDEEP TLSH
apt/postgresql/13/main/pg_xact/0000
- SHA256 8ad37f59409d53d3b16a76274eb930bb69f411b1a7bd99fea68f2e0294cc9ffe
- MD5 6d3ce1ff82b9601c859f55644553a9f5
- SHA1 4d75a4ba563df79ff877a83f77cbf240e6492587
- SHA512 8f1c1de622a7d81b9acf6a1f8ac144da5539273caed81917128277355b89fd9baf5a1de7aa1a35b41a4583b65150a3bd21cb63f2fc02c5fb8a7d05aba5f800a1
- SSDEEP 3:EK6/:i
- MD5 SHA1 SHA512 SSDEEP
apt/postgresql/13/main/postgresql.auto.conf
- SHA256 0874e665ecf5c0a6135a73158ea1b71a959dafb809574810da5c9cc28c0c63ed
- MD5 a6083d6b0e13d27479a12386750ccd05
- SHA1 c6b93d1c2880daea891c8879c86d167c6678facf
- SHA512 424e1812e1bd2d31becd237f9376b5ca7614d2ce8a03bda40568dc5475f08043c9f06400b6634b12ecfb4fec4e68e3c532043cbff6317cdccc82e3eefa59d7c0
- TLSH T13EB012DE75C40920580013405F074AE50240D03840385307202D3C012158671058089E
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/KeyFile/1033/sqlsysclrtypes_keyfile.dll
- IMPHASH dd949f9c2ea8d8f2d9dbd7c28c3ed8dd
- SHA256 c51a51d4e3734765d1352dbf09511e49a2773b3d6bd9a704ee664fb8e3059e42
- MD5 166a4eb063fbff4d85b7647b9b3819b0
- SHA1 1738ea07615836656f9d5579e1de65a1a9fa6ca4
- SHA512 d178a00dd133698bc04c9d641c4c77cd6547c05e2fb4b81d9b86db53b12ee49def2496360eee2d8b84c7461adc1db8cc0f1632d6bd8938957fb34880e8df992f
- SSDEEP 192:eezaYKTBCxaMQk3X7rrqYPWhRmWQRFGQKPnEtObMacxc8hjeyveC3cgYBv:euKT4wMdrrxPWhgWQKLXci2jpvqBv
- TLSH T13A523A868F7DC10AFD970EB0A3F4D9D33E7CA7C31B52A09F5651E64408A67D08178A79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
6
Entry point
5333
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
KeyFile.pdb
msvcr80
_onexit
_lock
_crt_debugger_hook
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_except_handler4_common
_encode_pointer
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=3, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
binfmts/Shared/KeyFile/1049/sqlsysclrtypes_keyfile.dll
- IMPHASH dd949f9c2ea8d8f2d9dbd7c28c3ed8dd
- SHA256 c51a51d4e3734765d1352dbf09511e49a2773b3d6bd9a704ee664fb8e3059e42
- MD5 166a4eb063fbff4d85b7647b9b3819b0
- SHA1 1738ea07615836656f9d5579e1de65a1a9fa6ca4
- SHA512 d178a00dd133698bc04c9d641c4c77cd6547c05e2fb4b81d9b86db53b12ee49def2496360eee2d8b84c7461adc1db8cc0f1632d6bd8938957fb34880e8df992f
- SSDEEP 192:eezaYKTBCxaMQk3X7rrqYPWhRmWQRFGQKPnEtObMacxc8hjeyveC3cgYBv:euKT4wMdrrxPWhgWQKLXci2jpvqBv
- TLSH T13A523A868F7DC10AFD970EB0A3F4D9D33E7CA7C31B52A09F5651E64408A67D08178A79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
24:0d:f8:e2:37:3b:15:c9:8e:61:45:06:5e:4b:6a:70:6a:a6:b3:6a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
6
Entry point
5333
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
KeyFile.pdb
msvcr80
_onexit
_lock
_crt_debugger_hook
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_except_handler4_common
_encode_pointer
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=3, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
binfmts/Shared/Linux/README
- SHA256 daa05ff1ba66a5000b7dbb1519534d65f3851ea1fc1d16bef5b5159fac6b9eb3
- MD5 9eab59b84a740910a0b342f1bb998eb8
- SHA1 7b2e8f7225f0422be4467639d4e9a0e3f40b80b5
- SHA512 e97e86cacf25091191d7d3b676bb9d5c824a192b3818cc17a68166e759df49cfce8fb0687ab7ecd1d12f753b317b1caf7f5d6542a940402510f725afce98e3d9
- SSDEEP 96:DXkyNBRWAPJczKqH+FmomQvnmjbSuDTRbR2YEwhX6Pme9WMH:DXkU2zKw8m/QmjOuDtbRN6PbH
- TLSH T1C4B1351BD989D767238200B37B4E94A9D73F51091324A86A74DCC1687B06B2CD3B76F1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/centos_x64/nph-keygen_get
- SHA256 43c321312b133a133b3ea44502e9e5216590d38161b2b53e715df38d9419cb56
- MD5 09c5369bd70b4e0ddc05f90cd08c8352
- SHA1 9a1356bc49cfbbb5a871f72be657d82dc6947b3f
- SHA512 137ec621ce06ee7b5c8bc85f16316fc613233fab2c0711912cc88689f2325cbafdbe813fe2354e0449c0e33891ae956c0ae7fa7c821a947a1c68f9bf5370f4e0
- SSDEEP 12288:mVQnKfXMvmMqkJAbDB1fMSkNApjNOmL97QWegQY7sotSQ6cs:mffXtMqkJAbESkNApjZLhQW6ot
- TLSH T146054B4BB7B664BDC1A7C474879BD6B3FD30B8644232393A3685D9312E25E201F2DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/centos_x64/nph-keygen_post
- SHA256 124249d176b6b6f6f5427d00f15cb9d6a519a27961ca7dcf3aae8a8033c3e695
- MD5 48423e75aa4d339e41af9237130a52f3
- SHA1 e764cb90d8c715c83fa57e2a17c08e75ca5b885d
- SHA512 48604604ff07617791d90212028b5cf38e938d129be8ba107ab5b179756641c1954332350a825950daaae5195521a8e521a268c8a4c33d2e1b4db4a813297127
- SSDEEP 12288:9CQGyfXMvmMqkJAbDB1fMSkNApjNOmL97QWegQQ78otSQ6cs:91fXtMqkJAbESkNApjZLhQWCot
- TLSH T129054B4BB7B664BDC1A7C474879BD6B3FD30B8644232393A3685D9312E25E201F2DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/centos_x86/nph-keygen_get
- SHA256 2011c66859da541c89475681a9758f8a65c5c3ee94e56e6f596b4bbbbe860689
- MD5 a7235d625bb05ea26bb3f153d6159c00
- SHA1 eec378c6207d77e32582f52d5910e535f6b30830
- SHA512 45d517387c930fe7ee62a4759198339309409408402ca1cb84e268f629168496c58de6248c78d8154806c9012a7e365bfbb4bebd126fa122a18aa78fe813ccb1
- SSDEEP 24576:CfA1t66FX75/MP3mq5YZv59bI7a6oclLLu:CI1t66FX75/MP3m8UT0+6ocF
- TLSH T17C153B0DFA03C0F1D2635371864BE2FFDA54671A8013ABEAEF4E1D55FA775026E0A192
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/centos_x86/nph-keygen_post
- SHA256 30a86b7a01fbf4c8852b379f87fac403cfaa146d5c1f98ac096e2aa1acaeb50f
- MD5 e810e3f26c58fb5cd2af60279ffc91c4
- SHA1 48dfa65bc9b75020f0331f96f028e0ea36b59edc
- SHA512 8d04fb9194ec1bf8dd5d97e17d20ec3a3436c7ddaf681505a1d43b668bbc4557f99b83dc87fdf48059f6bae168a32f2f7bd06e6be9d5ea8d807a135406f3e953
- SSDEEP 24576:Zbc1t66FX75/MP3mq5YZv59bI7a6oclHLu:Zg1t66FX75/MP3m8UT0+6ocZ
- TLSH T159153B0DFA03C0F1D2635371864BE2FFDA54671A8013ABEAEF4E1D55FA775026E0A192
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/debian_x64/nph-keygen_get
- SHA256 72f7aa52fcdff3a24230d470e2560b0de5775fcb64e49889735ec01e211e233c
- MD5 75975d83bbcb491b34d5d16810a89caf
- SHA1 3373527579d56eada1d366baac15ef93516ce505
- SHA512 13933744f56dcdb5b15400155b897eed567648be46c2123a7c84e15b52697d20b33eff505c060dc279f22c1335db28e95b1b06886dac822c7225e2957729e06d
- SSDEEP 12288:T9Np5Oxxgokqq+kyKJmemHe+XMylsDnSTJKzs0oc/7m:T3sxgo1NdKJJmHe+hlsAKzs0oc
- TLSH T1C4055C07FA6610BDC08ED534868F9537E660F46952353A3F3A85DF712F26E205B2EB81
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/debian_x64/nph-keygen_post
- SHA256 4ac4e9ede458044bfd002fc75bb92c93a9a77a708f3c65b593b752ae66d05bc5
- MD5 9b250dde9fb2f22a4514aa340be53cc6
- SHA1 8952eeb151f933365a64e101e388f4d665a0f3ec
- SHA512 338d41fe6a12a7c357c15ba0e888a3905d9af6099dab4c6efd97c117c3ae3d94f400d2dd7b40e9f634f949cac8715718671c9dc30e7aa79fb99bda94ca78942c
- SSDEEP 12288:W9NQ5Oxxgokqq+kyKJmemHe+XMylsDnSTeKzs0oc/7k:Wasxgo1NdKJJmHe+hls/Kzs0oc
- TLSH T1CC055C07FA6610BDC08ED534868F9537E660F46952353A3F3A85DF712F26E205B2EB81
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/debian_x86/nph-keygen_get
- SHA256 eeb98260ec79a4a7ce2ac5dbe94c8a970c391743d0e85932909acbf9556f536c
- MD5 a2ccf94149bac45728360bdc5b22fbcc
- SHA1 9fe91a9fe3b1eba6ac27ca0342f2b268e233cae5
- SHA512 ae293f70d6b67403560a33fcc86c7697b62934ae6c77baf63d4487a7fcca21fc4d89cbbe248c8c129384d901bdbc28ce2c2c7202436c53bf4a1147228de61ca0
- SSDEEP 24576:Lm8dVXpyxJM5sFLusU/e+tQXbSUbSwxcftAektTqu8FHwY8bYPv:Lm6VM9Lu2qty8FHwY8bYP
- TLSH T10B457C19F783D8F1F6A351F1034AE6F66914222A4153E1F3BF8AAFE574B3112AF06125
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/bin/debian_x86/nph-keygen_post
- SHA256 60c53bb1a59e31720cfa5a9569b77d0e53039fbe10d4c35b6aac8a98e479b48f
- MD5 40e19b0e7969e64a37dd51046f8cf9c4
- SHA1 d3d23fe4c49a423f10f448fc1aaf0818b1f41277
- SHA512 8716d7a8479d029949ef03f2b62c33adf52429d8e751345094e7bc6579a780fa18682c071465a241254a63ef56a4302c52550e94370611d6d726f03344b1a3d8
- SSDEEP 24576:3V8dVXpyxJM5sFLusU/e+tQXbSUbSwxcftAektTqu8FHwY8bYPv:3V6VM9Lu2qty8FHwY8bYP
- TLSH T16B457C19F783D8F1F6A351F1034AE6F66914222A4153E1F3BF8AAFE574B3112AF06125
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/keygen_short.php
- SHA256 7cccf62f01d9c504ce7d12a758550545739ad2bd80b86f4a7b7e53dda33861e9
- MD5 5feca331e7d22b8a30e84e1d08c5f061
- SHA1 7a959adb5f2a51cb1e1d5b0963692c75343d0d04
- SHA512 df73e8e00da11506430857b0e00c16e52c4d3c95bc20d4fc107d31870e90aa72e114fe18b01713df6ecb30f3c6a063bc85857a4c2c90f1eefa5579e03e815838
- TLSH T10A41C8D86E42D12777322918BFAB1C4DE76A92574218E450BC5C01E82FF2014FAE4EEA
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/Linux/keygen_short_test.html
- SHA256 08451e1f3cb00edd9b49cd0e41eab9c957be3b5839686bb40a8d15f5e252ea28
- MD5 0fd586bd54aec120d9b7966e1b646c37
- SHA1 d466c135e526a967210440f18b41228aade87a1e
- SHA512 a70f5321eb0c0eb26926d6b270e0ac43bf16b2c121df6cb4591a3a3af795dc63361b8b7af85690fb54115202b308ceb67731dcb089616062b427f810b46db927
- TLSH T1E501F1FA70018EA08373D97471C3F915149AE3E592841D8C75C0756FF8A754882A7BEB
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/Linux/keyver_long.php
- SHA256 035a0aac54ff6e67edd8ab19f36d8ed802f38ba653dc9882f37adf01264ead9f
- MD5 938c08f49fce1fbbbe0c6f8448973693
- SHA1 8be7e1af24a9b19d1a608555f244243b62c80e1a
- SHA512 5d016b427b3b5c60603444c9977f3133f5459d1afded9198950611fa6a480e684048e70e46a6c6e11a42dc8a471229f28ebc2e68750252994bc74df69c99f984
- TLSH T10C511FA97D8AD05363372429EF7B2D4DD75ED15302206460BC1D82E82FB0028FEB5EE6
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/Linux/php/obsidium_keygen.inc.php
- SHA256 ac637dbf7fb9cf628b66e5dd3f31ecd641bf21f0e8d878e360c84a19a2040478
- MD5 9935116bc38e3c986c46b38cb21e8436
- SHA1 6a4fe12a92ad37907c2b2b433c739f1cad7e76a0
- SHA512 5c3fffbf84f18e1a7b1bd5ba52bcae3396fd01047f600087b710c80b8dbb5d1b968216777e807768432cd2d9523bc4d1eafc26db5594ee43194008052f8a6fcf
- SSDEEP 192:V74XDpiFBVCjLJwICqFJjLfH++FtMQP3o+F8PWe:4pyCbjLTY
- TLSH T1D59265C1BF8E24AD63B211A0D67BEC56DE7DF210226941EBF8D87149E59072C93288B5
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/Shared/Linux/php/test-generate.php
- SHA256 8525b86c60294b5455848ae69ceb20c14fa17d90e859754632fb72e1b053ebc1
- MD5 d30b113f2aafe34b0e75fe93c2aae145
- SHA1 704a2d3ab5cb8fd8b3fc02dda2f606f357f2cde0
- SHA512 90fabf5d9c8c9177eb71b186b64911d33efb1ae55569faa962ac6406f8d657398a2f02eb529d4492f5d8ff2d8d523070c9ffa4341c8719fd0b91af5c8fa28627
- TLSH T19A310DEEF10391B8188110BB72384660EBB18209E6634812B76ECF137907D5CC21EBC9
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/Linux/php/test-verify.php
- SHA256 ab1599677c6d0e0b39e983c90262a4966127af1f09db25aeed86d45b135e9af6
- MD5 3fd7d54cc5d61dc1e0e5820e9cbd2e7e
- SHA1 e8baa63fb3e9cd345e67a65a6f244b9243d738b9
- SHA512 6156aca1d815c340f38e335a851c93ba111a3944a088853a8c78cc072459ebc91e58899d5c0c7690a081201334cf120235587f51e3f00608f3b53425fe033887
- TLSH T1A04167C6EF83E3E82842904157389D11FFB4D22686F3656E3B3DC549128A61EA33D79D
- MD5 SHA1 SHA512 TLSH
binfmts/Shared/SDK/Assemblies/Microsoft.SqlServer.Types.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e272e45652092622db856dca4e840389be109abcaefd1f376b0043b450a801f5
- MD5 e3f6937bbc9f71fe87a931adfb92cecf
- SHA1 91d3f257a6bbfbf8c50843011db6ce6535d998bf
- SHA512 0d535416d4e3c485a4d133a23270c31d4e0e9f6e59a53c34fbaf0475dce0dc1004d329d3d7d58bb5c6a8f2b4b189932fdb90ce1294aa1d5ffb9c285711882210
- SSDEEP 3072:X9ZHG6aeJrHhGKyoE8GoPxjdBiFaAGWjvGiPP2EpPZHqjm1Dkkr0v9o3:X9NbaeJrHhGKyoE86/KZ8
- TLSH T1E964981DEFCC1226EA76F374CAF4447663227A13663DD7CF40425E8D0A6B6814AA077B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
32:71:0b:07:1e:0a:38:31:e9:79:bf:fd:12:c5:9b:9b:b2:a0:e3:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
6
Entry point
305546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.SqlServer.Types.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
binfmts/Shared/SDK/Assemblies/ru/Microsoft.SqlServer.Types.Resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 69841056dc8d96096196fb08c79cf7d3b9d4659b5e7e64d13e47fc3c403e3f3f
- MD5 92ba39e66c3d5894a23b110da092bbc0
- SHA1 3c25e7140e6a59bf4af205c7ccaf7fe5907326e4
- SHA512 7055ada1eeeb954e5770fce83469ecddd2c9bc2aaae05887ea899042ad22b2513550de20242f5af25cd2338093e085a2d2da4682363a37834b83c01294348177
- SSDEEP 384:9iua0XKriuQVqDvOo/dHoqWZLXci2jpvMUqR:9ium7QQDvPahMi2jpvGR
- TLSH T19413745297ED1449F2A2F937D514FE067CFA6AFE3F2A931A10182D7E34F2550C628329
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
19:ae:c2:0a:1f:39:f4:3f:98:d8:70:ae:77:0a:f4:ed:63:11:f1:c9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
29486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
binfmts/Shared/xe.dll
- IMPHASH a717c506893e6eb4a4cd9bdf05e01b92
- SHA256 f724575de0ea9ec3cc15a1f10d6a936ef2ec6dd3790d0d1c39dfc1f9d31aece4
- MD5 9abbdab424f66a7f4c395fd8759cef0e
- SHA1 d08a1fe1ab2eb09827f26fe493994e8f064c74c8
- SHA512 2583f01afd894330c1e98a57327df14605b19c4baa06beba9f42bb63a0831f669bf495fc91c16041cd882169434a568b09fffa2d5f56edbd2b36fbb6a8ae5ef8
- SSDEEP 6144:atkUO5IjISRbo5x88oTPVXU+u/o6XPLFlDxzqKoAMl2FrbyOHgNf1UfD2t2BgCcJ:ukU3IBC823SLMkFrzgx1Uyt2mL0eUW
- TLSH T190D44A2066CA8669E4F315341779B25B533CF9254B22C8CB52A4596F1AF82F22F35F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7f:94:fb:b5:1d:d4:a1:73:82:01:c3:fe:01:54:f7:d5:a7:48:e8:22:9b:b5:cb:f9:70:b5:6a:a0:29:90:09:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
429968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\y\obj\x86retail\sql\common\xecommon\dll\xe.vcxproj\xe.pdb
vcruntime140
__CxxFrameHandler3
_purecall
wcschr
_CxxThrowException
memcpy
memmove
_except_handler4_common
memset
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
abort
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initterm_e
_errno
_invalid_parameter_noinfo
_initterm
_cexit
terminate
_wassert
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vswprintf
kernel32
lstrcmpW
CreateThread
LoadLibraryW
Module32NextW
CreateToolhelp32Snapshot
SetNamedPipeHandleState
ReadFile
TransactNamedPipe
FlushFileBuffers
DisconnectNamedPipe
GetCurrentThreadId
GetCurrentProcessId
DebugBreak
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateNamedPipeW
IsDebuggerPresent
GetModuleHandleW
InitializeCriticalSection
QueryPerformanceFrequency
HeapFree
GetProcessHeap
HeapAlloc
TlsFree
TlsAlloc
GetUserDefaultLCID
VerifyVersionInfoW
VerSetConditionMask
GetSystemInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
UnmapViewOfFile
MapViewOfFileEx
OpenThread
TlsGetValue
GetProcessTimes
ConnectNamedPipe
WaitForMultipleObjects
CancelIo
InitializeSListHead
GetVolumePathNameW
WaitForSingleObjectEx
VirtualQuery
CreateIoCompletionPort
CreateFileMappingW
CreateSemaphoreW
HeapDestroy
HeapCompact
HeapReAlloc
GetExitCodeThread
HeapSize
OpenFileMappingW
GetQueuedCompletionStatus
ReleaseSemaphore
HeapCreate
SystemTimeToTzSpecificLocalTime
SetFileValidData
LocalFree
FormatMessageW
lstrcmpiW
SystemTimeToFileTime
GetDiskFreeSpaceW
SetEndOfFile
GetModuleFileNameW
GetProcAddress
FreeLibrary
LoadLibraryExW
RtlCaptureStackBackTrace
GetLastError
FileTimeToSystemTime
GetNumaHighestNodeNumber
GetProcessAffinityMask
GetTimeZoneInformation
CreateDirectoryW
GetTickCount
VirtualFree
VirtualAlloc
GetSystemTime
DeleteFileW
FindFirstFileW
CreateFileW
FindNextFileW
DeleteCriticalSection
GetDiskFreeSpaceExW
WriteFile
GetOverlappedResult
FindClose
CloseHandle
Sleep
GetTempPathW
SetLastError
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
CreateEventW
SetFilePointerEx
user32
MessageBoxW
rpcrt4
UuidCreate
shlwapi
PathCanonicalizeW
PathIsRelativeW
PathFindFileNameW
PathRemoveBackslashW
PathIsURLW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindExtensionW
PathCombineW
UrlCombineW
api-ms-win-crt-string-l1-1-0
_strnicmp_l
_iswprint_l
isxdigit
isalnum
_wcsnicmp_l
iswalnum
iswspace
_towlower_l
isdigit
_wcsicmp
_wcsicmp_l
_wcsnicmp
strncmp
wcsncmp
api-ms-win-crt-filesystem-l1-1-0
_wfullpath
api-ms-win-crt-convert-l1-1-0
wcstoll
api-ms-win-crt-locale-l1-1-0
__pctype_func
advapi32
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
EnableTrace
RegisterTraceGuidsW
QueryAllTracesW
UnregisterTraceGuids
StartTraceW
ControlTraceW
ole32
CoCreateGuid
CoCreateInstance
oleaut32
VariantClear
SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantChangeType
api-ms-win-crt-math-l1-1-0
_except1
SetAssertHandler
XEGetEngine
Name
.text
Size
456KB
Virtual Size
453KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=262, version=25203,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=26706,
count=10, id=260, version=26706,
count=11, id=259, version=26706,
count=21, id=261, version=26706,
count=14, id=257, version=25203,
count=194, id=1, productName=Unmarked objects,
count=56, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
binfmts/dbus/machine-id
- SHA256 c3aee3bf01f7eea0c3ec9a0637a21c7efb2cf96a3663689afa7daccbbb242582
- MD5 a48d6e4f70392f85780bf9713651613c
- SHA1 1971238defef786e299cb7c54d60fbd7bbf4d6c0
- SHA512 00b7ad232f4d9f7951f6120431337b175fad1bb273c099e52312e86eb225fe4566d88c0f4ca4ee37d081d6c66a438cd605b8b66646680945a1ad065271952e59
- MD5 SHA1 SHA512
binfmts/dictionaries-common/aspell/aspell-en
- SHA256 9426a693bac42b4b35f1284a45418f315b9408f700be4c6040ddedd7ebd868e0
- MD5 cf8881eac6418aae0af3f5a1d2b032dc
- SHA1 39940e0d90e5eec129287e4c1884f972232c82d6
- SHA512 404ba705c1bc528deb0ea655c5ae7a15ee154f8f7d5149271bd5a54694a744582ce026b853c36f90f892f87c9b9ebf5113a1aee71f87f4c4cac30f746f75b501
- TLSH T1EBE09B28E6847635AF965BA93C00EC14837140DF80D509B884CE3E56B8F02F7933604C
- MD5 SHA1 SHA512 TLSH
binfmts/dictionaries-common/hunspell/hunspell-en-us
- SHA256 a961876a3f31920d8296b739321d85182d3e6dd3d69996ea6ab45e22d71b5161
- MD5 4d768c86f22c072e004267e174e87a14
- SHA1 e4977ec9e38aa04ad581481ba935172fe67e8037
- SHA512 c27df74b437793d86a782e8a4b169d61d808e7c7c1fe1b02661133d71e0eafedc627056d8fae79466923cb6b09fb5584b28340ee0b77d44f62ff581260f59736
- TLSH T121B01215C34270066EF681192C40F94907B040CDC0C64CB488DCBA09B1F0797D33005D
- MD5 SHA1 SHA512 TLSH
binfmts/frame/LocalDB/Binn/Resources/SqlUserInstance.rll
- SHA256 89521c05d50625512ef53b3c11cded25cdee1d7dc63ff539c2ba8a58a6361e13
- MD5 34a0d74588db4242b3166bcfe1c2cdd6
- SHA1 19630f066153012c3f2c79cd02ea6dd08b5f512e
- SHA512 883ea9084dbd82be0320f44a600393899877190535498d39d6be6095abd59caf6058a993876ece2449eae2814bfa5e0245c6fe0680f4e6c2b61bde6bfedc5638
- SSDEEP 192:zvGPWFxxWOBWULwu0Sc2HnhWgN7ayvWYjKI+XqnajlFQuY:zvGPWFxxWO7D/HRN7/+ImlQuY
- TLSH T1A3A25E898E6B5003F8622D70D3E4C4D26FBC6F8334A2713FDF05A59519D278CA691EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9b:16:03:9c:04:ee:13:e5:75:08:18:40:6d:70:85:86:7e:2f:53:25:5a:95:ad:7b:48:e8:bc:10:88:f1:07:e0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:EACE-E316-C91D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4c:c5:4c:c1:d0:db:6f:3f:b2:00:00:00:00:01:4c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\k\obj\x86retail\sql\ntdbms\userinstance\res\sqluserinstance.vcxproj\SqlUserInstance.pdb
Name
.rdata
Size
4KB
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27034,
count=2, id=151,
count=1, id=258, version=27034,
binfmts/frame/LocalDB/Binn/Resources/de-DE/SqlUserInstance.rll.mui
- SHA256 5c078a9b5ef063d10f5059a37d0dea80d44a5297cd273e779f8b0a53fdfb8cb7
- MD5 b30fefc695f4444a893d567727b7520d
- SHA1 7c30c0664a6d7bdf5b74d6db49880b0412902a33
- SHA512 9e38cecf8b7866fda83a7c58982d8abf418cb67fd909e765727ea3e510713894a57426ce24de2c08e02dbee0b5736ef1623414704aa8952b04002ccde97ea338
- SSDEEP 384:NXe7Jj8tgZO3l3tBNADygiKWwmhGWbD/HRN7uDR1lT2X:NLHBNcRuzDvu1qX
- TLSH T1A7A2DB5287E95219F9F36F706EB892616FB6FDD2A838951E0240A06C1CB1F40DE70B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
97:cf:19:ff:6c:0b:7d:25:00:6c:f7:f9:9a:1c:af:24:74:4c:8c:d4:ce:4b:51:cc:ce:9f:1e:f3:f5:b7:25:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/en-US/SqlUserInstance.rll.mui
- SHA256 f98754389a248c07098a28aadd445863ab73273497803cde52cc90ec6cebb359
- MD5 fc4f82a8de54ccb30de50d9981ac6839
- SHA1 7dd0063fd84285759731dd19299dab8a01c752d9
- SHA512 df1eabadbe157d27bb7182619e5a0b0461414d3df04359c30ae809d185d55b997eaf32254151f9c427d4cee48d730eb4f7c9878e8f9849ad967b86d4d550977e
- SSDEEP 384:0+wmn1FXuebMWyP545PWFtGWUD/HRN7N9R1lT7s7:8u3Yt8DvNL3
- TLSH T19092F8429BF85119F5F37F306AB995315EBABDA2A939C21D0240A42D1DB2F80DDB0733
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b5:d5:23:c5:ae:fe:92:9f:7e:80:90:b8:53:98:50:b5:e0:9a:6c:f4:50:b1:2a:e9:c0:1e:93:b1:41:c8:38:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/es-ES/SqlUserInstance.rll.mui
- SHA256 f9874030171972d18f3dc0613e66033b94c380570a43bccbc3c4f196c94d4221
- MD5 553937b6919c99be1c01f2573e0ceedd
- SHA1 064abc97a7c8b9ccca56688a853c2198bdb31d91
- SHA512 99caa8b06ae1ce3ddba98de5d9630374afc58e4f45bdc816eaa20b193a0a675900a860b96fd0dfbf09d7003fcb5d31884627000244ab72134897a8430479203a
- SSDEEP 384:mTuganLHNJ/EcTN0mq6uwfiq5oemXWfrGWtD/HRN7KImlQNv:9r1Dv5
- TLSH T1AAA2A8519BFC638AF5F37F317A7999215E7ABDD1A838841D0200A2690CB0F84DE64B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8d:d2:f5:8b:03:1f:94:8e:50:25:56:fa:4e:8b:a4:eb:53:8c:0a:74:0f:75:3b:88:78:9b:49:ac:2d:b0:71:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:EACE-E316-C91D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4c:c5:4c:c1:d0:db:6f:3f:b2:00:00:00:00:01:4c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/fr-FR/SqlUserInstance.rll.mui
- SHA256 60c405450b4a0dbad51709ae5c861d1294c4b086755fe3f9a8f27a6762ad3a27
- MD5 de9f74d85d098faad2e6a474da74ed5c
- SHA1 634c5df556356d4e28a6254e4151c9afa938e646
- SHA512 e9f2adf5c8c10e778b4892e3a4592df7ebd9d1ec67360b561a5f09f7ae7031d6d642372717afcd921ba543463b33584ea361ef75d24de2452518f791c5fd74f9
- SSDEEP 768:BMLOOyP53fXPDjLlxFJAmLGtJh1Zwbj6pVDvSq:AFvSq
- TLSH T141B27455A6E91606F6B77F30BDBD90915EBA7D8AEC38C01D0680A0981CB1F90DD78B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:66:58:e8:f2:f8:ea:7e:ee:34:3c:84:02:29:f4:7b:04:2f:02:6e:17:0b:ec:55:ff:f8:92:98:7c:b6:dd:83
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:2264-E33E-780C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4a:a4:f7:31:c4:ff:22:a2:49:00:00:00:00:01:4a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/it-IT/SqlUserInstance.rll.mui
- SHA256 f58eec9cece4bbb1abe97241cfcbbee35a6ceafcf8a39afba122693af13a42f3
- MD5 2950c68d38391ab2c206e5ab231c0945
- SHA1 d958eb015858ee43674768449e2de6ede58d756d
- SHA512 b1e1b034b6e350476f37cb2f2545186f34e49d4cf933447745142d3e18381b3c7ca311ddb5415c4e8a2ee9fddb45f4603ed98deed0a89658b16a57c00bcedc15
- SSDEEP 384:+UrE1HsxSsSOr6q2NkBqRvVmhNW6uGWyD/HRN7wR1lTnc:mViuaDvIjc
- TLSH T166B2CA129BFA5205F5F37F306E7996255E7ABEA2AC39D02E0240A05D5CB1F90DC60B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a0:12:2c:dd:ff:4d:7a:26:2b:72:66:f1:0d:e4:e5:ab:83:2d:2c:b9:48:58:49:ec:c7:6a:21:bf:fe:12:a2:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/ja-JP/SqlUserInstance.rll.mui
- SHA256 16a6f34a270c3e78db03af615d4812ac4d7e1362899e21aa74c190cb85e4f3d0
- MD5 74e96fd0f188ad2dd3f91f2bb4dc749e
- SHA1 1a13ff7630023689ec9b04e509eca6da48e1e433
- SHA512 a21fe7a95fb72fbd3cc812aa10018eca8601eff9514b83f40630f1a7a6344a77fd64a8274cda70e6279445d374bde2f9c9d16d020e6186dac73d6d53b8f29e78
- SSDEEP 192:xPnb5mkmZnPGfIKyCk0PY4WFtGWRWULwu0Sc2HnhWgN7ayvW1xmZdGP2qnajldG4:KPGf7koY4WFtGWLD/HRN733Llfbl
- TLSH T18382A347D6F8141AF0B28D7047F8B0A17FBCFAE294A3406E0A45E45A2D61F88DF1077A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f6:a1:94:13:82:63:d5:d1:ee:5e:e0:8b:da:69:43:14:cf:bd:6d:c7:bf:57:fa:74:ff:f1:45:d0:bf:e9:a7:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/ko-KR/SqlUserInstance.rll.mui
- SHA256 626cc8832025d12f8cb79e11ecde52ad499053e2e7c9abaf785de5c7f5cc1ab6
- MD5 ba2e9ac880f22762db631e4f183d9d25
- SHA1 149b6440aa6005da3241b2520b555e0060fd18fd
- SHA512 0ee9016a31f0da0c645327bf2e691dbc3a4932e8f22416c8ba440a9ddb6d33c497476a0c4349837f386e3d11e57af23225d000f00fe9d0384cf459acd419757d
- SSDEEP 384:XVVcMFwHY4okRv8HYq33cF0WstGWUD/HRN7SmgR1lTC3:eYntMDvSTm3
- TLSH T1CA82B853D4BCE14AE472AA3067B89B72AFF9BAD35517501E4240F0582DE2FD0DD213AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:46:c6:30:7b:da:06:55:eb:10:30:95:ea:15:ee:07:2d:54:d9:2e:fd:f3:d1:c4:e3:92:d0:1d:81:22:2b:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/pt-BR/SqlUserInstance.rll.mui
- SHA256 658bf89a45bd5172c2ee761aede87798d5a3610fcec29a1150287b6977b5c186
- MD5 f89385dcd27c93b16915dcb29dbd5702
- SHA1 9fe13a9593a5ec8a5f1ac1ee68e81c16a79f2708
- SHA512 065eec8d5f50901ebde3097fb79acaa8c6ed34a9613df6a3a3041f2af1b0b11cca2dbae10f4d3684dcc2cd6b0b1f9a14caa90032d5a080811d0f54b27888d47f
- SSDEEP 384:7WvWvW0W+WaWyWRWhWvWV5WNWpWK/WfWXwLWWW/9WWlWQWmWnWPaW9WgW1W/aWrn:LxwWJuCDvgU
- TLSH T16CA2EA4297FC224AF4F37F716AB899319E3ABD92AC39911D0240A2691DB0F80DD74777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ae:49:aa:00:77:f3:c2:07:15:19:38:db:b7:a3:3f:62:12:1c:5e:f9:c8:a3:a4:4e:31:b4:b0:a1:44:19:d8:9c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/ru-RU/SqlUserInstance.rll.mui
- SHA256 0c9f35b1a60054e5455201ede66f021d5b4ede92d0ba2add88cfbc910c632691
- MD5 951e8bedf4aa6a878e98206d88b6d0e8
- SHA1 c43a4ab970d0feafe28022ff3c3817d0dffe39b3
- SHA512 f728eb9c2e3bacfc7b693d28171e73e5c6440e1b81dcbf80a3a6fd6b9ccd99d1181fddbe611a8f65c81b55ab499193ca1726342520d0a10e753a8dcdc489253c
- SSDEEP 192:mXNamfu34jsmRttCzdkzscVEvPAGWEqWULwu0Sc2HnhWgN7aQWDbCJky1qnajvH:mXc0scKoGWEcD/HRN7nR1lTH
- TLSH T193A2724FD9BCA011F565E5701F7284E329BEB790531894DB838FBC6424A9B70BB202DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
78:59:70:85:72:bc:1e:34:0f:d0:d0:77:49:df:f9:b3:2d:47:cf:fa:f3:6a:3d:e3:db:5a:99:01:a7:4d:25:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/zh-CN/SqlUserInstance.rll.mui
- SHA256 2f8ba9e830fb7937f34a1278525df941b684d453134a676f21c358b127070859
- MD5 fc5831d92a79c879d6da3a30351ebe24
- SHA1 758cad15e0952ba32690d0743a785622da63ca67
- SHA512 1d30a30b6db5bb743caa5f756a179611e63f2abcba240f6b6ff6200e98de3268db26134c0cbee49bcb5f7fc376e041bf8616466ee079c90a4b03bbc2a8a9f4aa
- SSDEEP 192:F/kfKz4FP3gsz8YWF2GWzWULwu0Sc2HnhWgN7aQWozRCJky1qnajvhgux:nqAYWF2GWxD/HRN7JzgR1lThgu
- TLSH T1E272B6428AFC2406E4B26D3067F9D5626FFCB6E3A56A401E5568F4242D61F80ED10B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:6d:71:e4:55:1e:26:15:25:de:03:8f:28:33:2a:d4:f4:c9:59:cb:e3:f4:18:4d:e5:33:f0:a6:61:78:9b:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:64:2e:75:f6:7a:03:5a:83:00:00:00:00:01:4f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/Resources/zh-TW/SqlUserInstance.rll.mui
- SHA256 53628cdc01c218e796e700033944e3acd9c9e2e098509493e98aaeaadfccfb89
- MD5 13142c39ab174fd96e34e90cb11faac5
- SHA1 647ca5d03a506eab70c1ec5d2df5fb5c58616124
- SHA512 4feabcde64c219817c79e6a7f889d3778a1eab557cc09fb1ec2d1df89a845d120d67c861cb9e9b6b840f369d9b8a60f3e373dbb1012690cf58c5d53f6daa2645
- SSDEEP 192:5EzY7R66aU1KUZtwTWiAGWSWULwu0Sc2HnhWgN7ayvWZJHI+XqnajlFQXW:5HF66n1LwTWiAGWED/HRN70JHImlQXW
- TLSH T1D972E942CAFC2805D473AD701BB9E8127FFDB7E11927901E05E9E8542EA1F81EE1537A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f2:b2:cc:93:41:50:a0:8b:48:66:49:f9:7f:de:aa:41:d2:31:f9:1b:ab:a7:ed:05:c3:38:75:26:10:9d:1c:26
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:EACE-E316-C91D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4c:c5:4c:c1:d0:db:6f:3f:b2:00:00:00:00:01:4c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
binfmts/frame/LocalDB/Binn/SqlUserInstance.dll
- IMPHASH b0547bab9ed2aabbbfc847c2d4a998fe
- SHA256 ec41019a6ae2874e75d5856e845eb42b2ada2e738467b11e44868061f552c617
- MD5 26f2ffe2b77e18f02ad44dfe0976c084
- SHA1 5c53aeb7558e3ffcaa0fdae00575e65fdaa32e17
- SHA512 867db4e9f92cfcee9d36fe404a972880dc72748d45747a2e5afdd8ba5d98a1cdf2f3476f4e3b1b79b0d1173942ef28656bc1e08640c4d6a68043d6202b13daea
- SSDEEP 3072:gGhuUCVJUiOQIlJYSz4c/iOH5HgDFJhhsn6/8dTdrOWH6WtEHRRHwNdE4AAfJ15X:9QUXiObliSz4c/zZgDFJhhsn6/8xdOW5
- TLSH T1C1F37C207BE1D13BFAB316F025B4FA6A5629FD790B2044CF42C45E4A2AF47D19939723
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
64:97:7a:44:d3:6b:8b:ea:fd:1b:65:08:75:fd:a3:08:a1:92:ba:c6:44:13:97:91:88:95:a6:c4:b1:f8:42:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:62:d0:fe:02:f3:01:e5:cd:49:00:00:00:00:01:62
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
45600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\19\obj\x86retail\sql\ntdbms\userinstance\dll\sqluserinstance.vcxproj\SqlUserInstance.pdb
vcruntime140
__std_type_info_destroy_list
memset
_purecall
wcsrchr
_except_handler4_common
__std_exception_copy
__CxxFrameHandler3
__std_exception_destroy
_CxxThrowException
wcschr
memcpy
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsnicmp
_wcsnicmp_l
towlower
_wcsicmp
_wcsicmp_l
api-ms-win-crt-convert-l1-1-0
_ultow_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_configure_narrow_argv
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
shlwapi
SHDeleteKeyW
odbc32
ord24
ord31
ord241
ord75
ord111
ord136
bcrypt
BCryptGenRandom
kernel32
SetLastError
HeapFree
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetPrivateProfileStringW
CreateDirectoryW
EnterCriticalSection
HeapAlloc
GetModuleHandleExW
TerminateProcess
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateNamedPipeW
WaitForMultipleObjects
CompareStringOrdinal
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
WaitForSingleObject
LocalAlloc
CreateFileW
GetFileAttributesW
FreeLibraryAndExitThread
ReleaseMutex
DisconnectNamedPipe
OpenProcess
CreateEventW
GetExitCodeThread
FormatMessageW
GetLastError
DeleteFileW
CloseHandle
CompareStringEx
LoadLibraryW
CreateThread
LocalFree
FreeLibrary
CopyFileW
IsWow64Process
GetProcessTimes
LoadLibraryExW
GetProcAddress
Sleep
CreateToolhelp32Snapshot
GetModuleHandleW
Module32NextW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
IsDebuggerPresent
DebugBreak
VirtualQuery
CompareStringW
GetCurrentProcess
IsProcessorFeaturePresent
user32
CharLowerBuffW
CharUpperBuffW
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
RegGetKeySecurity
RegCloseKey
RegDeleteKeyExW
SetSecurityDescriptorOwner
SetTokenInformation
RegQueryValueExW
AddAccessAllowedAce
GetLengthSid
ConvertSidToStringSidW
CreateProcessAsUserW
GetTokenInformation
RegGetValueW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
RegCopyTreeW
CreateRestrictedToken
OpenProcessToken
RegSetValueExW
RegDeleteTreeW
RegSetKeySecurity
SetEntriesInAclW
CreateWellKnownSid
RegCreateKeyExW
ConvertStringSidToSidW
RegEnumKeyExW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
CoCreateGuid
CoCreateInstance
StringFromGUID2
oleaut32
VariantInit
SysFreeString
SysStringLen
SysStringByteLen
VariantClear
SysAllocString
VariantChangeType
LOCALDB_PRODUCT_NAME
LocalDBCreateInstance
LocalDBDeleteInstance
LocalDBFormatMessage
LocalDBGetInstanceInfo
LocalDBGetInstances
LocalDBGetVersionInfo
LocalDBGetVersions
LocalDBShareInstance
LocalDBStartInstance
LocalDBStartTracing
LocalDBStopInstance
LocalDBStopTracing
LocalDBUnshareInstance
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=26706,
count=26, id=261, version=26706,
count=10, id=260, version=26706,
count=4, id=259, version=26706,
count=13, id=265, version=27034,
count=2, id=262, version=25203,
count=18, id=257, version=25203,
count=197, id=1, productName=Unmarked objects,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
binfmts/frame/LocalDB/Binn/localdbxeventconfig.xml
- SHA256 93185d3e7a527c760f2e9b98704b8c93ae7a7e30ad52dfb21f1e1ea5238be7e2
- MD5 e880d4f5587eb5d0aaa1b3e9b6a67df1
- SHA1 abdc8cdf87375d70b5c135930737c50021d2cf2c
- SHA512 e6a365b32a4294fc0b68b1a1e47af5a14e081e78eb3b5c1428477f596719ac46c957f514317d95a204ded340ec585126a8da5a8dede1fa02b2dc8e328e4c24ef
- TLSH T10B31B804B7B79F66892C5D9FFF796411647FA9F3F1082180B5E8FE332A1B48A2453419
- MD5 SHA1 SHA512 TLSH
binfmts/frame/langs/Arabic.ini
- SHA256 28081820b472af264132cf4f1a11f31376457848400216b9d5e5d19ab79faa65
- MD5 48552ee0c2f36b7687b0591792736860
- SHA1 9f81363d908395544f7c792da268e53245af1dc0
- SHA512 348a30dce5588157ab30db80f763b9f1b1b39ae191d2aebab5a66a2c602421f389f6debe8422b2769ffaa8ba1c1b03d0b1631d5b61833266f1662dcdc4c25f22
- SSDEEP 1536:YopL3t/PRReCq76+U7F6xBByNAPFcYJ1tbIT:rHeKlF
- TLSH T1E8A3131069D8E0387417B695CF8AD667C327A1E949FA5E3A11AD0A0727DF8204F1BFF1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Arabic.lang
- SHA256 a763cdacf51c0eb78c91f9168a925ed3ae0dc5c93f791a6b4b3349e23cf36c1c
- MD5 116a2921721c837ea81d77cfcdda0d56
- SHA1 d6d372e4f90649f9a50917cb9a2cb3780059ee9e
- SHA512 29bfd56a9c49563e20c09d5f8f94254b90c13a8cdeb9bdb477ab71758766736ecb69f484031d53e17cdfdc4ad30fd19a232ecd09d10e3a6928045dcaa348dd53
- SSDEEP 1536:26YuNjnFQARbFr1t3iH7kr4IJCiAa23tHFQIbAVk:26d5nF3Fr73iH7kr4IIiAHVFQIbF
- TLSH T13673CAE10E1154724567EA0AEAD236B9D439BD135B5FFE20309F1AA093BB05393BDB31
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Armenian.ini
- SHA256 c34973a4e61dcaff7dbb98fadfd49b0557475985a6a6bfe271a4d55b70b462c4
- MD5 2c8930db4af7cb3910e186d5ae6d1e42
- SHA1 faf9b8a4465fbff7dc666f6612fb80cb04320221
- SHA512 7a56c9b02b46c05d929e205c08d33869e77c63cf14483e44911141c5b252b993ff02ace49e1064e9ef141dd6c1f2d4ba6fb0449e039b4b92b34d66d603f5232e
- SSDEEP 768:wq6jPXpx646x1qEE4LznR9DEuKSf+4NpyhH4aE3gccfJf+65bimH5nLP+B9y7CbX:L6jPXpx6tyv4LzU5bi07CAx7Ud4K
- TLSH T148B3D33624D490197427B6945F8AD269DB27E3E9C17ABE1A10DC512F23EF8019E1BFF0
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Armenian.lang
- SHA256 625d9da7e873e0b79b45cef6c1ce1d70f7a64b4adfeff160826f93b1af51ff72
- MD5 aa51c0a6af522a4e5ea54ca0f3cd17b5
- SHA1 6189ed7c34952df0877be87c08cf65a22136b44a
- SHA512 a8ba01539cac0bb496acb4b3f9a12e6fc53fdc9d9ef4fa8e9b6b29adb3ea47fc6b622e35351bca23ef2867eae9a0482ea509ee48f12e253d44cc8b7d31bfb9a8
- SSDEEP 768:qlzLmfo3hklSGCGEnBvPOjgVhrkme5yZ1l7Rhd1X0CSxbnX95CYXNWtX4ytN0fet:3gILeE5F+rIG
- TLSH T19063FE727D12493F766FF469AEA107B1C0EDF85519560A48B49F2AC60F340E21B7FB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Belarusian.ini
- SHA256 75723086a2c083a3d625bdfad8ffb39cac6819bcd84241002ecdd19ec4f3122d
- MD5 e345897882019c990457b83651f9ad97
- SHA1 2ae5a3917a4a6b1312454b5cc9b4ddf670c667d5
- SHA512 c20441612c64b7f2a9a46aa6cd68b950d2056de268bee2132e0d286498a42aebd8cb3cb4c42cd6e618df9b6cb38ca7e2f6e0b6af8fbed5d6ec95edf96e4035e6
- SSDEEP 768:wRmpwuzTeCmPMuQKh+k+xP2EEeg5L6PZYp9lJpFGyW1zCRwK9J2p9RiIa0oDgYpT:NzTeCmP7+xuXIa0HmoQz4Yh
- TLSH T14DB3F11A75F951247026F2954F8AD2A6C2B7B3E8437A8D9A188F7506239F4702F13FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Belarusian.lang
- SHA256 1e1d5e275974d1a8c221b80a6617af6a9bdf7460380145cb8db19915182be565
- MD5 5415c2134367270eefb5620d242bf0a6
- SHA1 366f6e20c36b638e75d0bfb5b25b93ac8661224f
- SHA512 01e870d5deeda1a57e7457e93e1309b85a7258b3652da4c6abaf804f7852f24b8bfe69b472f159ec7b33cde90d83210cc94341a9af760edd0020ff2fd436041e
- SSDEEP 768:FL2dXWHIKw9CIyPAJUtVQA0ugAFhdoADQoAqaroY/KQPLmXDebKzRx9ydZ/8gj9W:gdXWH4neakp
- TLSH T1016399890E4D1CFF4103E04BAE09666FFCE618BA6AAE3706309D6DAF53B5160637C315
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Bulgarian.ini
- SHA256 e9a93618225cb41cc154ada8e86696f461479d4d553d773d8044901e3cab26eb
- MD5 32ed2b9de12338d96f949798a4bea3ce
- SHA1 b980e001fb39688a20921bf5ff85490560e7ee1c
- SHA512 7c331c1c9fc46df41e2367ed98e7c27ac992bff898d5077cb18ac25229c86ba4c4ae2eaecd2fa5374ca6b64f67aff2990cf19381e1c7a30d1048d3a090a019f7
- SSDEEP 768:w6eHKTb+AIFePD3dVIglPfYYdntoRJl3BWSO85XVs2yVxxoItpg2ngUBs5l89YMp:vGKT6AIIPD3nlPkZItpnYznkAw
- TLSH T113B39D1BB4F960147126F1954F8AD2E5D2B7B3D8233A4E5A109F2916639F8702F13BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Bulgarian.lang
- SHA256 f266b7ea1d7901cccf37f70723638288622568d6c1240d8508fda37cc842090d
- MD5 e744f7dfa0e84d423af7feed5eaa364f
- SHA1 865dd266ac655f7fb382df7c22872acdfedeee9d
- SHA512 1debf9afaf447b07a562d4a6fd1294929d91c96b4d8076b373d06640dca7f7dc7624d23da18b705c074b46d298f563d654e957a915bad373eba7622db0efebba
- SSDEEP 768:3hlRMAO5yyYSQ0XnicfMkz8kn1Ltlzp6CRggIZW8a9ZJ6VDN7neY7ipYsHL/w7Ef:x65H5NgQ0MIGn
- TLSH T11163A6650E0E6CAB0402F45BAD056B5AFCEA94BE2FAA5741706D19EC73F107853BC70E
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Catalan.ini
- SHA256 a7b4f3b0c32f56620f8bb59eb4b8ef8f0dc03fe09ac10a08607af3c5108b1989
- MD5 866e4eb647f5dcc5c38a2080eaf3f82c
- SHA1 0edbf621cb40b6e74c34a61a8a330051adaee350
- SHA512 fa383dcd94b4f8fbb0b9cf4142a2a6ce40dee379457503897d770626d1fec489105d99b3c9703b7567eacfd4ae7e4a4c19d9d9d052ab205f0cd98ebb3206bcbc
- SSDEEP 768:wcoUuYL3UhpVPLEBfyiQDEP1FOh/CYC69dQ9a9w5/gWr9qxzMDzpfgLW2zRyE730:FNYj0/6Miomz72KmqGS2XVXKVgxd
- TLSH T1FFB3A1112AEE2114F1B37A959FBAD268CB37B5E9553ACD1E009C014A17FBD504E22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Catalan.lang
- SHA256 ca8778470f2f6d29f4687aed2ae57926a74faf7975f8a814b7e2e900bc4fb32c
- MD5 be9664e9539660bf8261d71f8f13db58
- SHA1 471be1c9602c4cec32bdecaaa6d11fa23d559b35
- SHA512 0de1f0fbdf6601fafa586b349f0fd15ae3079a141225eb89e393721d433e7ee19ab89307b42344ed8e814660cb2127fe267a53a501098255534cc848fd0e32b5
- SSDEEP 1536:R0nTXmdW9mj7TNT5tOJ8+GA1ZQnxxVCBvJR9IEdC0dsvJZ/ZzRSI:kmV/TNT5tOJXGA1ZaC99HChD2I
- TLSH T18973D7538E022F379897E15ABF46D3F7D0A9AC022C2C4B44F18D27E59378998877E785
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Croatian.ini
- SHA256 5bf2b70edb78073f3ce4fe6d809a3a25c982cb2840b8ebaf4367ebc42f16bd3e
- MD5 8477123868f12632d652c6da5df683c2
- SHA1 23dbeba17e366e1bb5e7d7be156a9be309c9555d
- SHA512 b785f8d680f22211c01cfa59cdf86f1bfdeca0446c1c26fc2c144e3018773d22e4050c95cd513d60df9b226df31dc504b5059db168977b3949dbcc428a7ff30d
- SSDEEP 768:w0VnpiuM0pY1HIlw1VoIGRweBLUab7Fno8wBtA1yR4IY52t9RM8wE4c+Tyb3TRr2:VdpiuM0pY1olaEZLUYg4c+7wvO60ll
- TLSH T1C9B3D31236F92114F1B7BA959FA9D265C737B9E9523A8D1E109C020B17EF8804E53FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Croatian.lang
- SHA256 428e74d64426a6d2ffc6dbd84817ff5b991e73db54a0595eb70f4e4cd9e0a95a
- MD5 8ce0cfe7e299888e595d9afa7e7b09cb
- SHA1 eb7efa5964f4af9307fd24c21b8e5695f803edf7
- SHA512 24f02a38e84c0ab2a8d621b6d532e031a12c199909ef99c52933be857c552fc5a1b35b81e46980b44af89b8ebd40138056d16e82ef326ffbaa9e0d403b78335c
- SSDEEP 768:R6vk2haEUfqDfCAJ5VFuM4qNVijBhndGO8SaBpZbnbrbZSt2yLZ:cc2GXBJKVBVyN
- TLSH T10033D6558D13AC36445BF08ABE2143F7EA7D880A9E8C9B9974DE67C483B94E003FC756
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Czech.ini
- SHA256 f7997d9a8cdf6a4148d8deb43ffdae893cd670c45866370738d7290b8b55b70e
- MD5 03f0f4a8c9784bdf9d64c019cbc8b6d3
- SHA1 bcf32c15dc6edb0a1856c101e59e3a9a16dbe98a
- SHA512 0711f9a42ba8ff4560be4d1e5671f700b55540490eed7f185ebf4359dde137573d4673a3ccc95595ad21f474c45e1aecb35584e1dff8b184fe44e59eeb02179e
- SSDEEP 1536:mrM/p+b8KeDYi0FC13E3InsRSoDo8xmX5mjeLIHnkdPw:X+oHYi8WE3koDjxE5mjeLhdPw
- TLSH T135B3D81135F91119B1777A859FA9C2A5CB37B9E96636CE0E109C020B17EF8805E63FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Czech.lang
- SHA256 23a8cb29404bc66fdf6784eebcb6fff3a8ef0cb89aa7115b0b503fa10378ab66
- MD5 63e5515e3aa41b511f2fca55c345245b
- SHA1 056bfe5a163ea63765662f3eb2d06f6848b5df8b
- SHA512 a53b8a923b9ed7bc8afd7c48f04082caad76afc45629128607ff222c88d6c96ff36200a8a9d041e2787984897e3a4f8d349cadbafd5edbcb56b139aea837e5b8
- SSDEEP 768:fNwrHuKvLAkIYeWTCo+4glP/JdKyC9c3lyNN08eIv/WYH991M7CKeyRezCdzDG5K:lwrH51SkalSNiYH99bRyTDGPtO
- TLSH T1E943C53D4C036C329497E589BF4A53BAE43E48460E2E0B5574DFABD483B889457FE705
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Danish.ini
- SHA256 59df77a75aca7c0a8574f6d4b5be5632908c4fea8634f4748e36ff6fee40e317
- MD5 5f50b22de0efb245cd3b8f2fb50a6d3d
- SHA1 be369ffd0c47ff92b3aa5c259ab9f4d40807b687
- SHA512 f3fec19409ea564bd68f4bd1253297ed8bcbe86554422a22891c61ee237f581f95f6976512e53bcabc5cafe3411343e660d3fb8f398f95f9c1efcec8eaa4367a
- SSDEEP 1536:gmGRkLzUJnbfeKzcqt5G+qX59CcZEY9dHbm/c4C1CgqfRG:gmGRbnbfNRt5G+qX59CcNdX47G
- TLSH T14CB3E71132E81118F1B77B95AFFEC264C727B9E9553A8E1D109C010A1BEF9904E63FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Danish.lang
- SHA256 f3636e036a18ff6abd9a99e15836642c181e3858ef56deba37c938846d023f9c
- MD5 8c363bbc443f2fc6e5e1ef9b0f3b11ce
- SHA1 ebdbf6110d66412deeb2b2fcc8a55f397a25a78b
- SHA512 0b04050fb556c71912986583d49bb23ee52d9ce3c4981f3013622ab17cbe72697b73f2a4b8d794b7409ab83386020b9470355b1f441a533d565c12248412b518
- SSDEEP 768:gf36HJFAIXTIt8YCFMQLUybE+cRMWXQGlvbATF4qP8PWzZ1naTLBWexBB2t370+X:gfYJDyMgvU6Wt1C2mpPR4
- TLSH T17563A5868D022E3B996BF599BE0667FBD47E9C1B4E2C0709B4DD5AD8837809403FC356
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Dutch.ini
- SHA256 c3a8b3f305f66e6801dd738dfc3c6934f10eb1874f177d79dec30564a29d1b6b
- MD5 6aa3f0edc2cadc362174f000273fdcef
- SHA1 fb2157f1931854e7c1ba71559f64ad8c86e77af4
- SHA512 ea070006b85712e495a1eef7d98061de29a25501baa7f0ce59ea67798473e544900aafedbc596b52016dd35717be4e953d3abad37ae788ed8e82021abb04aed4
- SSDEEP 1536:7VeFTS/4QTjsZTf/Uevv4vWWm3aM+gnHSQNEVOL5jwMV:76QT4ZTfs8t3aMDy4EVOLbV
- TLSH T14DB3E31136E91018B4B37B859FF9D2A4CB77BDE955368E1E119C010A17EF9809E22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Dutch.lang
- SHA256 f1cb4e8ad3364a1acd8a9f9b1c4823ef4c9a7244d3afb462e113fdb0b7098fee
- MD5 548b52b5ba0fede5b18a85351df4e52f
- SHA1 2e864179c6b1dc7e1febb9d0c3687fbec32d05ea
- SHA512 9393d8c46d011fb8c12d432166800491c092476c1670800d55152cea03a53b4461148177155e487775e29f6d7ac7deed1f9d61ec650902e303662744e2340494
- SSDEEP 768:OPB1gZuQK8l3kQng1NM4Mg/QI4rYrDYHgtISNS00J3JvBeSdHPF58BVgD4oLneWr:OwK8l3k4rrYrDq00h0OC8LZ1sBs3
- TLSH T11863E7074E025C3B999BF486FE8547F7E57A940A8D7C4B28B0AEDAF5473449903BC392
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/English.ini
- SHA256 0f9d467f6bb6f682c0d1351b26038950c73720f2bfc0741ec1c7bfab2046d75f
- MD5 525ce1c02ca53f9c63cb697ed3aae899
- SHA1 9ddc2763d9dd663f3cb0febf0d580e21c52c2f18
- SHA512 734d599d839b1266c42f340e044243ae30d1859d314eed7738f72f59201d19359f1ac6ee0cac8bfef4a0a2b8f2232a4f1f33336770c8c43f929c1bef162d2317
- SSDEEP 1536:5S5Ybl8/lKlXiF3y24FMuRvV5I7BohUT1:xxXiVQV5uJ1
- TLSH T19EB3941136E91018B0B77A959FBAD264CB37B9E8953ACE1E109D010B17EF9505E23FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/English.lang
- SHA256 d08df0231cc1a9579f177a6ed4057fd707487e0fd6e03787dd8bc3d86feaa2f7
- MD5 35b1101ee1f4b2d7df182b9bbd91cf88
- SHA1 ae311cc350c2f9c0918300fd99876cd95660748f
- SHA512 5ea12b3738df2c18da84109d81d7c58332dec6f02257f23d66867b1beaba09287e7007fdfd6d0b58af12cd2eaf2c58063ae312c83f409bb89a7abfd893932b45
- SSDEEP 768:RtWXHNkFQHI0N5k1e+0k6AJ5VPlW9HrPJ1iwV3N4EuMV9MXFKA687oosFdZtv6gq:EHdoYa4vt6gEbTC09
- TLSH T17A63C55A6E031C379897E486BF06A7F7D435A80E0E5E0B55B4ADA6C8A33C49043FD3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Farsi.ini
- SHA256 f76ba06b70927aa15dffcd8dc0604c5e7a7c6e5ba7a91a6faf807b769b54c85d
- MD5 2cb8837e4e85e3d85d004ebb3c779c08
- SHA1 db89c51ffce5be5f141ce2a9f46d428be7fabf91
- SHA512 a4c2a401203d31631fce9d53116ca62b7afe7c16f1012861b9d3dab26ccc8505e6ce09fcb81e5c83beb43cd40b4d21b49f330fb2c99eafeee7250bba9b727ef4
- SSDEEP 768:w7HTYzGe5eGG0jh3OlYRCryudmeAi2Ig1+LrjkC0td/3jK2eJifPeipO9RcjU/Y+:wHTYzGEpleu4yoAurjkC7A9D9k7ArRW
- TLSH T128A3D10168E9D43835277699CF8AD667C323A1EC41FA8E3A05DD052B179F8A85F07FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Farsi.lang
- SHA256 efc71fe26993906194de1dddc7108fadd13333147a0a59dcf77dcf8f45ee5d20
- MD5 daab2272683f6eb7e7c699190e719eb0
- SHA1 a6ef94b9e68fec631ec44ae673dd3d77842ac8ed
- SHA512 3d2ac60cc6cd1385be7e70ad99f173bf6293505379eb67cc62d5276cd8b9920e026b623bb75bb5cfdf9438af842035ba6d401da45fc7f912f26244dff3b7b1d0
- SSDEEP 1536:VKdqrbWDGYzZ5TOKfgs+48iE3ChzYycPZRf:VK4rbWD1fTOpiEuo
- TLSH T1D38321851D282E728667E11769933A79C67BED139608EF40B0AF0FA15778023977DF23
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Finnish.ini
- SHA256 eb6cd045c3899f7ca4a7ecd4e8211478720206b3e607ab21c22e164f4c684510
- MD5 09abf1d7277a388b362c7c94012c9655
- SHA1 85b3a52814c0a4bc9b0c39550e920340f4fb2ac2
- SHA512 c531f18b5516a5cd32733bd2c00be746d580805a1178971ac57316befcdd0216e906e2283690157c622f217743a10d09e1e78b82558301a95aeb80f2278d4cb0
- SSDEEP 1536:+0X4yMypD2b6/lXRYpc1maOK+RJh5enKT2e2ULv387G:fMyYL5/fgG2e2UL4G
- TLSH T16EB3801125F91024F1B3BA859FE9D264C737B9DA567ACE1E119C050E17EF8809E22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Finnish.lang
- SHA256 6cb59c198494e2a1fb9d41b1cb34ee4acba0445f661bda61c3f3b98dad32fa9c
- MD5 dea5c510318412aa19140c9d4d7d0429
- SHA1 4b952bfe7ef2c440c07181b98912864768f48689
- SHA512 87160d9cac26cfc0c8de7ccdfa152a48c435b5d07c017dbbfb31924368a230840731d58e99035211539d2de67b92e0d6c00179e72a09357583adda817227f18a
- SSDEEP 768:nmT7HduZ4OIAP6AJ5VgRNWOh0npttZAe/tLHDTWIrfIv7eXX5OAl37Y8NJnI:nS79uOStTvtfWsfo7aoY3suI
- TLSH T16133B7495D13AD7659A7F4C6BE0143FEF4B5A80A9D6C0F05B48F6BC483B80848BBC766
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/French.ini
- SHA256 a45a453c475760d88b96375687e1cd476e4b6e847b313deb06da8c70bb1ff6e2
- MD5 0d6f9b38d4a9a57d3e7e1d1811806cb0
- SHA1 75c28446e5f00c8863a661ddddfdc04b8b5685ce
- SHA512 85ce7d120630b6416d966b7eeeff7ac78f21e1cefd220519cf9d48d24ab34b69ef9ff31acead36c37a09183509ff800b218542e860870cf95b22840f87e9822b
- SSDEEP 768:w6xL2y68PnZ20f1tZQZZ2Ph9+sIvzWO9V+QiB8JZ2Prs7zWIkCWXHTsJ6my2PLQs:RxLOknZw4PKWXHth0Do+
- TLSH T1AFC3B51137E91114F5B37A959FBAD265CB37B5D9893A8E1E008C015A27FBD408E22F73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/French.lang
- SHA256 c8b718c7c4aed6759b876c693e4bb34657fbfb4f45055ee5c1fae5702d8c903b
- MD5 2b3361ec1d82fde6d42a2ec6a703a0df
- SHA1 da658c452369ff29fdc9c05bb3544f007e9fed37
- SHA512 d09c244732efd808855a5c63aadd921d05d263a8cc2fc4ca536a7f8f9f7625f2f99eb940cc613da475bdf82a1e4b6530be235d4b48ecaa96170fad9c57f61ef3
- SSDEEP 1536:/7NqY1PqdCG0cfd4m9GfxCIeiepfak02NRu:DNqCPJcGvCIeiie2W
- TLSH T1F473860AAD8129736583F147BE42D3F7E4388E069D4DA70574AE66C8837C8EC93BE355
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/German.ini
- SHA256 6c56774211c343d45eb76c534f2877685a7bed1e02f0f20d66db1c1d721d608f
- MD5 92557857fdd4a311641da09a5e188d54
- SHA1 eccac9cce6710f695a66a6bb3802bc53125f7a22
- SHA512 796c35e7a0e3b366bf80211e8e3d82871c7bd3c09a9abe5aeecf71624b4fa5d11c2bed0a4ba5024d4099276ce85d624b8610bd44d179b55f0d86be9fef8ca4c3
- SSDEEP 3072:DWwLtz1UvCEwIk6+9KVUZPuGF4M7x/5GqPa7wXLdzawRKGuEv0vkV:R
- TLSH T16BB3A01126E91128F1B37B859FB9D264DB33BDE95676CE0E119C014A17FB9408E23FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/German.lang
- SHA256 66437eccab96d90a83cda2c435e223e1efe5b4025ab0d52821060137e99b72bc
- MD5 091a7f8c9c27e458a3aa74cd89f1afa2
- SHA1 522051a580b02c81e52de82b5f81170d63645ab0
- SHA512 8493e6226d4e4fdee9793d6e52c759c073c0bb5417fd9d6f3685cdf1dbf4f3754e0e668c2f1e14f2e258de82d90b2cca285bb6e46ecc97a3c0d75ac3400bda19
- SSDEEP 768:po52bnMiyv98MjK8aTYPxJnjE7xsGsigEyFkYYR3wvPLZoovx3zF3c/YMzftBHgt:652mjrBxEr8r3c/3zftJeHx
- TLSH T12F73E7522D076D3BDA6BF2457E0183FAF439C9474E9C2758B4ADA2E983390A407FC356
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Greek.ini
- SHA256 6af7a755923d8ab1a2c64ec69679a395f4577901ddb3c36acbff8e15b5d113b5
- MD5 532946fc3923ee5d3ed293e9ea313ed9
- SHA1 e3be2018d29eac14fc921ccacf4cf40d94354aee
- SHA512 138de5283c004b59be5bf63d01d4a4b43b3d01d36a26f480446091a50b7d3c4c7693e59f3f46fed18dcb5fbd51c064d7dfad126cc86eee62ac165938d58c1a5b
- SSDEEP 3072:oNR2HHk8ysv5boM+q9KmzLy/sw6k8jCD6fCJf2:AE5boM+q9KmzLy/sw6k8jCD6fCJe
- TLSH T1C5B3F41929EB2124B96674F69F9BC255C72FF1D90539DE6A20EC210667DF8010EC3F72
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Greek.lang
- SHA256 66bb02ade87b67914111a80956e8c2654a5e71858a509462967ff1336a6b177f
- MD5 84e4c0abec522f2261b7d08b055baca1
- SHA1 eb308495150e9e72efb790ecaa2aaa196404fe50
- SHA512 ec611dc35f823f14f6d76a20a3b34a41b41939b9062b5fb4bf3bba423fddb86710bb7a2e945b5f0b1e7320af8757eb667a45c636d406d7da490abfaa6a24c0ed
- SSDEEP 1536:Sy/I/efMy/aHZm6bfEvQ9J26LaCrReuSq/9U9k+Dt9aScHy4Y/QmUDYX:Sy/I/eky/aHZlfExm9UpcSbN
- TLSH T19B93DB9FBC042EB9944BF0465999A17DEF867D196A09CAD4712DC7D0BBF8060823DF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hebrew.ini
- SHA256 42ba655e5b635698995a588f4dd39147be867a0c4b45fd49edc65982b12b9531
- MD5 dbf6973ac46a0adcae8500a16cce4e48
- SHA1 eae986788b33ad048f08ba722fd4eb7354212e63
- SHA512 7a59fe15ac9c10caf3b3abed60201f008583684dfa476cbb9f8ad4c3f5e93d34f31dec859019f1f36d92129b2298272df5eec15be59e367cdcb77d5e89b46549
- SSDEEP 768:w2kJwh+FrSb7UJTvsjkhsRGn6PqwKJTDv69ZUtiGn5Eq5lBQAjV8WEdtWfSZu/JR:zkJwh+FrScvs6Eq5uWpfSZ6KlThAd+C
- TLSH T14DA3A11135D9A168B523FA868F8ED66DC363E6D8417ABE1B109C052227DF8900F1FFB5
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hebrew.lang
- SHA256 18638e0d1eb39967b226ffaeea4277742cb748d2b5955c585d4bbeaa330c535d
- MD5 08b3364e1f0071a77b286fc0dbe14a47
- SHA1 c5f1b38e751fb53c9e32b958005d83b4af70d38f
- SHA512 053d9326db7a89ac4cbcdebbcd53772b000aa354425dca6a333402e557ceea8346d9ff629e54a1eeb848b99a6ab27cc26fb4a36c4dc817f20f575cfeed8588a7
- SSDEEP 768:qFg2nkYqrRVb91xaMFLEryMRMk8vOt6QSOoqr2JOpRFdun+DG7kmy2SMOlf+RsfJ:2g2YDMOLQ8daCkD+OXXbd
- TLSH T17073DEC89DC50B318037F9C25F41E569EF7285622C5A2A14F70C2ADC9F362E4A6FE395
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hindi.ini
- SHA256 0fdec29dfb2f882fabc1a1a4a1df1622589df4310485f7232b1f892e4aca82a7
- MD5 de9f2581181762d8370d6710f0f5ed13
- SHA1 bb8ace83f93a5288f02818b8669003b82ec1229f
- SHA512 1f90ae67a13b9b78e8a3c85ce0d72972097d45993d9664f5f2bcd8ba45f96378ee423405365060cacfbd8bdbb58d8eceaa5a40a88afcfaee6d6bd13519032797
- SSDEEP 1536:7Rh0t3bsVTMy/lBXvQuc1SCjHAV1AmgNBPgT+U+SHx5YT:7Rh0mvKmwsJx5YT
- TLSH T1E7A3060135D91024B06BB9D6DF9AD267CBA7B9E8527E8E0A00DD020757DF8785E13FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hindi.lang
- SHA256 5cc1b64419d533e88d61ca6adba0f0cb9303029ebc551436d8931e31ee159335
- MD5 48ce24f26a78ca500d5c7e9108113c9a
- SHA1 0a708c1b2fefecf587228a1d5806709b0d916fa6
- SHA512 9cd903eaa4401fefe90b86b65c5786b483144c96171cab4a8665ee7f2a891a90787d946a62d3290a2a28a31d30018ade0bc62e0d2c751c2cfdfb4bb5fad52f3d
- SSDEEP 768:ba0TLFm5t6AJ5VImMWhOs5Lc7VaGxt8EVIW6BuH/:O0TL4c5f
- TLSH T1DD63990DAF25F73548AEF48A3E050B77C47864379BB85612B49DB2D68760C7052BE3B2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hungarian.ini
- SHA256 fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d
- MD5 7591df7fae4342cbc7a0706e1b28e87b
- SHA1 825e88ad498e8713522f5aef3b21ee01d6fa8b41
- SHA512 8f58c6fbaf5ea140a3ecbbc88cbf4bdd0e0ba3fbdf169f4b7cb831094a47a6ead103f89fc07748f91d1396ebd13c7ebcc90a316f0eb203ff4c86a50be5cd3ca4
- SSDEEP 3072:UaKBsDgGod8NAH4iyf8kXrLfKgL6YhL+L3yGU:73X
- TLSH T126B3A31132ED1119B177BA959FF9D2A5C737B9E9563ACE1E009C010B17EF8409E22FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Hungarian.lang
- SHA256 a09b0e89ac30d112c99c8b4c36795a7977b74a2beca74ac00521932254197dcb
- MD5 ccb3610a528134a424a9aa2a18b69296
- SHA1 feb3859c22acaa79ed7561d004bcedef6bf90848
- SHA512 73cc61f4f2a51fc25cebed0d3b2913c651a297db628da580576369869444dcdd87422de9b1a0d32049cc5894fc75a152cae64cbe9e2ce9e2ed36dbbb4b03a51a
- SSDEEP 768:1iJi0IXFw91XLV+6AJ5V10WAdVBSg9Wtj4SSsK0c/sDsDmeMZYGrUxfQSmDE3+cG:1si0IXFwZVB4K9n0tferG4iST35MpkA/
- TLSH T17333D86A1D125C3B852BE887BE0153FBD93E980B6D1E0F5630AE67C683781444BFD74A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Indonesian.ini
- SHA256 9e52e0b1f7ec39a36e2edd0231dc98865de8524a651fcf6b1b948a575e35fd0f
- MD5 d944d8a3551719a176db4da31733ab75
- SHA1 6cf51cb43dbd7ca84334389076adbabe407d95b8
- SHA512 b9077bdeb69e07894c995bd519ebab594016c8077a213b29264a8040370c9841f1ad6dada2d0af595a596a3875f9c9989dc30af8e7c7b981b420cf1382d5c9a6
- SSDEEP 768:wbWt5bTJA+NtkooQG+Wioa6lBT8IwUzCc0qfcLVUWf1RzVARBBfxP7KLVoeY4z9v:9bT+atkwR2AIheY4pMOy0F8gx
- TLSH T14CB3E91136DD2015B5B77B859FE9D2A4CB27F9D9563A8E1E118C010A1BEF8C05E23FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Indonesian.lang
- SHA256 38a8581e5c1efd80c26a6c4db90e2ee1f395ba7d68fb67b102a3e188cfab9fc3
- MD5 17aa49394a52a2fb421bf08acc87fdd2
- SHA1 308b8ef955bd18a317f3e6109415a61add1cca2e
- SHA512 40be990b1894f7f27a7af670eeaa84514d680212e8208e24d79e62fe12e0e73dffcfd70881720395e65ab81a7cd0fd46bd491cb2eb510ac504a1a0229b3b95c5
- SSDEEP 768:OoiEC1/BmlKjUV+fSlgTG/ZCn92MAvdNyE5ED7vnuX3ioCxKVR4:3iEC1/BmfLc29aXSMKM
- TLSH T10933A4158D02683A9857E4D9BE4967FBF83D6A076E5C5708785DAFE083B40D083BCBC9
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Italian.ini
- SHA256 9544db0f451e22cac4f886d73b0f9d6b4e64fb8d8304c412b7677d70252fbefc
- MD5 f56e3c49a512aa717f2022a129961af6
- SHA1 ab31ce42622481d52549d77d68dbdba6963976d3
- SHA512 d1a922dcdf379521fbef35bea6ef08a6d6609502f79796619a40f9c1816429279804926ed2ae9a5bc11579dfb2bd013f1f815651cbdfb877740a28c80fe590d6
- SSDEEP 768:w1DSOMjufZEyu5UkPV3cqcmjKOfoXr0ykFz02/DycTOf8T9j41enHtwYJYAS1MrM:2DSOMjOjkPV3XT9jOMrrw6CCG
- TLSH T17EB3B21132F92118F1F37A85AFBAD264CB37B9E9953A8D1E019D010A17FB8545E22F73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Italian.lang
- SHA256 55e0f66e246596e09d0708e8d40429c932a6b0df490e7289d4f6550272c71611
- MD5 2a731322166a9606228b5d6e6b0c6171
- SHA1 e5614e71e30ea268bfd5010b0cdbf30822404f18
- SHA512 64cb1f4cd7c04acc56811b3961fd6ed602fb87d5da87540eff06cad571277887a4a9a8ad7e16f2018bec3d4769a6c891cba3757c2a7358b233004974f8c74110
- SSDEEP 1536:ZpaKF/p+m/LhqCZtVTFHqV0KhejOkG+FKv:ZpaKF/pb/LRU0KhejOJb
- TLSH T11673C9265E461C32A867E18EFF42A3E7E4749C4B2D1D271474AE27C8937C88057FC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Italian2.ini
- SHA256 a21450767a4237a2206cb69e475427151bc24c63ef80d812743dbef799f60a4a
- MD5 9f8875359f6bb8b07b072c8dae9b9ea2
- SHA1 7214303695d43acfa20e692712f0ec9494fb2467
- SHA512 ce804dd261314bb6e0a2ba89efa5094792635b6cb4ae4fbafe9ab6d9d2ffc5ff5c63b7fa58d2426ee6b4b9e419fdd78c89dd6be35383f6e32574443fe83ea5a1
- SSDEEP 768:wiDSihiSfEELeAHkYV3c4cmUKOfpXr0dkSzy2/D5cTOfl6cjl2enHtwKJYAj8D9d:5DSihiyHkYV3N6cjMD97B6CRp
- TLSH T1E3B3C31132F91118F1F77A85AFBAD264CB37B9E9953A8E1E019D010A17FB8505E22F73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Italian2.lang
- SHA256 a3b38b385a49b3afef70ce1fac0fe0e1dec4ebc9e87679c27c7fe3a3bc351cdf
- MD5 78771fd13555e87124a817c4f05836c7
- SHA1 2982446f40e503657fee65b2b10091d20fd7ae9f
- SHA512 0569f3d8bb602a9c4f87ba95d63ccd8e34430444152bfbe45243d8ef03cbe713eebb9258aec82ffd1354d8459799384bb1fdcd972439cbf89cc88740fa013041
- SSDEEP 1536:suaGWrF+m6eWqiDtVTFHqP70tstw7pG6i:suaGWrFb6ekI70tstUw
- TLSH T1EF73C8265E451C32A867E18AFF42B3E7F475AC4B2D1D271474AE27C8937888053FC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Japanese.ini
- SHA256 9077b41d743ed6af51cd9b8aedaebb6d1e0e6217825635a1aa9451994efaff0f
- MD5 36d47bfae8d0d48d56b7b1feb3b317e7
- SHA1 1d8d59aa40f765319fcb70a9f49e997aca305b89
- SHA512 b510a5b17e52778b87f58aaa61f222f11c6190a988440789d1d40591aebdcc7311f7bb3bee9621ab8d971dc2de1ec6ed4d52598b3808dd689f693c3e5897f938
- SSDEEP 768:wPZoCIywqTgXCaNnWYjV6UDFlv0Gaf9xS7ua6PE0FtrqGv0ZQkxKQRTM94DGNWdN:1CIywqTKnWKV5GAQkxHKUfxJYNeNx
- TLSH T11E93F15435E921297067B5D68FCEE2A8C767B1EC427A8E5A10DC460B23EF8851F13FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Japanese.lang
- SHA256 f6eda08261c22ae829f73e82149303149d64d6829c2580a7d754c43b2c90367f
- MD5 2d28db971a841b73f7c64204e6f5329f
- SHA1 1e50e2d15e431543eebd22ee77db0306e1892c6f
- SHA512 201e6e0b20dd3787787b31760a718ed8733c6bef66c654f5adaa449d5b41f6a3fbb54dc642d36198fc8c65d8e7b37d44de215397e62502da2efb1965b778a5ec
- SSDEEP 768:QF3yatnKWCKVS2RO3qst3FdGlQK3Ph8mA+wgfblWQBvplntKw9yBjRwKfHafQkx:ranOm/A+vfblW+PnYCy3nm
- TLSH T10C83212C8F8229368853E1526D0A33E2F5158C06FCA96F25716EE5E4AB305CCD7BCB75
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Kazakh.ini
- SHA256 1fde00989b3baeb67e6b1f8654cd2fc7216a40a4c5a5a9a64d03d47ee95e76be
- MD5 fe2b5687f2de60cb55629fd7f0ca9a21
- SHA1 5299f36a7b8c5a0b59e3603b8517cb1b3e0f2160
- SHA512 ebda06bfb42a56ed71915a1f42d84edb795927697eae51fa98bcdbac76ce6dd224c7e7610743050f45649f2d756aea82e47af3ef6ad929ddc9593d8044e3334d
- SSDEEP 1536:UdBOtqJCnhr189gDXrbF3h14FMuRv5RI7EhUv1:isH/VG5Rm1
- TLSH T1FDB32A0236F91014B077BA959FAAD265C777F6E8563ACE1E109E010B17EF8505E23FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Kazakh.lang
- SHA256 2ebeaf2f7db3e034b33e94d0fc71e976ada3e529649101bd66139e2f988b6d48
- MD5 7e294b3cf9b5763ea3f3edcbd79b78cb
- SHA1 e6bb48bc55bd98206efb43cd87e84537989c0588
- SHA512 1ae85c53cd9ab29147a0e52af1e742c03150bbc6b431c7f2d89f624d9aca7b09119222c96d075c20dd7eb1fec388801ab34b868fac1cce2b18c576ddc083d24d
- SSDEEP 768:Z2xUnjbsDHBb2hN3/4d6akQUVyHzAfO21iwQ3NxeVJGMPO8cTo9LpUH6Ob8QNUuW:8xUnjbsDH83ufHzzSI6R
- TLSH T10443B6451D079C7B9453F8867F0267BBE87A681E6E9E1751B45EBACC63B809003FC386
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Korean.ini
- SHA256 ad556989f6e4a683d9668e41d2d7175b7b46847c2eef26188b9075fc600d0132
- MD5 efae0c78be2abe2920c78b9d4785ab45
- SHA1 8c0799fb68852cb071bbe260deb4ab357bd5f4ed
- SHA512 44737be4d4bd0f93ca3e986c89102612932f3749b8e9b89446a567cff60ceb856b4bd7380da7fe3f1809579e6ec2162d0cdd4a217935a4961c6b36a482dd4ac8
- SSDEEP 768:wPYhkzQl6qE7rY+xuPAsyKVmq8Ag8lyWqFk5ziCfsg8S+EZNlWJ7lxyBiCWfbMav:HSzQlc7siCmq8AFlBmLfbNA2Nt7osVP
- TLSH T1F293231175D960297027B6C58F8ED3A9C327A2EC527B8E1A10DC160B27DF9909F13FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Korean.lang
- SHA256 bb0b29d17b42b1220870cb135f34d7ad03a0f85fc0f450fc2a390df87f7e7d75
- MD5 bc6a53aa5a1f780c0069ba5592d66c31
- SHA1 364131a2a30939a0f05f2c06d2a79ef665fe2ede
- SHA512 da40e4adba231088de64d1312d3f8cce32952db1cbf03120255e21a7263aeb0e7726e48666a0c4fb4546c5ca04b6f3af8dd6d88aa2d15a93f0718e697e25eeb7
- SSDEEP 768:TjKP/PLZIw/7ngGsVLl36KpsEba8ACi5XS8Mq+NqHkR04eLutnFjXitpLQpd7NdK:XKtTwlPtiNAN6uzMCbKMkubeKh2d
- TLSH T1507373635C2319782597D4417EF6A36BD1C9A4430F6E0358B9CD9EC9CB348C10EBEBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Kurdish.ini
- SHA256 94ac43cb7eb95277db44616a53b23e9174415377b4b3b98a1bdfc98d06a40a4b
- MD5 af61b416403963d653f5008aaba82e03
- SHA1 b1ab14d6ee43e1230cfcc5acfc4de27ab2a6f6b3
- SHA512 a65a21d5d9f7085acf0a96701d4577bf5fbfc0ebcb4f188ff39139b135570f95d76677e6470261aef022b75378898342ab3105704228029f90b8998f414603ab
- SSDEEP 1536:rESqStTfwl/lmie4rC3DA3f1wjF7af0/KkmwL3mnJ/6BD1I:lbTNC
- TLSH T117B3121165E9903570277694CF8AD266C333B5DC51FA8E3A09DE052B1BDF8A48E13FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Kurdish.lang
- SHA256 5cef63518e2c7a79d015f2acab5466214f73e8148c205590354902aed760abf8
- MD5 6e2ab546147a20791937deae48f725fd
- SHA1 39dfee82dcf43d273429443194d6b69f4d08d936
- SHA512 f6a20f801465426e9882f64eca78c840f4a37e2d2bc261f9ff961522a1f78eafeb96827023d4a471a139648d26e908c6fa6f16302bee17f4f5948d21875ac58d
- SSDEEP 768:6mrXjefnk7KJrC8GK6AJ5V2gfVb+7L/6SiyWpQ7nCPpZmLV/gga8ddwaaKYsktZE:6UmoKJSmpOaNaai5bt
- TLSH T14B53618B1E389E3283A7F446AE4276B0C76F3D172509CE44B46E1AC44B255125FFCB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Lithuanian.ini
- SHA256 24adee0cec1265578d8f63415b4b978f3861e56b6a5003acbdcb5e1f3e23b7d2
- MD5 90b79cf8cccb6091c1adb095add878fe
- SHA1 0d673c414d4ad01f03ba48cbdc0b47867083c74c
- SHA512 8ab159f747ab4b988e4849c4fa7f7269cb9b0a38b8a14c04a107275e614871964cc4751858bf3c0f3f08bc0ef9c0370f36ca4f299542458b789655375787e2eb
- SSDEEP 768:woG67lSJza9I4kNe0pggOJ+4ZY6S+y4WDHuMhzEmrV7dF4s9reLu1ywam0gPuM5f:VdlSJzKIh0J+4DwamVLN29pE
- TLSH T1BEB3C21136E91019F1F37A859FD9D265CB37B5E9563ACE1B109C010B27EF8909E22FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Lithuanian.lang
- SHA256 970481446cba1c76e58efa65a5091fec1ed740a3e010604862634aabf945ee59
- MD5 628d9c80ae8f699d0d4a4e55cf9ef2f4
- SHA1 e7df3a83068d3f4704c137be2f26309ca7b88500
- SHA512 a08b955df59366885a93cf7bca4bb6f131b74f40ee38b20073f391368881e374caef0ddbe4266d3f56815065309dffff71d3b1e7cd0eac5650f7dadca36ff547
- SSDEEP 768:M7A+bo9I633x8/0obeAfB4Z9jKQkyAKEUK5wsuDYFF+nIlVGJAwZ5KEdGFNBxYL9:oA+bHQ8KEyjEJwZ5Vdc5YAcGHM8m1+SP
- TLSH T17763D8061D036CBB8867F4CA7E069BFBC8755A056EAD4B14B4AD67C4C37908027FCB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Norwegian.ini
- SHA256 1c99b7b06af0d5ac5582f00447fbe04e2325e173666cba8ce2d18678f7b31e3b
- MD5 5cf9c294bd9d233d95e54e198bd8b4ab
- SHA1 670de196a831bc9b0d503694b594524ccfb77b04
- SHA512 bea2be5e1dab1854cbb83fc221f392793aa7b67a1ba1ee521c4ad0aaea671bbbda868d57b3b226cc713eaf9f90bd9fc05b3166353d78c532a43111349159ac7c
- SSDEEP 3072:/Tu1PWiYzr8Z2GIBpLkQXtgpE7ZrB2kyC+3HX:0
- TLSH T136A3A31136E92118B1B77A959FFAD264C737B9E8953ACE1E109C010B17EF8504E63FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Norwegian.lang
- SHA256 10280a5aef7004697c07570f262676189d4e8a2fb46df0c01c9ac8d3b4be74fc
- MD5 246e62c17107c7c859aacbeaf250dfb1
- SHA1 3376f1775853a22aaea3d1a80bd1e34c1b3c5af5
- SHA512 212e016e3942254c72e85be218b7e1e8cce82c2cd1c1f1f8a5b6a1d7b2f808dbd2ccbfc1740cbff5e63a0969bbee4e2fa897bf84742e8f447fe88657152a11f0
- SSDEEP 768:c71eg/LYVhUlD126AJ5VjhWvHR9oyGDinyA8i+0Bi6cCkxX4TLWdGLIOH:21egDhLnnzYO7Csx
- TLSH T16E33B54A9E036D37988BE48ABF0667FBD8399C0E4D6C0B45749D66D8E37818443FC396
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Polish.ini
- SHA256 79aa94f5abf1d717a5ae26e73a6f32713b6da2ade2e7c3d21a1a4f696daa979d
- MD5 f1bb7671a64f3c9eb76cf79175929c20
- SHA1 405a3b22a4188ade84d63e28dc027bee2fc2fb19
- SHA512 2a0bcb18ae40b852524b30bcd5c4c04a77adaa5fddd723ca065840374597197558052816ab86ff83d3fb6eee3a546ee30fd7a444a0c3a153326d56620130ca3c
- SSDEEP 768:wVNKpb4dFFx0YFpcLItTJRKDQsBl/CNutf7LN2VxO5TcjF+QZbYURDNM9BHUQJPI:yMpb4dvxbRZsBlKN29BHUcqOKTLKyv
- TLSH T1A8B3080136F92114B1B7BA959FDAE268CB3BB5E952368E5E109C010717EF8905E13FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Polish.lang
- SHA256 641733d827364092cde9f95260baa12c0c08a6d0ac9a622cc2fd2852a376e69f
- MD5 7c1ac0a551ef2a2d65113ff40f4786b9
- SHA1 33af83a72a055b9ec2d973b1f1fdfe73c260c7f1
- SHA512 76c00b704bd77ee4764bacafc62aacd48291ce4e802731445d9baa34e22b212d9fa0f7bacadc7baa4f21b6f4aae68748e1ff9eb787e041fb44e7fe2279805934
- SSDEEP 768:azwsS5WPPNWcMwf/AqLSMpq8+eXLO6rUb74Foz+EQ1RdHsLsOWsA0b4D95V4V4Bu:7s67Evkj0RdHsL1WL0bM95V4VYBY8oT
- TLSH T1FB63D78A5E129C769CBBF48ABD4793F9D8BD58065E1C4B08B4DE66D483B809103BC3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Portuguese.ini
- SHA256 81f5cdec57a6ce2c28d3fa73d59921dfbe9e27beffa76fd390ea32beb4815277
- MD5 a0db2b36fac97a6d19c1cd58ccd12598
- SHA1 eeb2d08e096d1a02a871df6bbe72bf82519906b4
- SHA512 1d43421fb9b4a07baa683e730fe81c91179f14bce8bcfba104c479a764d2303c028c3f8c103ad4a57f697210122cd490cc5d7c4378006ff3a05649663f555715
- SSDEEP 768:w4onUHFvlKYqE9FARTDWcspDOgfwCuWEV182yc3nDO+JYZElNg8S0PUjM2x4Agrm:2nUHFvlKY5AR3NJYZRM2x2/D8
- TLSH T19CB39E1126FD1114F4B37A968FAAD265CB37B5E8553A8E1E009C110B1BFBD409E26FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Portuguese.lang
- SHA256 42f2f12149b5a14a4ef6c756c75c3a326be462a04f578066b60476c2bb9f0d07
- MD5 d7e859564cfb1f67b44df9540b87ffa0
- SHA1 1fe79d43bce274142e5818c2b81cbdbcfdcd5a4e
- SHA512 414ab02b356d6d492c2841215be8e28f00d0bc6f73690160c867b65ea906fa7d4b40e5f5e70000748f8dc7c2bb135a5b0a3df97999a2839d6fdd7c6b2b9fe55a
- SSDEEP 768:DG68yC+NNmkGw7XAJ5Vl55AzIOBG8yAEDnvnJAZGQpaD6sst3eFEv2oml9GSoL:Dw9+NHGOVtc1nvnWS8h
- TLSH T1FD4374261E0658364963F792FF01D7B7E8A8A8071C1D5B49B29E97C0A3BC5B043FC766
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/PortugueseBR.ini
- SHA256 c55b8be4c8b4a349bdf5a0964adde702efc4620a05094cab4587bf44d6878471
- MD5 7a0fa474a69a7d9c5b3a82e2dfa0cf04
- SHA1 a2be0cfb718eed9cda9cfe7e8b6456d8e5f2a74c
- SHA512 3e9aea6cc62b70f33ad8a8818efd34f8302c3891d659e5d0cb7866607cab1b118a818a445450ac03ffc203c990eaf4bbdfbbfac7d30c12b853f3b1aad1fbd3bd
- SSDEEP 768:wMbN1Co32yzWZW1kihWPqcffDO6xQ00cOMbqOcyRnDOaJ89kDrg8+hH9ZMufoMCW:P1Co32yzGihmnJ89rMufodN5m
- TLSH T148B3B21167FD1118F5B3BA868FA9D265CB37B9E9553A8D0E009C010B1BFB9409E26F73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/PortugueseBR.lang
- SHA256 b44ace97efba2f7782a960e91493b677a94351c6b1a125e94dd7081b02d3a341
- MD5 0a5035f573faf3ed67dec6515b458626
- SHA1 f2472545b296b445ebc0d1a33c128bc451dbfb59
- SHA512 418fc239f23e4a9e0853a4c0c2dfb7a44e3e9e0ecf74964172f9079438ee06bab4fb754157a74b7f057b98bdbd8c9dbbc798abe79724d6846277527c87340341
- SSDEEP 1536:DEacJqzEGTBnE8fSM/n3Yd4hQklOpQIkbc:4qzEGTB3gX9
- TLSH T13473A51B1D4619B64C67E3C2BF0697FBE8AD18035C1D8B45F1AEA7D083B8480477E7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Romanian.ini
- SHA256 3be68154b4721802685a32444c4abc72a0aff8fe488a772a1b1df5854268d0b3
- MD5 5725d7d35785e84b7d74926743f6fe0d
- SHA1 0920b953832223bdf8d36df192f1b8830cf37d61
- SHA512 8f371472a17204d23867b82180aee831bc5bf99711431d9321d5822c9ff1d9218d56ad46fdf37c9e3ea250069585530e9ea34b20331948eb8f8a4e174feb0df9
- SSDEEP 768:wzy8ANT626xZcdoovdlRpHzxecPLRfxC3f554CYsk9RNLREuOw4NvQoIqVgMmAfj:IANTl6xKdtVHguOw+dzG/S
- TLSH T11DB3D41136E91119F1B77A95AFB9D268CB37B6EA957A8D0F109C010A17FB8804E13F73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Romanian.lang
- SHA256 fd97d3a5df01d57aa4466e9602a6363280e6d287867741a182769549c46eca6b
- MD5 57aa9dbc3e0d19aedba337c7aca77dcd
- SHA1 a068a99f9e453c90ad4e08f9089328196af717ad
- SHA512 43388d72b651353f5a9417896619539b95da6a6d439e2271754354b78705028739cbcbb2a2dfee983872c9748e8b6c55a4ff716cf3af212336d5cee25e484708
- SSDEEP 768:Z5UaLh/AM9FJtw3THQ8DGg3c/H1h61AGk/U/4O5RFcXN/V6e3JkLxtBzDGwViFnM:/UaLyM5806lgO5YdGDvVipbY3
- TLSH T13B63C4525C429D334C57F4C6FE4177F7D89A980A2E2E674CB18D9AC593B80A107BCBCA
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Russian.ini
- SHA256 00ec97549036c54b872ea9da3610b43b74164ea2cecc06e64438b175d7605f2d
- MD5 5efa2b91ecb5bec144eab12505b2bc03
- SHA1 7905697da239ec3d470cc8365a8f79c1bd4aab97
- SHA512 4d354962af3b8670ec342c4ee799235dfe1004ad4e95306f166bce5322b6943f3c06d92b654d99b8d5200fa8bcd59d1be4b4e56ae3f1b1d328b40ff87f0d7dae
- SSDEEP 768:wJtJjUCGSx/LHfVaBU9a5nX3bhsXlp5eMPUxO8PUPlG9LQp5YyQQK20Nw3sAJUdn:1CGSx/rBKnXFyQQahXpGraNl
- TLSH T161B3C11BB9E961147026F1954F8AC6D5C2B7B3D8133A8D9A508F2916639F4B02F13FF2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Russian.lang
- SHA256 82f115d58a37b06f8cf0688309ec12d6999d428c228bef8eaf94de540258a9d2
- MD5 a013dd7556fc2bc9200d2c970215e200
- SHA1 1ce6ebb2943a1047ecc11b1e991d7ad51efa435c
- SHA512 3cc81c0dd9ef5da87fde71e7abee4198bfc22e88fbb6c489809210e69ad4f415da7b728f2b78170d5f8cae6b29215a57c245ba497a87861f4d04461a59f4aada
- SSDEEP 1536:iI+nm2vxhlNI5F6BpcsSykfzYCmPfxnpV:iI+nm2vxrNIaBpcsS/fzYLx
- TLSH T19B93CA651E4E6CBF0406F44BED056A59FCEA45BE2FAE1715346D2DAE63F2024933C30A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Serbian.ini
- SHA256 dfc35c969654e63152ec0f45fa0deb1c2613c883c5b65ae011db5123581d5eb6
- MD5 da416974387195327227edcd70449813
- SHA1 ef39ebdad4bbf05ba69b58022d92d716dc0274e5
- SHA512 b6b9fc4c38099f56cd91e6811f9b3a1af7245d006a7175921fb6ea04acc7249f47dec2855fd593efd86ac3eeccf1c05e1f6cfe55a99d6d82b39bcd0fc1caaf58
- SSDEEP 768:wG04uoYjirPnTogfCV76kgSIXNiBneXPgBwmVmQHdducBnVjdnDNq3xGRLPtoprE:04uoYjirPnTvfhkgWjdn0pYDMbgD
- TLSH T1F0B3DE1B79FC51147522F2954F8AC2D5D2A7B7E8633A4E5A108F2916239F8702F13FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Serbian.lang
- SHA256 f7a0a92795ba719e2f1e3247133518bdbc3e8b0c37926611a5be40ae5b66fbec
- MD5 9c975979e1908fa1604aca9c1bfdcdd3
- SHA1 db85192f068e35230aca856e8d759f1405bf4140
- SHA512 0bdf3f67e8f298c6c7e721b76d8028aca185a61306eda8019c450d5f8c7e9d0c81764917c5df56eb5f00d13123e54f1379a391ce11d90d680c416bc3937f24d3
- SSDEEP 1536:PEvqAuMaESwuvLJ9JbCCA2PL6Y6hpKl/tJJcZbgTSUTB:PEvqAuMaESwyLJ9lzA2PL6Y6hpKl/tJp
- TLSH T14563A7A20E4E3CEB0502E41FEC056A5AF8AA54BE2FAE1395356D1D9C73E007457BD34E
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/SimpChinese.ini
- SHA256 1bfa864f7012e64f5c1656fc5636ea29e87e2a45b5eb2c31a3b20643fdd8ad4d
- MD5 7aad044a68d89d8bb5a202f8bc69d87c
- SHA1 e20ca69d6f4d1612dc4457612a4b5e4808470bf3
- SHA512 1fe22968bcba141229d8a4d36f8a7d300e44e76ea701d6a07430854567d15c8b8ebaaacb646d038a89273414c5b2a48562407ca31ac9c75e1e22fece73686625
- SSDEEP 1536:SXm7cLrzWFubvgkOvAbGCgjhRrERD+0xs3sqPHGUt471J2BZIn:8FKNPHGVt
- TLSH T18B83001136D920697127B5D69FCED269C737A2ED827A8E6A10DD460723DF8801E23FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/SimpChinese.lang
- SHA256 8e75912879bd1b1c5ab2b6f89ad3268a998a65c37e54bda242e349040453c94e
- MD5 3f9fac376c1c2c38a106a7e382ef5700
- SHA1 4d14355815e172df71124dba3f2cda0af710ab03
- SHA512 dfe8828360f2c90f3bf750a69bfeb8364fc91a350a92b2bea34af3df3f5a1cf199225075860775f7298b2aa6babf8d706c59760f82ed3fbba8305bc6f1f525c1
- SSDEEP 768:kAX0XuCYjO8qYupIYgKqSrG/xxjP4bRGpEUZ8kVyqUTxEEXFiWV9t7J7UlPwefek:FqYuUwbDDloMeVwI+aF
- TLSH T1A963A6510E022CB69543F046BE824AFAF42959076EBD7B54B9CE96C4D3B404C13BEF9B
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Sinhala.ini
- SHA256 b6fad3bf2adba7c77641ee1a17ff4cd9e5e9b14bac1b855346c91a286e517504
- MD5 318ee9a93c4620940f88052b904f05ce
- SHA1 a5574f778537ce085d53c3fc52299b3049da2371
- SHA512 054c1e0322a170b83273a5c253eeb9ffc107056c555ca470d19dbdefc7d68c822d67576fd9333cf5b17357878dc6147a3d1367219db48b2b10e9bd915e806e52
- SSDEEP 1536:Run1VCXWZTr/lOPoMHjYMgr5xU1Jdr/pSnE8EtwO5vrzAKnUs2:RungtoMHjYMgrgJqE8EqOxzus2
- TLSH T193B3282139E92115B377B5858FCED264C727A1E9C2B68E0E109C493B23DF941AE13FB5
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Sinhala.lang
- SHA256 b8f87a8c87dc78f7661e2f4ed47ebe6e7e5ccb8b144159fab4038a02f6bfe971
- MD5 4ed13a45ccdbce7add1ea4c13287074a
- SHA1 9a1b8110936dacc4d77514a876052c160105a775
- SHA512 1b5331fe4d79fa65260b543e09f53e4a1a5a603f78ce7cc84024b7a4494b349aeb05c46c789d94b65cad86da99793d68774b95ffbdb327058f413abcdf30de19
- SSDEEP 1536:3C1Ke7+A/DYc5fgXQCIfacga4lNqSGuidVa4nnZplargHykFFaPA5FZyWkL9lRpC:y1iSZy6rxEO
- TLSH T1F26376BDAC3EE97568A6E001291443EFD958691B958A4320F06F57D8BB66C3007FCB73
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Slovak.ini
- SHA256 b5b2f7fc1c62f1c8161ec59af79cf5e8f12cb0070264703087dcc5cb58e7352a
- MD5 fcba4d2df72a46575ca828c807224431
- SHA1 265e34f895f4b2fbe98a39b960c385be7309dfaa
- SHA512 6edf1e1484225455b76a1deb6c9f02857433a941bc0aececb916f0aede4398a4f22e70e9c152bd6a78ba2f02f11237a6ee92fb05b21374d250f680b56c6a5cc1
- SSDEEP 3072:2ykd4BlB1wCoG9Yhgt8VQcGlW2Jw/6ro5pw9v6Nv83diJoTNfaRlnCoUjZ5bYtZr:P1wCnyNYpCaAWK
- TLSH T1F4B3B41132FD1115B0B7BA859FA9C2A5C737B5E9673A8E0F119C420717EB8805E62FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Slovak.lang
- SHA256 02b5880c0c67a58265a89eb2509130caf87d081e4e381c1a9d820be7779355a3
- MD5 759fa8b328c55a7a8b0d585b1c115f32
- SHA1 40bd0aac4138a8aa103a36505b98463af565ec2b
- SHA512 7bb35d37b7092c54dcca2eae62c9b718cc82fd8443609657354dd08a30b727e38950e0a5c2e5d04c8ca32fc7069a70e6515b472aa53f1dd8bbcb96369253186f
- SSDEEP 1536:2XB7gsl5lIqNIpSvlwpmFTEpOwhPwLZk2Cr04vXjzu3hOlbcx:2X9rNP6pmFTEpOwhPwlkRVu3hO8
- TLSH T14D63C57A4F022C7EC96BD94ABE8367B1EC3E58060E5C4B54B49E26C693B44C803FDB55
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Slovenian.ini
- SHA256 5184d032c6d29c94695665b4777bb3219ba53965cb2bdedb2706fe842d2b9aa4
- MD5 802dc486cd4f9617a0545d33c5d08ecd
- SHA1 17d767a2123f7b68e86738779e4eba5af867efb1
- SHA512 16657a203096cbdf7f61cb9769fcea95aadcd12bc281f0644a9a14aa5e7dbe3779ea0e8e889112ab9e03196970159a89d1f5ec615885909afeb0a9e6ac797381
- SSDEEP 1536:S0iht2a1sj7ZuJ1CE0oYShi1LHmxChEPi/q5:0+/ZurLi1LYChEp
- TLSH T109B3B51232F92115F4B7BA819FE9D264C737B9E9523A8D1E109C024B17EB5805E63FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Slovenian.lang
- SHA256 ad28b840cd39669a34b00a4649c9a2b8269dae35e54b17aa8aea08ee16fb5d69
- MD5 059110a2f3c830a6937cc18d010308e0
- SHA1 e9204b353cc8617074a4fc160adee5dd9e756239
- SHA512 39875d317638edd5a8b3aea298ab049383966c58d9fb84292c8fd6370043a58217a69a47cff982db1978b0590f505d7a6b99f374238df1770a45147bd3136ab2
- SSDEEP 768:Il0aCHiFGQojC3J2bb5CX0izf357pmQQUaU5pG/pFxa11dhrx8q73O2ZFdiGb9bN:o0a7iCtjpdppG2ZxBiGYtKd
- TLSH T15463C9669D076C3A489FF48ABE5203F6D97D88069F9D5B19B49E37C8C3380A003BD759
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Spanish.ini
- SHA256 4694e5ac8fc1b4c936c5087804452ed24e34f0fe712e6ee74afa2494d73e32c4
- MD5 bc21e69e841ad727e33ed00941a9fea8
- SHA1 c137dc7a8222513ef33eee8681260e4eb3d0130c
- SHA512 0f8e68f40acad9d5d99aa977ba3a37582526e068749338c933295ec3c94ff0a84e27468935834dd87c9d3e40af6b9329af3c0b510de7bb4b130829ae7d07c595
- SSDEEP 768:wqTQuTCcHWR4kBjWoHJDeAaBhRrDP018ch6OyeASB6dngjYFP+3F6ApM9Dkk71AL:5TQuTCcWTBjlB6dxAMPw+y
- TLSH T166B3A01127F92115B1B37A859FBAD265CB37B9E9953A8D1E009C010B1BFBD405E22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Spanish.lang
- SHA256 20cdbb72266d1fabe835e335b3472d5c3ed080f7f8bd4df5b9a0aecea85d0840
- MD5 a49c8b9070ee957ce52e78e549274b65
- SHA1 aee6c43096095786c9551e8e0a7ccf12a8533013
- SHA512 7f0cc138a761b9f1937d9f0d8051138a6b950c4ef8314f69e40bed4058a62c02901fe475a75fcd63af7003d1c6a272906b3b6866a8bf23402f078abf134101f7
- SSDEEP 768:BJPYn0W46qBJVYlXYJ09pfKz8N6pQ6Yt6fz1H75HT3yhBdsY2C:BJAn0WA8ItPVc
- TLSH T1F043952ABD465D32A463E056BF47C7F7E4685C422C1D9781B2BE57D083B8C8483BEB16
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Swedish.ini
- SHA256 f1ee3b2de54ee588813a7dbffca7e7607bbb769c763cdf73ccd600e06346fe1d
- MD5 d0280eb9ebf7e5f9b91dc0e405bd7178
- SHA1 e0425673213109f140f8f9b7474029a0326cdab4
- SHA512 0102a9b215d169b5cad039bbf80ef9882ad6eea7933ccb47e6ac204451456c50baabaeca43dd477a36d2db3eda317f4d59979e5387e169fbedf1c13494dc87e2
- SSDEEP 3072:lMgTj95UgiNg1TdyjQxx3Ho7wAM65CB9mptXse6/3/GbBJsXdFg9FNX:w
- TLSH T162A3F71137DD1028B0B77A95AFFAD264C727B9E8457ACE1E119C050A17EF8904E63FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Swedish.lang
- SHA256 ea19b69dd0833c877de35ccdc9515442f5bee44a1dd5f123166d1f57e29a36e5
- MD5 7f12a201f29313339188d44a79f6e2ba
- SHA1 f7757b435e61c709ede75fd6f18119a1ce44750c
- SHA512 dceadd8a38b4f10172f6ccc3f9b501c4634648f94280cbf783105bc7368c0cf3afe38c81a792e1715c60a68aad72bcc8010f70c7b82cf91fb83155152a86bffd
- SSDEEP 768:ARuc4brq+AJ5VoLjaCHXhA1kPF8p3Tviz79tKVKOCM+gNrFfC3ADW:QuccxAaptKVKOVNpa
- TLSH T13333A54A8D036D3BA957E44ABF4517BAD46DAC0B4DBC0B09B98E6ADCD37408803FD356
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Tagalog.ini
- SHA256 7005ebf0d5c7294390a7c4eac5b6e4ad369c018107086f49407d19bbf677b645
- MD5 a572decdd881b2050c479c4d1a6e44f7
- SHA1 0399ca872e32ec3516017e6e126d5321916b6dba
- SHA512 e09b45109983a81d47bbcc381ddc7914bee7f20373b5884aa5d6993f97b4fbc210cf571196e08e627607bffa3552d2cc1601091e01a7ae7292469819e3459372
- SSDEEP 1536:Z46YKsoP9/wUOn+wvFi/5PVq8JbmTZx9Lj9Rl89:Z429RecPgKbmTZx9jl89
- TLSH T10EB3D21136ED1018B5B77B859FA9D264C737FDE9953A8E1E118C020B17EB8904E62FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Tagalog.lang
- SHA256 1189100a9697006f0a619f7ad32dc4b14051b607ebf43c7dc3c1728f55eb2b5e
- MD5 a9b11057ccfabb2cbc2a13a97f7e11dd
- SHA1 98053328f1a1a7fa8e03af8517c108ede20b3220
- SHA512 ba7e03a84ba9a0bf70174a683fa78345f854293a1d769518ba8e8d0ec13e8dcd9ac29a2db0b9fbee4b562854b46f15cd0e7a71343d2205f09c92a61542e803df
- SSDEEP 768:ZOIwbDpQ3qzWppI6TbvRGex+7qXofSMnWFXjygwsIqoqCShGseVEBquPp+b9LMVu:ofbw+7q1MLsIN80C1py
- TLSH T13D5396156F42693A9A8BF0C67F0117BBE469681B3F4D47587ABE26C493784C083FC396
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Thai.ini
- SHA256 172276c875a496c173b349e24f7dec66ddda24f6a424120a13de73ef5e70ba07
- MD5 b193d9eacf4afac3199e11b4f4cb6572
- SHA1 9b3f47c3674b11e16df5ba6d5d29d2698a3e1694
- SHA512 11a6971e4ba3c03822de4a46bd9854f2a1525b5380000afac9eddb5d644ba4af0308454413016c859960ce4cf49efe0dbea4a59651b6127d643d1c7eaec34f32
- SSDEEP 1536:5fJMD1fKNP5/l3X8vruiFDKn+0PRs5jWY+APLR2lw:xy
- TLSH T1E0A3132035F921157027B6D9CFCAC265DB3BB5E9817B8E1A009D861723DF8605E63FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Thai.lang
- SHA256 17e5cc7bf6e78e9c2e119a0637bfb2dbe19265ab0e0f612d50c0f3b02f86d3d6
- MD5 480268c6543fa6352930d2f48254e17f
- SHA1 3f1966b3e90f1aff25b990e9e452c16880cc1330
- SHA512 131804f270872602e56ada5ae634c4db695a0661db80645c9f6e67a34407717def67b64c78005e5120f447a045760af36b28afdf0c6eff06baf030a264a0f03d
- SSDEEP 1536:8IPoCjp+fHJ3K9Gd4G1Plz6m+2xSAZNpRjDlBlGHDCdni3:8uo/3Z6q/jBi3
- TLSH T1F1639A632E0758A9741AE64B2D063795E539AD0A3F77F9D0B08D228693F0708463DFF6
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/TradChinese.ini
- SHA256 eb8fc39f2551834010f3748d81e5f842a1b4e27adb87e425b764bb9152b55cb1
- MD5 dc01555f89e044192a9ad584b62e41a7
- SHA1 e830a3012e610b2c8775c993ff504f6f3e5628ee
- SHA512 954582efc17a2ffb29ba462d3d670576682211066a67de11daae4e5b2f283e055bb3119ce6aab1f40fbf8e629d7e0562c5059455ae420741558484f3c464bcca
- SSDEEP 768:wRZh4e4gX/LtXW2DhVaajeVbWFcqnxCjDvUkkIRNQz+q8wbXrFtUkFhBaQagVQlz:yZGgX/LtXW2Dhk1bWF5dhBa00uZNfsi+
- TLSH T11D83E11235D96029752BB9DA8FCED269C737A2EC427A8E5A10DD460723DF8841E13FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/TradChinese.lang
- SHA256 d8809340e468f2a2ef8268e5cf74a9a4e5cad3833696148e752e227efc016be0
- MD5 33cb258e587016bc300abee039f301c9
- SHA1 f2d400570bcd0a0840ce0f71b781c76a4059f4f4
- SHA512 2d737e7e725806e96560b518cb947b347a19680c96357f472f465b8fbd78a55bfb41fb2ecfa255633cc55fd9f0930566a1ed00686243f1804473f1e7efc0cbfc
- SSDEEP 768:N8az8IarMOEYXZbSuo3lL51ZrBLQnCFQs6InIgFccle+sb162HbXn5MFKhcAe85i:2IaS0fvMycAJS8C2k
- TLSH T13963B6550D071C369583F886BF831BBAE47D6C176CEC5F28B89E6AC4AB3405817BC74A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Turkish.ini
- SHA256 65a2e7ba64592c6b2689d17aaa031d9bd85db2626e57060a7a43ca17e6af3080
- MD5 13ceba5c722e3960dbab75c2c9bf3527
- SHA1 eb0b26f277c296a0271684b4c8e6da396b3b2e88
- SHA512 5452df4e97521ecd5759e64138dcd8e39b32caab19eca82f87fd99bb774fbe7df21f47d851fd80224a1510f38e42ac26627c1d6a7fec49e063e4a23b9f7519ea
- SSDEEP 3072:i9iQDSwqOIli6VUq64ot696TTuOVyfc8Gqydlq7xx74U3eOUN6P+6Ev4F2Y7ffms:iNIqHwPB
- TLSH T154B3E41122E91015B5F37B85AFEAD264C773B9F9663A8E1F119C010717EB8905E22FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Turkish.lang
- SHA256 4bd811a22fccb0b47b545f27f67eff86f137dbdd03f6c5bf0716a4d55250ab47
- MD5 6fdae51637879b11006e3e44851fb123
- SHA1 1261045e8805459df5cb831880991edb9ee33356
- SHA512 dd376ec053b50d56af28c7108ed7438088eb2c2196320972a29389a910e0f4ca744db31669fc6d5e5e774038e1176ae20b3dde2598552a66b821fb9a4f11a83b
- SSDEEP 768:f/Kj9z5JkcoHBK+Qwh1TwFB/zBHRagkvht1+YfHbFXhXketTX0+wIJ1baH1om+uP:KxdJkemvht9TwIvb6o2
- TLSH T1165395494C036C37D47BE48AFE8203BAE42E8D16AE7C5F05B09E66E1A7B459507FD309
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Ukrainian.ini
- SHA256 f1f0c46ed4c136149fd57d9cae512242a023e14dd13d7c633bb4f7bf9ed71343
- MD5 9482109e20bf801180bbe11e0603c972
- SHA1 bafe4b7daa5529a5bd7b708482cfcdab95273959
- SHA512 b06df7881df5f79fd246e4c95edbe8c2072dbb9a6a02a7f66886b1a41c6928cf9b7d544b0c238ff2ddcb77fdb7f9ed8764ecd32fb46aa05f7bc6a5e167fded1e
- SSDEEP 1536:iziJtNQr3yk2oKLNzPOcGC+Be6fJzFmXZ:sPcGC+Be6fO
- TLSH T121B3D11779F851147426F5954F8AD2D6C2ABB2D8037A8E9A108F6912239F4B42F13FF2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Ukrainian.lang
- SHA256 f63977ead10478329240a5ee06ae640a68a49e4d06b349fd68a69e493ff2f13f
- MD5 f4c6e718b7357fe2a15a216c9b045e83
- SHA1 029056564b17f37e393fb8a0c1c1a3f08d08cbf4
- SHA512 8b71729fff56d5cc68236b0bb8f46cc22752d18f52e6cd12585047d8ef981c7c52f7a61b26ce9bb89647add6cbea538a0888ae7400ffa212a47d4ba053130195
- SSDEEP 768:ivmmCsSIuXRFnvPGxaAjgj9gKQT7nfllhdRd9Ar8NmeyVboOFK3aaMCs/7Ivo:9mwK1Uh
- TLSH T18B6388A54E4E6CFF0502F04BED4C665AF8AA05BB2FAA5B15309D2EDE53F1014673C31A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Uyghur.ini
- SHA256 56e7b11b5b68f126012a7ea78860803956f59f940d89a133831efa921cac6a44
- MD5 f3f74317f51de229f5b367e2d5397584
- SHA1 8083a0e1aef6810d29c7d9d94137806ac9fbc182
- SHA512 cd3d18704e399f6e5e4f781dbe11b0821a39daa30bb55d4b0edc96180bb7346a6c9e31c162532c412426a22a8bf1ab13a80d57512cb3873490a230415d685890
- SSDEEP 768:whhloOb/lKqwBf+2U0r/OCtLWxoEyooL2CPUj3PDL+71u3kK0bG3EQno5i0f7rA9:GhloOb/lKy2Uu71uLo5TxNC
- TLSH T1D7B3081075E9923470237599CFDBD65AC227A1EC42FE8E2B109C0A5B17DF8648E1BFB1
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Uyghur.lang
- SHA256 2ba8468e81868a2fe94e093cfd259d95d1b4cc610b8e5ff8f4a32656cf85cfd7
- MD5 cc32980eaa22474d41b90b92fd70017b
- SHA1 65398ac95f49cdb848d37b32477b40b9fcb5fbcc
- SHA512 75f3e6929c2ddb3b2033624baf066c4543407bf92a241c69c7671becd8c00fa22dfdd4f3b8fc89dabc90610dc2d2b62960e939aa4c0fdcfe03e587179cd5a490
- SSDEEP 768:oky9OxPSbKCzU3pYtd3o9dyYbeNlwzlkxfRfxefwHlXoDkS6AJ5VAiW433vFdavn:OY43DI9OGAfnHBa5h06yhtnB
- TLSH T17E5322EC6E1605738C87E40E9F622175CA2E7E224E06DF14B44F158CD7AA0592BFCBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/UyghurLatin.ini
- SHA256 d517f3322a43292dbb241597353ad01013ee3be86d666c83d87c0eda4f56f926
- MD5 98eb38cef87e8fa6e6d2619577d4265f
- SHA1 205d6e9147c1f935612423bb9716fa402efa3e57
- SHA512 4e85b523bd819d41ab1032534ef1ca38e841a0d80c2fc672b21a9f2dfa846384ccedd4cea9745ef7ccf127c98378bba913057b0dd716fd620e4a7d2bcf9e75ae
- SSDEEP 1536:mJ05+SP/l0iI5XYIUicOFCWsvzqUSS0XZqISnFhKoMfyLd9:dI5oEcOAqUSS0XZqIWMfyLd9
- TLSH T1CAB3C61135ED5018F1F37E819FA9E265C767BAE9593A9E1E108C050A57EF8408E23FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/UyghurLatin.lang
- SHA256 c63392835fd2579c2e6084077cab34d6f0725113c5d6f65819e34c42691dac56
- MD5 55ef3c0de91c274acb7c2caf40e9b695
- SHA1 5f2f1b9a1bffd0bf7c7b71a265d8220c02273148
- SHA512 284974cad2da5ce06e10489d0df5d7756a24cee37e9a1f5ae2af5861bf4bc6ca515c74a52898306e34c9a28368592be295d80520be837f9a68ba0062ac9e9b34
- SSDEEP 768:NAOwrdurp7U6AJ5VlbFWRptGuh1ix8oGx5Tbqlp:urduWu0P
- TLSH T1A73382555E325937A55BF082AE0317FBD43B88061E4E6B48B89EBEC883B469907FD305
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Uzbek.ini
- SHA256 af11b0cbdcb67ddc024272d45d098cf1da8a21661fe9f6fb7a0239d0c6684531
- MD5 29dc4e77b361bbce2780610edf092861
- SHA1 5edc783102a4f213e876d70599e0155387ca7429
- SHA512 ad87a926748c607773dad37b1a9fcdd47a87dde0defb36aadf6c8b043561e57b5c420e517d7ae3283f098b661c49e5d8a3ae6f3a348824780ef9d5435be828a9
- SSDEEP 768:wR2Wh/kX5yUYBW0nbEwiW8S9LZU0xqXKhTVT2EogXcZILi2LAUTVxlWRumLFE0DZ:DcBW0nbEnMUMlWRRr+Wntr
- TLSH T1A2734F1235ED2029B07776D59FCAD269C7B7A6ED427A8E1A10DC460727DF8801E13FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Uzbek.lang
- SHA256 452ba85b60c863843b9c59c2990b13502f48b630aff4e141af923f59d6dd072f
- MD5 f9306964046402ae944f6f324fbe31bc
- SHA1 208c40dfc5a1746ce270ebcaf43a4939f30815eb
- SHA512 289796e79c53253babd10044db4799e2056800403de9b00aeffca3685d2c707082206fa917dad468f09a9204dbf4584cd3201a7b056c6b6326040788f5dd1b0d
- SSDEEP 384:uFRBk+s5ORk7/yasmieO+C/rYJlKJVWr37Bu:4nrs5ORk7qqit+C2lKJVc3Fu
- TLSH T1F47250AD1C235D38C737E1DABF06ABF6D6B94802996D0B44F99E27D12B7064503BDB08
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Vietnamese.ini
- SHA256 7b939fb24a88a01b1e45b37427dccb8a319cead04fd012136551f36b4363e887
- MD5 9ee05121e1a02efeec015669d96161eb
- SHA1 28d253a23000f4ca1cba851410cec9b1b02b52c0
- SHA512 0f31ccc9b86661ca679258b309ab846608145c8366225e95aa61691c5b42323a50a1631f645ab58483dcf26331239b677e97d04106029c67aa3c67367fbfbca6
- SSDEEP 768:wVna1qkfNk1220z8aypq/EJDPU35BL8kDgavFij+I7Cs3L+LnL80Tj3DSHPoH1ag:5qkf+12SFU/bnP3DSE1swQg5
- TLSH T1DAB3E410B5EF6025B0B777854FCAD264CB6BA9E8613BDF0A519D060A17DF8401E63FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/langs/Vietnamese.lang
- SHA256 92ba8f8df1ca6509aa13f15ef91675f3f88894236490cc2452e8e655cb2ba3ae
- MD5 20a0147d611a42335ea9678f2e604952
- SHA1 915d2b4af19d05ac58503baf9dd81003858fe395
- SHA512 ea3f28c4db824744b73686fb20cab241b49471b1327b3970f010e437dff48f85d34fb4a22da2de451f0341683c6a394ac4b2090ca4f8fd60097934d110a8f8c3
- SSDEEP 768:KISVQ5GyK62qNSQQkMhSJQ/ccYE/fSySiiOy6ByrkDoH22zHXD:7S+JgJSiipXT
- TLSH T15C4341224D121836C46FE01EED4F93AAF9D9A81FDA488F5578ED16E483B9084177CB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/shellicons/bandizip.ico
- SHA256 a6b036486ee772400dc4807386d195d3beded587317ff790c2ef9ae28593b89b
- MD5 9ac0bebaeb07eca1021815ed1bea6ce5
- SHA1 d4bb6a703f1c7354be379b3ae3421cd39e4d8e75
- SHA512 60f292e8adb7600e91b3c709be441677b81fba3cb0f32762c20a962f508880b587418cfdb8f322661fbba5afa2591f0e0c0e7b2688c492a664aedcb4bd30b7b9
- SSDEEP 96:VLaC7sTxKaqbJsCyLPHMnN6FuzNnvXS+OMbCOeH+Yvy0JNia+Nsw4cVyeXL:V+xKaqW7HMnN6FuMjMuOrYvy0JNijsoL
- TLSH T1C67258D42DDA719ECDC58A75300A4B3F63174E8825746790C4F3F14DEA731A5A20EE89
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/shellicons/cmd.ico
- SHA256 bc4ce575ef75be8389d2880fd2f64c4a08290e7960a4a6df4b143e1210a94f4e
- MD5 966428bc31af7c8fdc20ea3c98f812b2
- SHA1 dc1e631b661f0b8bceb27a366df44d33c2e7b945
- SHA512 c506a5c3ba716e3eabd5e8a41da5407dccf68757f792fae8fa3f207d7a646f86a411f9dcedb4ce1ca6a48cc6fc96804ef6596efd3ee7c59ca3032ac041f48a5e
- SSDEEP 24:i7xuAoq8xX5auOqnOMdUO3dUOedUOROWGjXX2d9jaDSDSKDSSqNSjaDSDSKDSSqz:gtuWF9ZIkk
- TLSH T10AF1084162D484B2D221AA74AE16D4B5832E7D38C842BF67F3E4FF1F387959925CE24C
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/frame/shellicons/uac.ico
- SHA256 2e8b01233c0b3a731ccbeaa59e5b7a2a9b2b28d5cec95c43b8c8bb7379931e56
- MD5 a0487c3af2e43751ea9bab604f7a8a0d
- SHA1 8903c45c9fa7f3004332ba2c6c07be91fc351778
- SHA512 8b2c50a607f7965eae32cb8ab1a89538258240ec3d9b7e41eba22b2b6aba41f466b66bbe8e6585b620c3a04692fd9a62848003c9ee4e7381bc9aafb35184e4aa
- SSDEEP 96:CvD2U/GBb4m5UIUBUkUwU6UB7QincUIPdjBYwlH4o/MrBBUAvGq:CvAHQincUI1j85BdGq
- TLSH T1B4F155EF3D4974C3D910863523308E7C12262F9126F364B542C3FE66F5BBD0E826699A
- MD5 SHA1 SHA512 SSDEEP TLSH
binfmts/jar
- SHA256 8e9a0c5dcef8d3ddea311c2f42f286e98b50718167313c7676a286d4105c0fe4
- MD5 34218fa0764f51d0c301eca14a9f1e19
- SHA1 2cfbc6afaa1d13d277beb36937ffe6d8a1634018
- SHA512 55dbaa9c977343659bfc6fe1457942662e977d61865d19b5933d15cf1a7a04f69a2a3286d1eea2d510aeec22a17de4676d81ab9cad2c7d9a05de5dc6d6b45925
- TLSH T1EE900285D5544A7458C144FE1D101A0385C79091BD43B650524505C1E038D46310645D
- MD5 SHA1 SHA512 TLSH
binfmts/jarwrapper
- SHA256 71c9b3fd222c209357107dc38a552b0cdee5aa7a319af595b619f4adc190b4cb
- MD5 045c496e2be3df076f01ba5d9a672f87
- SHA1 5fca60b8f9eb28e970ac8345eab74d1a42a678dd
- SHA512 2a131482b12261a148647081ee95b24e9452c50dad23eeb91e208c295673a60202f8bb963410eecc4e5bb90f1df9f2b2ac756ddb2ca73d1955f8b325ca27a014
- TLSH T19CA01281D0152030484188BE14100E51049040A21810B50402C20B04F3055815B1581F
- MD5 SHA1 SHA512 TLSH
binfmts/llvm-6.0-runtime.binfmt
- SHA256 d85f187b4c90070b1111fd0aefda77ccb13a2fad3f1095ff754f6fa4ff863f03
- MD5 c116a68d24013e4c9e649e4e20b861a0
- SHA1 416be665f23d300b347b075ab7cc26359f9b07e2
- SHA512 51168698b0d167b6c24e23407d8b363ed5d9ab72218b9caf1ef31fded1a78cb1c84ecc1dfec27cb49ffc3eae6d6d485d31dfcab702366784aaaf2b6a51d717c4
- TLSH T1B1900210ED9911514C61067720700649DD546410D805B4054A40391555401D99619289
- MD5 SHA1 SHA512 TLSH
binfmts/llvm-9-runtime.binfmt
- SHA256 f333a0eae9408cd5c56314363ec29f07f94565e05e6c7d14f520254fc4ec71ad
- MD5 1d3f73b850954a818ad2d559a26bbff1
- SHA1 2eb48d5f0b6a107b2316d3265786c35a2edfea3b
- SHA512 f43f3a48a17e9cc73487cd6e62ec1fa3e25a96f76d893273ee5a59471fadb0952e00fdd21177a985b0d1432e0bdf4f7bcd36564d817987c62b8b871624428c2c
- MD5 SHA1 SHA512
binfmts/python2.7
- SHA256 cb138f00a62348c62f11b9170a1ce0f44184d75f13adfce751e5c216f6bc7aa0
- MD5 4574a1f6ace69941e13cf52efae64262
- SHA1 d7d03e5ea5e43796c14d4572d0ee6fd894037dc3
- SHA512 361e66be321e4553a1b1a5e7c318a8f017b487142715bf20d3aa67c8fc896efbcf243ec454ff37aaa593de18df47745853c9f8f238b4ffc1f2144a531c18a6e5
- TLSH T196A00296D068C9D899C6C5B910105EC5C641A168D5E3FF11817D1A025935584254229F
- MD5 SHA1 SHA512 TLSH
binfmts/python3.7
- SHA256 b39dcbe89c23576daad4596a1d8943685d634c20c9c249eae489882b9909875d
- MD5 a40c9c00fe805e57805c01be3e731b03
- SHA1 0194a50377f38442f0589042336df7c78fef78b4
- SHA512 79ba79f3aaf750d13092925ca2e655f1d3b6d1c5ca5ee7934a5fa049136c20aa5946ec4071004ab461771ffd470afaf91925d6a035384c9087d6fbd8ccb7e774
- TLSH T16CA00282D048C9DC8E92CDBD3040A68946411941D565FF1905660E025C241C4154279E
- MD5 SHA1 SHA512 TLSH
binfmts/python3.8
- SHA256 e5864e97321b397c83718a3213e7940d291fa5a93f56c75ae7e1ee2eee2d6252
- MD5 ba3f8e023df3d01a6a659121021ba4ba
- SHA1 680e9ac1902ca34dd4e1bd0480387acd39d7bdac
- SHA512 a355cc0ee16b6e334d6277aba20eaf05226a5f772866b5304f6e1d4d6169ae22b4d664e4b5c443b65da765f0bca576282ed59118afe6d150a86167ae4fab5899
- TLSH T1E5A00282D048919C4D81C5B93441B7A546711841D565FF2815620A0758641C7650159E
- MD5 SHA1 SHA512 TLSH
binfmts/python3.9
- SHA256 76ecccb08d23fff4d9a02a3396acfe9caf1d62effcaa6b63a086e1f6ec218358
- MD5 a1b38d6c44885c92559bbd95ebec91d4
- SHA1 ac6674f95a83fe21e19b8310b15d400b591fcb1f
- SHA512 92d23a37842ed00debfd8df7bacee510edc50d65ca59da6f7a408e46aadece1b5f82b15ff0453b83c582da8626ae17599d26e5f58e06eb936ef6c1c62a27ffb0
- TLSH T14DA00286E058819D6D85C5B93041964546412442D5F1FF1941621E02D8241C4151055E
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/gem_make.out
- SHA256 b7f2b4485a1d5e537ff0e67f48b4cd9cef6485f82e8e9e1632ed35195b9c4f5b
- MD5 f9998ca8e0b97e1a11623700dbd74e0c
- SHA1 fe91834eb82528bd262fdbde5f103b4bd199e106
- SHA512 e5b5500e56aa40a809b052699d8de41ef956a468b4a2167e56561daa306bbc03e2dcbe0872bf6bd33b5ba089f0936b96c32f74d4d185a88637bd105daea9e544
- TLSH T1A9017B04E9D91A70A902C9F15D82536E028205DF764FF94FC0EDFF687A66B20563E50E
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/mkmf.log
- SHA256 11f2d6878d89732864fe2ee7df10cca595dedf327f250cd17471819577918bdb
- MD5 7401ccd9e50bb935fd45db8be9fda8c2
- SHA1 ed6c902a1f1384f28c458bdb39699c75f43b581e
- SHA512 64acacb35e0d8f544af6b3832ce8aa8fee528ba1f7d7f0b259a2ad273b02a1913babd1e1accf29d76b91283381fe3ec2c64979968fcf70a764e2f22d13d467a7
- TLSH T1CB315601DEE8D5722561D75D0160D335E176F18E1F543E00A81AFB5CEB02599123F7A4
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/racc-1.5.2/racc/cparse.so
- SHA256 5b25b1cd41c662ba6904603e51c7f325c6b35c744b35ffe89e54002179082407
- MD5 ed4b33e510ea70f769d6a93ef39aa73d
- SHA1 655fe9e1ceb3d5c1be216d01cbb4f857511c5fcb
- SHA512 0aadb6b570cf9a53f4ea862b17c30b43c38696cbe21fd005127d770ba4a23a49e3204d5f0690be81cda261e66a8ad23f0bf9d905ba7afeeb474c5be206af0e06
- SSDEEP 768:sP1Df5CFNkbvIVxyOTb5R9u/rcueZPqOLPkfI0aI8oJoV1Q6BlEdrbSn9zuqpXfz:s9DAkbI7Tb5RTPZPJHhIng1Q6tf/a0
- TLSH T18A63094AAB588C3BC89481748CEF03997730F09AB3426F2F151EA5703D937EA4E9D764
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/gem_make.out
- SHA256 acc32fb74c0132aa4283d4e0cc7c0d91599128723a5bfe177757afce9a859aa4
- MD5 607a3c9e164a4c0471cf5bac775425da
- SHA1 076e06db826deee5cbd4c39e3dc6b3eeb77f263e
- SHA512 846246eabcb1dde9c42c9d7d229fc1413ced177fa908f7f18bbeab145804a6dea2b461f5ceccac64307ad3a3ad75c6abe64001e45319d6364692ebec0976ac75
- SSDEEP 192:KWR0Ex0SJ505JZ0feEeqw1QdXZ3JHqnIqJ00JsO:dH9w0rx8mp5KpbB
- TLSH T1B1027D6A476E26309D92F6FD91423E3769C5A2423E08680474BD433A677ECFF161F42E
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/mkmf.log
- SHA256 f4e8a2c0821a75b1387dbcfabe41cfddd115b301ba6f1fa80a6821abba34e2b2
- MD5 dd41c77fde0394664602afbabfc778a9
- SHA1 aee6ad41a6aee10c1631175dd33acc1ec5d2322d
- SHA512 02eb1263c10ea62e0c1ee7588cb504234c4bbf7d226a2b12e8bd0a18d8f7f8fe8d5863e1b562769f7286c63ce95762cb7d42a7d8b8d336ef66557871d92d3917
- TLSH T1A4315301DEE8D5712962D75D4160E335E67AF18E2F543E10AC1AB69DF702546123F2E8
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/extensions/x86_64-linux/2.7.0/unf_ext-0.0.7.7/unf_ext.so
- SHA256 bab66387a286705c16de06c3b9154442d2a746075a990b35d4f597b71eefcf9a
- MD5 a630a34b5706659c3b99f27dc4aae2b0
- SHA1 2060c33856f2d3c976b567dc507e00c954818775
- SHA512 69993ecb6356ea11c2c6ef685de70cd7d80f344429a3784ec75c563e600015db29d24b1f45fe0af8adc2935402cdabf3bb363440d31d1d13bb01547f0c5eae69
- SSDEEP 24576:yUQWawOcK52C9f3GBawOcK52C9f3GJUQui6VyKch2SPK:yUQWaHRZABaHRZAJUQutVy1h2SPK
- TLSH T189357C4609881625F6AE3B3484FA2EFDA359B82298DED48F63684C4BF3D17C595C071F
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/addressable-2.8.0.gemspec
- SHA256 48e2f7eed7bac33260393dfc19433fb4346579616b7de75cdeea4fdd4d6dfa3d
- MD5 9e0a7e3da3c0c891d49a1daf1fa2afb8
- SHA1 4f22b5c745cdab20117c5e5a230e803b74b5f9bc
- SHA512 63e29a98cf19ecea4544bc37ae80412d639d5f09cf4b29c711b9946e3346f1bf495c41ea14d8cce0b7baf440bcf0dc304cc0079b4bfaf356cd2ed9dc47d4b056
- TLSH T1E2310E6E9EA0742237322FC2C0D1285643E3E5142F4C4D186E5A8D7C1217F0A87DAFB7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/connection_pool-2.2.5.gemspec
- SHA256 79956b8b7708ea1b2f5d29f139df4aea5ca6522f23af2d056628c26b520a5427
- MD5 ae8dfbb55f30610f1c1ecc32920747f2
- SHA1 6f04429423a72e1e3af1f1d8ff20bfea74d64a2b
- SHA512 efc2cdecfda6dbc0624e10e2710c0df050862a9d5ce484909d1ac5b9a2f15426661c33c985a4796c75531a8a52202224619f4cc3ede7b3ec32d7e3ba6017c9d6
- TLSH T15021782E5DA2B06177721F82C892009403B7E5552B4DCE1823168E3C5627F8B67EBA7B
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/crack-0.4.5.gemspec
- SHA256 9bbcb72ed36a916ca48dc70e707356782e52bd07436cb380ae999925acaa790b
- MD5 fab4be448f9bbc01dd9e3626d7d2f5c4
- SHA1 830f79accd5247d3a0e7fb4d5bdfa15c8972e6aa
- SHA512 ed38bc46990111db0c52e21efdd92925db25318c99e393b357ec8ff35f3dd39a75b75745c6ea02edde4be46e220f0d5104f34454d62c6524bf19cf94042cdcff
- TLSH T10011AB7D9DA272223B711BA6C89115928333F5182B0C4D18B7438C7C1243B0A6BAB7BB
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/diff-lcs-1.4.4.gemspec
- SHA256 e110e1c2824699087afb4d7f273ff59e527d7449046a5bdecbf7d6bffc0124ed
- MD5 82f6ddb6953bebbaf87697c976f0566b
- SHA1 1fe8f9d553175315ec438d06b5f28344a2d7a931
- SHA512 80e51eb55d91b8957e88ae2eca4231747dfc7aa7960e06d5d4691acaefda29788bb0e5f6fa7489b13340b460f82c41aef27deffb23318823a1d6422f8957cb46
- TLSH T13E71462E4F52B061A7B22FD2D8D501A2266FDC651B4C8C48664D9E7C190FF9B1319773
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/domain_name-0.5.20190701.gemspec
- SHA256 e30ac8766b77e996209e81a6b592b318b9d7e17e158ef64ce38f07a8da236bf4
- MD5 283fae6f2dfeeefa944233363dc55e14
- SHA1 6cec649c330af8f6c56fadc58b042002b56bc11f
- SHA512 a4fad288934d141a51e3c61d13eeb503c3d12f8e74884b29a753d46e148bfa76341ed8bc71abd3d293bf8976d86933033a0c6da89353da50591dec963b4d280f
- TLSH T16631FF2D4CB274A27BB26FD7C8D5109122B7E4021B8D8C4C274E4E3C0013F9B57A6AB3
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/hashdiff-1.0.1.gemspec
- SHA256 28cd2e6c07f4ff9676b15cd3b0804099898173bbf3026576eb1b31e512b697d8
- MD5 80d0bbf9d73753d44bec5746f2ca45e4
- SHA1 79d9dfb56bb0831e72626a33c3a6cbe1d244d5b0
- SHA512 02bc7d7a99b9689c266309edc608e1a79091d2fc57c57a04d94cadb5a8da5ee0e0a7173f3ed4279dae66890acfe37267e8d1e24a52ca9ec7c5364d4ea18ef4c2
- TLSH T1DA41AD6E48A3B062BB732BC6CC9141A623B7E1051B4DCC05A75A9D2C2517F8B1B4BD73
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/http-accept-1.7.0.gemspec
- SHA256 293a47d04a179f3b4a84607ea43df01dde425dd778c4334409432e34e2f7145d
- MD5 fb3a0a85e067ceeaad143ad11157d8fc
- SHA1 4707258a4134764a045acf49d3415435a541ea7d
- SHA512 f2a6ac97adb3e3666df1473351ab37c23e0a4906b34fae4cabdf676a8fef9b8cc32f739ffd857cf3e0b2cf73cd2f647b176c1fae3e74b53c61534259d39cf9bf
- TLSH T12221E43D4EA270A23B712FD1C8D105961373E42927498D44A71B5E6C1507F4B1757BB7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/http-cookie-1.0.4.gemspec
- SHA256 a961129f22515c3fccd933e3f830226c03bb2f790cd142a1d23ed3c149aadaed
- MD5 aaee897bc20a578b90c90a92c6e686c9
- SHA1 25e904683149bc1c1157cd6256ff58a2b381971a
- SHA512 8e7b2ac1db86c196a14811b54abb8a94ab6d0160f2cd8f6fe02ca535c8c32e5f5f43102195cea3b588e08ed109afb21a7d4591be7fcd45c26a3204ff8d2953b2
- TLSH T12641041D9DB2B061B7B22FD2C4E50061077BD8161B8D8C88620A2F7C0607F9B675D7B7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/mechanize-2.8.1.gemspec
- SHA256 8ad9534cfc8accbacbdeae730b1fc706d8d2e6db2e1c40549ae01d9a35834f39
- MD5 807a7cb0fd8b7933b62d9fc5419c9746
- SHA1 75af8a9a1f95d0181437f0a181e403b9069cc133
- SHA512 ddb57a304c549c861fb0960123a385c4b29540f7ddc0943cf1b8ab5c536e34f6fb634631bfdbad90d0dac33eecdecbb58d1f706418a173188f8b7b768a2daf2a
- TLSH T197715C1D9CA6B462A7732FC2C8E5405216BFD9121B8D8D84674D1F3C0A1BB9B13557B3
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/mime-types-3.3.1.gemspec
- SHA256 f2e6db896e90a7731d6dd38b13439dec5f69e9b5652a572a6f807016d2388bc0
- MD5 00e52e2fbfe86b9e9e8cde84528af9f4
- SHA1 d9ee1a90d5aa9d15bdeded19bd05170b7aa3a2c4
- SHA512 aade8a8bd1d3fb06ccbbe7460d1e1547910513f026c0cbb3a74443880ad5b1f6c82619ec8fde712ab0796c32735bb38391e737db3cf5f199c4332f58a69d5593
- SSDEEP 48:uAeBmZ/KFKTCA1xBmV64KQQnknW/IL60BUtdfzhfb1mL1zr9Xm74xo2hVKDLEMCc:uARZKcCam0go8W/I0QyaHxc4W
- TLSH T1ADA17A1E9D937052A7B22FC2C9E91061267FC8265B8D8D84B70D1E7C0A1BF9A2359773
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/mime-types-data-3.2021.0704.gemspec
- SHA256 2f0fb0abfe596e9b4aae50e734e36b5d14921a655484f6a6d263ff929804d144
- MD5 d0319fbb24120affd2119cd6412cc876
- SHA1 b6722776ec0c5d834c51298d1e8492a3e265b963
- SHA512 17c4bcd7f262c16126dd75fdd917b777c7aa317d5b06361a495d9dcaf28f2ab79a4906fbb909240ea970ff3e4513536ab0867bf004fb3de2c9c03476b0849c24
- TLSH T1BE51671D9D927492AB732F93C8E904A116BFDC261B4C8D847B491E7C090BF8A23597B7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/net-http-digest_auth-1.4.1.gemspec
- SHA256 7d8aacdc44ea13b676b63f19b63876632a90081f5fea499c3bf5445bf6370db1
- MD5 c9426fb881e307df773bacc2392495d8
- SHA1 c8e406703b859e6d7aec1ca2d017739ae6fb0cd2
- SHA512 20bfb9623d5477ec8eb287323c8b0120cd1b1bfa55e0f36b2e4b76e0bc38ae49a340919641c698c2392f64c3fcf18f1a40596775870a2dbd677e06b1fd6b022a
- TLSH T10851B62E4DA1741279B26FD6C8D6908123A7B8202B484E9027DB4CBC1397F56572D57B
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/net-http-persistent-4.0.1.gemspec
- SHA256 b2304119860ea1d7f6aedc8a6840c47bd7f063596451b0f3c60c7eaceb47fb5d
- MD5 22b4ddbdf7121523248226cc8391e202
- SHA1 2c5d69da0a0f947799ebf20b353f163db6f1f98b
- SHA512 3b19bb25b8f9d3afb86e4fb43784604617c28dd6018f09fd1c7ca647f65569e21c37c51ee1efd5cb0fd127bbc5fc82add1cab86282aea60636d86e8cb2d7f2a8
- TLSH T1BD51001E5D92702297732FD1C8D2016027B7E8212B0D8C48675F49BC1A1BB8B63677F7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/netrc-0.11.0.gemspec
- SHA256 169d418163e2a45bd21d601727e35467b4d75e53080eab5b787381f2cd875c81
- MD5 32a09c4506f7e67fbc0281b10c9cdf34
- SHA1 144486463c4077f4d137e068f82aa713ba8d5796
- SHA512 33b08073143b361dbb293c2bde1bbf2265a98e6f536140f7013291af3550381d9f915b30b961c108254a1a535d8a367e961cf1035b458831cb8aec709b89b47b
- TLSH T10311AD2E8EA270113BB01F55C49210514367E9182B0A8E582287887C6207F8597F72BA
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/nokogiri-1.11.7-x86_64-linux.gemspec
- SHA256 50861989332128018948ec2b58958bc03ad87ba80fec25919ce89cdf2f3a646a
- MD5 293ee0a08992a40ec0014d64bf7cb115
- SHA1 899211a6e47667249a9026650ddae9200f76e401
- SHA512 f5e7f5f012582f928d3742278677f406bbc74b8f81a71959991f3b16ccd3e3f69897400192bbe9778008ba2ba2a808dd719190c705662d1986737336ba0cbc6b
- SSDEEP 96:uvQRgxDG7e4Gq8hGPqmcLa/2Zi084Nqe1:UF4ChGim0W8Lj
- TLSH T1F9D1F65D8E63B7729BB23F81EDA608A533AE58A0124CCD81B305DF3C0527BDD1326676
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/public_suffix-4.0.6.gemspec
- SHA256 034877e998a0f0d99dffbf84b246285203c4beddd19d3642bec09c165e53e403
- MD5 8040e11a8ca0cdda0011cacb8e5bb048
- SHA1 0b853814a579095f74bfb4b0d17955d84a32f816
- SHA512 ad674ecb6a764a2cc1b805792eff435dec525684ebd1555103c8339b281558499de1d3e4a8a5ae2bd533ad322c0c75e9d2412516e8ad0f6fd57d8a7fd4b66acc
- TLSH T1A421367A4F402431EFA14F8AD841691E5313F81C7F4DCD08976F0C789247B5497A367A
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/racc-1.5.2.gemspec
- SHA256 63d28734e3b6ee8f64275c16de8d00aaa87e52395a73d9273a549202f3e62ad9
- MD5 9472ed93f87373a84a55df3befc6941d
- SHA1 7cab8d2cea72d9a94e0bcbcacdb2ff11f6f5268a
- SHA512 65cd2a8181fde1bf0604ddb9b97775e858f6b92455289adbadc37d5c57f9bcbbdef67f55b11f1df06da16b117f97fba41eab6da7cc0d6f110137c1a02ecd028a
- TLSH T1A93188AD4E50BB11A335BF3DE78D0640928BEC88238CCE55076E5E7F7207B0B939A491
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/rest-client-2.1.0.gemspec
- SHA256 c8cb601a335fbbd41d23a77b2221bf86c94a7b06af10380b754fb453cbfc6a4c
- MD5 a5a107600cd800de1536a971f1157bbb
- SHA1 d3fe7b2d940764eff3acb328f2bd31e4142414c2
- SHA512 b81e60a0d71cdb58a43873b84567a45d4292ed5a5ecd3c682f4f02a58fd494fc4a5308e7772ff904fc912ba0c81121bcb68c6b90d173f21f58982bf1c43341d2
- TLSH T15F518C2E9DA2796277732FC3C8D5009126BBD5231F8D8C84AA4A1E3C0A17F8B1359773
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/rexml-3.2.5.gemspec
- SHA256 aa5aad5a918e007a496aecc8ce58855350e179ca880b7a7d4fd41f0a6dc5095c
- MD5 8b7a5363b3521879a8497dc70bd913d8
- SHA1 1e75c5793ef0bc9f5b988ed65544c7445cced40f
- SHA512 a5e39da3def6bf549eb3fac7f64b5b2a9b367a4d0d707147acfa3c237b07fb69635cee9de6e1bc3f15785bc9a5f2cff98e5358bcc0af1f524c6d11a2d853d93a
- TLSH T14651C15D5821F460B671EF4DC9EA03B3616B6E79DF8DCC28155C0AFA6003B0B135B567
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/rspec-3.10.0.gemspec
- SHA256 119070ca20133f976e92a495b190be7a627be964c72d1f5cd5fe62b5472dea86
- MD5 db12536be162fe0ffbc75620f37d629b
- SHA1 780c5f9ac338ba8e628bc422f6652b239159615b
- SHA512 dd34f14e1f90f672f76dd966d74768076090d14a564dde151a7dbed0cc17c4d2fb58e9c2e9c21b279ea6a51702b02382ca07e094d77771b13f831e38a656c881
- TLSH T12971087F5E6028592AB35F88CAAB42412B37E429B7488C109E416CBCC50FF075B86E77
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/rspec-core-3.10.1.gemspec
- SHA256 5160f6e84d58c9ab0653b33ef5eb13361fb3b3df6050a9e6912305c4c9c83b8f
- MD5 a3e4ca222e07bcb3fa0272b133d6ce23
- SHA1 d9fd4ee1cfe5dbeef4e7b638400f8cc8fffc63e2
- SHA512 683eb8da4acd567eadf9642d5e1c5ba6dd0e678b12f273675d24da4f205ab5ded2a25ebb17f3ee915e0e8729aa7d8208d17accbcfada938188d84e7c426ff55b
- SSDEEP 96:uIlRQHJLTuVXpVXlVYGaahl81ALL/Tkqk:l4HJLiVjDYGE1Q7oqk
- TLSH T120A1D73F9EA170992BB36FC4C9994162163BD836678C8C80AB052D7C450BF9B2B55E73
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/rspec-expectations-3.10.1.gemspec
- SHA256 cb3ecc3beaa309a39cb56aae03f6edd7b565c6335572ee3afd39d3e9682ed1bc
- MD5 53db4e0b2b846da8745a972add4c55e4
- SHA1 64e8b8f4be0e70ec933d1754d492989fb8f177b0
- SHA512 028a1a2f9a95446ee3f5ab86f06afa0b05bd63756897f1b60e5c32ef7bc26360f78f2d7c74b8de4d057dca58284191553deadd528b5231b31ab8235d6d092495
- SSDEEP 96:u4RRAeJLTuVXpVXlVYGaahl81AcA2/TIY/aY:dEeJLiVjDYGE1lAKMoH
- TLSH T1B691E77F5E6131592BB31FC6C9A64091173BD429AB8C4C446E46683C450FF871B59E73
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/rspec-mocks-3.10.2.gemspec
- SHA256 b37dfef5286852311c257fe45b34041f8ebc42301f51da60b032b38787756608
- MD5 065cf7a8653f6def0ab2b7e6d6675fd0
- SHA1 2effc789bfd5fbc02ba6b4c41cc3f569f8468c28
- SHA512 66559cd34bd7965e89cf1e7fd1f9517930e754f36bda90a7808f55df4226bd5463cfe188b41d6709cfb85a081061de07c54bd4adf126eaec90cf05c0c18304cf
- SSDEEP 96:ulyRveJLTuVXpVXlVYGaahl81ASoNS/TTY5ai:peJLiVjDYGE1nGOfcH
- TLSH T11891E52F5EB070592BB21FC4CD9641911B3BD429AB888C445E066C3C890FF972B59E37
- MD5 SHA1 SHA512 SSDEEP TLSH
gems/2.7.0/specifications/rspec-support-3.10.2.gemspec
- SHA256 e110677d7eda218e31b23bd2bc1f0cf00df8a0dd5e6b09a68ac1d4428b940bc7
- MD5 941a87c3da5bbaf098d02c7213674b43
- SHA1 9d85bcb90d166833813be8c33c0348952045d28e
- SHA512 67b3769cf3af523189dbbbe513cc043bc259b9dc068551d91602bfabc30910782a9da6c01b0d54a71fe71512150e6ca2582e5b925ad46731b156dffc580b0618
- TLSH T10681E9BF5F6074991DB19F88C8A681921B37E419AF889C144F016C7C810FF97AB6AD27
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/rubyntlm-0.6.3.gemspec
- SHA256 1be3dc528144cd155986545547f38e8eb711e6ac0b12835e3b52de23148f7f7d
- MD5 03351f137c1d7e14076cafe337d3b6e1
- SHA1 519a2b1a9b2fce3ecf03c7793240e77dbb191205
- SHA512 7141bd95307956df2651fdd57c6b70d871906b4082245848d26a6d53f8dfba3192c0f7c8c54d88858314be010822800108a972a273b20c69685c9c43d2da6718
- TLSH T138319C6E8DB2B06277B22B82C89110A216FBE4455FCD8D8473165D2C1503F8B375B6B3
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/unf-0.1.4.gemspec
- SHA256 769e0c533b001f02809a020c438782df6a692af73c172575fc1171018076ef23
- MD5 a9c33023b72de161e456100bb3339286
- SHA1 708d3b85d3d919b50aad79431d7be64aa5ea8d6f
- SHA512 6e917dcb76416b754f40567534f8e4c19c273359aab6b6ca12de151109699f3cefc0e31b2a6c5fb76001d36abd85b51c959e43f9d6deafeb8c93a57b5e81d345
- TLSH T1DB31DE2D9DB274117BB23BC6C8D5146213A7E4111B8D8D48234A4E2C0607F9A53CAB73
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/unf_ext-0.0.7.7.gemspec
- SHA256 fdf23a1a35c754b893610800dd5cecc6695b147c672b803326bf37b7037aeb51
- MD5 294d4b8d4cadaf914104fd674801bdb9
- SHA1 37030d94ead3672ced3b61dc51fbd1da33bb2f87
- SHA512 4873d91f155782ba17d7ea93e0a3e47f644e1b9c7f01ba5ae2caa711e2e934c712fa6144bcf5bf4be9c0e1b1daf8b16e4535762dd1c3876600e0a775a66ea1c7
- TLSH T10C419F1E88B3785177B22FC2C8D5149616BBE4022F4C5D88235E4E3C5507FAB639AA73
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/vcr-6.0.0.gemspec
- SHA256 6450fc4fa661cd117da9cefa6a7bce23c33485e1070c5745785439b004859203
- MD5 1275934934c1c3a7b7e8aa305b59b3b4
- SHA1 6cca2fe3a20204420103f249e745d4e2f4edcd0c
- SHA512 3c880923f7a88c164c80680855a0167f7984679f4b85549ccab87e111c841d4e96a1f6ac8a73af5c3fa62f47bce7b75501ba13155d02e2c549cb5c3bbc1bf4ce
- TLSH T14671AB1E99B371A2A7732FC28CD600A215FBD5221B8D8D84B6096E2C0D16F97335DB73
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/webmock-3.13.0.gemspec
- SHA256 36d49c1cbd98978c1766df296f7bad42ddcf06723c05044eb0b369175635dddf
- MD5 f6d631bf9b538e7d72f0be6a46a12075
- SHA1 1273fd672047bbb4bff7430546bd8935af77dacf
- SHA512 04079c9e007dca84d097345a7d6872ed671a0cc9fe681a9cc2a47563940d2a3081dab8f427e6e2dc2c226454c47b75bb293f7141b391c1778e3d53d53bde3545
- TLSH T1D671DC5E59F370A2A7723FC3CCD500A125BBD1126F8C5D88B60A5E2C0D26FAB2359673
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/webrick-1.7.0.gemspec
- SHA256 c876f06562e77e71254a0030e01754b1792f75a1412acaa5af406fe7dbf1687c
- MD5 38d4537515d7b0aa40fdb3758f6835c5
- SHA1 97986f4080457db4a94346fdc47e5a857355ce7b
- SHA512 6234096a2afc7999d6bbc177497351c6ed45201c7a6d4c3eaa5683ee3486a32b97d40cc1ebc79a2233a97626cc721f6c1e61ace475fbbaaeb0cbb5a425e1150b
- TLSH T15D21026E5D91B0663F711F96C48211A91363E94C2F0CCE882B678D7C5213B4F53E7AA7
- MD5 SHA1 SHA512 TLSH
gems/2.7.0/specifications/webrobots-0.1.2.gemspec
- SHA256 44dce7c169779b219bdadadc066f80288450ba90c70adc34bd3fe680a35062cb
- MD5 31e2af6f55781e2cbbac92b6abf2811f
- SHA1 0d90fb8edec52325c5de0146dec3e5e3f247b1ec
- SHA512 873ebfcea273b8774a2767550545780f95a7fcf1e0a0b77ff22bb2331e7698f6396b51c13759c14dce0be53055958ca68833f6bd2a55f648e446dd3d521ef456
- TLSH T1D3413C1E59B3B0A2B7723FC6C8E6006616FBD4121B8D8D8873495E6C0917F9B238D673
- MD5 SHA1 SHA512 TLSH
ispell/README
- SHA256 acb192a368414c6e727488159aa2a3dcf6176a3a5828ac9d73ea6757a551f99d
- MD5 c803c2de3f3ae503c1136eb97748925b
- SHA1 e2c3a6c145de0bfa44da735355181447c5337c09
- SHA512 24a3ac68f15fe802a06ee42c6ae3b6ee9350299c3fe5c56e1746ed70cafe30d0c3fb58a47d4c7b177f49b89051b349ee3e74ad92ad01b71b7b590e48862a56ae
- TLSH T1D4A022A288CE002228008BC0AA220330322FC3CC833C00000A08320820A300C08FB000
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/DG/PAV3WSC.exe
- IMPHASH e6924013f9544cd1b5edce5063af9cd1
- SHA256 d71836b7deccb91c9419b064284aa6824fdb06609e44b0adb1a95c976a928388
- MD5 8014bff2c0237d2002624d6b76c846c3
- SHA1 70f26ef7d0496d2c23eeac928a7cb43cfff97be9
- SHA512 8bc0cbf8a1f6cfe273700c536e125659b27e290fc71ae0b097e1991dc371a0db0cfe9894bf32538593dbcfb5f6ea8e7d70bbe27178c5f511c75f8ad243a64fff
- SSDEEP 3072:XcYpATai7hZ0Bvz3K540ZSrRQf/cGQi2y:MYSTaiV+Bvz3iSt0rQib
- TLSH T143E39E2277E0C432D4D70630A978AB662E7EF9764B7480CBB3980A7D0F547D06A76367
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:4e:65:44:f3:a4:21:31:fe:0b:6c:f1:14:cd:8c:eb:a6:81:22:36:fe:ac:d6:fb:0e:2d:55:9b:07:9e:4f:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Panda Security S.L.,OU=CIT,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
Chains
Nov 15, 2020
CN=Panda Security S.L.,OU=CIT,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
89:4f:f2:5c:6d:dc:a8:ae:28:60:c9:8b:91:56:2f:d3:b9:0f:b9:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
Chains
Nov 15, 2020
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
Subject
CN=Panda Security S.L.,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
Serial Number
0c:ab:80:ca:72:78:c1:c6:ce:80:a8:f0:14:4b:19:4b
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 7, 2020 - May 26, 2021
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Panda Security S.L.,OU=CIT,O=Panda Security S.L.,L=Bilbao,ST=Basque Country,C=ES
Serial Number
07:2b:f5:aa:54:a4:4b:15:3b:44:ff:8a:d3:cf:66:49
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 6, 2020 - May 26, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
49422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\TFS\UA\Release\PAPS_1.x\Nano\Source\Code\Common\PAV3WSCExe\ProjectWin\Release\Pav2WSCExe.pdb
kernel32
InitializeCriticalSectionAndSpinCount
SizeofResource
LeaveCriticalSection
GetModuleFileNameW
lstrlenW
DeactivateActCtx
EnterCriticalSection
LockResource
CreateEventW
DeleteCriticalSection
GetCommandLineW
CreateMutexW
ActivateActCtx
ReleaseMutex
K32GetModuleFileNameExW
OpenProcess
GetVersionExW
Process32FirstW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateActCtxW
GetModuleHandleW
SetEvent
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
LocalFree
CloseHandle
LocalAlloc
GetProcAddress
GetLastError
MultiByteToWideChar
GetACP
Sleep
LoadLibraryW
GetTickCount
CreateProcessW
RaiseException
FreeLibrary
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
LCMapStringW
EncodePointer
DecodePointer
HeapFree
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
HeapAlloc
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
user32
GetSystemMetrics
advapi32
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
QueryServiceStatus
StartServiceW
TraceEvent
OpenSCManagerW
CloseServiceHandle
OpenServiceA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ole32
OleRun
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SafeArrayCopy
LoadRegTypeLi
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayLock
SafeArrayRedim
VariantChangeType
VariantInit
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
VariantCopy
LoadTypeLi
SafeArrayGetLBound
SysStringLen
SysFreeString
VariantClear
SysAllocString
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=158, productName=VS2010 build 30319, version=30319,
count=111, id=170, productName=VS2010 build 30319, version=30319,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=147, id=1, productName=Unmarked objects,
count=1, id=260, version=25203,
count=6, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
ispell/Sounds/Drivers/NNSDhcp/NNSDhcp.sys
- IMPHASH 80667d24b9163a005062df0c0e887644
- SHA256 a32fec18b6d3972095f2b177bd57deacf5fb52af187ca203ecc78f85368e234a
- MD5 fcbf498ab77e374319aa72d093a37161
- SHA1 6e07ee655c08e8118438f3f5039f7a044a067cf5
- SHA512 d6f07aa26b3e10cc7080c5969df8255b365f151f621084535997a2f146e669cfb07b3abb6bd5fb0b6b1c06d79e8d5351ab0ef72a3dd993be8dfa92c11757e6c9
- SSDEEP 3072:vvbyls/1NB29RvBEPpJBUL8YaFBbJxaVE:vjylstwpBuo2f
- TLSH T157B3192611F22039DB47557984F64E879623348CAFF8BBDB413891925B037D0AB3E77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c0:dc:ec:7d:1e:9a:6b:16:27:b5:4b:7a:36:48:0b:4e:66:cb:72:3c:0a:b0:37:0d:89:7f:17:d6:3f:0a:ca:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
c0:dc:ec:7d:1e:9a:6b:16:27:b5:4b:7a:36:48:0b:4e:66:cb:72:3c:0a:b0:37:0d:89:7f:17:d6:3f:0a:ca:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8a:3e:38:8d:d2:0e:02:fa:e8:00:01:00:00:01:8a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
110692
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSDhcp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeDelayExecutionThread
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=70, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=17, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSDhcp/WVista/NNSDhcp.sys
- IMPHASH 80667d24b9163a005062df0c0e887644
- SHA256 56559cb8b4ecce9cedf3e85e6928641a01fc86f976eb6d3255d216a9613045b7
- MD5 361fc24cd58434ef7d71b51f18537af0
- SHA1 632febef312a3a28866549decde3a2dbf91ae971
- SHA512 a285df3a06de9c31fe4202a0ab95d0bfa67454525a148fbac0711b327d5c19176ad627c405c39b515972b14f0d024f1e95fb5adede2d6c8d06a584daa0e37998
- SSDEEP 3072:4vbyls/1NB29RvBEPpJBUL8YaFBbqHSxxn:4jylstwpBuo29
- TLSH T1C9B3192611F22039DB57557884F64E879623348CAFF8BBDB413891925B037D0AB3E77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c0:dc:ec:7d:1e:9a:6b:16:27:b5:4b:7a:36:48:0b:4e:66:cb:72:3c:0a:b0:37:0d:89:7f:17:d6:3f:0a:ca:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
c0:dc:ec:7d:1e:9a:6b:16:27:b5:4b:7a:36:48:0b:4e:66:cb:72:3c:0a:b0:37:0d:89:7f:17:d6:3f:0a:ca:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8f:f3:51:a8:eb:5a:72:dd:cc:00:01:00:00:01:8f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
110692
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSDhcp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeDelayExecutionThread
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=70, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=17, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSDhcp/WVista/nnsdhcp.cat
- SHA256 f438301539ab8ffeef84a7f8b9eae234af0d3923603322e8ec8ab826abbc97df
- MD5 d8515a7e643f3085a37a12bbdccb735c
- SHA1 5a4e3c244add42a85f2fd4dcb03625920dc2493c
- SHA512 f31c63329a440778929eab962e09333a935a77ca09d8e1ba42cfb36d2b926103bb62baaeff002127d2628fa335d17977f64c46662a6671e2114f9702c4cdad6b
- SSDEEP 192:7BS5lf2ZEO7DdIM1/nScOL7yKnUi8rFWQF80FQhiK2YdX01k9z3AcB7pT:7BV7N1/nX4CFRHQKwR9zPlT
- TLSH T12F32D6E2AA6C44C2ECA7AC7093E8E4973C397BC70C50546D129BF7640D927C5EB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSDhcp/WVista/nnsdhcp.inf
- SHA256 d047ae9ebf06becbfb0202a288fd151f80838650199ae51d63fe680b6513304e
- MD5 1c6dd426805123dc82e6690d5d264955
- SHA1 c8da8ae61c9b362d31862de02311e39839ea17a9
- SHA512 095d448cb71558a90dba65a54a4f92127625f914cb791cb6fc5040117dab2a3b9e7c4282dec8a320e23fdbf19962ea0a0570933520960b00614e062480996e02
- TLSH T10151010B5E4A8A34217EC29A4A3750C5F5341101C16C340FF2EF528BABF8B0D872D1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSDhcp/nnsdhcp.cat
- SHA256 08d7a40e27257dcc7446f81013fa044987a836972d3cb76116cf663df82a0e36
- MD5 2c1c1c80a654188b4ade1e233aa89f7b
- SHA1 dd70becc5d2a69349afde40cf88d98f1d8b0592b
- SHA512 aa9c8ca761e800a7bd822e14ee035a1bd8afe2cc98bfd78eb3a9559ba7ac6524b44603d9b9a02a51ddcb057a9c89b886527004c57e833bbbf35023e3dee9ee76
- SSDEEP 192:2xKfNefXEwI+CYhYCWzXCFaqDu0K9X01k9z3ATLOJ1L:IiMh3SXCFYj9R9z4LIN
- TLSH T1CA322BB6966C4082E9ABFC5043E8F9833C7C27CB5D50506A65AFFA191C973C8F71816E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSDhcp/nnsdhcp.inf
- SHA256 d047ae9ebf06becbfb0202a288fd151f80838650199ae51d63fe680b6513304e
- MD5 1c6dd426805123dc82e6690d5d264955
- SHA1 c8da8ae61c9b362d31862de02311e39839ea17a9
- SHA512 095d448cb71558a90dba65a54a4f92127625f914cb791cb6fc5040117dab2a3b9e7c4282dec8a320e23fdbf19962ea0a0570933520960b00614e062480996e02
- TLSH T10151010B5E4A8A34217EC29A4A3750C5F5341101C16C340FF2EF528BABF8B0D872D1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSDns/NNSDns.sys
- IMPHASH e77f2b001c1604a8d12f501b02a2959e
- SHA256 b98d86866e271c1d7187d9c28fe55742ecb5b2f9a7f27b316f147e39ec2a9dca
- MD5 eeafb784b225d517bd1d5b55dc7096a8
- SHA1 9144d65d32eb3b06143663e90880cbdb68fbca48
- SHA512 8342a9e6d1bf0328c1075666b46c0dc0033e7e9659c9a62626827b81bca0eaca29f2aec245b323fd54ef4334b0a7aca91e09d08aa33d3de4dd6c2b02379c9046
- SSDEEP 3072:p7QLAKuiepTOj596NG9EMu/zCaQD1+3SG3Gx08L8Ti7e2Viy6Cx76z:p7QLAKuiehOj596NG9EMu/zCaQ03SGkQ
- TLSH T106E33B5261F52038C79B9178D8E20E876673344CBBF8BBDB4A7981515B037D0A73A37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bb:d2:69:31:da:60:8b:10:29:f5:e5:1d:5b:95:74:2b:cb:a0:45:d9:bd:72:cd:2b:2f:44:53:7c:6c:94:c3:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
bb:d2:69:31:da:60:8b:10:29:f5:e5:1d:5b:95:74:2b:cb:a0:45:d9:bd:72:cd:2b:2f:44:53:7c:6c:94:c3:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8a:3e:38:8d:d2:0e:02:fa:e8:00:01:00:00:01:8a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSDns.pdb
ntoskrnl.exe
strstr
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
isdigit
KeDelayExecutionThread
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=19, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSDns/WVista/NNSDns.sys
- IMPHASH e77f2b001c1604a8d12f501b02a2959e
- SHA256 efa6a571030ed33c675d4eda1efeb8d6942ea7ea142a3a9ab57468e91095d49f
- MD5 17c5773e535107a3e277e65720b11daf
- SHA1 8fa46e94a0582436d6c38e7fa2ea0a1c78034b83
- SHA512 8c9c17e0504d47c9356841d66bec48cdfc6127d4618b54e228b7e91512248120959f7d597fc8e00f07b7d2dc30cfcdcd27328457b0a54ee6e6395b65cbc5795a
- SSDEEP 3072:i7QLAKuiepTOj596NG9EMu/zCaQD1+3SG3Gx08L8Ti7e2ViyrcRcDxe:i7QLAKuiehOj596NG9EMu/zCaQ03SGkk
- TLSH T122E34B5661F52038C79B9078D8E24E876673344CBFF8ABDB4A7881515B037D0A73A37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bb:d2:69:31:da:60:8b:10:29:f5:e5:1d:5b:95:74:2b:cb:a0:45:d9:bd:72:cd:2b:2f:44:53:7c:6c:94:c3:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
bb:d2:69:31:da:60:8b:10:29:f5:e5:1d:5b:95:74:2b:cb:a0:45:d9:bd:72:cd:2b:2f:44:53:7c:6c:94:c3:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a1:01:85:55:99:b9:54:5d:8a:00:01:00:00:01:a1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSDns.pdb
ntoskrnl.exe
strstr
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
isdigit
KeDelayExecutionThread
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=19, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSDns/WVista/nnsdns.cat
- SHA256 bf744627f53bea97585b7443de3fc0be692223ee7597a6eeca43238fa0faaf8c
- MD5 42d19aa196c517373e83cc52ea92d867
- SHA1 64ea1cd9d343de4765f845d9b12758610983df2d
- SHA512 e1bc22209d5dd5d3086ffe09d15f2f1bd17113452c3c1867378f22b91b4c1813f85ce7a5691f11a8b3e8e02eea1aa0545a855174e8fdc752905756e3fa3cfb12
- SSDEEP 192:U4dHgf2ZEO7DdIM1/nScOL7yKnUi8rFWQFN7ks9gICQX01k9z3AF9Zcx:UU7N1/nX4CFR/7/P/R9zw2x
- TLSH T1AF32F7E26AAC4482ED67AC7093E8E4A33C3D6BCB5C50547D529BF76409927C5EB2403E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSDns/WVista/nnsdns.inf
- SHA256 b6ca3ba180295fd1406ae4061bb3e51ca9ac68ec32a8ba681c0e991853a19a47
- MD5 3a389ff52f096d81962af4a88f2b83e5
- SHA1 2b853f43cc967086935c4344c18ff7a49d397597
- SHA512 4f8d54d019949d44b8cc2e5f20e2849c7b631195350c4e2881649202d564cd611e6a2ee22b04eee73249200aeb6141fdf6875f11091f86260d9bb04c83222882
- TLSH T15A51CD098F47DB34619BD25A0B2710C6F5382215027D640DF1EF5E86ABD979D872E0BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSDns/nnsdns.cat
- SHA256 52617039950fab55f019da9fc148bad75c9a7653eb9fc059219e1ed343d3f733
- MD5 0c6ec24d3e994f984d60a6d98168c9f2
- SHA1 f9d25db053e05f730e3852ad875d4c5c9a38a1eb
- SHA512 fa1fe4a9f8f66b2a3570885ab2173a9cf627286ebcea9143c62e22bec12b75ffcb774ca08b04097ba6bde7850e7b939841c2b33b6e1095e4beb71529a20ccec0
- SSDEEP 192:e6/zvr8cgfXEwI+CYhYCVLCFaqDu0K9X01k9z3ATLOeQ:fz6iMh3VLCFYj9R9z4LzQ
- TLSH T173322BE285684082F9ABFC5053E8E9973C7D67CB5C50116A266FEA291CD73C4F72812E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSDns/nnsdns.inf
- SHA256 b6ca3ba180295fd1406ae4061bb3e51ca9ac68ec32a8ba681c0e991853a19a47
- MD5 3a389ff52f096d81962af4a88f2b83e5
- SHA1 2b853f43cc967086935c4344c18ff7a49d397597
- SHA512 4f8d54d019949d44b8cc2e5f20e2849c7b631195350c4e2881649202d564cd611e6a2ee22b04eee73249200aeb6141fdf6875f11091f86260d9bb04c83222882
- TLSH T15A51CD098F47DB34619BD25A0B2710C6F5382215027D640DF1EF5E86ABD979D872E0BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSHttp/NNSHttp.sys
- IMPHASH 1c245e7c7bb2ad1e107bb32ae2057795
- SHA256 126f977a81ecb10ed8aa1ba1314e8ef8a92c0eecfdfc031a79f68415fb423b34
- MD5 1c3d01596c2cfa08ac90d74e119abbcc
- SHA1 8788c7e2a7710091ee18c01e8fcd93fcd4a11b6b
- SHA512 165073940d058153805bb4ac58f8eed81ceba64040f160155d84c053bde2485c83a56b5e796a72fe356121e680b5b4a4f3cbcce015fb90cd2e77fbe8b928841b
- SSDEEP 3072:G2J2GnFgrxWmZ9Hnmsq6y+bPOM2g7ufg0o/ef0Fl75bkB6V3z5+9ZPoBMR6x5/:3JvUo8b+9M2dfg0o/wKd5bkR9ZPZW
- TLSH T178244B1613F220ACDA771175A6E24EA7F632348C7FB49ED74868825517037F06B3A36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:1c:d1:e1:34:c7:87:0e:e0:5c:22:6d:b4:60:1e:2a:64:b4:ae:86:71:5c:44:9a:72:21:d0:3d:b8:29:8b:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
e7:1c:d1:e1:34:c7:87:0e:e0:5c:22:6d:b4:60:1e:2a:64:b4:ae:86:71:5c:44:9a:72:21:d0:3d:b8:29:8b:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:86:78:e5:19:89:f8:24:4b:cc:00:01:00:00:01:86
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
217188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSHttp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
_stricmp
_strnicmp
strstr
atoi
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlUnicodeStringToInteger
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
tolower
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=34, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSHttp/WVista/NNSHttp.sys
- IMPHASH 1c245e7c7bb2ad1e107bb32ae2057795
- SHA256 5aed214a995fc9d3ec6d952d373c88e971cb3ad723c13f955bad1dba38dd90a8
- MD5 96522be9ab926c44b3efe02d190eb399
- SHA1 5a08ba21e9b6fb896a4bec7d35f0f697be7cb206
- SHA512 b02bf5ba76a7e4b416e04042664df04d914cadd029fe9318cea7111644272cbdc57a2283ebd27ed315caef27059590373f36ec135f837f0a8c10887adaa02918
- SSDEEP 3072:U2J2GnFgrxWmZ9Hnmsq6y+bPOM2g7ufg0o/ef0Fl75bkB6V3z5+9ZPoBMRP7yx9:FJvUo8b+9M2dfg0o/wKd5bkR9ZPZe
- TLSH T1E8244B1613F220ACDA771175A6E24EA7F632348C7FB49ED748A8825517037F06B3A36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:1c:d1:e1:34:c7:87:0e:e0:5c:22:6d:b4:60:1e:2a:64:b4:ae:86:71:5c:44:9a:72:21:d0:3d:b8:29:8b:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
e7:1c:d1:e1:34:c7:87:0e:e0:5c:22:6d:b4:60:1e:2a:64:b4:ae:86:71:5c:44:9a:72:21:d0:3d:b8:29:8b:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a1:01:85:55:99:b9:54:5d:8a:00:01:00:00:01:a1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
217188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSHttp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
_stricmp
_strnicmp
strstr
atoi
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlUnicodeStringToInteger
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
tolower
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=34, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSHttp/WVista/nnshttp.cat
- SHA256 8cb3d2b1c7ae89badcbbb193f68277410a2cc39d4c9d8aef31cdf1ae2b5f032f
- MD5 c929fc47988b17c99c22b594b99d1b16
- SHA1 132d9c72ace4f52777fc7ea15708d11d425c4192
- SHA512 c2f2d10de977d3746d505e31e84502220de5895d78863d21ac03eaf041be8dd4f10469d3958c09d64843ccdc853846c1e7ea71f72dca8fd89a61bcd70b848605
- SSDEEP 192:/gZlXf2ZEO7DdIM1/nScOL7yKnUi8rFWQFa1Vks9gICQX01k9z3AF9nNHj:/gQ7N1/nX4CFRo1V/P/R9zwpj
- TLSH T1FA4208E256AC44C2ED67AC7093E8E4A33C3D6BC71C50803D629BF76409927C5EB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSHttp/WVista/nnshttp.inf
- SHA256 16c50154c97578968f3a6c7299fb244d3b47f1a13c784f79e1727de1a1f0ddc9
- MD5 f28247c43558d52b045f71a661bba04c
- SHA1 140f93bbf366ad97d6efb3e6599b8da565282261
- SHA512 4d20f8cb1a14da7e4a6b75bf3b307f9430db580690691ef155743428d6733775212fc03322e76e96839b9389f40b6aebee0fcd7ceb258584a9bee052d048b30d
- TLSH T1A651FE495F46D638214AD35B0B235089F9381111C169280C71FF928BFACAB0DC6FD17E
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSHttp/nnshttp.cat
- SHA256 06fe674b84d6ffcca9875dbb6568588e2a8397da60f4fa06dfc754efa853595e
- MD5 7f818556b027c237ea4791949df683dd
- SHA1 ce561d89040bfe364f2a149075dfb48d47032d9f
- SHA512 f8ff60e7b13d39c0a94199af1c8c7a78db6e3e1e8462735a260254b0d70e8b986de0e3c3c305f4613f5c7e450fab294530508fd5aa9912f9f2ed5c5ba88cfee2
- SSDEEP 192:k2HcOl2M1fXEwI+CYhYCcuh+Il+jX01k9z3A9rUEQ2:kcsWiMh3cWEjR9zirlQ2
- TLSH T128324CB145684183FDA7BC6013E8E9473C3D27C71D50406D269BFA291D973C9E72467E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSHttp/nnshttp.inf
- SHA256 16c50154c97578968f3a6c7299fb244d3b47f1a13c784f79e1727de1a1f0ddc9
- MD5 f28247c43558d52b045f71a661bba04c
- SHA1 140f93bbf366ad97d6efb3e6599b8da565282261
- SHA512 4d20f8cb1a14da7e4a6b75bf3b307f9430db580690691ef155743428d6733775212fc03322e76e96839b9389f40b6aebee0fcd7ceb258584a9bee052d048b30d
- TLSH T1A651FE495F46D638214AD35B0B235089F9381111C169280C71FF928BFACAB0DC6FD17E
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSHttps/NNSHttps.sys
- IMPHASH e56594fd3cacf09c74e083c6ff3fa3c9
- SHA256 69b8e87b5fd7e86f18a019eb133b91bff2fd7e34314fde4c8f652bd7942017f7
- MD5 887a6e211601dc15730e5f2d0bf4df30
- SHA1 70b505fa302be63507812c9fe1c006a32d0ae075
- SHA512 4b793c0d6dba2490c325616dc3d656c755edd4c295953486657576fb0c1719df8e6147762e485463637f4433fa7d0c3492ff055bde2867f392fa4a6e38048990
- SSDEEP 3072:zDW3zAoNcfLpGv6gP/CJ+K8ni+cEMRjxJb:HWjAo+fLpsLPPhU
- TLSH T1A8C32A2616F2203DDB57517888F24E875363348CAFF86BDB457891529B037D0AB3A33A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ac:fe:f5:8c:3a:5c:cf:8d:6f:51:b3:6a:6e:49:d9:35:90:ae:f5:a3:ed:63:0f:36:46:8c:9d:48:9d:08:3e:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
ac:fe:f5:8c:3a:5c:cf:8d:6f:51:b3:6a:6e:49:d9:35:90:ae:f5:a3:ed:63:0f:36:46:8c:9d:48:9d:08:3e:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8a:3e:38:8d:d2:0e:02:fa:e8:00:01:00:00:01:8a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
127076
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSHttps.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
KeDelayExecutionThread
__C_specific_handler
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=25, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=22, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSHttps/WVista/NNSHttps.sys
- IMPHASH e56594fd3cacf09c74e083c6ff3fa3c9
- SHA256 310eeaf49ff346dbbf07ee4401e1ae60bd2f70c4c6b21abf7cc5a399aa1db5a1
- MD5 1c75e0df00def2030a7ff496a5b945b6
- SHA1 79ccc0d74781d2c8bb29578160f6a16f28eaf8ff
- SHA512 33e4eb5e1d48f138cfe7d94390063d92faf37d68f66b1e210c56a7b0bba42475996e0a2858568f4d6c294f39903c21da261c9dcf313a87674ea7d5ad56683070
- SSDEEP 3072:XDW3zAoNcfLpGv6gP/CJ+K8ni+cEMRwn9xE:zWjAo+fLpsLPPhS
- TLSH T1ECC32A2616F2203DDB57517888E64D836363348CAFF96BDB4578D1529B037D0AB3A33A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ac:fe:f5:8c:3a:5c:cf:8d:6f:51:b3:6a:6e:49:d9:35:90:ae:f5:a3:ed:63:0f:36:46:8c:9d:48:9d:08:3e:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
ac:fe:f5:8c:3a:5c:cf:8d:6f:51:b3:6a:6e:49:d9:35:90:ae:f5:a3:ed:63:0f:36:46:8c:9d:48:9d:08:3e:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a0:e9:bb:8c:bb:0e:a2:d1:7a:00:01:00:00:01:a0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
127076
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSHttps.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
KeDelayExecutionThread
__C_specific_handler
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=76, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=25, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=22, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSHttps/WVista/nnshttps.cat
- SHA256 1eb0d5b0adf4460e2f4899f71775c0f44d9f84997e6cc35939e32d7c41d4e2f0
- MD5 b584316b802146fb4db06cbfd1ad2a67
- SHA1 e94ee4b300eba5561191d2e914e8af2ef8e75153
- SHA512 e770cc6587f9c96b3f072f3c4f7570137102afa4d1a89aea4dbf096e079360c7bb3631864d94cc5ef7e097e928bf27b10f521f38d8e9df3ba86fc597c1878298
- SSDEEP 192:PJkYf2ZEO7DdIM1/nScOL7yKnUi8rFWQFp1Qu7hG2ZUnQJeX01k9z3ADsp4Pxf:PM7N1/nX4CFRxQudG2teR9zXc
- TLSH T1BB32D7D25A6C44C3ED97A87083E8E4A73C396BC71C40456D239BF7640DA27C5EB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSHttps/WVista/nnshttps.inf
- SHA256 1d9acf017c7af7b4bcd94203a825e6f6c93e6b44f27f06eb143a514a546c9f34
- MD5 6fcd176ea4ec9c2ffb757b5f0d9a54c9
- SHA1 89b2ad667de943f04dabdef50b3d01eb2f8ab348
- SHA512 31b9364bc3cd659dc95b9be3d10691bd231fea4a35e2faf3b0116be87708d4635b30448a9d7e7efdc3a267df7e9257cb9cdeed902677c0fbfeec5bcd98410428
- TLSH T15051C1944D46D63862D7D3570B2F14C9F1B8220181AD1C0D75EFA147E6C561D87BD0BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSHttps/nnshttps.cat
- SHA256 fe60add01756dcf77892d2160d939a491da22d6ac1f39b12e009a7a0ba97e799
- MD5 a1e7b3861fdc23d11ac205fe5773be6e
- SHA1 0b3164d737974015a3626953f89264001ac1610f
- SHA512 e973044caa12d26fb00bb99a78e8b92ceda381057ab5dc4dd669865158c3f7819378da53af45c1baafbe898152e282dd266007b8a74b515f1b78f837ad5e9dea
- SSDEEP 192:bSsYH01sfXEwI+CYhYCsBWGaN4NhrJgX01k9z3ASf31Uv:yCsiMh3sYTN4tgR9zl31Uv
- TLSH T195322BA6956C4182EE6BBC6013E8F9473C3D27CB6C104169659FFA1E1C973C8E72826D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSHttps/nnshttps.inf
- SHA256 1d9acf017c7af7b4bcd94203a825e6f6c93e6b44f27f06eb143a514a546c9f34
- MD5 6fcd176ea4ec9c2ffb757b5f0d9a54c9
- SHA1 89b2ad667de943f04dabdef50b3d01eb2f8ab348
- SHA512 31b9364bc3cd659dc95b9be3d10691bd231fea4a35e2faf3b0116be87708d4635b30448a9d7e7efdc3a267df7e9257cb9cdeed902677c0fbfeec5bcd98410428
- TLSH T15051C1944D46D63862D7D3570B2F14C9F1B8220181AD1C0D75EFA147E6C561D87BD0BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSIds/NNSIds.sys
- IMPHASH 64dc166a1bd2f56f7327738288388f78
- SHA256 b14759727200a42b25c4f411e03ff01201f76f35f7d1e2cb59f2c542075a9784
- MD5 e6370604cc9338c40d226d61de6c7d54
- SHA1 71d3199a5b417f7a903321c684d084e01c854cd6
- SHA512 0cda50470ed487a68038f14cf483f028882f3e9fc20296d09f1ca6a6680ecaffdcd8751aa50337d067a4f8d219bc16927e4585d8d013dd562214ddca4f67c1c3
- SSDEEP 3072:u/etm3VYt+DQLYfjHQQ17gc1VPDkTlISxPs:u/etm3VYtdsJ7bgKt
- TLSH T1D0E3295521F22039D787817984D24EC7A672348C9FF96BDB4138D0656B037E0EB3A77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3c:2c:fc:ea:c5:39:39:2e:2e:37:d9:d4:c8:fb:bc:02:b2:65:bc:95:75:78:cc:24:9d:37:84:e0:aa:dd:21:0f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
3c:2c:fc:ea:c5:39:39:2e:2e:37:d9:d4:c8:fb:bc:02:b2:65:bc:95:75:78:cc:24:9d:37:84:e0:aa:dd:21:0f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:86:78:e5:19:89:f8:24:4b:cc:00:01:00:00:01:86
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSIds.pdb
ntoskrnl.exe
IoWMIWriteEvent
KeInitializeMutex
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareMemory
IofCallDriver
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
RtlUnicodeStringToInteger
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
KeDelayExecutionThread
IoWMIRegistrationControl
ExDeletePagedLookasideList
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=33, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSIds/WVista/NNSIds.sys
- IMPHASH 64dc166a1bd2f56f7327738288388f78
- SHA256 25c73bca17db04f9539bb2b4b5e718c2876ac9770606acfda92476879eae671e
- MD5 62802a135bdf46b22f35c9905421f3b3
- SHA1 17929073f24c768cd6084d2ec89ca3e4efec5d6d
- SHA512 4acbc8b09e767b4a4abcd4bfbd73543f6f70195af34aa6b2b18e1f3b72e567d450be15ef3fa897353183623ec1108d8df6da8bf0c0f0386733cc760d3e3d4a1e
- SSDEEP 3072:ucetm3VYt+DQLYfjHQQ17gc1VPDkTl6B5xJ:ucetm3VYtdsJ7bgi
- TLSH T1BAE3295521F22039D787817984D24EC7A672348C9FF9ABDB4138D1616B037E0EB3A77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3c:2c:fc:ea:c5:39:39:2e:2e:37:d9:d4:c8:fb:bc:02:b2:65:bc:95:75:78:cc:24:9d:37:84:e0:aa:dd:21:0f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3c:2c:fc:ea:c5:39:39:2e:2e:37:d9:d4:c8:fb:bc:02:b2:65:bc:95:75:78:cc:24:9d:37:84:e0:aa:dd:21:0f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8f:f3:51:a8:eb:5a:72:dd:cc:00:01:00:00:01:8f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSIds.pdb
ntoskrnl.exe
IoWMIWriteEvent
KeInitializeMutex
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareMemory
IofCallDriver
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
RtlUnicodeStringToInteger
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
KeDelayExecutionThread
IoWMIRegistrationControl
ExDeletePagedLookasideList
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=74, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=33, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSIds/WVista/nnsids.cat
- SHA256 18bd2cc6f4419f2657205d0abdade7e9fd8b1e41956a736602fe9da31577da53
- MD5 751eec0aa5e5a63c437b4951e5db09b3
- SHA1 eee5392678ebd7929cbd5f328d811182ed509229
- SHA512 6ff294025869bcc232698f350e137667be0dfc2286e9580cab9abc88961eef88904efce0cd86785d6c414c8ca8e4fe293e361afed7184ce3fd32523049766ec4
- SSDEEP 192:0x5/f2ZEO7DdIM1/nScOL7yKnUi8rFWQF8aaQZfbF0F/C+dyoX01k9z3A7SVar:Sy7N1/nX4CFRBZjWF//dJR9z+SVar
- TLSH T19042F8E2966C4182ED976C7083E9E4973C396BDB1C50846D22DBFB640D923C5F72847E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSIds/WVista/nnsids.inf
- SHA256 7d170a9f15fe1f584db1c3299a08a02603e9d3e1e74393fe6603117556a53e58
- MD5 1b9cb890c93e942c865866d3850d25e9
- SHA1 c383dad209652c75e40b42796c011bf51255cfcb
- SHA512 080e636a0786dda57c70b98122e36977b05742dcc5e173c9bc33de8c9373c0b88eb50f9f3e4585076a0a8ab918fea31c5d93cfd8fdfaf6c21b4ce57c961c2f4b
- TLSH T13651AE1C4E479A38619BD2E52B2750C5F578A10502E9A40C71EF9186ABC570DC73D7FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSIds/nnsids.cat
- SHA256 78e4f96a00cea9fd62936e3ca8dad91c997ac30388978ba24d97b3b02e304a3f
- MD5 edac6e98a033fbcfa96de24da9cbbb7b
- SHA1 0db63509430168ef59be6bc5bb93a24aa024fe6b
- SHA512 7f7d312421ce770c2b953555860b850b3e8e024fd8271d95661f6f0a672eb3f2ff091a5f16bc143a5bd8d145012cd036c9ad38c7cc64ae997f39ed62c78a0641
- SSDEEP 192:Fu7hXLfXEwI+CYhYCUsWGaN4NhrJgX01k9z3ASf31FI2T8:2iMh3URTN4tgR9zl31bg
- TLSH T188322AE2859C4182EE9BBCA063E8E9477C797BCB1C5040B9619FFA191CD63C8E72412D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSIds/nnsids.inf
- SHA256 7d170a9f15fe1f584db1c3299a08a02603e9d3e1e74393fe6603117556a53e58
- MD5 1b9cb890c93e942c865866d3850d25e9
- SHA1 c383dad209652c75e40b42796c011bf51255cfcb
- SHA512 080e636a0786dda57c70b98122e36977b05742dcc5e173c9bc33de8c9373c0b88eb50f9f3e4585076a0a8ab918fea31c5d93cfd8fdfaf6c21b4ce57c961c2f4b
- TLSH T13651AE1C4E479A38619BD2E52B2750C5F578A10502E9A40C71EF9186ABC570DC73D7FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSNHWFP/NNSNHWFP.inf
- SHA256 c5b89545ae4dd2c9a4183407042dc5bb3ece29c52fe0dc1bf80cdfc583cbd568
- MD5 d070818f473f66aa2b1cc9bd27933fe6
- SHA1 42531becce370f5d7d1aa3d0fa3319ba7d85a0fd
- SHA512 93393ad86f6f07c477e672708b6a69ffb519241bc526bcff88a00f946bf31ba7c9507120f2c23521e67a7941f29c14f09e1cb9959cb42240d33a7956ef6cbdb9
- TLSH T14751AE1F4E469734715FD25A0A2F20C5F939110141BD248DF1FB63879AF4A4DE62D1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSNHWFP/NNSNHWFP.sys
- IMPHASH 7d137fadd7b28d6453ea16a3046e199e
- SHA256 3d1b9feafce7ccd1f52b6ab031819dc0171c87808fec22556e252695dbd349b5
- MD5 0d390a7c3f7db2f150ecd33203bec3fd
- SHA1 f7dbe21d13d60214c944500ac8e81bb08bd69232
- SHA512 90438a7460c978bdfd0f3cfd9bf486c98bb0efda0538312fd04681f709d2d1c69f9f904337731f5c834a20590ad145f47b926dbcb84ee1a70e39022138370d5f
- SSDEEP 6144:Cz1ppXZaTwWPCopz7ng8N01owCb50NPxv9oqHw8t0W04oht7U8Yo+z8:ypJaTwtopng8N01owCb50NPxv9oqHw8I
- TLSH T16F242B28B2F53079F627D1BD88924D16A63770885FE59EDB127C82116F123D0A73B3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:5c:3c:7f:be:a2:43:2a:5b:57:f2:c6:c0:6c:b5:6d:f7:d5:ce:05:74:94:61:19:71:63:bc:91:d4:4b:d4:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 11, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
01:5c:3c:7f:be:a2:43:2a:5b:57:f2:c6:c0:6c:b5:6d:f7:d5:ce:05:74:94:61:19:71:63:bc:91:d4:4b:d4:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 11, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9e:fd:c2:2d:d8:31:5a:b6:b1:00:01:00:00:01:9e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
217088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\TFS\UA\Release\PAPS_1.x\Interception\NNS\Source\Code\bin\W8.1 KRelease\x64\NNSNHWFP.pdb
ndis.sys
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisAllocateMdl
NdisFreeMdl
NdisAllocateMemoryWithTag
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBuffer
NdisFreeNetBuffer
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisRetreatNetBufferListDataStart
NdisAdvanceNetBufferListDataStart
NdisGetDataBuffer
NdisCopyFromNetBufferToNetBuffer
NdisCopySendNetBufferListInfo
NdisCopyReceiveNetBufferListInfo
fwpkclnt.sys
FwpsCalloutRegister0
FwpsCalloutRegister1
FwpsCalloutUnregisterById0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsQueryPacketInjectionState0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmSubLayerAdd0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectMacReceiveAsync0
FwpsInjectMacSendAsync0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
ntoskrnl.exe
strcpy_s
wcscpy_s
RtlInitUnicodeString
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoCreateDevice
IoDeleteDevice
PsGetCurrentProcessId
PsGetCurrentThreadId
swscanf_s
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
KeDelayExecutionThread
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmMapLockedPagesSpecifyCache
ZwClose
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
KeClearEvent
KeResetEvent
KeSetEvent
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializePagedLookasideList
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
sprintf_s
KeBugCheckEx
KeCancelTimer
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, productName=VS2019 v16.11.9 build 30139, version=30139,
count=3, id=260, productName=VS2017 v15.6.0 build 26128, version=26128,
count=7, id=257, version=27412,
count=128, id=1, productName=Unmarked objects,
count=5, id=259, version=27412,
count=19, id=260, version=27412,
count=3, id=261, version=27412,
count=1, id=262, version=27412,
count=17, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
ispell/Sounds/Drivers/NNSNHWFP/W8/NNSNHWFP.inf
- SHA256 c5b89545ae4dd2c9a4183407042dc5bb3ece29c52fe0dc1bf80cdfc583cbd568
- MD5 d070818f473f66aa2b1cc9bd27933fe6
- SHA1 42531becce370f5d7d1aa3d0fa3319ba7d85a0fd
- SHA512 93393ad86f6f07c477e672708b6a69ffb519241bc526bcff88a00f946bf31ba7c9507120f2c23521e67a7941f29c14f09e1cb9959cb42240d33a7956ef6cbdb9
- TLSH T14751AE1F4E469734715FD25A0A2F20C5F939110141BD248DF1FB63879AF4A4DE62D1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSNHWFP/W8/NNSNHWFP.sys
- IMPHASH 7d137fadd7b28d6453ea16a3046e199e
- SHA256 0f7b4f7d535157ee2546b2d33933ec89b5856597ee9dee85046a1bf3930b8c37
- MD5 b086de66625da8dab49e7cf8e253ec04
- SHA1 149e5123f59915ea42a30127b3a03c2809775d58
- SHA512 3e15af0602c465fc633839ace369a9e228ba09f1d37bc12dda8a48f4cde0796f623e8b2aceb6b25aec24abe8a184964a82f4740e398908c31aea33dd980ce443
- SSDEEP 6144:1z1ppXZaTwWPCopz7ng8N01owCb50NPxv9oqHw8t0W04oht7U8Yo+q:ppJaTwtopng8N01owCb50NPxv9oqHw8a
- TLSH T161243C28B2F53079F627D1BD88924D16A63770885FE59EDB127C82116F133D0A73B2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:5c:3c:7f:be:a2:43:2a:5b:57:f2:c6:c0:6c:b5:6d:f7:d5:ce:05:74:94:61:19:71:63:bc:91:d4:4b:d4:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 13, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
01:5c:3c:7f:be:a2:43:2a:5b:57:f2:c6:c0:6c:b5:6d:f7:d5:ce:05:74:94:61:19:71:63:bc:91:d4:4b:d4:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 12, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
10
Entry point
217088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\TFS\UA\Release\PAPS_1.x\Interception\NNS\Source\Code\bin\W8.1 KRelease\x64\NNSNHWFP.pdb
ndis.sys
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisAllocateMdl
NdisFreeMdl
NdisAllocateMemoryWithTag
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBuffer
NdisFreeNetBuffer
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisRetreatNetBufferListDataStart
NdisAdvanceNetBufferListDataStart
NdisGetDataBuffer
NdisCopyFromNetBufferToNetBuffer
NdisCopySendNetBufferListInfo
NdisCopyReceiveNetBufferListInfo
fwpkclnt.sys
FwpsCalloutRegister0
FwpsCalloutRegister1
FwpsCalloutUnregisterById0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsQueryPacketInjectionState0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmSubLayerAdd0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectMacReceiveAsync0
FwpsInjectMacSendAsync0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
ntoskrnl.exe
strcpy_s
wcscpy_s
RtlInitUnicodeString
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoCreateDevice
IoDeleteDevice
PsGetCurrentProcessId
PsGetCurrentThreadId
swscanf_s
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
KeDelayExecutionThread
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmMapLockedPagesSpecifyCache
ZwClose
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
KeClearEvent
KeResetEvent
KeSetEvent
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializePagedLookasideList
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
sprintf_s
KeBugCheckEx
KeCancelTimer
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, productName=VS2019 v16.11.9 build 30139, version=30139,
count=3, id=260, productName=VS2017 v15.6.0 build 26128, version=26128,
count=7, id=257, version=27412,
count=128, id=1, productName=Unmarked objects,
count=5, id=259, version=27412,
count=19, id=260, version=27412,
count=3, id=261, version=27412,
count=1, id=262, version=27412,
count=17, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
ispell/Sounds/Drivers/NNSNHWFP/W8/nnsnhwfp.cat
- SHA256 addb1546c63de94ca0fed7f694938844ce0c04c8fb86ed24d4b11853958e9568
- MD5 0d9ed59ffa89ce4192bf8eed72e26c83
- SHA1 03ff225249456307e778bb88fb23d97f8ba9dc79
- SHA512 5b602b60584af46bcd146c4b4e760faf218694efaeaf76da8aad5ac95a713b2ce5e3fa251e2c406e326a802fa3259f98697104472bfb8e9cce42c33c04e2fc13
- SSDEEP 192:HN3uVaVX2aB0OL7yKnUi8rFWQFYYj+6IVnKaQwP7yX01k9z3AnN7L:HuaZ04CFRhq6zaHeR9zY5L
- TLSH T1B4322AE24A6C1482EE97BC7083ECE497BC3D6BDB185054B922D7F6650C833C5EB4412E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSNHWFP/nnsnhwfp.cat
- SHA256 7d6bd54a40f34ca6b62a00652ad326351fc24e02c0b6e081de0475359342e7ec
- MD5 9695703a91c609dd2a5b516d0158c805
- SHA1 81164bab6efd1822aa69d23cbd505ad49388e3fa
- SHA512 e652c7ce324eea37299f9b6af8a304889914779f4e984933ff41934fba187a4cc5a0a8a8735b29709547357fd542a46a6956141492d70f239a4899d6efc0cbbe
- SSDEEP 192:T/ISY2gUJC1ofXEwI+CYhYC8MOyUs+OX01k9z3AfvgE:gUOoiMh38riR9zUp
- TLSH T126324CA2926C5083EA97BCA013E8EA873C3C37C76C50547A629FF6191D9B7C4EB1417D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSNahsL/W8/NNSNAHSL.sys
- IMPHASH fa33d5f7b39cfaa31f6dfff8ae848b9e
- SHA256 4b814163d49d05e72f8dd518158006ccb854ed03d98adef95f206703ca500507
- MD5 fcab7abe8a60f19b6ffe88df7d4594f0
- SHA1 65a6cffc074bff36003d2be63cdbb03b0a8319c0
- SHA512 89385e1603ef9a9e95b6026de3dda1673be67cff3774daf45efedb59b7dd278935ec698070fcb05ea88935762f948670b43f8d3727e3559fc5cee69190477b86
- SSDEEP 3072:6KQwTYdkzMWZ0wIDOmsycLmj5CPQMzkZsQ7Hd7jI2aZ0/ekV7feBh9PxE:1gWCwIqnPGHd7jck0B3i
- TLSH T179E33A46F3B56938D45AD0B4DEE3111DAAB1FD1A4B76A2DF035C8A006B123C0E9793ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:cd:d5:ca:26:4c:84:ea:db:78:df:7b:09:a9:45:39:0c:d1:d0:88:4a:a6:d1:95:1d:49:98:2e:f5:07:69:8d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 26, 2023
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
db:cd:d5:ca:26:4c:84:ea:db:78:df:7b:09:a9:45:39:0c:d1:d0:88:4a:a6:d1:95:1d:49:98:2e:f5:07:69:8d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 25, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b3:fe:25:ce:29:1b:1b:8a:1c:00:01:00:00:01:b3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
10
Entry point
148480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\TFS\UA\Release\PAPS_1.x\Interception\NNS\Source\Code\bin\W8.1 KRelease\x64\NNSNAHSL.pdb
ndis.sys
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisGetDeviceReservedExtension
NdisFRestartFilter
NdisCloseConfiguration
NdisFreeMemory
NdisInitializeEvent
NdisSetEvent
NdisWaitEvent
NdisGetVersion
NdisOpenConfigurationEx
NdisAllocateMemoryWithTagPriority
NdisAllocateCloneOidRequest
NdisFreeCloneOidRequest
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBuffer
NdisFreeNetBuffer
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisFreeNetBufferList
NdisAllocateCloneNetBufferList
NdisFreeCloneNetBufferList
NdisAllocateNetBufferAndNetBufferList
NdisGetDataBuffer
NdisCopyFromNetBufferToNetBuffer
NdisCopySendNetBufferListInfo
NdisCopyReceiveNetBufferListInfo
NdisAllocateMdl
NdisFreeMdl
NdisFRegisterFilterDriver
NdisFDeregisterFilterDriver
NdisFSetAttributes
NdisFSendNetBufferLists
NdisFReturnNetBufferLists
NdisFSendNetBufferListsComplete
NdisFIndicateReceiveNetBufferLists
NdisFOidRequest
NdisFOidRequestComplete
NdisFIndicateStatus
NdisFDevicePnPEventNotify
NdisFNetPnPEvent
NdisFCancelSendNetBufferLists
ntoskrnl.exe
RtlInitUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IofCompleteRequest
memcpy_s
MmGetSystemRoutineAddress
RtlEqualUnicodeString
RtlGetVersion
RtlCompareMemory
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmMapLockedPagesSpecifyCache
IoWMIRegistrationControl
ZwClose
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwCreateKey
ZwSetValueKey
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObfDereferenceObject
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=260, version=25203,
count=5, id=259, version=25203,
count=5, id=257, version=25203,
count=78, id=1, productName=Unmarked objects,
count=10, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
ispell/Sounds/Drivers/NNSNahsL/W8/nnsnahsl.cat
- SHA256 ee4ed4b01597fcb8c8658eaca45d7d49473f24acf5f79e84164da9574aa4853e
- MD5 4adab7b1a1475e0a0139c10cea3b17a1
- SHA1 ee1f49f95ae86dfc2f49dd75dad4127340e970dd
- SHA512 07b5a623cea657dcaa48b1fa9e1692997606b46cb6536f4f87b0edd289c1a87196dcd8999d65ce61e1499acfc7afbee4bc0b4ae855da5eda81620de0fc691b03
- SSDEEP 192:XnoYmn27PJCdFOL7yKnUi8rFWQFEsuPGpF+nasu+JX01k9z3AzsuhXbi:XLNPWF4CFRWshpUad+JR9zusuhX2
- TLSH T19A3207D28AAC9083FDA7A97053F8E5937C3C6BCB1940546961ABF7240CA33C9E71416E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSNahsL/W8/nnsnahsl.inf
- SHA256 18a34261deefc87c7870943ea7d31c52380ac375bb3e863688256c35f19ecba4
- MD5 2314bc8f6e1983f74e025ba400d595c3
- SHA1 d1daa30e09b3db496d875011f11ace046a481b19
- SHA512 0781ddf89174a464c1a407ec7d1242a770a0d7d2ebe581f34f96cdcbb514bf84cbfc8d120380aef8c704c0fe12f102778d02ec5ace733c1d91e05607f41cd558
- TLSH T1948131046D8E56B4E443C25A725B2452E67C21B061FE201CFEED46A7F38FD4CB21C99B
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSPop3/NNSPop3.sys
- IMPHASH 8f1c40326087ac5466699c9400fd6c2c
- SHA256 ff8844bb121bde577f344680c4f6b7441760e4243187e26fe261eb0dabc21bf4
- MD5 472e053ca5a4784eb16674d9971d8b32
- SHA1 1b5669bc52f405c6649623011dae02f7cfba91f2
- SHA512 1b86d650bc9879c85bcda729b476daa5d14f4e2872d313b5a1f8f31a7e8417e6d1f3921d2ff36851f938c9de4d61766efee8022339cf2e57c2f93e5fd40b0c0c
- SSDEEP 3072:0k2RHlIdsxt49agKzw31P4uNNmh1YvQbOR16xwE:0kel9w31P43FZ
- TLSH T1ADD3181712F210B9CA571636ABE24ED7F632348CBFB89ED7446891545B037E09B3A32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:a2:28:59:42:0d:15:b3:70:d4:8d:c2:53:bb:7e:86:82:f6:eb:51:7a:e9:8a:f8:ee:c4:05:a2:44:8f:bb:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
00:a2:28:59:42:0d:15:b3:70:d4:8d:c2:53:bb:7e:86:82:f6:eb:51:7a:e9:8a:f8:ee:c4:05:a2:44:8f:bb:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a0:e9:bb:8c:bb:0e:a2:d1:7a:00:01:00:00:01:a0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSPop3.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
atoi
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=23, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSPop3/WVista/NNSPop3.sys
- IMPHASH 8f1c40326087ac5466699c9400fd6c2c
- SHA256 814e7fdf2a709ed818a15ad6f431b09ccf36d36fee40041bb6f10647c54fb0a2
- MD5 8347e712bb4d547312581a3ccab4eacd
- SHA1 0ed815763fa439541ca9094ab7182b6209f43ab3
- SHA512 cbbfbff6f610fb2e6c84cd7422b47a01c6f7ca693e43d1dff9d01ab3923953d40e9dabff21c9251fc843324941a746b95e37256cb5fdce27ce671462d8427d38
- SSDEEP 3072:ek2RHlIdsxt49agKzw31P4uNNmh1YvQbOR1uQrxD:ekel9w31P43F+
- TLSH T13BD3291712F220B9CA571276ABE24ED7F633348C7FB89ED7446891545B037E09B3A22D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:a2:28:59:42:0d:15:b3:70:d4:8d:c2:53:bb:7e:86:82:f6:eb:51:7a:e9:8a:f8:ee:c4:05:a2:44:8f:bb:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
00:a2:28:59:42:0d:15:b3:70:d4:8d:c2:53:bb:7e:86:82:f6:eb:51:7a:e9:8a:f8:ee:c4:05:a2:44:8f:bb:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9e:fd:c2:2d:d8:31:5a:b6:b1:00:01:00:00:01:9e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSPop3.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
atoi
KeBugCheckEx
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=23, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSPop3/WVista/nnspop3.cat
- SHA256 454ca5c6b17d0d89eb297aab6d215c081d4c0de01790076143a51dde8c2c105e
- MD5 c2cdba297599d0f2c90f731c788fa015
- SHA1 be8b12ad92bbfc03296cf88aed49c1cfddd3cb6a
- SHA512 a01874a8d18297eca953e87cb45a4b87791cf797d0ee19c4d75b6bae81541ccee4bc06fdfcae7823972adf036343a23130a2366e7c0298b55992dd9afc19843f
- SSDEEP 192:0CIcf2ZEO7DdIM1/nScOL7yKnUi8rFWQF4L5BFYIN5vCX01k9z3AtiBiuhs:0v7N1/nX4CFRWL54UJCR9zabuhs
- TLSH T14432D7E3596D44C2ECA7AC7083E8F4973C396BC71C504929229BF7644D927C5EB2847E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSPop3/WVista/nnspop3.inf
- SHA256 8748c7694634802aa739edf46e9d7f528bc8761d526095c056b30b1734048b88
- MD5 316102ea8f18bc9cbcc82b1711ab4a12
- SHA1 7f45c422b78bb509a75f8935fcffe04459c17834
- SHA512 bf72619f7fb78d87a87363f7e73b7aee5624f3c683f42f0a13a8dd7df40dffe047de760b2a3c0fe0c17f21370f558e5dc6456553989359f97f24dbcf1cda2079
- TLSH T113510D98AE4A8BF82D57D2654B3350C6F13412311168240E71EFA38ABAF4B0DC32D4BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSPop3/nnspop3.cat
- SHA256 f2b813d82e0749a03873c40ba98e53e7b92d3adcb0f600a03b12e85e2d289fab
- MD5 d8849428f0198ac81dd2be4fbfabaa9c
- SHA1 2fc639b37a021b0c12fbde9d67c542b63b49b3b4
- SHA512 5489f6b2af00cdb2f3b8751b8fbd7b5911ae2e68e699c9c752ef972aeb506a6f435af216d71399fa4928f8abdb1052d5da1d40ef33d9e79e84204ea6dd06b37f
- SSDEEP 192:hByw9Em5fXEwI+CYhYC7EqiK2YdX01k9z3Ac931q20y:9iMh37EBwR9zz31q2l
- TLSH T1C3324BE2499C4186EDABBC6053E8F9473C3D37C71800446925AFFA291DE73C4EB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSPop3/nnspop3.inf
- SHA256 8748c7694634802aa739edf46e9d7f528bc8761d526095c056b30b1734048b88
- MD5 316102ea8f18bc9cbcc82b1711ab4a12
- SHA1 7f45c422b78bb509a75f8935fcffe04459c17834
- SHA512 bf72619f7fb78d87a87363f7e73b7aee5624f3c683f42f0a13a8dd7df40dffe047de760b2a3c0fe0c17f21370f558e5dc6456553989359f97f24dbcf1cda2079
- TLSH T113510D98AE4A8BF82D57D2654B3350C6F13412311168240E71EFA38ABAF4B0DC32D4BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSProt/NNSProt.sys
- IMPHASH 13c15b2e7214bade09bbfaea21baf890
- SHA256 b1193a8da487a212f262e50a37087fdcbc9d8f5d847a1a22ca290dffe7b3da5a
- MD5 156d8d8bb9a1a884977f465c576894c1
- SHA1 79784aa46ebc8ebbce754d7907567f39e9b1623e
- SHA512 b325a01bf0900098465d4d192a28ba79c19d65437d09d2455d5d54aa459862e300c883fac76d51f2809a87f9aedef4907c3e39cdd7a290d894657b8ba1df1a65
- SSDEEP 12288:n/TjSHl6SyXJYPqZomrNAcHkaF66B3GoScwSITojTVzW0AW7C+g3K+aq13fRjeEq:/OFkC+CK9qaEq
- TLSH T17284FA19B1F92038F22AB5B6CBCACE56D33370DC5B9A66DB0038955357026E85B3B335
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:8a:ca:9d:e3:02:eb:34:59:30:9d:a8:ca:c8:ed:1f:8f:71:54:7d:fe:7c:98:b2:16:88:b7:63:27:9d:61:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
6b:8a:ca:9d:e3:02:eb:34:59:30:9d:a8:ca:c8:ed:1f:8f:71:54:7d:fe:7c:98:b2:16:88:b7:63:27:9d:61:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9e:fd:c2:2d:d8:31:5a:b6:b1:00:01:00:00:01:9e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
409700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSProt.pdb
ntoskrnl.exe
IoWMIWriteEvent
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareMemory
IofCallDriver
ExSystemTimeToLocalTime
RtlTimeToTimeFields
_wcsicmp
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlTimeFieldsToTime
ZwCreateKey
ZwSetValueKey
ZwQueryValueKey
ZwClose
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExFreePoolWithTag
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
ZwSetInformationFile
_stricmp
KeDelayExecutionThread
RtlHashUnicodeString
IoWMIRegistrationControl
ExAllocatePoolWithTag
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
ZwQueryInformationFile
ZwOpenKey
IoBuildDeviceIoControlRequest
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
282KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=43, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSProt/WVista/NNSProt.sys
- IMPHASH 13c15b2e7214bade09bbfaea21baf890
- SHA256 d000fc30227c6f53a6c7a659dcf2d7dad5945d099463c84014fa018f967931da
- MD5 f54dc9e8c91c5664eef5adc1aeb1cc95
- SHA1 76e70ccba8ab854c132358335791e16a60b052fd
- SHA512 bf2fe87099f83b30435dd687a3094def13219b8b7021f820b63cc75885e43c1e214463894ea53f6004557845340e3d165fffe58ce1cf8d4acb89521544d36770
- SSDEEP 12288:t/TjSHl6SyXJYPqZomrNAcHkaF66B3GoScwSITojTVzW0AW7C+g3K+aq13fRjeEC:ROFkC+CK9qaEqn
- TLSH T1D084FA19B1F92078F22AB4B6CBCACE56D33370DC5B9A66DB0038955357026E85B3B335
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:8a:ca:9d:e3:02:eb:34:59:30:9d:a8:ca:c8:ed:1f:8f:71:54:7d:fe:7c:98:b2:16:88:b7:63:27:9d:61:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
6b:8a:ca:9d:e3:02:eb:34:59:30:9d:a8:ca:c8:ed:1f:8f:71:54:7d:fe:7c:98:b2:16:88:b7:63:27:9d:61:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:88:2e:cd:c6:81:41:e1:bc:2a:00:01:00:00:01:88
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
409700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSProt.pdb
ntoskrnl.exe
IoWMIWriteEvent
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareMemory
IofCallDriver
ExSystemTimeToLocalTime
RtlTimeToTimeFields
_wcsicmp
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlTimeFieldsToTime
ZwCreateKey
ZwSetValueKey
ZwQueryValueKey
ZwClose
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExFreePoolWithTag
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
ZwSetInformationFile
_stricmp
KeDelayExecutionThread
RtlHashUnicodeString
IoWMIRegistrationControl
ExAllocatePoolWithTag
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
ZwQueryInformationFile
ZwOpenKey
IoBuildDeviceIoControlRequest
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
282KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=43, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSProt/WVista/nnsprot.cat
- SHA256 da93a2792e2961e0dd0003c2050271fe691cd7dd711bf2793c62f8b63b04cf94
- MD5 7ae5245b69b4cf85f8403fec5d1d3ca9
- SHA1 8d913e13787a4bf6559d864195b975b765676378
- SHA512 39422107b57035dd30226f3801b5787fe19ed703b4e89d00df7d8ae1c12c8d5e8d2783f4e68abf7aa6865861cd0ee500b9528f2c94ab741e7e0c38300ff3e5a3
- SSDEEP 192:Pzn6mf2ZEO7DdIM1/nScOL7yKnUi8rFWQFen16O+KKnAX01k9z3AEC07z5n9:LY7N1/nX4CFR416OTKAR9zAA9
- TLSH T18242D7E2966D45C2EDA7AC7043E8E4A33C3D6B871C50447D229BF7640D927C5EB2847E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSProt/WVista/nnsprot.inf
- SHA256 8b6107051bf644893eb5f2c0417a756f1fbdbef257f1c5c61736fcd2498e97a0
- MD5 9e21a4b86a6f8411fa8396811a0563cd
- SHA1 6f22dea86015d08dcedf4b0a0fc54718c7068b63
- SHA512 cde916a25598e01541fc95c5de7b37903ae8dad6932e9a77716cb1e9564efdeb6817dbc2780f8bac2a2e3198bdb870bc24c42d8f064b8324cb1165b9b7d52cde
- TLSH T1DD51DF086D669638658AD2990F276085FF3C120011AD1C4DB1EF565FABFC70D872D1BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSProt/nnsprot.cat
- SHA256 15924b86d78751eb00da0425387cfb7e6eae1fc0d36d82c34c14da0f3a34ddb2
- MD5 a2b3ce1c6a4d77f59a3ed28727685b3e
- SHA1 76dd53f800e56a80a79b95d90d247c079dbc6496
- SHA512 d1a6f2ce711db797c615341c4a2106b48f0154c611f163740a3ef9652e72bb51c3aaa74d6841f91b8590cacee9982b7d74dd12d71d28ff214ec5cbb3ccffa11f
- SSDEEP 192:oB0ztMfXEwI+CYhYCTcCXh+Il+jX01k9z3A9rjUhnyS+:QiMh34C5EjR9zirjUN0
- TLSH T1E4324CB1816C4182F997BC6013E8EA577C3D27CB2D10446A265FF6291DA77C8E71823E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSProt/nnsprot.inf
- SHA256 8b6107051bf644893eb5f2c0417a756f1fbdbef257f1c5c61736fcd2498e97a0
- MD5 9e21a4b86a6f8411fa8396811a0563cd
- SHA1 6f22dea86015d08dcedf4b0a0fc54718c7068b63
- SHA512 cde916a25598e01541fc95c5de7b37903ae8dad6932e9a77716cb1e9564efdeb6817dbc2780f8bac2a2e3198bdb870bc24c42d8f064b8324cb1165b9b7d52cde
- TLSH T1DD51DF086D669638658AD2990F276085FF3C120011AD1C4DB1EF565FABFC70D872D1BF
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSPrv/NNSPrv.sys
- IMPHASH 6dcf2c1e3e5c4bf7c6d1e89ab77e01e6
- SHA256 c92424c13c159a59731a969511923cb3e0ceed866963de02412f95b5c5c0d1c4
- MD5 51c2877303cff764b6b9ee7a0de94d95
- SHA1 02cb49aea36d991949c1981a78dde75fa3697a46
- SHA512 3d52ad20e1899fc3059edb96c3cc1998db6e4c12094f4e1f04170e979369443a00b611263efea2b717dc6295c3b5d8f7500e5eb371271441cc863167b967d4ed
- SSDEEP 12288:g4gJAEw/Hr/HJqW27ZDR4W+DwBTEbBIPxg48Rom42xdcwL+:g4gJAEw/H7HJV2j4LGTIIPxgemrYR
- TLSH T1CDC41805A3B1103DFF87D13B81828D5796B2348CA7A75ADF05B49672BA327F0573E226
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ca:86:0b:2d:a8:68:50:16:50:df:61:f0:7c:36:89:96:b4:f3:bf:a7:a6:af:27:5a:11:91:9e:cd:0d:82:e0:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
ca:86:0b:2d:a8:68:50:16:50:df:61:f0:7c:36:89:96:b4:f3:bf:a7:a6:af:27:5a:11:91:9e:cd:0d:82:e0:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 9, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9f:2b:45:35:15:08:2e:4b:5d:00:01:00:00:01:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
585828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wlh_amd64\amd64\NNSPrv.pdb
ntoskrnl.exe
IoDeleteDevice
MmGetSystemRoutineAddress
ZwClose
IofCompleteRequest
RtlCompareMemory
IoCreateDevice
IofCallDriver
KeDelayExecutionThread
PsCreateSystemThread
_wcsnicmp
RtlUnicodeStringToInteger
_stricmp
RtlInitUnicodeString
KeLeaveCriticalRegion
RtlTimeToSecondsSince1970
KeSetEvent
KeInitializeEvent
KeEnterCriticalRegion
ZwWaitForSingleObject
PsTerminateSystemThread
KeWaitForSingleObject
_strnicmp
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
KeBugCheckEx
KeResetEvent
IoWMIWriteEvent
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
ExReleaseFastMutex
ExFreePoolWithTag
ExAcquireFastMutex
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeSetPriorityThread
KeQueryPriorityThread
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
ZwSetInformationFile
VerSetConditionMask
RtlGetVersion
RtlVerifyVersionInfo
isdigit
strncmp
IoWMIRegistrationControl
ExInitializeNPagedLookasideList
ExAllocatePoolWithTag
ndis.sys
NdisGetDataBuffer
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
426KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=49, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSPrv/WVista/NNSPrv.sys
- IMPHASH 6dcf2c1e3e5c4bf7c6d1e89ab77e01e6
- SHA256 bc3e528a250e6e21c9445668a9edfef7eb2622d18908af798a0a695c0dc43b46
- MD5 54dcbf7e975de89dd46aa77ec3d36977
- SHA1 f90461ffca14be5c18d89c948f1f1cf4dd533191
- SHA512 e9ca5fb4066098fee37bee7067331a12857955e88eead528894643397e92d5bd90f4bb0979b91bd5cb01a4441ae472f5f36e01c67ea44c30fc23df4213708a8d
- SSDEEP 12288:M4gJAEw/Hr/HJqW27ZDR4W+DwBTEbBIPxg48Rom42xdcwLN:M4gJAEw/H7HJV2j4LGTIIPxgemrYK
- TLSH T1DBC40805A3B1103DFF87D13B81828D5796B3348CA7A65ADF05B49672BA327F0573E226
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ca:86:0b:2d:a8:68:50:16:50:df:61:f0:7c:36:89:96:b4:f3:bf:a7:a6:af:27:5a:11:91:9e:cd:0d:82:e0:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 10, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
ca:86:0b:2d:a8:68:50:16:50:df:61:f0:7c:36:89:96:b4:f3:bf:a7:a6:af:27:5a:11:91:9e:cd:0d:82:e0:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 7, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
585828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wlh_amd64\amd64\NNSPrv.pdb
ntoskrnl.exe
IoDeleteDevice
MmGetSystemRoutineAddress
ZwClose
IofCompleteRequest
RtlCompareMemory
IoCreateDevice
IofCallDriver
KeDelayExecutionThread
PsCreateSystemThread
_wcsnicmp
RtlUnicodeStringToInteger
_stricmp
RtlInitUnicodeString
KeLeaveCriticalRegion
RtlTimeToSecondsSince1970
KeSetEvent
KeInitializeEvent
KeEnterCriticalRegion
ZwWaitForSingleObject
PsTerminateSystemThread
KeWaitForSingleObject
_strnicmp
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
KeBugCheckEx
KeResetEvent
IoWMIWriteEvent
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
ExReleaseFastMutex
ExFreePoolWithTag
ExAcquireFastMutex
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeSetPriorityThread
KeQueryPriorityThread
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
ZwSetInformationFile
VerSetConditionMask
RtlGetVersion
RtlVerifyVersionInfo
isdigit
strncmp
IoWMIRegistrationControl
ExInitializeNPagedLookasideList
ExAllocatePoolWithTag
ndis.sys
NdisGetDataBuffer
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
426KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=49, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSPrv/WVista/nnsprv.cat
- SHA256 7c11a75521e9a6f0b123e2b92671cb6f1b8882c2ce5211c3263ed5d96f6b9804
- MD5 902c08b5ea50978c725f42d092a7237b
- SHA1 35ebbe177d53563238fb2dabfdb514378969041b
- SHA512 cecf18130bcbe94461fe25833e86498f5c1d667d1d6f7a22cd212ddb4a5860239e205fe98ffe45d700fccf47d71a8d8d23483b44f77b3ec5cc2d34350d2a4e45
- SSDEEP 192:99EnW2pEOVOL7yKnUi8rFWQFIfbh+kSobX01k9z3AePkskP1AQ:3EtV4CFRebK+R9zRCP/
- TLSH T16D32E7A3966C5082EE97A8B083A8E9937C3D2BD71C40586921DBF6140D927C9EB1857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSPrv/WVista/nnsprv.inf
- SHA256 72bf5c11ba3265e0bfd0cbcc3519567385bf86d436a84117366b619bed89361d
- MD5 6337b150fdcfcff439c57976290d4650
- SHA1 3c2f3fef53ec4c855024d49c1f4b7d232f37ee42
- SHA512 e8489c5de075c4f80e6a533822e7e5ea64288db906aad1886195afc56335fc5be9c98670feac3fc10db9d25886f03311a0c487cbaf8626c18353d15661ad0aa3
- TLSH T1BD51D01C6E46AA35626AD2690B235086FD3C120405A92C4D71FF568AABFDB0C863D0BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSPrv/nnsprv.cat
- SHA256 a2c877efe3c975a35043e66b29c8724c47537a5377c9473d767d4a4ab7954c3b
- MD5 2e7225690614cada2902bbf36d7a692b
- SHA1 1cbd7f62551fc58062e00535620a058008534ff2
- SHA512 bafefe78df4349f103fa5628584be23ce8f21f7f0e2519bcb0753734d242c74ce97f13dd70d68f757969ca3dcebe86500c1a085e6c90070d17b564f2b460536e
- SSDEEP 192:Gk1DaZzJC1fXEwI+CYhYCUX4YIN5vCX01k9z3A7VGTH:qZaiMh3UXTUJCR9zUVGTH
- TLSH T1773219A285588082FD97BCA053E8F9977C3C67C71860456926ABFA191CE73C4FB1816E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSPrv/nnsprv.inf
- SHA256 72bf5c11ba3265e0bfd0cbcc3519567385bf86d436a84117366b619bed89361d
- MD5 6337b150fdcfcff439c57976290d4650
- SHA1 3c2f3fef53ec4c855024d49c1f4b7d232f37ee42
- SHA512 e8489c5de075c4f80e6a533822e7e5ea64288db906aad1886195afc56335fc5be9c98670feac3fc10db9d25886f03311a0c487cbaf8626c18353d15661ad0aa3
- TLSH T1BD51D01C6E46AA35626AD2690B235086FD3C120405A92C4D71FF568AABFDB0C863D0BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSSmtp/NNSSmtp.sys
- IMPHASH 845ffbe5f11184e098e19cb40914fae7
- SHA256 10497d670cb5963482f2fa1594504ddd04cdcd440f37b2b02eac56c6e3e3749a
- MD5 dcb8b1572cb3927e3a448de573ef666c
- SHA1 4f5fd236f70c1e9062425bb4588c5c17051541c5
- SHA512 6cad099a0ba911fe47cc13927489a761ac48228129b8353b072f31dfcd05d5dc94766847e4fa1c0edde193b164a3147a11a17acb6a9828a9e39f5d1667759576
- SSDEEP 1536:o6NBOPZRjXBAePZsNEZzV2ssnOs3nSOtL4SbtLZM6kBWSB/kV3YVgIrfhgT2wcv8:oEO7XW4sEgnF4qWWgcV3YgP2wc3x6EI
- TLSH T185C3295621F2107DC6635176ABE24ED7F623308CBFB89FE70568914157037E0AF2A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8b:06:85:98:3b:75:28:02:d6:91:6b:95:9b:77:ea:16:f4:0d:a3:b7:b6:dd:ca:81:a2:ba:d7:81:36:7f:a9:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
8b:06:85:98:3b:75:28:02:d6:91:6b:95:9b:77:ea:16:f4:0d:a3:b7:b6:dd:ca:81:a2:ba:d7:81:36:7f:a9:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:97:03:cf:59:9c:6b:89:78:3f:00:01:00:00:01:97
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
118884
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSSmtp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
Name
.text
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=62, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=21, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSSmtp/WVista/NNSSmtp.sys
- IMPHASH 845ffbe5f11184e098e19cb40914fae7
- SHA256 ded229d61315f4ddbc407dd828e24f8e4197046e7dc2dbee4d7eb52ac5aedf48
- MD5 65e7c75d894605130ed4880ac1758bfe
- SHA1 07f67e29cd33157b7a7561cf6dc362f01b294f88
- SHA512 a16418263487969bef7738ef4cc65d5cc08b7687f6d825df4853840b39ea5f478de498f27af3ec3b92875e99609518e486f1b5c9dd9114691dbfde8c3023e5fb
- SSDEEP 1536:f6NBOPZRjXBAePZsNEZzV2ssnOs3nSOtL4SbtLZM6kBWSB/kV3YVgIrfhgT2wcQd:fEO7XW4sEgnF4qWWgcV3YgP2wcQ7Brxd
- TLSH T1FAC3295621F2107DC6631176ABE64ED7F623348CBFB89FE70568914157037E0AF2A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8b:06:85:98:3b:75:28:02:d6:91:6b:95:9b:77:ea:16:f4:0d:a3:b7:b6:dd:ca:81:a2:ba:d7:81:36:7f:a9:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
8b:06:85:98:3b:75:28:02:d6:91:6b:95:9b:77:ea:16:f4:0d:a3:b7:b6:dd:ca:81:a2:ba:d7:81:36:7f:a9:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9e:fd:c2:2d:d8:31:5a:b6:b1:00:01:00:00:01:9e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
118884
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSSmtp.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
KeLeaveCriticalRegion
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeEnterCriticalRegion
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
Name
.text
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=62, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=21, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=21, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSSmtp/WVista/nnssmtp.cat
- SHA256 ee77a597f5935600cde2f71fc79a532c9280da9dcb0178f102b4e004d39d1a45
- MD5 cabe401d0df9bd5b8704c62e85d98c39
- SHA1 9f246adadde4352ea052f6362b29fad865cae58a
- SHA512 440d62c2b98e45d9cff0246653f099c8db33fd4b67d5d5d9cccdf36e8c1b28d410fe7a0a4af6ba231058013b6b921d2d0aea30a66e935f8a4c8ed63246a353e4
- SSDEEP 192:thHsMf2ZEO7DdIM1/nScOL7yKnUi8rFWQFWQWYbF0F/C+dyoX01k9z3A7keMxfL:tZY7N1/nX4CFR9WAWF//dJR9z+kRB
- TLSH T1B04219D2966D4482ED97AC7083E8E8A73C3D6BCB1C10446D229BF7640C927C5FB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSSmtp/WVista/nnssmtp.inf
- SHA256 4173030d40219bff64c1c154fda8456033d4635e4d098e6def2130d0325a7087
- MD5 f022ca1c77018943bca2922b715292c0
- SHA1 492f637c485013bcea3452339dd00c68f75d6040
- SHA512 0f5f906fd3d80e15b721d8a25a0ed5c0b7a114cb99398463d95a37667c74b210efdeb56b6bc600c9656271ac7ae1a3aaf31c06bd3825f56dd75adcf8d6e49cfb
- TLSH T19C51CF894E86A63C6186EA5F0A3F5085F13811050A6B280D75EF92B7BAC5B0DC7FD17E
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSSmtp/nnssmtp.cat
- SHA256 3106d369c4f8546c1b9a62200a48462d819469ad7f912b909ae55627a03cec34
- MD5 1beb9ce3afbb3a23e1fe1b2c2e62fbcb
- SHA1 c5eb2b26a621a55352a28da350816a7d80fdd9a2
- SHA512 51416fd9276fd72d2cba509b594530d228dd0ec9ff4402c21abd66dc3f1b96247021877875a64a59a480a1023f48117f5826f952c90662ad44c8a6203270c1ac
- SSDEEP 192:H/9dTrfXEwI+CYhYCifhG2ZUnQJeX01k9z3AxeiuYQ:DiMh3cG2teR9zEeiJQ
- TLSH T17A324BA2466C4583FDA7BCA013E8F9473C3867CB2C40416A269FF6191DA73C8E72857D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSSmtp/nnssmtp.inf
- SHA256 4173030d40219bff64c1c154fda8456033d4635e4d098e6def2130d0325a7087
- MD5 f022ca1c77018943bca2922b715292c0
- SHA1 492f637c485013bcea3452339dd00c68f75d6040
- SHA512 0f5f906fd3d80e15b721d8a25a0ed5c0b7a114cb99398463d95a37667c74b210efdeb56b6bc600c9656271ac7ae1a3aaf31c06bd3825f56dd75adcf8d6e49cfb
- TLSH T19C51CF894E86A63C6186EA5F0A3F5085F13811050A6B280D75EF92B7BAC5B0DC7FD17E
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSStrm/NNSStrm.sys
- IMPHASH fd3f2d21cdb0b4772868cc73b4e5ba05
- SHA256 63f8b471806a5fe6f29d631f08c0a1b4839f7961b78fb7d5b106d68fc7139a31
- MD5 3378858e03f1ab361277a0dedcee802a
- SHA1 04a3d0b255c35faa2297340126fd023f49962c22
- SHA512 084a161445327d53cd2691f87a38bfb227c38494a5b121c1242f05f8afe0b2a38a4d995ee36ed1fa753553c23d8f35ad09c05d871194caa2eef7d5a422570a46
- SSDEEP 6144:XwqpwEVBqNvAABP6MBOfHHSueg9av//KDMXm6+IGXsaXthMGjCsBBPRayWRyrVU1:XwqpRVBqNvAABP6MBiHHSueg9av//KDg
- TLSH T174641A1DA1B650FCE576D83584A24D56A677304C8FAC2ADB017C8650B7223F8EB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f0:1b:d3:7e:d4:06:b2:50:22:ad:9e:f5:c6:87:9e:85:99:3c:c9:3b:39:6a:c5:e9:2b:fd:fd:95:be:c3:77:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
f0:1b:d3:7e:d4:06:b2:50:22:ad:9e:f5:c6:87:9e:85:99:3c:c9:3b:39:6a:c5:e9:2b:fd:fd:95:be:c3:77:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 10, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
340068
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x-xdr_fireboxopenconndenyfix\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSStrm.pdb
ntoskrnl.exe
ExFreePoolWithTag
IoWMIWriteEvent
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeReleaseMutex
KeWaitForSingleObject
KeDelayExecutionThread
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
IoBuildDeviceIoControlRequest
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
IoWMIRegistrationControl
ExAllocatePoolWithTag
__C_specific_handler
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
285KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=27, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=38, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSStrm/WVista/NNSStrm.sys
- IMPHASH fd3f2d21cdb0b4772868cc73b4e5ba05
- SHA256 e8296523891b931a4443b40b5ea4a8646a1882750237c46cfb749188a79e580b
- MD5 c9d87d30c8d4355e69a5a03f59af8672
- SHA1 460a6e7eca3d092f2a87ae857b0ad997b20a45a5
- SHA512 5eeb3f99ef7a7f8be6a592b90205a174add4908ff039378fa9179d7472239d7eef4e19687b67c96df0e1b8421a8a1d1862315c6fe502657e0a7532a593128cf4
- SSDEEP 6144:CwqpwEVBqNvAABP6MBOfHHSueg9av//KDMXm6+IGXsaXthMGjCsBBPRayWRyrVU6:CwqpRVBqNvAABP6MBiHHSueg9av//KDn
- TLSH T180641A1DA1B650FCE576D83584A24D56A677304C8FAC2ADB017C8650B7223F8EB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f0:1b:d3:7e:d4:06:b2:50:22:ad:9e:f5:c6:87:9e:85:99:3c:c9:3b:39:6a:c5:e9:2b:fd:fd:95:be:c3:77:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Dec 3, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
f0:1b:d3:7e:d4:06:b2:50:22:ad:9e:f5:c6:87:9e:85:99:3c:c9:3b:39:6a:c5:e9:2b:fd:fd:95:be:c3:77:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 2, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
340068
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x-xdr_fireboxopenconndenyfix\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSStrm.pdb
ntoskrnl.exe
ExFreePoolWithTag
IoWMIWriteEvent
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IoGetDeviceObjectPointer
IofCompleteRequest
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeReleaseMutex
KeWaitForSingleObject
KeDelayExecutionThread
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
IoBuildDeviceIoControlRequest
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ZwClose
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
IoWMIRegistrationControl
ExAllocatePoolWithTag
__C_specific_handler
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
285KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=27, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=38, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSStrm/WVista/nnsstrm.cat
- SHA256 91ce896d8458887f81007e756f23518c3b6be9cae29e8906f7e15e6ce96e39b5
- MD5 298ffa85708c9e0ce30297b17e480fad
- SHA1 c36606297c4fcc8c7e2df157043cc318e187110e
- SHA512 3ac105d1f64efd4366f8927767c4ea2684ce0a42ffc412fe0033e2c9aaf7be5ba06bcfb150f7da40d2c87799200936d13d8b319b9df484b16148da9e5fce1122
- SSDEEP 192:KieTn28gEOVOL7yKnUi8rFWQFM/kCBAh+kSobX01k9z3A9RhO8yT:+yV4CFRmAK+R9zyjhyT
- TLSH T1DC32F8E68A6C50C2ED97BCB083ECD5933C392BD71850842A21DBF6640DA27C6FB5853D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSStrm/WVista/nnsstrm.inf
- SHA256 d1a4ccb97269425fb8f587deafe6200bac0e704e81b8e77c94b49595e3be373c
- MD5 bec9b6446f8aec24233c5979f43c0ca0
- SHA1 0810ef3521a7632ae672b15f581c9b5f010ab57a
- SHA512 31d5717b5ecd00968768260f57842a9405b84e8701105150c0f9a87bd56b56013390ba6051108359643fcc627fb9e5cebaa1f6ef522883a5fb5b9e546aaaea28
- TLSH T1A351CEC84DC69A787286D3A50B3F1286E5351205016DA40C71FF558FBBC9A0C86BD1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSStrm/nnsstrm.cat
- SHA256 7c0aafb8be92d322ac758c3eece5ba4b314dbbd39574ce285debb0fffafa24e3
- MD5 397d4aec35150cfd7241ed51dca7d1c6
- SHA1 6743393c49a3e994c1be9cc8a3be09d33d34dd04
- SHA512 4db5ca2eefccce57aad8ed15ecd2702e5c649a66faf90bc8fa6f903bb3e8ef4467b72a6501a5e4380ce9a086f446f7e1ed4f1944528d2297a7f9abee5230605b
- SSDEEP 192:uWFh0kJCNfXEwI+CYhYCt/HGRSp0X01k9z3AP8hhh:u8aiMh3tHGR00R9zO8h/
- TLSH T14E322AE1865C5083ED97ACA013E8EE4B3C3E27C75C50552931AFFA191C973C4EB1826E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSStrm/nnsstrm.inf
- SHA256 d1a4ccb97269425fb8f587deafe6200bac0e704e81b8e77c94b49595e3be373c
- MD5 bec9b6446f8aec24233c5979f43c0ca0
- SHA1 0810ef3521a7632ae672b15f581c9b5f010ab57a
- SHA512 31d5717b5ecd00968768260f57842a9405b84e8701105150c0f9a87bd56b56013390ba6051108359643fcc627fb9e5cebaa1f6ef522883a5fb5b9e546aaaea28
- TLSH T1A351CEC84DC69A787286D3A50B3F1286E5351205016DA40C71FF558FBBC9A0C86BD1BE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSpicc/NNSpicc.sys
- IMPHASH eef0bee7d47d01fe22d3d1083ecb12f1
- SHA256 407b3c3ef6c70fe8991bd0a15b3f3a46443d3c4621a1993b2aa2adf4a10291ed
- MD5 d3ed3abbc010c0d3e9afd899d3818d8b
- SHA1 94e7bc020e812d08bf5dd9cc0748f54daa079c24
- SHA512 ecd23b854f2342874eaf3d0aac4651bdb5bf3fc6148e877dcf085733e8ea4e038fec1c073fa616eb12e6781924413d10ddac72980979a882c3b049158d37363f
- SSDEEP 3072:UPLtJOxMCqub8QxEi8bGhwlauIYdD5l4TT8nXVBxb:UPLtJOxMCqub8QxEi8i1SzP
- TLSH T15FF3295552F2203DD75B8178C8E20D87A673304CABF96BDB457891626B037E0E73A37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:ce:9b:6c:f0:79:91:a1:d6:de:23:3d:65:27:96:48:39:f8:35:14:5a:6a:a2:a5:79:de:16:75:89:fe:93:3f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
c7:ce:9b:6c:f0:79:91:a1:d6:de:23:3d:65:27:96:48:39:f8:35:14:5a:6a:a2:a5:79:de:16:75:89:fe:93:3f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a1:01:85:55:99:b9:54:5d:8a:00:01:00:00:01:a1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSpicc.pdb
ntoskrnl.exe
ExFreePoolWithTag
IoWMIWriteEvent
KeLeaveCriticalRegion
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
KeEnterCriticalRegion
IoGetDeviceObjectPointer
ZwQueryValueKey
ZwClose
IofCompleteRequest
KeWaitForSingleObject
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
ZwOpenKey
RtlUnicodeStringToInteger
_wcsicmp
wcsrchr
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeReleaseSpinLock
IoBuildDeviceIoControlRequest
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
tolower
KeDelayExecutionThread
IoWMIRegistrationControl
ExpInterlockedPopEntrySList
ExAllocatePoolWithTag
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=22, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSpicc/WVista/NNSpicc.sys
- IMPHASH eef0bee7d47d01fe22d3d1083ecb12f1
- SHA256 f9f2704b55efb67e42ce11d8173e2620f224b622cf9735336e58c73bd361311f
- MD5 8820fc68e64bd7b1d00d0cacb3faa131
- SHA1 42ff4e79ced7b2989cbbccef898d7b0f40b286ad
- SHA512 2748cbf068239306571633382a19159a549ef885568d5c512cae74cad19c5679a160a4040de05bc9b4897265c1f695bcd305a7bba5dfe4bed55a791dbbab7f86
- SSDEEP 3072:7PLtJOxMCqub8QxEi8bGhwlauIYdD5l4TT8nXV31hYcxM:7PLtJOxMCqub8QxEi8i1SzPFYZ
- TLSH T152F3295512F6203DD75B817888E20D87A673304CABF97BDB457891626B037E0E73A37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:ce:9b:6c:f0:79:91:a1:d6:de:23:3d:65:27:96:48:39:f8:35:14:5a:6a:a2:a5:79:de:16:75:89:fe:93:3f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
c7:ce:9b:6c:f0:79:91:a1:d6:de:23:3d:65:27:96:48:39:f8:35:14:5a:6a:a2:a5:79:de:16:75:89:fe:93:3f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8f:f3:51:a8:eb:5a:72:dd:cc:00:01:00:00:01:8f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\interception\nns\source\code\bin\objfre_wnet_amd64\amd64\NNSpicc.pdb
ntoskrnl.exe
ExFreePoolWithTag
IoWMIWriteEvent
KeLeaveCriticalRegion
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
KeInitializeEvent
KeEnterCriticalRegion
IoGetDeviceObjectPointer
ZwQueryValueKey
ZwClose
IofCompleteRequest
KeWaitForSingleObject
RtlCompareMemory
ObfDereferenceObject
IoCreateDevice
IofCallDriver
ZwOpenKey
RtlUnicodeStringToInteger
_wcsicmp
wcsrchr
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeReleaseSpinLock
IoBuildDeviceIoControlRequest
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
KeInitializeDpc
KeInitializeTimer
KeSetTimer
KeCancelTimer
tolower
KeDelayExecutionThread
IoWMIRegistrationControl
ExpInterlockedPopEntrySList
ExAllocatePoolWithTag
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=22, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/NNSpicc/WVista/nnspicc.cat
- SHA256 c71719f33e8c965ab019d335b48d880cdb2069f597e15b2ce29c83d146476734
- MD5 228a8d4ec26a590e1030ff2861f5b1d1
- SHA1 b650db4ea49211b91db826f81c17f2b7d6e4ef97
- SHA512 7379c1a22757a25873aa6d04a362c3f572679194128e34c347240d426c209954a74308501caea2676493053a793c8c1fbc114b7a45654607dcde6d42f5624311
- SSDEEP 192:rSLN2rf2ZEO7DdIM1/nScOL7yKnUi8rFWQFA6D+KKnAX01k9z3AEC0/R6f:2R37N1/nX4CFRS6DTKAR9zAYQf
- TLSH T1A942E8E2666D4482ED93ACB043A8E4973C3D6B971C50443D62DBFB640DA2785FB2847E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSpicc/WVista/nnspicc.inf
- SHA256 2c98dc596f7ed55734e1f24a9e638234ce2b9e9fe007b08cb939fde3fa0ac24b
- MD5 d07b379aa10a272698e7536677e3f9ae
- SHA1 03f4cdbf16318a2dcf818cdc752044bc5e6e6430
- SHA512 176b8c8075408a8b4678e5029b716345cb22d337fe866143e5de44e97bbe5803059d409ecfc872ac4db25bb31e07c04cffe718208348b3db849d19059199ee63
- TLSH T17951AC08EE4A9B74619ED2AA0B335086F139111521ADEC0D71EF5287ABF470D862D0FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/NNSpicc/nnspicc.cat
- SHA256 73270318117814d574cc10b28425d6c5d7fea0d366e9701948a140ae2a647833
- MD5 7f4b4c3cc1814d84912562596e63736a
- SHA1 bcc282bb35bb884fb302d33422cb56ef88401e4f
- SHA512 0a705e4282e265c1fd5d0f41bf2318ff4a1f4197715d535b6e4791f265693257e25784e0cc0f46d06bd500130d156ad01e909a6b892b413d4979e39708805587
- SSDEEP 192:f+evdcfXEwI+CYhYCBLys2WGaN4NhrJgX01k9z3ASf31WNDI:6iMh3NTTN4tgR9zl318s
- TLSH T1A1322AA2966C4186EA9BBC6013E8F9473C7827CB2850407A659BFA1D1CD73C4E72866D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/NNSpicc/nnspicc.inf
- SHA256 2c98dc596f7ed55734e1f24a9e638234ce2b9e9fe007b08cb939fde3fa0ac24b
- MD5 d07b379aa10a272698e7536677e3f9ae
- SHA1 03f4cdbf16318a2dcf818cdc752044bc5e6e6430
- SHA512 176b8c8075408a8b4678e5029b716345cb22d337fe866143e5de44e97bbe5803059d409ecfc872ac4db25bb31e07c04cffe718208348b3db849d19059199ee63
- TLSH T17951AC08EE4A9B74619ED2AA0B335086F139111521ADEC0D71EF5287ABF470D862D0FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/PSINDvct/W10/PSINDVCT.cat
- SHA256 7acd463e377c5fc448dc7b3205930c54b2b44a4a62be8405f92cb8b4e6229ecb
- MD5 38ec018fe59c841b039a62ebf050ca52
- SHA1 9f70e11e666d79cd532f95e5390348c655de1048
- SHA512 f89b28ccaa6c11f7e822aaddb1daa44a2097bdb1e4ff0144c48581da1bd08c5bde947d6827a5f3afc7b0b7512914d8233af6e1117d8d4f50c2240574825aaa56
- SSDEEP 192:chhtFlJCABp5UEwQl/WGhYCYpYqCE0qnajKsvg:glrBpzlnh3WBClGsvg
- TLSH T1CA22F6A249AC4083DD636CB013E4F557BD3E67CB2C20515A28AFF66A0DA37C2F71856C
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/PSINDvct/W10/PSINDvct.inf
- SHA256 249892b01363b89a66dd223a30091222ff0c73e0c17b7b2fc910bf80e40195a0
- MD5 4829d39208b045ba37bc23b1af4e2b1b
- SHA1 dcaf06d87ef2e9cb403051c34a6e9b6b535c83ff
- SHA512 cbe060159313bb479b79e0680f7f55ee80d398d5a192cf69877d912a0e13e036faeaefc17ae33bd1f9eeaecea38baf2c158d5d529d42012aed57314caca9971f
- SSDEEP 96:iRN/37m3SXvZV9rvmbm5abeuMrUbJ2D4dycdeIMy2qHvjmabVFM43baNQDdy/PVw:iRZ71v5mbm5VuMrUd2D4dycHcqHvSuF1
- TLSH T127A1FB5B66639730D913106CF7275D82F07DB9A227EAEC0A36CD9C0365A216CC7A18CE
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/PSINDvct/W10/PSINDvct.sys
- IMPHASH f399d42f96818bdb5d318e50c3ca1497
- SHA256 32a17c513ead50c2b90888ba7974d5a99b0f2fdb6c78386a102e29acbf080396
- MD5 f7141ef630a055ffbf7f010bc87c6064
- SHA1 b0f43b2039eba7f441bccaa264671b6030096231
- SHA512 1d2fecedfb26ac217aabb92fb46654d98187abfe5f8e64ce266524ed9f67967c1625a4ac589b5214b4672601162c8c40dae67d6142b948efaf0966f316f75a1f
- SSDEEP 1536:NKslQ47rl4hGQsDQvFpTYyW4wW1HCq1cyX7TGZ8Ho0wtHu:ksCGGzsDQvoUcy+Z0o0t
- TLSH T1A5834A6A826644B9D547C5B8C9F4521BFBB4B4894FB467CF0230C9106F127E9AF3836E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
5e:06:be:a3:96:ce:0a:8c:97:b7:0b:de:41:d5:2e:b4:88:e0:5b:21:46:d7:65:2f:e5:8e:12:0b:09:80:28:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2020
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
5e:06:be:a3:96:ce:0a:8c:97:b7:0b:de:41:d5:2e:b4:88:e0:5b:21:46:d7:65:2f:e5:8e:12:0b:09:80:28:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Oct 29, 2020
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:f1:68:c3:c1:0a:96:49:a2:cc:00:79
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 18, 2017 - Jan 27, 2021
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 2, 2011 - Mar 29, 2029
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:24:cb:cd:02:a1:17:70:5c:9a:00:00:00:00:01:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
77924
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\interception\devctrl\source\code\bin\objfre_wnet_amd64\amd64\PSINDvct.pdb
ntoskrnl.exe
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
KeLeaveCriticalRegion
IoSetHardErrorOrVerifyDevice
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExNotifyCallback
MmGetSystemRoutineAddress
KeInitializeEvent
RtlGetVersion
IoReleaseRemoveLockEx
IoDetachDevice
KeEnterCriticalRegion
KeDelayExecutionThread
RtlFreeUnicodeString
PsCreateSystemThread
InitSafeBootMode
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
RtlCompareUnicodeString
RtlCompareMemory
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
ExCreateCallback
DbgPrint
IofCallDriver
ExAcquireResourceExclusiveLite
ZwCreateKey
RtlCreateUnicodeString
RtlUpcaseUnicodeString
ExInitializeNPagedLookasideList
IoBuildSynchronousFsdRequest
wcsncpy
ExpInterlockedPushEntrySList
IoAcquireRemoveLockEx
ZwSetValueKey
ExpInterlockedPopEntrySList
ObQueryNameString
wcsrchr
wcsstr
IoGetDeviceObjectPointer
ZwQueryValueKey
RtlGUIDFromString
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
IoGetDeviceInterfaces
ExDeleteResourceLite
_wcsupr
IoOpenDeviceRegistryKey
ExInitializeResourceLite
IoGetDeviceProperty
ObOpenObjectByPointer
ExDeleteNPagedLookasideList
RtlLengthSid
ZwOpenKey
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
KeBugCheckEx
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
MmHighestUserAddress
ExAllocatePoolWithTag
PsGetVersion
__C_specific_handler
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
246B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=135, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=6, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/PSINDvct/WVista/PSINDvct.inf
- SHA256 249892b01363b89a66dd223a30091222ff0c73e0c17b7b2fc910bf80e40195a0
- MD5 4829d39208b045ba37bc23b1af4e2b1b
- SHA1 dcaf06d87ef2e9cb403051c34a6e9b6b535c83ff
- SHA512 cbe060159313bb479b79e0680f7f55ee80d398d5a192cf69877d912a0e13e036faeaefc17ae33bd1f9eeaecea38baf2c158d5d529d42012aed57314caca9971f
- SSDEEP 96:iRN/37m3SXvZV9rvmbm5abeuMrUbJ2D4dycdeIMy2qHvjmabVFM43baNQDdy/PVw:iRZ71v5mbm5VuMrUd2D4dycHcqHvSuF1
- TLSH T127A1FB5B66639730D913106CF7275D82F07DB9A227EAEC0A36CD9C0365A216CC7A18CE
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/PSINDvct/WVista/PSINDvct.sys
- IMPHASH f399d42f96818bdb5d318e50c3ca1497
- SHA256 cf14f5e9fb908a11a93644bd3263c44f900d603d4a6792f1175f50096e56abb4
- MD5 93f406a6890f2738adfd426478aa7b6d
- SHA1 1a778da58d259572d4430301e2704439531eea9f
- SHA512 93dc8ae20af0abc67ce2e7f2cb9a1ab8dbc0d6d080b117804a679011b7afcb96752ecc0de0e04702c9e923d9ade5c0538f3f77e6dbff3d767bc9f41191d489a9
- SSDEEP 1536:SKslQ47rl4hGQsDQvFpTYyW4wW1HCq1cyX7TGZx3eWqUf726fQ:psCGGzsDQvoUcy+ZxLDQ
- TLSH T12F936B6682A548B8D897C6B8D9F4961BFBB0B5494F7097DF0230C4505F027E9AF3836E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
77924
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\interception\devctrl\source\code\bin\objfre_wnet_amd64\amd64\PSINDvct.pdb
ntoskrnl.exe
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
KeLeaveCriticalRegion
IoSetHardErrorOrVerifyDevice
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExNotifyCallback
MmGetSystemRoutineAddress
KeInitializeEvent
RtlGetVersion
IoReleaseRemoveLockEx
IoDetachDevice
KeEnterCriticalRegion
KeDelayExecutionThread
RtlFreeUnicodeString
PsCreateSystemThread
InitSafeBootMode
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
RtlCompareUnicodeString
RtlCompareMemory
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
ExCreateCallback
DbgPrint
IofCallDriver
ExAcquireResourceExclusiveLite
ZwCreateKey
RtlCreateUnicodeString
RtlUpcaseUnicodeString
ExInitializeNPagedLookasideList
IoBuildSynchronousFsdRequest
wcsncpy
ExpInterlockedPushEntrySList
IoAcquireRemoveLockEx
ZwSetValueKey
ExpInterlockedPopEntrySList
ObQueryNameString
wcsrchr
wcsstr
IoGetDeviceObjectPointer
ZwQueryValueKey
RtlGUIDFromString
ExReleaseResourceLite
ExQueryDepthSList
ObReferenceObjectByHandle
IoGetDeviceInterfaces
ExDeleteResourceLite
_wcsupr
IoOpenDeviceRegistryKey
ExInitializeResourceLite
IoGetDeviceProperty
ObOpenObjectByPointer
ExDeleteNPagedLookasideList
RtlLengthSid
ZwOpenKey
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
KeBugCheckEx
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
MmHighestUserAddress
ExAllocatePoolWithTag
PsGetVersion
__C_specific_handler
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
246B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=135, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=6, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/PSINDvct/WVista/psindvct.cat
- SHA256 2927ee458f80a2d45eb373f132e6749e1db079e1c91db46c0b1e38738ebc2e69
- MD5 5e773468f4ebf08c77af7ef4f50ed0ab
- SHA1 4d1f53796a262a6fa418585ec511c7c35013252e
- SHA512 1d06b8c1d1841c509244bf3484d7bdebeea6bf49423915cc12132bdcc4bc56102de1c403c9c064b2ff70c62bf2372670d0f78b0d8fb5896a629bc103e9c8c1c9
- SSDEEP 192:xnbT29EO7TfvyyKwnsFWQFhxRClLhMzqnajKsIJ89Y:R87TfrnsFR5RSVslGsIwY
- TLSH T14C22E8E689BC44C3ED93A86083E8E597BC3967C72C10856D219BF7A41D93BC1F70856D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/W10/PSBoot.sys
- IMPHASH ff7fc431c09ffd39de61c3d117f0bfa8
- SHA256 9a59386fd5201d21c8c0af3f2295fee5c53634ba8fe08623b17ed5d0405dc956
- MD5 eeb7fa5491d07b3acf6aa2bac4537bb9
- SHA1 7b43bb368714b1c86e5f29840f1e0cc4ec1a7b58
- SHA512 0dcf2ace6f3e1fb7b6a3fa957876e99ff260c7b16884ea83fba0cd67044089f25138539b2029876cf42230c0d036ff3456844a7c4c3cf303a4ccf32869b77bc3
- SSDEEP 768:ZiMSFODIhHTM3GTWxt6z4wFDbBlWe33qGHwcCAAc1fQ32LWGyqld3I9/9zAGQsz0:RBGTWS4wZZS32DldczRPxW
- TLSH T10E336C614394486BDBABDD39E2F2C627BAB1F149272183EF0685C4541F73BD0963C7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
94:aa:ce:20:fd:45:53:2c:7d:2a:5a:b8:d3:a4:17:63:a9:f6:08:29:f2:c5:d9:f6:26:b1:e7:5a:bf:58:48:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Dec 29, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
94:aa:ce:20:fd:45:53:2c:7d:2a:5a:b8:d3:a4:17:63:a9:f6:08:29:f2:c5:d9:f6:26:b1:e7:5a:bf:58:48:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 29, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a4:07:cf:e3:8f:a3:ba:6f:d6:00:01:00:00:01:a4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
45156
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\nano\source\code\interception\psboot\source\code\psboot\src\objfre_wnet_amd64\amd64\PSBoot.pdb
ntoskrnl.exe
_wcsicmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ExSystemTimeToLocalTime
RtlTimeToTimeFields
DbgPrint
IoDeleteDevice
IoDetachDevice
ZwReadFile
RtlInitUnicodeString
NtQueryDirectoryFile
ZwSetInformationFile
ZwCreateFile
ZwClose
ZwDeleteFile
PsGetCurrentThreadId
ZwQueryInformationFile
ZwWriteFile
ExQueueWorkItem
RtlUnicodeStringToAnsiString
RtlCompareString
KeDelayExecutionThread
ObQueryNameString
IoGetDeviceObjectPointer
IofCompleteRequest
RtlFreeAnsiString
IoAttachDeviceToDeviceStack
PoCallDriver
ObfReferenceObject
ObfDereferenceObject
IoCreateDevice
IoRegisterFsRegistrationChange
IofCallDriver
_stricmp
strncmp
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
ZwQuerySymbolicLinkObject
ExpInterlockedPushEntrySList
RtlAppendUnicodeToString
RtlInitAnsiString
RtlGetVersion
KeReleaseSpinLock
ExpInterlockedPopEntrySList
PsSetCreateProcessNotifyRoutine
ZwOpenSymbolicLinkObject
RtlFreeUnicodeString
strncpy
PsCreateSystemThread
IoGetCurrentProcess
RtlAppendUnicodeStringToString
ExQueryDepthSList
RtlCompareUnicodeString
CmRegisterCallback
RtlCopyUnicodeString
MmIsAddressValid
CmUnRegisterCallback
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoDeleteSymbolicLink
InitSafeBootMode
IoCreateSymbolicLink
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=69, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/W10/pskmad.sys
- IMPHASH fd6f187973877c1a6575a7291b30f617
- SHA256 2dd05470567e6d101505a834f52d5f46e0d0a0b57d05b9126bbe5b39ccb6af68
- MD5 1e989aa5bfc9ea8e097ffe51e31086d9
- SHA1 2eef404740eaebff74114e375d422db23a5db4f4
- SHA512 1aba9137c14b679841facc1bda365f6f1aecfc1a05fdd6bb72c4392146d8dcb5968ed025a2d08fd02fec031939c57082548c17b5a5302710b0b22f4d4ac7383a
- SSDEEP 768:07sBqVP8usiEjBHZOPwqY0r2EoN0MaPGDB2JxRa25YC6uT4cTYuBpEIXNNoUv7Rv:3+knJjZN0zfpr6ukwXfRdXEOHa0/Z
- TLSH T135636D6A81659579DA97C8FA9EF4D223BA3078955F7962CF0030C215AF067ECA73C31C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:c7:38:81:0c:8a:c5:8c:3d:bd:d8:1a:96:24:ac:79:b8:ca:f0:dc:d0:d4:3d:69:e7:c0:13:10:16:49:15:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 20, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
e9:c7:38:81:0c:8a:c5:8c:3d:bd:d8:1a:96:24:ac:79:b8:ca:f0:dc:d0:d4:3d:69:e7:c0:13:10:16:49:15:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 20, 2019
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:f1:68:c3:c1:0a:96:49:a2:cc:00:79
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 18, 2017 - Jan 27, 2021
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 2, 2011 - Mar 29, 2029
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:25:3a:27:38:69:0a:34:51:c1:00:00:00:00:00:25
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2018 - Sep 6, 2019
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:1A8F-E3C3-D69D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:f2:76:0d:fc:0a:31:ea:e0:22:00:00:00:00:00:f2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 24, 2018 - Jan 10, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
61540
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\interception\mad\source\code\pskmadrv\bin\objfre_wnet_amd64\amd64\pskmad.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoGetCurrentProcess
IofCompleteRequest
RtlCompareMemory
sprintf
ZwCreateKey
ExInitializeNPagedLookasideList
IoDeleteDevice
RtlGetVersion
ZwQueryValueKey
ZwClose
RtlCharToInteger
IoCreateSymbolicLink
wcscspn
ExDeleteNPagedLookasideList
MmSystemRangeStart
MmUnmapLockedPages
PsProcessType
KeSetTargetProcessorDpc
KeQueryActiveProcessors
ZwFsControlFile
PsLookupProcessByProcessId
InitializeSListHead
ZwQuerySymbolicLinkObject
ZwSetEaFile
ZwReadFile
ZwMapViewOfSection
ExpInterlockedPushEntrySList
IoCreateFile
MmHighestUserAddress
KeInitializeDpc
KeAcquireQueuedSpinLock
ExpInterlockedPopEntrySList
KeReleaseQueuedSpinLock
MmUnmapIoSpace
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
MmGetVirtualForPhysical
ZwSetInformationFile
KeDetachProcess
KeDelayExecutionThread
MmGetPhysicalAddress
ZwWaitForSingleObject
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
ZwQueryDirectoryFile
PsTerminateSystemThread
MmIsDriverVerifying
MmMapIoSpace
KeInsertQueueDpc
ZwQueryEaFile
ZwQueryVolumeInformationFile
ObReferenceObjectByHandle
MmProbeAndLockPages
KeRevertToUserAffinityThread
RtlEnumerateGenericTableAvl
MmUnlockPages
PsGetCurrentProcessId
KeSetSystemAffinityThread
MmIsAddressValid
ObfDereferenceObject
ZwCreateSection
KeNumberProcessors
ZwQueryInformationFile
ZwWriteFile
ObReferenceObjectByPointer
ObOpenObjectByPointer
KeStackAttachProcess
IoAllocateMdl
ZwQuerySystemInformation
KeBugCheckEx
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwOpenKey
ZwSetValueKey
RtlFreeUnicodeString
__C_specific_handler
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=135, version=30729,
count=102, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.cat
- SHA256 9116127a413b4e35573d697f962e28b6feba4d50354c3c80389bd649021a8b45
- MD5 b69cadbc764f039b7801810cfaf80d44
- SHA1 8c2f68b37621d910746fb1361c1ddcaeff310279
- SHA512 059c3bd24218b918409a5789766a959df0bf7bcbf1c9079e4afeb53ed0f00cfd6d97d21e566d944c359adcb7fe700558585a411c6ea531dd3c8d29dbb22a2f03
- SSDEEP 192:tavCexJCA/o2XKEwfVhYC/QK1Zk9gTFqnajTSzFMEGHfh:Yrw2WVh3/QK/hl3SzuEGHfh
- TLSH T1802218A2996C4083FA63B96043E4F9537C3D63CB68204669249FF6950D977C5FB0426E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.inf
- SHA256 278f983ade781a364790d575447fb2758c06147df5f562dd4e75384576ffdc04
- MD5 73f95df48c8c434accf5a259d50a9517
- SHA1 460894f936dcc31dfc68f7236591029be511df71
- SHA512 0b828da795808ed8e9f58abd9d26b3c9b16b0e89d3ccbd5193ecbf61f80b24766b254d3ec6cee3d41f133758c439f49c58cdfb9d7a022b3e30d6dfaa22af84ed
- TLSH T1C4410C9C8EC39974298376549F3344C7B2781208207D304837EE9299D7CDF1C87B06EA
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/dvctprov/W10/dvctprov.sys
- IMPHASH 915f1b722fe87ac3e1c211dcc505ee6a
- SHA256 509142e1f8ec4baf3994a16f8cac4cec7a76b2d7c4e1dcf99116186e783e54f5
- MD5 3189dac754fc95fcb5636b40207a750d
- SHA1 e778b6d7eb3297791e7703277cc86df9a74f36a3
- SHA512 8ed8f9e33ef8b13aa728d2cb0e84ec31ea3613860d6f0198ab5a2d1aad6697c24b9b9c31f786a4b3f8696409cabef4606a591ffdc3c7a4c7dafc0e1972f08d5d
- SSDEEP 3072:hCZAdq22NUOvDvzN+gjV93qrLkmJodinv00:KMgjV93qrLc0
- TLSH T1AAD34B0211F51039CB97917985F64D47A673348CABA9EBDB013891A15B037F4AB3EB3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
d5:fa:46:0e:8e:35:0a:e1:a1:f6:aa:61:e1:02:95:ae:70:bd:ac:77:6b:b3:47:97:02:a9:a7:89:05:7d:5b:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2020
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
d5:fa:46:0e:8e:35:0a:e1:a1:f6:aa:61:e1:02:95:ae:70:bd:ac:77:6b:b3:47:97:02:a9:a7:89:05:7d:5b:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Oct 28, 2020
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=B48435218,CN=Panda Security S.L.,O=Panda Security S.L.,STREET=SANTIAGO DE COMPOSTELA 12,L=Bilbao,ST=Bizkaia,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:f1:68:c3:c1:0a:96:49:a2:cc:00:79
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 18, 2017 - Jan 27, 2021
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 2, 2011 - Mar 29, 2029
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3b:cd:6b:d8:3b:c6:71:b8:fe:00:00:00:00:00:3b
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:20:1a:39:db:d9:6b:9f:ad:f2:00:00:00:00:01:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\interception\devctrl\source\code\bin\objfre_wnet_amd64\amd64\dvctprov.pdb
ntoskrnl.exe
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCreateUnicodeString
KeLeaveCriticalRegion
RtlInitUnicodeString
KeEnterCriticalRegion
RtlFreeUnicodeString
ExAcquireResourceSharedLite
ExReleaseResourceLite
RtlCompareUnicodeString
ExDeleteResourceLite
ExInitializeResourceLite
ExUnregisterCallback
IoWMIRegistrationControl
IoWMIWriteEvent
PsSetLoadImageNotifyRoutine
_wcsnicmp
MmGetSystemRoutineAddress
RtlGetVersion
KeDelayExecutionThread
wcsrchr
PsCreateSystemThread
PsTerminateSystemThread
PsRemoveLoadImageNotifyRoutine
ExRegisterCallback
RtlCompareMemory
ObfDereferenceObject
ExCreateCallback
DbgPrint
IofCallDriver
KeClearEvent
KeSetEvent
KeInitializeEvent
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
RtlTimeFieldsToTime
KeBugCheckEx
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ZwClose
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
RtlAnsiCharToUnicodeChar
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
ZwSetInformationFile
ZwQueryValueKey
ZwQueryInformationFile
ZwOpenKey
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=18, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.cat
- SHA256 2a2678ccabd92a98c29f1d84fa70f3d1e7d8392d9529e90478ac609722bf176b
- MD5 bc0fc3651346797c432dcf4709f5cba3
- SHA1 825ffaebc6a58d4dfb487acdb85f511556a16912
- SHA512 637e1f9607f214a94e9576f23c1ea71acc3e0c7a344d6d9621e39c941cf17c0b0ae6716f74c67a7329328e783d874c308a42e2cd5001c68f256d54f30fa50061
- SSDEEP 192:sjT29EO7TfvyyKwnsFWQF32LhMzqnajKsIJr0qcT:z7TfrnsFRp2VslGsIGZT
- TLSH T18C22F8E68A7C4483E993986083E8E997BC3D67C72C10856D11DBF3A41D92BC2F70856D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.inf
- SHA256 4b02d9920093fdc2b87b20b52900e5a63e169c10a63d6a5f5eadc21cbb22a7ee
- MD5 2842e82efa01edbe7efe395276833beb
- SHA1 dc2d2d181d091105963a26c329542c7d3a4f0bcf
- SHA512 f42b4e62ee676d2053bf1ac082b226675bcd5fdea5bea51c028958b0b1e58e06c35785f91e033a4bb8cf48bde5b3ab2b8b33569651111be1983c3eee2684e601
- TLSH T12D41FB9C8EC3A974298376549F3344C7B2781208107D305833EE9299D7CAF1C87B16EA
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/dvctprov/WVista/dvctprov.sys
- IMPHASH 915f1b722fe87ac3e1c211dcc505ee6a
- SHA256 5ef65e84c8e75bcb5bf1fc3b935515e07905fab82a5d3b7a12568e01c826f41e
- MD5 701d4753c3e18753a07cae713a230596
- SHA1 7601c4185bbf794541ffd0df69a3f06f658f9ae8
- SHA512 b00c439a22eab19ce1e2f00bfa17481f72d1157f7874f85559a60a332445dc9925b6ba5b1ae4e625054d26d83331d03071e4112d63b2d5dd7927cd978b418780
- SSDEEP 3072:oCZAdq22NUOvDvzN+gjV93qrLkmJodiaNq:pMgjV93qrLqNq
- TLSH T110E33B1251F51039CB97927995F64D47AA73348CABA5EBEF413880905B037F0AB3E73A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
143460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\dev\dev\interception\devctrl\source\code\bin\objfre_wnet_amd64\amd64\dvctprov.pdb
ntoskrnl.exe
ExAcquireResourceExclusiveLite
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCreateUnicodeString
KeLeaveCriticalRegion
RtlInitUnicodeString
KeEnterCriticalRegion
RtlFreeUnicodeString
ExAcquireResourceSharedLite
ExReleaseResourceLite
RtlCompareUnicodeString
ExDeleteResourceLite
ExInitializeResourceLite
ExUnregisterCallback
IoWMIRegistrationControl
IoWMIWriteEvent
PsSetLoadImageNotifyRoutine
_wcsnicmp
MmGetSystemRoutineAddress
RtlGetVersion
KeDelayExecutionThread
wcsrchr
PsCreateSystemThread
PsTerminateSystemThread
PsRemoveLoadImageNotifyRoutine
ExRegisterCallback
RtlCompareMemory
ObfDereferenceObject
ExCreateCallback
DbgPrint
IofCallDriver
KeClearEvent
KeSetEvent
KeInitializeEvent
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
RtlTimeFieldsToTime
KeBugCheckEx
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ZwClose
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
KeInitializeDpc
KeInitializeTimer
ZwCreateFile
KeSetTimer
KeCancelTimer
ZwWriteFile
RtlAnsiCharToUnicodeChar
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
ZwSetInformationFile
ZwQueryValueKey
ZwQueryInformationFile
ZwOpenKey
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=18, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinaflt/PSINAflt.sys
- IMPHASH 420bcae1712938249347fefa04018574
- SHA256 ed419b641d060adbf25d8b8460792a1bbaa56441470328924c77ebee24cf1ce4
- MD5 61e64fa7fd588bcee0f5112ecc738a7a
- SHA1 5eb17fe61261093239209d48a93fad0f34c20d89
- SHA512 56df52f83cc885cdfadca703bb46dd9c6f9a0204a3dbb7044d973c926b6a251d31f7b0b8d9df2d77ec297e990ea632cd4c25cb308278c53b66f0778e9daf9378
- SSDEEP 3072:ofTtR5Q+5O4BfmMaY1r1pio/tuLPVGTJcphvGk9800jnxD:ofTr5Q+x/LrmGuLPVGTJch9Z
- TLSH T1C9144A1281B2123DFB9B91B585D34D879772344C4BFC7AEB4138D1A22B067E0A73B769
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:e6:07:bc:23:e8:b4:fe:93:2d:58:3b:76:8d:d9:b7:aa:9e:d2:e3:60:70:61:d8:60:e9:16:47:44:74:c8:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
2e:e6:07:bc:23:e8:b4:fe:93:2d:58:3b:76:8d:d9:b7:aa:9e:d2:e3:60:70:61:d8:60:e9:16:47:44:74:c8:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:86:78:e5:19:89:f8:24:4b:cc:00:01:00:00:01:86
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
286640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinaflt\Project\objfre_wlh_amd64\amd64\PSINAflt.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
RtlGetVersion
IofCompleteRequest
RtlCompareMemory
IofCallDriver
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
RtlHashUnicodeString
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlCompareUnicodeString
RtlCreateUnicodeString
RtlAppendUnicodeToString
wcsrchr
ZwQueryValueKey
ZwClose
RtlCopyUnicodeString
ZwOpenKey
RtlFreeUnicodeString
RtlCopySid
IoFreeWorkItem
KeDelayExecutionThread
wcsstr
IoAllocateWorkItem
IoQueueWorkItem
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
RtlTimeToSecondsSince1980
ExDeleteResourceLite
ExInitializeResourceLite
KeClearEvent
ExInitializeNPagedLookasideList
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
ExpInterlockedPopEntrySList
ExQueryDepthSList
KeWaitForSingleObject
ExDeleteNPagedLookasideList
KeBugCheckEx
IoCreateDevice
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
KeResetEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExInitializePagedLookasideList
ObfDereferenceObject
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
ObDereferenceObjectDeferDelete
IoBuildDeviceIoControlRequest
KeReleaseInStackQueuedSpinLock
ZwQuerySymbolicLinkObject
KeAcquireInStackQueuedSpinLock
ZwOpenSymbolicLinkObject
ZwEnumerateValueKey
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
__C_specific_handler
Name
.text
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=31, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinaflt/W7/PSINAflt.sys
- IMPHASH 420bcae1712938249347fefa04018574
- SHA256 13b86a78f649ed6f87494d64f0d90e667ff4d5bbf948496dcc766fb2ee42dc74
- MD5 37b3fd2ee74f1614d8611ceb7ed6d1a5
- SHA1 ea9dae784a127252eecc8eb1c368c1b0ec4c70c5
- SHA512 aa21fc77a75cfeb8d6bdd48b5f34aacfc535a8f930fe744ea86c991fe7e3dd20adad31b48d7943066a12a579f84f467e1c3f6c1b14036f7b7c456d9dc64f8f3a
- SSDEEP 3072:QfTtR5Q+5O4BfmMaY1r1pio/tuLPVGTJcphvGk9800jcRLnxW:QfTr5Q+x/LrmGuLPVGTJch9ZNU
- TLSH T1B0144A1281B2123DFB9791B585D38D879672344C4FFC7AEB4138D1A12B067E0A73B76A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:e6:07:bc:23:e8:b4:fe:93:2d:58:3b:76:8d:d9:b7:aa:9e:d2:e3:60:70:61:d8:60:e9:16:47:44:74:c8:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
2e:e6:07:bc:23:e8:b4:fe:93:2d:58:3b:76:8d:d9:b7:aa:9e:d2:e3:60:70:61:d8:60:e9:16:47:44:74:c8:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:88:2e:cd:c6:81:41:e1:bc:2a:00:01:00:00:01:88
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
286640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinaflt\Project\objfre_wlh_amd64\amd64\PSINAflt.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
RtlGetVersion
IofCompleteRequest
RtlCompareMemory
IofCallDriver
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
RtlHashUnicodeString
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlCompareUnicodeString
RtlCreateUnicodeString
RtlAppendUnicodeToString
wcsrchr
ZwQueryValueKey
ZwClose
RtlCopyUnicodeString
ZwOpenKey
RtlFreeUnicodeString
RtlCopySid
IoFreeWorkItem
KeDelayExecutionThread
wcsstr
IoAllocateWorkItem
IoQueueWorkItem
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
RtlTimeToSecondsSince1980
ExDeleteResourceLite
ExInitializeResourceLite
KeClearEvent
ExInitializeNPagedLookasideList
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
ExpInterlockedPopEntrySList
ExQueryDepthSList
KeWaitForSingleObject
ExDeleteNPagedLookasideList
KeBugCheckEx
IoCreateDevice
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
KeResetEvent
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExInitializePagedLookasideList
ObfDereferenceObject
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
ObDereferenceObjectDeferDelete
IoBuildDeviceIoControlRequest
KeReleaseInStackQueuedSpinLock
ZwQuerySymbolicLinkObject
KeAcquireInStackQueuedSpinLock
ZwOpenSymbolicLinkObject
ZwEnumerateValueKey
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
__C_specific_handler
Name
.text
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=31, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinaflt/W7/psinaflt.cat
- SHA256 387734ab1bd816c7e9e01608e049428acfe581c93a4da516d990461fdddcc424
- MD5 c28e5dc1a35d9b94f29b18be7eea932d
- SHA1 eca2928fbd815653b69e368d3d9f08b14fad9c81
- SHA512 248c3ed1a8b3f85e26935052b48c4aa018025a94ba623fa3a505dd8fe253a7298bf3074673bb248c746da7e993cc9666a97dcfd2065e88b90f619e6d58ce6a4f
- SSDEEP 192:IcVf2ZEO7DdIM1/nScOL7yKnUi8rFWQFT5tbF0F/C+dyoX01k9z3A7uG+:IB7N1/nX4CFRtWF//dJR9z+ut
- TLSH T1F74207D256AD40C2ED97AD7083E9E8973C3C6BDB1C10446D229BFB640C923C5EB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinaflt/W7/psinaflt.inf
- SHA256 e2b1da579b984b1f7346f659640dfe0ccd821ab5647922ccf8519012434c561a
- MD5 f5f749a7e7f79574375110ffd3171154
- SHA1 7444d3554e24a97aab357ca17632ba20dcee43e1
- SHA512 5c40193b4943832870a7e0d0166b47bc47f15533a231ccca7fe2a337f99e43be505e6a510e19dbee1d4e70083f298a63f84ce8cc04364ad1bb0f50b63f24185d
- TLSH T1BF5101890EC6D67936C62650BF336CC7B234261024B970447ADE83D9A3CAF1C87326F8
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinaflt/psinaflt.cat
- SHA256 b088dd12dd6fb58ee217ec10b10c10381321c8bc68f6c7e9eef8465f8173e0cf
- MD5 7cfa24162eddd55a96979e18cbe84500
- SHA1 9c56f798d1078d286b943a4625440f0c8c3efb94
- SHA512 53bd65c11f1769138779d020fa4fee202a806ee52dc750926b3766a8540b32b01ca87ecbca9c66664d178d5f8d58b3bfbc64e142ad72619a4a25dc38643760ed
- SSDEEP 192:xdZ6F0JC1TfXEwI+CYhYC4NqPJJGlD/Jn9VOMbSX01k9z3AS0oWQAQ:xDOTiMh3FvGlD/LVNSR9zh0NQAQ
- TLSH T11C323AE285284083EDA7BCA013E8FA877C3D67CB5C005569219FFA591DA33C5FB2812D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinaflt/psinaflt.inf
- SHA256 bf0a44a8931ca3a7161f3cab3f2bc63e6977b563c3e38651b0b29b3cf4de8716
- MD5 e509e4e426f38940a57d224fe1b3cf32
- SHA1 3295fe9336e230a4cafb41d670bb84d8ea511f80
- SHA512 87464d7fb34abc9780de4203479d2a1f1b4154c3be088c0451a27661059044150d16a30e2acef505203251aa2ce7e53e72e6f6065cd4b26f5f88608996f5c85d
- TLSH T13F51E2891EC6D67976C62550BF336CC7B234261424B970447ADE93D9A3C9F1C87326F8
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinelam/W10/psinelam.cat
- SHA256 a7d04a82ee2fd497e5da37c8366e72596ce4fe0445854d23019e411f666c93f2
- MD5 aa777497c274e254e366c3939755040d
- SHA1 31d8e37ee1244a58addd61b08c6172ed3e77e041
- SHA512 7c05d08ba44e359a34c76989872aaf3e32d54d2e3156e8ca85193346d41458e95625c5b362712f0cb161c613a2f31a894f35b7293e2ec56e3b99abd7a7c057b1
- SSDEEP 192:r0R23fWyhJCKjOL7yKnUi8rFWQFqu7QTCchC6zm60X01k9z3AzsbsdCW:4ylpj4CFRATCcM6a1R9zusbsdCW
- TLSH T1673218E29A6D84C2ED93A8B117A8F1937C3D2BCB0C50516962DFF7250D923C4EB2857D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinelam/W10/psinelam.inf
- SHA256 2cf308d2ab78460673c811dbb132895eb4c999f3866b635a608c69b002c15c45
- MD5 1639988743a76dc45c6f62f392254e61
- SHA1 6ac992273eb4c13a9a8dd560c3b0ea1293504ba6
- SHA512 c61bf6f9585dbeec5bb22091394d70abb5a1f6424bb806d9e7c17b27f9c3a0e82f379ccea58b974d5661e6e5b975ea1dd1772387ec532373203f854c25237c22
- TLSH T10441E25849CB5AB936477290BF3708C7B2385124207D301576DED296E3DAE2C9364AFE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinelam/W10/psinelam.sys
- IMPHASH 46c5957c333d67de89ade30bad85d130
- SHA256 e079856906ba958e50b058518f195bd346d54602a7712400decb199bc01eb125
- MD5 29d409998e060cea6050aea799015cf8
- SHA1 5214b4e920a023e5596c53760f65d2c2b4f52607
- SHA512 cf2bd0f4b8c3a2fa48a78628c0330dbc1ac3cc18f729f9962d9a25b2ff1a24e57c0e8149cca253b88ea173441976d8f88cfce92a83a423eb20d38f0cac6fbbdc
- SSDEEP 384:oTARRLy/N3VJ5WacUaEr334foG/s9NKxfY9nRmuTcR9z/EbOT:oTARo/Z45lfoMxwRmuU9zkOT
- TLSH T147C27EA146A810A3F597D9B5C3F1C5037E78FB822B2285CF01A8D11A2D977C4DB35A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:f7:1d:fa:60:a0:c9:fe:75:32:08:84:a2:0a:33:01:e8:16:99:62:d8:e2:7f:9d:4e:6a:15:7e:e5:2b:9e:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 13, 2022
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:9c:57:74:24:81:a5:93:7c:d8:00:00:00:00:04:9c
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:D9DE-E39A-43FE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ac:66:bc:87:22:5d:de:3d:7b:00:01:00:00:01:ac
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\TFS\UA\Dev\Dev\Interception\PSELAM\Source\Code\bin\Release\x64\psinelam.pdb
ntoskrnl.exe
IoRegisterBootDriverCallback
RtlCopyUnicodeString
DbgPrintEx
IoWMIRegistrationControl
MmGetSystemRoutineAddress
_vsnwprintf
IoUnregisterBootDriverCallback
RtlInitUnicodeString
wdfldr.sys
WdfVersionUnbindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=263, version=27412,
count=5, id=257, version=27412,
count=12, id=1, productName=Unmarked objects,
count=4, id=259, version=27412,
count=5, id=260, version=27412,
count=1, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
ispell/Sounds/Drivers/psinfile/PSINFile.sys
- IMPHASH 4fa82f92514a1308008689ad29aebfe2
- SHA256 52a3f6cf39f655b74060afd53de3f9106ced125dc354375e8be1270adc2b9e7f
- MD5 e1ed43bc3d23720b48d9077498ce5ebc
- SHA1 edd0db51bfc9b8c7fc5dd1aa65853d22ec4c40ff
- SHA512 8fd3deea3df8f4e7402ad51a457d28459161855b6943a6ab4334000c8bb4bc5c4d0d1b1c60d53ed3bffc1a0eab1af2560fe4787d9b29118eb246e329d9fc8f58
- SSDEEP 3072:UNElee68ys1y57rx9UuUVEjoMM9aDTBqa5qFBsNe4Ga+7xziI:Uulee68ys1y5Xx9UuUVEjoMM9aDTBqaM
- TLSH T1AE044B1193F41079DAABC278D6E28D57FAB3308CA751ABDF017482615F177E0AA3B325
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b4:73:6f:08:64:8a:f9:82:d7:27:3d:e3:a0:53:a9:f9:7d:62:74:cf:fe:fa:70:42:fb:34:47:72:51:04:03:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 17, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
b4:73:6f:08:64:8a:f9:82:d7:27:3d:e3:a0:53:a9:f9:7d:62:74:cf:fe:fa:70:42:fb:34:47:72:51:04:03:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 17, 2023
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ca:4f:c2:b3:ed:03:0d:18:6c:00:01:00:00:01:ca
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 4, 2022 - Feb 2, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
162340
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinfile\Project\objfre_win7_amd64\amd64\PSINFile.pdb
ntoskrnl.exe
RtlCopySid
RtlValidSid
PsGetThreadId
RtlEqualUnicodeString
RtlFreeUnicodeString
ExDeletePagedLookasideList
PsGetCurrentThreadId
ExInitializePagedLookasideList
ObOpenObjectByPointer
RtlLengthSid
IoIsFileOriginRemote
IoFreeWorkItem
ExConvertExclusiveToSharedLite
IoAllocateWorkItem
RtlConvertSidToUnicodeString
IoGetTopLevelIrp
PsGetCurrentProcessId
IoQueueWorkItem
IoFileObjectType
SeQueryInformationToken
ObReferenceObjectByHandle
RtlCompareUnicodeString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlAppendUnicodeStringToString
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeBugCheckEx
RtlCopyUnicodeString
ZwQueryValueKey
RtlAppendUnicodeToString
ZwOpenKey
ZwClose
ZwSetValueKey
ExInitializeResourceLite
ExDeleteResourceLite
IofCompleteRequest
KeDelayExecutionThread
MmGetSystemRoutineAddress
IoDeleteDevice
IoWMIWriteEvent
IoWMIRegistrationControl
KeClearEvent
IofCallDriver
ObfDereferenceObject
RtlCompareMemory
IoUnregisterPlugPlayNotification
IoGetDeviceObjectPointer
IoVolumeDeviceToDosName
RtlInitUnicodeString
IoRegisterPlugPlayNotification
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
ExAllocatePoolWithTag
ExDeleteNPagedLookasideList
KeWaitForSingleObject
ExQueryDepthSList
KeReleaseGuardedMutex
ExpInterlockedPopEntrySList
KeInitializeEvent
ExpInterlockedPushEntrySList
KeSetEvent
KeAcquireGuardedMutex
ExInitializeNPagedLookasideList
KeInitializeGuardedMutex
RtlPrefixUnicodeString
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ObDereferenceObjectDeferDelete
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
fltmgr.sys
FltReleaseFileNameInformation
FltGetTransactionContext
FltSetTransactionContext
FltEnlistInTransaction
FltClose
FltCreateFile
FltIsDirectory
FltFindExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetStreamContext
FltCancelFileOpen
FltQueryInformationFile
FltCompletePendedPostOperation
FltAllocateDeferredIoWorkItem
FltReferenceContext
FltGetRequestorProcessId
FltGetStreamContext
FltQueueDeferredIoWorkItem
FltGetInstanceContext
FltFreeDeferredIoWorkItem
FltGetDeviceObject
FltParseFileNameInformation
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltGetDestinationFileNameInformation
FltAcquireResourceShared
FltAcquireResourceExclusive
FltReleaseResource
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltGetVolumeName
FltAllocateContext
FltReleaseContext
FltGetDiskDeviceObject
FltSetInstanceContext
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=163, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=34, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinfile/W7/PSINFile.inf
- SHA256 224aedb93c7ea3219cd23489badf9fc7f21d175629a5105ff4a08402107bf67d
- MD5 af239dd8c53035eff2e6b8c48721a464
- SHA1 1ca8c015802df9d9b01c1c34e13ec97b5e3c9b0e
- SHA512 83af4e0642fed6a4b48532269528265c49c7399bf197bd35466de55df06a743c591fad67a4a311920f38b5e090bfaadfbcc77386fb83dfe3d7b33f343f73e0d7
- TLSH T13E51CC485FC38634A68E32647F333893B7257404A5B9344435DE82989395E0DCBB56EE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinfile/W7/PSINFile.sys
- IMPHASH 4fa82f92514a1308008689ad29aebfe2
- SHA256 c7466be4a5ba4494bfff3bc6350b3525b8c72458cea7b68d5bcc4080775e4251
- MD5 5980314bdf98b371ea49760317123825
- SHA1 611ad216e96bb4b5f73b9323af5f5e219bbd3ad7
- SHA512 8552aadd440526c1141f5fde452e151a3513f23b43c512364fcc71f77a3696427f0c66c6df4689c9d77248ae181366e5e06498eac9b171346c79c389e6aebb35
- SSDEEP 3072:oNElee68ys1y57rx9UuUVEjoMM9aDTBqa5qFBsNe4Ga+41+xe:oulee68ys1y5Xx9UuUVEjoMM9aDTBqa9
- TLSH T1C4044C1193F41079DAABC278D6E28D57FAB3308CA751ABDF017482615F177E0AA3B325
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b4:73:6f:08:64:8a:f9:82:d7:27:3d:e3:a0:53:a9:f9:7d:62:74:cf:fe:fa:70:42:fb:34:47:72:51:04:03:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 18, 2023
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
b4:73:6f:08:64:8a:f9:82:d7:27:3d:e3:a0:53:a9:f9:7d:62:74:cf:fe:fa:70:42:fb:34:47:72:51:04:03:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 18, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
162340
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinfile\Project\objfre_win7_amd64\amd64\PSINFile.pdb
ntoskrnl.exe
RtlCopySid
RtlValidSid
PsGetThreadId
RtlEqualUnicodeString
RtlFreeUnicodeString
ExDeletePagedLookasideList
PsGetCurrentThreadId
ExInitializePagedLookasideList
ObOpenObjectByPointer
RtlLengthSid
IoIsFileOriginRemote
IoFreeWorkItem
ExConvertExclusiveToSharedLite
IoAllocateWorkItem
RtlConvertSidToUnicodeString
IoGetTopLevelIrp
PsGetCurrentProcessId
IoQueueWorkItem
IoFileObjectType
SeQueryInformationToken
ObReferenceObjectByHandle
RtlCompareUnicodeString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlAppendUnicodeStringToString
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeBugCheckEx
RtlCopyUnicodeString
ZwQueryValueKey
RtlAppendUnicodeToString
ZwOpenKey
ZwClose
ZwSetValueKey
ExInitializeResourceLite
ExDeleteResourceLite
IofCompleteRequest
KeDelayExecutionThread
MmGetSystemRoutineAddress
IoDeleteDevice
IoWMIWriteEvent
IoWMIRegistrationControl
KeClearEvent
IofCallDriver
ObfDereferenceObject
RtlCompareMemory
IoUnregisterPlugPlayNotification
IoGetDeviceObjectPointer
IoVolumeDeviceToDosName
RtlInitUnicodeString
IoRegisterPlugPlayNotification
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
ExAllocatePoolWithTag
ExDeleteNPagedLookasideList
KeWaitForSingleObject
ExQueryDepthSList
KeReleaseGuardedMutex
ExpInterlockedPopEntrySList
KeInitializeEvent
ExpInterlockedPushEntrySList
KeSetEvent
KeAcquireGuardedMutex
ExInitializeNPagedLookasideList
KeInitializeGuardedMutex
RtlPrefixUnicodeString
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ObDereferenceObjectDeferDelete
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
fltmgr.sys
FltReleaseFileNameInformation
FltGetTransactionContext
FltSetTransactionContext
FltEnlistInTransaction
FltClose
FltCreateFile
FltIsDirectory
FltFindExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetStreamContext
FltCancelFileOpen
FltQueryInformationFile
FltCompletePendedPostOperation
FltAllocateDeferredIoWorkItem
FltReferenceContext
FltGetRequestorProcessId
FltGetStreamContext
FltQueueDeferredIoWorkItem
FltGetInstanceContext
FltFreeDeferredIoWorkItem
FltGetDeviceObject
FltParseFileNameInformation
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltGetDestinationFileNameInformation
FltAcquireResourceShared
FltAcquireResourceExclusive
FltReleaseResource
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltGetVolumeName
FltAllocateContext
FltReleaseContext
FltGetDiskDeviceObject
FltSetInstanceContext
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=163, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=34, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinfile/W7/psinfile.cat
- SHA256 9a683a1472ee52cd9e041ed0e1e62b7408bf98f06ee100a22caab5655520621c
- MD5 4856b56d6225d5cf30159ea6f9e0681c
- SHA1 c3d908e6cdb21999b6fd891f5a3eedd4c6475467
- SHA512 bc58026f9b8812b1f89ff02793e93b82c4f2d912377a18fcc2779349cc8c213856dd060d2dfdf241fc3ab41b62d8deb90f0ca00d5c2e2a35a73f8c953d318e58
- SSDEEP 192:I77sD23vhEO7SOL7yKnUi8rFWQFY7mTAPQTb8o+X01k9z3AVpBUW/Lw9:IN7S4CFRWFPI+R9zcYqc
- TLSH T11A3207E28A6C8082EDE76C3093E8E9973C3D67D32C50946925DBF7540C927C5E71856E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinfile/psinfile.cat
- SHA256 fd0983850d7dd96fc2478f47532fd3db0b33cac6be8dee72c8412d6853a24c85
- MD5 a2fb783754666ebffaae7cce799b3a3c
- SHA1 c023aa2aebbbce2301bd2b31345c8ef082b15b85
- SHA512 a3b11671968e86fe3bca9833d3d4314a7b68203ca9fef5efad4d6943207acaff03f317b98e31ac968f6fcee36498a54e482488fd5758977abd4c3aafef27394b
- SSDEEP 192:p7G727n72JC1ifXEwI+CYhYCgiFKh+kSobX01k9z3AtEuWRV2b8:COiiMh3giFKK+R9zqURoo
- TLSH T1E6321BA385684183EE97BCB053E8EA537C3D2BCB5820546A619FF6191CE73C4E71426D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinfile/psinfile.inf
- SHA256 bbdfba82a2a2d84e7edf55a7c3c10345a12dafe1bf4859ca770333c6f77372e2
- MD5 b935ff094d1e9a1a5769876b1afbadb1
- SHA1 311445f982e7c7732fcdb3ec027af2b824b04f9a
- SHA512 09a16734258120ca0290d78407119e0b17eed729cf50253183fb038121357b1b38a95f08b6c10b104f812d72d8431febabedb45636c77867fe2282fed81f9cb5
- TLSH T10C51DD485FC38634A68E32647F333893B7257404E1B9344435DE8298D395E0DCBB56EE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinknc/PSINKNC.sys
- IMPHASH d175a80a44ffd621240e51befee4e7ed
- SHA256 139cda6b52d689b4ac8d4f9a4dce7539bcbea59032d25e64d00c4927d2bc5319
- MD5 08986420c0e070a1379de43aad82e1ac
- SHA1 ce75f3ac4b3fc6d8aba32622c8843cffb8413aac
- SHA512 48fa3c5baffbe93cad1f3135cb7c95e78bc7c9a897db35fdcd52c62cc5b5e074eba0a4afe23343a0bccf426292342674c45fb5320db5d8716a106f33177a9d4c
- SSDEEP 3072:g2g7x6FIMxZoQiSvtTE8BQh7O7TlMeknB4rh0ZzgRrw08BxZnU:g2kx6qIekvtT/47O7TlMesBlMdiU
- TLSH T139244B2551B2253EFBA741B4C4C28D879772344C1BED7FEB503891A22B077E1673B62A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:d6:d5:de:ee:c8:4e:4b:9c:de:2e:e3:0d:fc:b0:10:63:25:95:a1:74:e7:04:82:b1:fc:2f:ad:51:19:58:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
75:d6:d5:de:ee:c8:4e:4b:9c:de:2e:e3:0d:fc:b0:10:63:25:95:a1:74:e7:04:82:b1:fc:2f:ad:51:19:58:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a0:e9:bb:8c:bb:0e:a2:d1:7a:00:01:00:00:01:a0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
217188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psiknc\Project\objfre_wlh_amd64\amd64\PSINKNC.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
MmIsAddressValid
IoCreateDevice
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
IofCompleteRequest
KeDelayExecutionThread
ZwMapViewOfSection
IoCsqInsertIrp
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
ZwClose
IoCsqRemoveNextIrp
ZwCreateSection
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
MmGetSystemRoutineAddress
RtlCompareMemory
ZwCreateDirectoryObject
RtlGetVersion
ZwMakeTemporaryObject
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
ZwQueryValueKey
ZwOpenKey
KeReleaseSpinLock
IoCsqInitialize
KeAcquireSpinLockRaiseToDpc
PsLookupProcessByProcessId
PsGetProcessCreateTimeQuadPart
RtlHashUnicodeString
ObfDereferenceObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
MmUnmapLockedPages
MmSecureVirtualMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
KeUnstackDetachProcess
MmProbeAndLockPages
MmUnlockPages
PsGetCurrentProcessId
MmUnsecureVirtualMemory
ObOpenObjectByPointer
KeStackAttachProcess
IoAllocateMdl
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
KeQueryTimeIncrement
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
RtlAnsiCharToUnicodeChar
__C_specific_handler
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
788B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=45, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinknc/W7/PSINKNC.sys
- IMPHASH d175a80a44ffd621240e51befee4e7ed
- SHA256 6b26c7c70dedd0c39f0e71e9a99755134c18af2cb26f855240d7a160a1ee2ddb
- MD5 fcb12541d45b8bff3de8c01d48309970
- SHA1 47e943ac756f54dd30308cb4c6795bb32b9852ec
- SHA512 c33e13603e78edaf6effabe895faf979ae4cb7279d5bcc911614945bcbc1d479c2031f3e64f0f355ade19a9e8d0616dda5ea35967a5516769b0ac6f5f466468e
- SSDEEP 3072:i2g7x6FIMxZoQiSvtTE8BQh7O7TlMeknB4rh0ZzgRrw082uDxb:i2kx6qIekvtT/47O7TlMesBlMd+
- TLSH T1BA244B2551B2253EFBA741B4C4C28D879772344C1BED7FEB503891A22B077E1673B62A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:d6:d5:de:ee:c8:4e:4b:9c:de:2e:e3:0d:fc:b0:10:63:25:95:a1:74:e7:04:82:b1:fc:2f:ad:51:19:58:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
75:d6:d5:de:ee:c8:4e:4b:9c:de:2e:e3:0d:fc:b0:10:63:25:95:a1:74:e7:04:82:b1:fc:2f:ad:51:19:58:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8f:f3:51:a8:eb:5a:72:dd:cc:00:01:00:00:01:8f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
217188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psiknc\Project\objfre_wlh_amd64\amd64\PSINKNC.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
MmIsAddressValid
IoCreateDevice
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
IofCompleteRequest
KeDelayExecutionThread
ZwMapViewOfSection
IoCsqInsertIrp
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
ZwClose
IoCsqRemoveNextIrp
ZwCreateSection
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
MmGetSystemRoutineAddress
RtlCompareMemory
ZwCreateDirectoryObject
RtlGetVersion
ZwMakeTemporaryObject
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
ZwQueryValueKey
ZwOpenKey
KeReleaseSpinLock
IoCsqInitialize
KeAcquireSpinLockRaiseToDpc
PsLookupProcessByProcessId
PsGetProcessCreateTimeQuadPart
RtlHashUnicodeString
ObfDereferenceObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
MmUnmapLockedPages
MmSecureVirtualMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
KeUnstackDetachProcess
MmProbeAndLockPages
MmUnlockPages
PsGetCurrentProcessId
MmUnsecureVirtualMemory
ObOpenObjectByPointer
KeStackAttachProcess
IoAllocateMdl
KeBugCheckEx
ExAcquireResourceExclusiveLite
KeClearEvent
KeResetEvent
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
PsCreateSystemThread
PsTerminateSystemThread
ExReleaseResourceLite
KeQueryTimeIncrement
ExQueryDepthSList
ObReferenceObjectByHandle
ExDeleteResourceLite
ExInitializePagedLookasideList
ExInitializeResourceLite
KeWaitForMultipleObjects
KeAcquireSpinLockAtDpcLevel
ExDeleteNPagedLookasideList
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
RtlAnsiCharToUnicodeChar
__C_specific_handler
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
788B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=45, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinknc/W7/psinknc.cat
- SHA256 396e9db15b3f3f9ff05c7b9ae8b528890723fc4c6d7abeba83651a577094733d
- MD5 2e06198ddf0caa9d8bb99af9352b1e03
- SHA1 6ac4ace949797af8477348a1a9ecfcde117a0b68
- SHA512 7cb61c0213915f9725e4683ad06aa3ae0a221d2c3d7c4db5617c418435ccd45042d05be7b41d495cb9e1a6e6af47dea93031468392b135cdfb8bc5c1e6935111
- SSDEEP 192:qr1laUf2ZEO7DdIM1/nScOL7yKnUi8rFWQFc9oaks9gICQX01k9z3AF9rVzv:qrm7N1/nX4CFRcZ/P/R9zwrVr
- TLSH T1A742F9E296AC4882EDA7AC7043E8E4A33C3D6BC70C50443D529BF76419927C5EB2457E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinknc/W7/psinknc.inf
- SHA256 e6c9400efa0840af30aefbb6bc1a5d1c8dcf74e0a5635e94b653bf4b91b18bd2
- MD5 b77c059b6a65756741b102db12e35a31
- SHA1 236bbaa753873487a9704f0b5f0b56ca5a0af20f
- SHA512 adc5e8aa13cf74c750c2662d61d44d1a6f0805431a6f5fa14b4afb5b6005f47b82e255732fa89385978e543c0d1bb0889134a1623e14241db89eba0699a3d63f
- TLSH T11D41EE6849C7EAF4258AB6603F3304C7B27426041179700476EE92D9E7D9A1EC3315FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinknc/psinknc.cat
- SHA256 09e19f46ab271400194d7c82b7e7f693c9e3e9ec13dc70bfc1a253556075e711
- MD5 13a0ac40d21b41284a0da6f11106a08d
- SHA1 4c51b77b7049f4660822f948fe5b86203d3d9e0c
- SHA512 9ffb7903db816327d557c4015e2db485d23f440f12562a1fb755a6f98a2862dfb22143235a210da907d307db90623bc9203f9901f2ada5bf1f00055a85ddc3f8
- SSDEEP 192:eDJqF0JCUfXEwI+CYhYC/6dmb2fUhJcqnBaX01k9z3AOdGdJF:P0jiMh31bjJKR9zDdGdJF
- TLSH T103323AA245684182EE97BCA013E8F9533C3C3BC71D50556A65AFF7191D973C8FB2812E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinknc/psinknc.inf
- SHA256 c7b3ece9912be1544dfc83d8c4f5e8008293df33f0f3ce3aa4fb5d39decfd789
- MD5 dd5bbf7fc6be33cbda25acaf8e0a7b0b
- SHA1 4e14206b284f8e0a3288c03ec1af76b5edd2143a
- SHA512 253dc34904dda8f199ddba42f8167c741a462463fa840962b9648403b6b2ac0a57971711c23ef45f175a16a539bf020e361566e05b588b63b45805a02757f237
- TLSH T1F741EE6849CBEAF8258AB6A03F3304C7B27426041179700476EE92D9E7D9A1EC3315FE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinproc/PSINProc.sys
- IMPHASH 653b02b07b2936d662fe4f4d1f61c8f2
- SHA256 93c912c7785491cf68c6cdbaa326dcfda4ea8c2c32079e07937d69840bcb1c7b
- MD5 09772ce2e9a34a64ebadc6a3e1e36e98
- SHA1 f0d576e8aca08ac9e851c569909e7f7d7ac97b8d
- SHA512 084d71ac68a5cce1bf7d3949f5a82d702c77ca2d88343f22d3d3c7da5d6d8d06fb927267258c5c2076816035a7634a91c3fd87fca257293056d191a6a934f73a
- SSDEEP 3072:x7CRdQq9G59oAZ4VmOzDzBRLCdWBv/t0v78xZRX:4R79GQe4VmOzDzBRLCdYt0y
- TLSH T1B2E35B1162F51479CA578278D1E24D07B6B3B48C6BA5ABEF1234C1611F077E0AA3F37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
99:d0:0e:e2:de:23:b7:e0:ab:7d:c0:3b:27:93:07:9c:53:6c:88:57:4a:16:b8:82:cb:13:7f:ea:65:33:45:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
99:d0:0e:e2:de:23:b7:e0:ab:7d:c0:3b:27:93:07:9c:53:6c:88:57:4a:16:b8:82:cb:13:7f:ea:65:33:45:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8a:3e:38:8d:d2:0e:02:fa:e8:00:01:00:00:01:8a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
137784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinproc\Project\objfre_wlh_amd64\amd64\PSINProc.pdb
ntoskrnl.exe
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoRegisterPlugPlayNotification
RtlInitUnicodeString
IoVolumeDeviceToDosName
IoGetDeviceObjectPointer
ZwQueryValueKey
IoUnregisterPlugPlayNotification
RtlCompareMemory
ObfDereferenceObject
IofCallDriver
ZwOpenKey
PsRemoveCreateThreadNotifyRoutine
MmGetSystemRoutineAddress
PsSetCreateThreadNotifyRoutine
PsGetCurrentThreadId
PsGetCurrentProcessId
IoWMIRegistrationControl
IoWMIWriteEvent
IoDeleteDevice
KeDelayExecutionThread
ExAllocatePoolWithTag
ExDeleteResourceLite
ExInitializeResourceLite
PsLookupProcessByProcessId
PsGetProcessCreateTimeQuadPart
IoGetTopLevelIrp
PsGetThreadId
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
ZwTerminateProcess
RtlAppendUnicodeToString
RtlCopyUnicodeString
IoThreadToProcess
PsProcessType
PsGetProcessId
KeBugCheckEx
ObOpenObjectByPointer
ZwQueryInformationProcess
ZwOpenProcess
PsThreadType
ZwClose
ExDeleteNPagedLookasideList
KeWaitForSingleObject
ExQueryDepthSList
KeReleaseGuardedMutex
ExpInterlockedPopEntrySList
KeInitializeEvent
ExpInterlockedPushEntrySList
KeSetEvent
KeAcquireGuardedMutex
ExInitializeNPagedLookasideList
KeClearEvent
KeInitializeGuardedMutex
IofCompleteRequest
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
KeUnstackDetachProcess
KeStackAttachProcess
ExDeletePagedLookasideList
ExInitializePagedLookasideList
ObDereferenceObjectDeferDelete
KeReleaseInStackQueuedSpinLock
ZwQuerySymbolicLinkObject
KeAcquireInStackQueuedSpinLock
ZwOpenSymbolicLinkObject
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
__C_specific_handler
fltmgr.sys
FltObjectDereference
FltGetVolumeFromFileObject
FltReleaseFileNameInformation
FltGetFileNameInformation
FltGetRequestorProcessId
FltGetInstanceContext
FltAcquireResourceShared
FltAcquireResourceExclusive
FltReleaseResource
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltGetVolumeName
FltAllocateContext
FltReleaseContext
FltGetDiskDeviceObject
FltSetInstanceContext
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
434B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=32, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinproc/W7/PSINProc.inf
- SHA256 94cc0d2d790ad87a27e2e276ef8a618b7fdd338bef72163b7f2f6ce8af076849
- MD5 5b9ca962ba70c77c7164c8fd2bc38a87
- SHA1 b2f6531a82ec8b79e30e9c7be091f797c6e2fdda
- SHA512 ea0f34bd02be618936d26a007778fd977e6fc35e7a20ff97149251a318139db6023191ece33225b8bd727617fd70d76244ae1e4ea0011b05bd849202fd17b89f
- TLSH T18251B0580B978735A59B32A07F3338CBB6353814A0FA344476DD9584A3C6E0D8779AAE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinproc/W7/PSINProc.sys
- IMPHASH 653b02b07b2936d662fe4f4d1f61c8f2
- SHA256 ca69531a427e39cc9c9ee0e6a093da9249aa10d72bcc1640b67a7db7e73a82e5
- MD5 6daf3c69ddd0b38087a99575609f2765
- SHA1 cb24fcb053694d43880456bc85abf9d441718ce6
- SHA512 d76a5d2a3ba9ecc0e2451e1bdaa5bc112263544bc08f1a94a93791445a68edff72fe1303c3d96a59b9799b373fd1623cdb910beab8d06641985ebe822f833f12
- SSDEEP 3072:U7CRdQq9G59oAZ4VmOzDzBRLCdWBv/t0v7szPoxq:/R79GQe4VmOzDzBRLCdYt0U
- TLSH T107E35C0152F51479CA578278D5E24D07B6B3B48C6BA5ABEF1234C1A11F077E0AA3F37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
99:d0:0e:e2:de:23:b7:e0:ab:7d:c0:3b:27:93:07:9c:53:6c:88:57:4a:16:b8:82:cb:13:7f:ea:65:33:45:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
99:d0:0e:e2:de:23:b7:e0:ab:7d:c0:3b:27:93:07:9c:53:6c:88:57:4a:16:b8:82:cb:13:7f:ea:65:33:45:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a0:e9:bb:8c:bb:0e:a2:d1:7a:00:01:00:00:01:a0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
137784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinproc\Project\objfre_wlh_amd64\amd64\PSINProc.pdb
ntoskrnl.exe
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoRegisterPlugPlayNotification
RtlInitUnicodeString
IoVolumeDeviceToDosName
IoGetDeviceObjectPointer
ZwQueryValueKey
IoUnregisterPlugPlayNotification
RtlCompareMemory
ObfDereferenceObject
IofCallDriver
ZwOpenKey
PsRemoveCreateThreadNotifyRoutine
MmGetSystemRoutineAddress
PsSetCreateThreadNotifyRoutine
PsGetCurrentThreadId
PsGetCurrentProcessId
IoWMIRegistrationControl
IoWMIWriteEvent
IoDeleteDevice
KeDelayExecutionThread
ExAllocatePoolWithTag
ExDeleteResourceLite
ExInitializeResourceLite
PsLookupProcessByProcessId
PsGetProcessCreateTimeQuadPart
IoGetTopLevelIrp
PsGetThreadId
ZwQuerySystemInformation
PsSetCreateProcessNotifyRoutine
ZwTerminateProcess
RtlAppendUnicodeToString
RtlCopyUnicodeString
IoThreadToProcess
PsProcessType
PsGetProcessId
KeBugCheckEx
ObOpenObjectByPointer
ZwQueryInformationProcess
ZwOpenProcess
PsThreadType
ZwClose
ExDeleteNPagedLookasideList
KeWaitForSingleObject
ExQueryDepthSList
KeReleaseGuardedMutex
ExpInterlockedPopEntrySList
KeInitializeEvent
ExpInterlockedPushEntrySList
KeSetEvent
KeAcquireGuardedMutex
ExInitializeNPagedLookasideList
KeClearEvent
KeInitializeGuardedMutex
IofCompleteRequest
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
KeUnstackDetachProcess
KeStackAttachProcess
ExDeletePagedLookasideList
ExInitializePagedLookasideList
ObDereferenceObjectDeferDelete
KeReleaseInStackQueuedSpinLock
ZwQuerySymbolicLinkObject
KeAcquireInStackQueuedSpinLock
ZwOpenSymbolicLinkObject
RtlAnsiCharToUnicodeChar
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
__C_specific_handler
fltmgr.sys
FltObjectDereference
FltGetVolumeFromFileObject
FltReleaseFileNameInformation
FltGetFileNameInformation
FltGetRequestorProcessId
FltGetInstanceContext
FltAcquireResourceShared
FltAcquireResourceExclusive
FltReleaseResource
FltStartFiltering
FltRegisterFilter
FltUnregisterFilter
FltGetVolumeName
FltAllocateContext
FltReleaseContext
FltGetDiskDeviceObject
FltSetInstanceContext
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
434B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=32, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinproc/W7/psinproc.cat
- SHA256 f63357bdadd069f8922169ee415d6d9423b555d65e13be9d68e5c6b57f55d80a
- MD5 e812d52cdeab2bff1ecef4408541e0ea
- SHA1 374890546846b785eb75852cb0a0e5602e9c3cae
- SHA512 7a47ded3b37288bf8948a8dc28f4584b69bf1ec8489fe262cda627e747babdc6f412d700a443100306872d1f3c6348539b5b1c1b554b008b9f30180a18d10ba8
- SSDEEP 192:RSHGT2oPwEO7ISOL7yKnUi8rFWQFGmjdDwqF9e+X01k9z3AeJLSbJyG:RSZ7IS4CFRQmjdD/99R9z/d2JD
- TLSH T1203218E68A6C84C2ED87687083ECE9937C386BC72C50592912DBF7A40D927C5E71857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinproc/psinproc.cat
- SHA256 b24f4aa5a074527fde9bab9781bc8706a9765d28c2a54324609acec162ef2869
- MD5 99b3b641c04efbb402f7bd5e3983b543
- SHA1 064321b6da7ce894fd62c2c0702c35f10a0b0b33
- SHA512 cebfd69c8a690d0116e094d34136b88a332a9a53a7b80d8e69b5e6aa92b9a635456e7f554c2266c76264ff23c8a613fe542391f6a1b86a1edeade689c1db620a
- SSDEEP 192:aYs4Q0JC1yfXEwI+CYhYCwVYIN5vCX01k9z3AJ/kgXhv4PM:u0OyiMh3nUJCR9zE8glSM
- TLSH T1E8323AA286684082FC93FDA043E8F99B7C3C67C75C20452A719FF6591D973C4EB1826D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinproc/psinproc.inf
- SHA256 28836e4a6e792e032f920d338f2bf0c852599c2e19e7b4b0dc441fc74ec056f5
- MD5 50c9576a8ca534e6551abdc743a30c58
- SHA1 4bccfee344bd1ba07d14e89f98449009163089df
- SHA512 278c9ebe9b649b2278bf7bc32f498209810beadedf09e1ad131dba9ec002f68c32802f9fd7351437fdb32f147029a8cc53d1c6acb051f1a0998caaf944bc34dd
- TLSH T19551B0580B978735A59B32A07F3338CBB6353814A0FA344476DD9584A3C6E0D8779AAE
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinprot/PSINProt.sys
- IMPHASH e54de0d07d3548110ce2b887fdd0ec7a
- SHA256 71df2f21747951bfdf7cffd694369ba50a00fa2cb797ba0ea474dfd736d207ed
- MD5 def073d79f39aeb8e62bfc19fa5a0089
- SHA1 e52afcab33640f2f239acae8384929bb1b0367ef
- SHA512 9cdc1ddcb102fb3327406802e62f4711f8148717de46dc90247f40b8b03d57d2499ff56cf92d8d45909e27a842776cec36ded02b36cbad82095faf302ed68b36
- SSDEEP 3072:iitXFoHV9Jmf2Ghm8ZZhljMPqXBPcc8kx/sf9XA:iiVo19Mf2GhDZZhljMPqXKB9w
- TLSH T156F37D11A2F5047ACA678278D5E18D17F6B2F84C67A097DF1164C1A24B0B7F4AB3E335
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:3b:e9:f8:f6:a6:bb:7f:a8:71:71:54:35:8c:78:60:c7:6c:05:ed:af:71:7f:49:f9:f6:84:c9:9b:6b:88:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 3, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
57:3b:e9:f8:f6:a6:bb:7f:a8:71:71:54:35:8c:78:60:c7:6c:05:ed:af:71:7f:49:f9:f6:84:c9:9b:6b:88:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 3, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F87A-E374-D7B9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ae:aa:0b:5c:b3:34:a5:95:1a:00:01:00:00:01:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
149204
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinprot\Project\objfre_wlh_amd64\amd64\PSINProt.pdb
ntoskrnl.exe
RtlCompareMemory
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
ZwOpenKey
KeClearEvent
KeInitializeGuardedMutex
ExInitializeNPagedLookasideList
KeAcquireGuardedMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
ExpInterlockedPopEntrySList
KeReleaseGuardedMutex
ExQueryDepthSList
KeWaitForSingleObject
ExDeleteNPagedLookasideList
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
IoDeleteDevice
MmGetSystemRoutineAddress
IofCompleteRequest
IofCallDriver
RtlUpcaseUnicodeChar
KeDelayExecutionThread
IoThreadToProcess
ZwOpenThreadTokenEx
ZwOpenProcessTokenEx
ZwQueryInformationToken
ObOpenObjectByPointer
PsLookupThreadByThreadId
RtlLengthSid
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeBugCheckEx
RtlAnsiCharToUnicodeChar
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
ExAcquireResourceExclusiveLite
ExIsResourceAcquiredSharedLite
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoGetDeviceObjectPointer
ObDereferenceObjectDeferDelete
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwQueryInformationFile
ZwWriteFile
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=39, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinprot/W7/PSINProt.sys
- IMPHASH ac4dfa4aa738ad678a8030fdf8712256
- SHA256 9f2c1f3a0be15f4a92a322fcf8cbd657231bacf8b248d88466e430f32402d461
- MD5 d1fa31ef0363b339f95c983b66482194
- SHA1 ff781a1ab9e640b1d3da557c79361ad226a6413f
- SHA512 3eeae7f38f8fb3db20a8570d27c3512fee4ca712237e63af4637627abd5f645143e4a72e463eda9cbe908a70335056c39ae08ef7f2a991e2ebb8cacec1b10b8d
- SSDEEP 3072:Svm+8see2Kaxm2f2I/arlWnkhFDYcWk1VtNNBFGMxs:SO1s+pZf2I/a5EkhFDYcWkC
- TLSH T14EF37D01A2F5047ACA678278C6E1CD1BFAB2744C5765D7EF1268C1A14B0B7E0AF3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1d:8d:f3:98:eb:33:51:f8:a3:d5:47:2f:cd:66:40:7f:c4:3a:5f:cb:bf:3f:8f:6d:13:36:5b:00:e7:46:17:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 5, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
1d:8d:f3:98:eb:33:51:f8:a3:d5:47:2f:cd:66:40:7f:c4:3a:5f:cb:bf:3f:8f:6d:13:36:5b:00:e7:46:17:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 5, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9d:fe:89:e5:f9:7b:bb:4c:c0:00:01:00:00:01:9d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
149204
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinprot\Project\objfre_wnet_amd64\amd64\PSINProt.pdb
ntoskrnl.exe
RtlCompareMemory
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
ZwOpenKey
KeClearEvent
KeInitializeGuardedMutex
ExInitializeNPagedLookasideList
KeAcquireGuardedMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
ExpInterlockedPopEntrySList
KeReleaseGuardedMutex
ExQueryDepthSList
KeWaitForSingleObject
ExDeleteNPagedLookasideList
ExAllocatePoolWithTag
IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
IoDeleteDevice
MmGetSystemRoutineAddress
IofCompleteRequest
IofCallDriver
RtlUpcaseUnicodeChar
KeDelayExecutionThread
IoThreadToProcess
ZwOpenThreadTokenEx
ZwOpenProcessTokenEx
ZwQueryInformationToken
ObOpenObjectByPointer
PsLookupThreadByThreadId
RtlLengthSid
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeBugCheckEx
RtlAnsiCharToUnicodeChar
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
ExAcquireResourceExclusiveLite
ExIsResourceAcquiredSharedLite
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExDeleteResourceLite
ExInitializePagedLookasideList
ObfDereferenceObject
ExInitializeResourceLite
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
IoFreeWorkItem
IoGetDeviceObjectPointer
IoAllocateWorkItem
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=39, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinprot/W7/psinprot.cat
- SHA256 1fc7c884b0252b8ee49f7b6b9a7e007d24f4b9608d4048e387f7eac289e5d9e2
- MD5 a5f34c8d8453383cd84472ccd0a967b9
- SHA1 2a0e40f81f99030aebf57194c24c872903357196
- SHA512 a9520f78520ee829ab469cfe639cd9bad73eccaa5b5c636dd925f6785ce1754b039f49f5e25681ffb650cb11787fb185444dd1e54fd21b03fc30eb6a102bcccb
- SSDEEP 192:Uz88ND2VA5EO7XOL7yKnUi8rFWQF5h7a1uC1/or7o0X01k9z3AQ6MaSuPHH:6sA17X4CFRb1av1Z0R9z3JaS2
- TLSH T1C83208E68A6C54C2FD97686083E8E8A33C3C67C71D50456A21EBF6580D937C5FB2817E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinprot/W7/psinprot.inf
- SHA256 7edbb837c31f3708084638d1861493d7b55cb7564104dec9701a9fb3273b4909
- MD5 19fffbfa4b03890eeceae337e9c94cd0
- SHA1 ad4bb1943a850f5e354fe5370e8746621926c68b
- SHA512 313a4151b936539dd98f8556dd5333aa88e80e9f1b7015beef5dda517b6a9cc30e64d8bf14541c8eef9d208858c06687aa0ddf23e6f96e528df24444a3b86f7b
- TLSH T15151E5481D82D67765D73690AF3358CBB2341E24247C700476DDD69993C9F1C873A6BD
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinprot/psinprot.cat
- SHA256 730b3a6193908c690c3078f36133135b2b136fe0bfc558448bbd2b4167c47a41
- MD5 dbafd0060f20e95f1d2dec2485d4613a
- SHA1 569332b1560440411ffd8195a57911b27bd17454
- SHA512 22be3c32964c217011f6650ffee1545343f148f5d2ead214f98ea5f111b2aeb7011eff90f07630766f9d88b7237dd2a797f0c625146ebe89bd09c10692ab6e2f
- SSDEEP 192:2KPJdQjJC15fXEwI+CYhYC3pMFwBmfWaNOQjX01k9z3AzswH9hGjMfv/d:OO5iMh33OFwBmfWojR9zuswdnd
- TLSH T1B5322AF2556C4082ED9BBC6013E8F9973C3D2BCB2C0055A961AEF6191D973C5EB1822E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinprot/psinprot.inf
- SHA256 7edbb837c31f3708084638d1861493d7b55cb7564104dec9701a9fb3273b4909
- MD5 19fffbfa4b03890eeceae337e9c94cd0
- SHA1 ad4bb1943a850f5e354fe5370e8746621926c68b
- SHA512 313a4151b936539dd98f8556dd5333aa88e80e9f1b7015beef5dda517b6a9cc30e64d8bf14541c8eef9d208858c06687aa0ddf23e6f96e528df24444a3b86f7b
- TLSH T15151E5481D82D67765D73690AF3358CBB2341E24247C700476DDD69993C9F1C873A6BD
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinreg/PSINReg.sys
- IMPHASH 9ba9a8fdb340cf2f20700fc7fccd8ab4
- SHA256 dc729aa297f064922be9409bc93a5a58936a0306acc5d3cd768667b0741025e5
- MD5 d22c427641b5a9c3150a3c642d619b1a
- SHA1 a1b7ae88c5472291dcd1c69ccd221a2c8b3c9c01
- SHA512 dffbc680aa5dec8534e20f83edd722fd1b8be781a7be44552c7fc44b18985dbb1d995dbe35147973d9e5b2cd57a3e22851e6665a675704ce30bf333e9ab87ec8
- SSDEEP 3072:SND657G1xRVFBGaTPx6kIfjuCljl4gLbQQIqCxPjm:SND5FcaTPx6kI7vl48Ga
- TLSH T11AD36C0262F508B5CAA7C239D6B29E57EBB3B44C575593DF122480911F033E1AB3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:ee:aa:04:15:dc:f5:1e:ec:52:5c:33:5e:5a:7c:4d:e5:8a:ac:38:ba:5a:26:55:91:3a:e4:05:50:99:38:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
6d:ee:aa:04:15:dc:f5:1e:ec:52:5c:33:5e:5a:7c:4d:e5:8a:ac:38:ba:5a:26:55:91:3a:e4:05:50:99:38:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 25, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:86:78:e5:19:89:f8:24:4b:cc:00:01:00:00:01:86
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
118884
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinreg\bin\objfre_wlh_amd64\amd64\PSINReg.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoDeleteSymbolicLink
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
MmGetSystemRoutineAddress
IofCompleteRequest
RtlCompareMemory
IofCallDriver
IoDeleteDevice
RtlGetVersion
ObQueryNameString
ZwQueryValueKey
ZwClose
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
ObfDereferenceObject
ZwQueryInformationFile
ZwOpenKey
ObOpenObjectByPointer
ExReleaseFastMutex
ExAcquireFastMutex
KeInitializeEvent
ExTryToAcquireFastMutex
ExDeleteResourceLite
ExInitializeResourceLite
KeBugCheckEx
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
KeClearEvent
IoGetDeviceObjectPointer
ObDereferenceObjectDeferDelete
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwWriteFile
RtlAnsiCharToUnicodeChar
__C_specific_handler
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=20, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinreg/W7/PSINReg.inf
- SHA256 423b0f2d8bebae516e2114b735eadb5dbc45bc6f678640c4551bb8770a1ab221
- MD5 399923b9a93a725c5c5ed07e3a128493
- SHA1 bbba15265ca2d85c04878b8f2a3034e9f9d51157
- SHA512 43034b60e1265269e0fc22c70f37a51f47c9b2c7eb26e08e9b4fa8a63dfff4b14eac447235b671af428261828eb2073796660e0304c3d49f7cdf7de68587f9ad
- TLSH T1C641A9488987963467823B62BF3318D7B6342A1410BA3054F6EE92E5A7DAE1C83715AD
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Drivers/psinreg/W7/PSINReg.sys
- IMPHASH 9ba9a8fdb340cf2f20700fc7fccd8ab4
- SHA256 19c0ba08a7e8d5b501b2cea71dead649dfd687c0e67b231af434aa8e9432eb07
- MD5 53058e872465835257be964a4b5f6f3e
- SHA1 618e56139ec763db9dccc41a596082cdbf94cba4
- SHA512 016fdbe5c8ad329c3327c64262ab98dd7e171f7617d415b862affbe5831c03aa1abc1efbcf55298ae411f8747edc69b682cb8c3cf6db07ad856ecc69e292a06f
- SSDEEP 3072:7ND657G1xRVFBGaTPx6kIfjuCljl4gLbQQIqtXSx:7ND5FcaTPx6kI7vl48
- TLSH T143C36C0262B508B5CAA7C279D6B2AE57EBB3B44C5B5593DF1224C0901F033E1AB3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:ee:aa:04:15:dc:f5:1e:ec:52:5c:33:5e:5a:7c:4d:e5:8a:ac:38:ba:5a:26:55:91:3a:e4:05:50:99:38:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2022
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
6d:ee:aa:04:15:dc:f5:1e:ec:52:5c:33:5e:5a:7c:4d:e5:8a:ac:38:ba:5a:26:55:91:3a:e4:05:50:99:38:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 27, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9d:fe:89:e5:f9:7b:bb:4c:c0:00:01:00:00:01:9d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
SERIALNUMBER=602 715 217,CN=WatchGuard Technologies\, Inc.,O=WatchGuard Technologies\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:85:df:b2:66:16:5f:52:02:5e:7a:5b:14:97:f4:7d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 20, 2021 - Jan 23, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
118884
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\tfs\ua\release\paps_1.x\nano\source\code\interception\psinreg\bin\objfre_wlh_amd64\amd64\PSINReg.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoWMIRegistrationControl
IoDeleteSymbolicLink
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
MmGetSystemRoutineAddress
IofCompleteRequest
RtlCompareMemory
IofCallDriver
IoDeleteDevice
RtlGetVersion
ObQueryNameString
ZwQueryValueKey
ZwClose
IoCreateSymbolicLink
PsGetCurrentThreadId
PsGetCurrentProcessId
ObfDereferenceObject
ZwQueryInformationFile
ZwOpenKey
ObOpenObjectByPointer
ExReleaseFastMutex
ExAcquireFastMutex
KeInitializeEvent
ExTryToAcquireFastMutex
ExDeleteResourceLite
ExInitializeResourceLite
KeBugCheckEx
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
KeClearEvent
IoGetDeviceObjectPointer
ObDereferenceObjectDeferDelete
IoBuildDeviceIoControlRequest
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
ZwReadFile
RtlTimeFieldsToTime
ZwSetInformationFile
ZwCreateFile
ZwFlushBuffersFile
ZwWriteFile
RtlAnsiCharToUnicodeChar
__C_specific_handler
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=128, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=20, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/Drivers/psinreg/W7/psinreg.cat
- SHA256 509933858639d5be16887d9575f34dcea8b1f1a707ab99ae4a1a44e2daade780
- MD5 7760c4382415737a4458e5c06a18878e
- SHA1 6db3348f38620a77f3e2e99913e66c36d9b27cf8
- SHA512 ab757904ef60cf8575bdc42341c5235dca1ef1e83e52fcd3811f21df3314b63f51eb538ab7e82fc9c3ca8ff9c022df53d3c7ad2cbfedb2c57fa8f4de575fd40e
- SSDEEP 192:1Nld/Kf2ZEO7DdIM1/nScOL7yKnUi8rFWQFrQH+KKnAX01k9z3AEC0vXj:157N1/nX4CFRlQHTKAR9zAcj
- TLSH T1B642E9E2566D45C2EDA7AC7043E8E0973C3D6B870C50447D22DBE7640DA27C5EB2857E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinreg/psinreg.cat
- SHA256 63041ed89498d7a5aefc81a1ba92c7cac9ae91c908df5dbd5d9fbff214b169f8
- MD5 a20162bf869d4847ad869649c06736b3
- SHA1 b87774c61ec30b580174a7c9f8dfc612e33750ae
- SHA512 0b8c663fba947367bc0c250da1ba4132630b05b2ba8a11431b652ecc797d29bdc427377a8b37d0902cc6e529780fdf45d4ce657f5321638f57cec56698121845
- SSDEEP 192:BV50VbHgVN/VbEJCcnfXEwI+CYhYC/NYh+Il+jX01k9z3A9rU2i:F9EBiMh31UEjR9zirU2i
- TLSH T169321A72855C4182FD57BC6053E8E9577C393BCB2D10406A269FFA251DA73C9E72813E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Drivers/psinreg/psinreg.inf
- SHA256 a1b66c08a589a1e35ec9ca8b131bd093091265a085ed3afe4a9e4cf89358e989
- MD5 7a3558e9a161e3f732c4764766bbadcd
- SHA1 3699d89913865fe44492a802b5fe98acf2809adf
- SHA512 de786b028c4c98e338bb7bfd163e3bd1c927b065bcfb9a2530baaac5d142a20f8d53789a71e353718c112574888e28223a1d1ed7a51d2f78a278e50248d76483
- TLSH T10541A9488987963467823B61BF3318D7B6342A1410BA3054F6EE92E5A7DAE1C83715AD
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/Fonts/MyriadPro-Bold.otf
- SHA256 ede2a5dcff2822ef16620cfcee512927bcd91891d00a163996c7a518e8ee1160
- MD5 5468e8ae287495d52508a13cbcb7b360
- SHA1 2138bbeb2ae24b68e6cb6b02a9ce550ec3ef2936
- SHA512 ed17646e58449a1cc4677e46bb5b8b5952236747f9aaaf59af87c99cf81d2ee9569fe4677115fad8b16b322084a617d97eea63b5e6297638f7b9f71fabf0c9fd
- SSDEEP 1536:6WBAjrd79vZp3MeJymLbVQbURe1M2ml4uv8Ej84l3o6RLL9GtLnstTz2GGG2OaHm:RyN79vZp3MeJymLbVQb4+9wRWCLODOTn
- TLSH T1FF93CF5777625F64D9468E3D6E92C7203732F28C8F05C712F89C95402CE76D02BAABA7
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-BoldCond.otf
- SHA256 a5403aa26bf42ab03010a68e8ed2fa0d3a6242c3c27900a81d2a5deb07d4f24a
- MD5 a7190477777b242c90ddaaec77199e88
- SHA1 6bbac397a8f0e6d1162f0fbaa028fb83e3cc00af
- SHA512 b0824e536ec4c2e5deddb68aa37194c714cec4c87dfa94ac746c55f116cab7cea3233ad7eb421d4c993ca77b277178b24e00a9c52967e327eb8ec0f24a662839
- SSDEEP 1536:2RBTvv879vZp3MeJymLbVQbUi9NALzvkqbtDP4AMVrxYWssSJI2UcIzyE:uV879vZp3MeJymLbVQbtAfcq5r4dSWse
- TLSH T1ED93CF6677221B68D9858E3519E6C3312332F68C8F1BCB17708CC5A41CC7AE46F55BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-BoldCondIt.otf
- SHA256 c3b6570a7aa16ba4f54ea95281336e2fb0c72b702a941b039ddb8c89343299b0
- MD5 36faa0e6dece6e12164ae098d54df41a
- SHA1 808eedf5c9247c1c994c07e8852f108ef4e07352
- SHA512 c0855d3b36c96e8a3b5aad9209af0dd272adcf50cf2c1a143326488d5f7e8dd0a20dae6ff13fc3cfb44f0651947b52009750804f15f7d5496381fe6972c38fa4
- SSDEEP 3072:Qt279vZp3MeJymLbVQb/LxegY470+RURi+KNY7cktFHmsoRXn:Qtbwmxiw+KNY7cYGvn
- TLSH T11CA3CF6733611B51DA44EF3599D1D3203332F64C9F1BCA12B99EE9201D932702F6AB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-BoldIt.otf
- SHA256 2e5902b9e6068851e3d77daf121268a40fa5895694625dac7e391f2bd03b7b17
- MD5 376fe926d13f58e8dc9420b274497ee2
- SHA1 1f684d1558e4c0d65785b3da48fe1ac4ff502f6b
- SHA512 b29667c045d9951a42403b420f435d9654832858adec14ee5f2c99a85a5c9e174a9b13b577e018504bbd359103f995b1e2efeaea5f4e5a66854780d9d1dd6bc8
- SSDEEP 3072:8K079vZp3MeJymLbVQbyY7RM2tvI5Kk01eAqPAE4H7W8NhFwsQdXs:8KIY7a2+5Kk0MtPn4H7W8zFos
- TLSH T184A3CF577B132B54D8428E3A8CA2D3313336F18C5F2BC712B5DDDA205DD32A067A9769
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-Cond.otf
- SHA256 0cd6ccf8dc3a20cdb19ef82008629c3028a9e21d5f6ebc172d10061831cf9608
- MD5 1a13f3ef9fc62c5414aa864f5445d381
- SHA1 48ccff470e2a7f2a2ec7d8c943ef615ed48cd2e7
- SHA512 4af2808064bccca41b8b82a03820cdf5097703e5c0a7e7c40f23dcf875bcc0002a8c021b949e7eb1138ad1eba85ae8957b97d043e418dec96c2515ebd5da2476
- SSDEEP 1536:E7BVjQU79vZp3MeJymLbVQbUXDf8BscOXnkCi/r8kw0on81e2GaFdkRzY:Qb179vZp3MeJymLbVQb0gTAqDJF7e2G6
- TLSH T1ED93AF6B73213B40D9826F395DE1C3307332F28C8F0A865A75C8CBA46D976A07B5576A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-CondIt.otf
- SHA256 4c5d8a54b7b0ece859e193b7ce49606d6f909eb82a35de890ac609c9ebf441bb
- MD5 019f9e23df547b21d253d15985b3879d
- SHA1 448558a56e6361ae4d448d83822b2180623c49a6
- SHA512 48072f3351046f4b55302d37db46e743934f252d1b78abcfd6f0edb72f28c8dad2b1f81ac973362a586f2f38b3121235dd9018b263c1cfddaaf20d862606b0d3
- SSDEEP 3072:RX3l79vZp3MeJymLbVQbtckdZvtZO1mYDDinxX9fu:h3ejdZvtUdPQlu
- TLSH T1EAA3BF137720AB55F741AF3AACA5D3302331F24D8F4AC75276A4CA942C973B11F62B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-It.otf
- SHA256 2248391aa1d7abecf37acb3a2a1c709612d449eb9024ece3b67561caadbb241b
- MD5 2ea0eee851eb38323f1739e83510a7c4
- SHA1 a12fb1e5f84dbd028bf600a768c2b0a8511f0f91
- SHA512 8cf422dcbaac5722a3aebac25dbee9677dda3c6ea5188e1a0d31774ba0bf418524e2003c4d5f532ee36d5381b4ab1c8d1229cc4c864bb23bcfe11d9a8cd7d381
- SSDEEP 3072:S5o79vZp3MeJymLbVQbmHWMRy34tatq/e2ggR4yndXX:S54bxatq/e2ggR3NX
- TLSH T1D8A3DF6B3361AB50E5828E3B1D51E7213331F20C9F16E701B9ACD9A53DCF6F02BA4665
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-Regular.otf
- SHA256 8cab5362ebfab49d8d371eb9a98e7cd4f70e59e41ff718fa2b4741c47d2b4a41
- MD5 7ac043ce58c2e61adcf7ebac9625d31b
- SHA1 969e004de800fe16cbe8d0f14529a358ae8066de
- SHA512 deb05ce5971d45dc5a40f4d0f24115ebd7128e14d3f3815fd06b18d75c34d5db91dc8c6ea0619ca0df6d8df3768891916e482f62cd8111a16ea8f5dc9d86809e
- SSDEEP 1536:OlBqyid79vZp3MeJymLbVQbUK0oXpTiqgl/5eAnFm33TNALHCnkSJCwkX9o/bUVl:SwH79vZp3MeJymLbVQbP7pTm5eB33Tax
- TLSH T12193BE5A3B126B99DE554F398DA1E7203332F54D4F17C20AF4AC89889CD77E43F046AA
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-Semibold.otf
- SHA256 ab8b12b88da1f5ed8507fc44f75996703a17a18dcd5701644ba9852f41f56158
- MD5 b9b1984ce047f493aa952d0094ec49d5
- SHA1 b403a86e95e0b5925ccd2d34d4bcbe3fb9017482
- SHA512 b23613ce61c16b94a02ad46a4caab57745ce07e6864c9d7593103fd711dd05f22c12f700b529d5ad0d099ec3b9ca8c7ae38b2c6803be6583e809a3064a5a5294
- SSDEEP 1536:UTmBovs179vZp3MeJymLbVQbUydGTyG+Dp91h5eagP9CJFIKT+Yll5cONvEPB1S/:VCE79vZp3MeJymLbVQb5DG+Dnn4/dKjP
- TLSH T15693BE53B7226B65DAA59E360DE1D7303331F28C8F1EC715B6C896141CCB7E02B8A75A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/MyriadPro-SemiboldIt.otf
- SHA256 b272ebee10336910d06f7d741350d67a177ff27c098a8466e720acd53aa6e0b0
- MD5 673c90442aa991fae7945dfece22b450
- SHA1 4535622413244277b1ac332d3fcaff958c12e996
- SHA512 6df76ec0eef3eace21bbb0ace5d3a2b58d3e3f931c4e0ade10ffc0deceaa5aa35a99e4d354802d7ec0cf6d66eac661273e4bf540a35f8154db38cf8eebf23940
- SSDEEP 3072:WGB79vZp3MeJymLbVQbw6l2tW8+s2zBs88jXfLY:WGwfs2u8i8
- TLSH T100A3C046BB51E758DAC18E319EE5C3207330F24C5F66C71675DD8A806DC33A06BA971E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/Oxygen-Bold.ttf
- SHA256 d5cacbff467896df614bcc479db114997f26febe7844d11f0e8dbf8ac8079bc2
- MD5 cb22d418b93310fe79ea10552fed6995
- SHA1 7fc4a1c8bc74506181ce2095416336e459aacb32
- SHA512 20e8f86bf9fa2733a48710f7a4ab950dd0ac574185c8244a5f13c5f08d2f95c8213df1a2ff02f784b108229462449a3a0f4f2789b04476471705be2443f8bdf4
- SSDEEP 768:sj/Mkh6Oyw1wQTlmiXYz9MYGKWb8Im2qI9SPNXD4Z9nLn92mTf:mPh6O11rJJ0mYpWg+qI9SlXDUbxD
- TLSH T1D3233952F7855646E1221D7CDAA6A2CE9659F8302A33CB07708CFF6C8C462D14B663DF
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/Oxygen-Light.ttf
- SHA256 e02498e2926ce4b46e22ade1e55699afdedc9c39ca655296a511207e0e4d2604
- MD5 703fea81b1d774e3bce8d17dbe013e7f
- SHA1 75852fb55e25f255c3e146f2e13c25b36c0800be
- SHA512 a9691df4df54ebf3832b03135c617edc2a8b30447fe0c16b5d1b43964b231cd3344bf682e465d50487c96c3b16be19857f29b1db0bc24245b0e6f29818608a1d
- SSDEEP 768:rjkDwFsgrhlbvaNUJRf1LSFtgwGmKIj1N36v1nl2db259ZOzgf5:UDahx3AFtgwGmKiX3yl959ZIgB
- TLSH T122133A0AB3549705E52A1D3E8665A7CE569AF8322B32CF07718DFE6C0C462D48A137DF
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Fonts/Oxygen-Regular.ttf
- SHA256 2a2c8870782c8508290f145fc09f85c011120175af5c6c63f0d660602254acb4
- MD5 6ec330b4917001db3f6c80c23ac12817
- SHA1 07b6892d6da15cea77801ed906786f441c31cbac
- SHA512 3b8c76923d303da7b828d3ba62a538db96e64bddf5391079ead0ebf62904ba7a3d286cf11bacd24d8665ea5d5495c1d6db3c8b2f806e9f87ac841ebfd5cbb4d5
- SSDEEP 768:Qi3Y+EBDQ9NygldoFRN+uXq7HoAJAET85/icQMC+tWlelL/k64eIDj5yoUvYCOo8:SfgldoAu67IovT85/icQMDt0elz4eIDj
- TLSH T14D234B0B7B409606EA391D3D5676AA8E62D4F4341937CB4BB19CFF2D58420E88A173DF
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/chi-tw/Dictionary.rar
- SHA256 4e7584e386d790b2723676962caad21e3930d2e4188dc40e16b9018dc3b01b8e
- MD5 4f622c8ad6f8822ae8f1cbd9012a59b0
- SHA1 f510bcc25f382bc15fe1e6d081f3566114589512
- SHA512 45c03e09717ed16e433beb7f0516700470fad53d10d1371e0c8c3c9ccbe1f1066e27f3913d2562967d8fc2701f132d66f9300000757896bd4631e6ef77a35cb7
- SSDEEP 1536:rHOZ6lAw1IONftoJKPuVJIIIfkPDPZxfltG6bsNM0cR:rgYAENBtoJ3VJIHfsPZpFoNr0
- TLSH T1C6330248AC7B3B97AF5A65E5A0B00381F03D74C4F229630C506170F3A7329572B6E1BB
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/chi/Dictionary.rar
- SHA256 239c9ff518e1a161736fcf8d679cd2c41f8070afe02bfa63d06127f1c4de71b5
- MD5 4448e3c3b147bdd1417f57aa2771da62
- SHA1 7accdf3d1fbedec8129622c35ce7ec84c3a2727c
- SHA512 0e4ba133e45f35765d74cfc12b701db3076a071479ea1120db390454b44258f37918235773b63773b936bcfd28fcff0683e7b9259570ee3af995f5f91f637c81
- SSDEEP 1536:P0hhoOGaPxeRlUBohfnXvb9QdHbOf1BB17ok:ElM2Bmvb9Qd2vv
- TLSH T1E7330235058EE78443E286D7D6A27F52DB73668D68CD5280F80236AF887160B3157E3F
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/eng/Dictionary.rar
- SHA256 69c02527eb682583982955b574964bb28c2ee9c526179feae5eeadce6c2e83ae
- MD5 cd5987c5d8d7e55cc4a9295a46074001
- SHA1 fc1ac5b8d3cd474e6ba2e1f895dabc7225c67a59
- SHA512 04f6948f9770f9cd624c948de28c2a52f30a5e4527222849f736f0fb612ed19d16a4ff9bfd588d23e226777c7b472f80b33a41fd3d75a3f45fa8c712be32f71f
- SSDEEP 1536:pkhaqlDV4Tw7qCw6giJUss7KHMbSPE/PS3a2Z:ehfDV4TS/ydFXca2Z
- TLSH T14E3302C21B493C74BE691AE8DA4BEC2EB7E504444A4ACE5B15E15C0DBBC188CC73CED8
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/fin/Dictionary.rar
- SHA256 bccad338cfd5e2e52e2273cbe5512b9cec94ffb7135a7169aa583d32e28fa335
- MD5 96e1dd73025a3bda8eafdde08a8dc88b
- SHA1 b854e0c52be74ffab59b360afa24cbd53bb28ff1
- SHA512 f718b8e829e3f9c71a1b8c7b8eb9d2d5e6295b11f49866f60edb84135c6cb7c6a7a9bc9af0ae4a46608167c2771644fb7d9f1e5ad36b5ba11d17cf657fa78a3b
- SSDEEP 1536:dcuil9VUW6FkWZsm7v0SBxDzYSdvcwyhH+c19YJtfR2w:3ilrUWajsbS/DzzUvYc19YXR2w
- TLSH T1D243028285D159CD52E0A220D9612CA2DBD1BC8F6EFF2555FC7BFB875493059A087238
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/fre/Dictionary.rar
- SHA256 71c121e12ae8bc8ff5469c0f8482aa3c832516fffcee6f3f4a02dd8314b9eae7
- MD5 a4836f1127f9ff4386b049d089d004d3
- SHA1 6a5a00cee2435c6bc3cd5d7de167c5f97212a6a1
- SHA512 d49f0b041b6df723b570caf31b89f0208fc7fb232fe9bf7ec6b2700b19ac12fc2610b99b7f4af690465c89aeafc4e136bb6a87af040533f4c625fd33686cc13e
- SSDEEP 1536:94B/nHRIVHO9TpPkQ8EhzjbPVIDv8CIm4I:9CnHReu9FPkQ8crdI1Iy
- TLSH T1943302FDA51D86B12F93BD0BBF18A72175BB200769EB54F406B36681610C6D3B6CD10B
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/ger/Dictionary.rar
- SHA256 336d62c910c7459aaea71281a8d907087a855c6507182a902e9b8678eb879bf2
- MD5 c7ad0c2b5a532dda50826c6c2986dde6
- SHA1 5f9e36587a6c0d8520d774899e32c79370705f6a
- SHA512 c241ba3ba5bfd420acdda2773c8ea0e8d614854cad652135a5fac06eb5d1a7d5fe71ac3437e3063ebe38c8ae1f3d9871a3615b29a02d76a7ee334fdc9066924c
- SSDEEP 1536:pl+56bSdcHlXPa378hdGWGgffvxFIThpbDxKEL:pl+5ISCFXPwoqWGKhF6NKO
- TLSH T1F4430110DA200479B365F453ABEFAE14CCC52D032065B68A6E8DBD69A0FE173327DF44
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/hun/Dictionary.rar
- SHA256 198df4d0cccbdf5af48111f7871c916e1f0d5d4340daa7f32df937a87dcd4fbf
- MD5 7890913aa6d66107866b0ad3efc87011
- SHA1 3b4d7db964bebca03272b8dac38766a0c5316148
- SHA512 228e25ba3d44c351456190e666b2f63098264fa67eb54a604077f4230cfe70c2fb114d9ef815ae3312fd41a48fbea5435573d9dcbe39abd699350a7524280f1e
- SSDEEP 1536:BEYsA+5tWqAT1yyopnzDvfcqrVeX7j4dRCYW55:rNEVAT10zD86Vm4dxWv
- TLSH T15143024DB213112437BFAA319513CB3702F7DF22B1CA54A402769DCCE5FB1299E99478
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/ita/Dictionary.rar
- SHA256 240bfe53ed1792bf9226b563d0b1ad89818d0655868c03c2e9619b392620bcc4
- MD5 2f451752e94480c57a86d493afcc6047
- SHA1 fe6a669f3b5c9f47359980075e50912a0fccc805
- SHA512 96e8891a654635355643b7f89bd773dae8d802532e2cc35decd7f6afb206bb1ca8c263b7457412cb0b9faa47eb19d564b22b3ac19e8ec9087e7f1623bfb15aad
- SSDEEP 1536:i80Ym5FEN2JRi9ZblZ/AHtXyorgQkuuhCml:JoC9ZbbqX1r+hCml
- TLSH T1703302E68B9023EB11EBB3AD753F6EB5D1DC894AF4429390145A80679FC3C4131EAA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/jpn/Dictionary.rar
- SHA256 29f1985331031121366285e33c84b08a4580c2e68f19b20e15b35fc4f59c5479
- MD5 d6963f3be2c8ba851dfbb48b7412cd23
- SHA1 cd3e52f8fb148268909cf074089e2c831965716f
- SHA512 04f20c445502a49faff0a8bf8924bdea83d6eb74c01531fe1ca84238752a19b53e137fb296a986d7f7b9de5eb199f7067dd4498a5e5c86d5b3e7e5e446ad0a6f
- SSDEEP 1536:YVOFJhI45WgNbByXOicvClJVW32v5zl8E+:YOtvAgNljDEV82v5zo
- TLSH T104430279093D4C8B7349624BF4633E593E2402BFA4A1207DC93CD466B98E8A6F4D591C
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/pol/Dictionary.rar
- SHA256 18f8a8c729cde91882a19bed6473b7709df6ec6e7ff3af0d8fdc3699f45d9c1a
- MD5 ec60d1c4bce4d377c9e22f4e09f3444b
- SHA1 de849d579d2cb56388f9fc4aab892de11499bd2a
- SHA512 6dc160695a43306259eff0414c262642d84c19de2a83931e746c0c0a1ed84c4609e9dbe437fb845aaa9ca8b5ec97369ac53ec06339dfbc7169b27c16698a5819
- SSDEEP 768:8osDIlPNbPdpi2OIeHX5FWtH8thqe15/SA3U0qQH32q5YBN7OIBCwolkx5tjlQSf:8oWOpFpcTAciei0qQmHvBCwoK5tiSf
- TLSH T1EE4302C97336721859D97C31890AD6BAC6C92DE76BF63530A6BBA801173C5C753B403D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/por/Dictionary.rar
- SHA256 9ff4167d410d52308643adbbb8cd333e782953a66da8e728e5403e3a76f23f94
- MD5 4be813fde65015c8f60505aa136b669c
- SHA1 5123c72f2965ec8551a4b9a0209445fca2cba883
- SHA512 0d49a2b5e356083fe2f7bb6d0b7aaaa9ec124141465639558b45f908efdc95002975be46d334f667e2d8d6f80af90933142308b4ce3105fbce3da1d245bd8482
- SSDEEP 1536:LNed0yVYzEaeZlRN9HsA2UP9oNxbHPjizPtAe:LA7uAaePxJPONxbvjizth
- TLSH T12F33022718100C3BBC5A83858A72BC8AA733F96E44542574D3AA24B53773ADED84F5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/rus/Dictionary.rar
- SHA256 3b84dbd99f7c040de8afdae75e45b83ea0ffbfe2725c5d5ab2645099fcb57c58
- MD5 5c2b4ee5732b356cf688aa6d2e8f1c83
- SHA1 95f6fccfdff64dd8c6e7d89cd9ad656c8e8c4764
- SHA512 0d469e74010471cd96e8acb703cf4d7fb648cfae46aeae2b2864ee5885910b033fcc80837eb07474f727093fde38c8f7d47a9bb28d0a62c225946c116024331a
- SSDEEP 1536:wU4iTX15zHSvX23hMcOIG+ytOJjnqsXifaj6TnTywTnB11z4P:xLFpHwg7OIROMj2TywTnB2
- TLSH T1B84302416FD71CAEB2247E2D13F25516BFC7843BDDE4ADA2A7DA38042224545D03D3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/spa/Diccionario.pnd
- SHA256 cfcd2504f2293dc2b69713f10e9307ca95fbc6fd2034e63d7f844384e2dbc073
- MD5 faec95daa612bbcc286a7612b2b24623
- SHA1 535f550f24f08780c0780b84a550bfa52d995be9
- SHA512 52207ffcb2707cb3d65071ea695bf840c85c302fadc1999fa09230e6c590b761cb8597815a33c0a21cfbe1049949acfb40ef5421384ef44cc0e0ed41799a876c
- SSDEEP 1536:TLaZIgFcY5566M+8+b6jE1W34ufNOmXu0:TLaZIgFcT6M+zg
- TLSH T1A923009366E39BA6B28AB21D6D838073543676019007FCD77EE743B630DE964C92D8D3
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/spa/Dictionary.rar
- SHA256 75c3fc37d3f39e4b14fc83353181a9f79cffa2d05770560cd2a04b8d13631bff
- MD5 998bbdc318b440992949578253379b83
- SHA1 715c432d72984aa64956c96d0d286ec0c301d403
- SHA512 34675d4626fbc7eed9a2154b52c48928799d01514dd8fc89ee8dc1b0e8ac41e9fbcc3eb2393bc40ab8108e040b52bcc078fc5a4d0a9ee8c3ae19f74cd75b8a3d
- SSDEEP 768:IqCqS9s1gNVKvCP2YKv+HPpNKFFlXvBD4F8Ud6YhmgskhlxIbNBetufB+r3:hdANVnK2ql94DwYMgssUSt2B+L
- TLSH T1BA03F15CEB77BC58125E4C384039A610D3DDDEA2CA9FD16518325E3F2EED0D50CDAA24
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/spa/PSUNDict.pnd
- SHA256 e1e0a394f7cb8983a9f71a1ab7e2c8f813d22d05c3b5fdb5aa0abf48bc9a5870
- MD5 59bea1939078b12a9a84e55c734b8b74
- SHA1 bae18b1a3d6bcf256ef787b0388ff5756e79f97e
- SHA512 5524af67cbd2aea68625b8701b8dea12038ad1c3612696aa3c320feb0e26a0b6d314f5a47fee06f95fa88466cf76b8d0b5f627ec8ca58a8ec5aec28be1f2bdf0
- SSDEEP 1536:nLaZ6gFcNXqsgU5xjeuFB4aP+n2je69kDvuY+8+McKudav61W34ufNOmXufC2:nLaZ6gFcru6LY+zD
- TLSH T10D041D4766C66BE3B18AB20D6E42C577907475412107DCD37BEB83BA31AE988CD1ADC3
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/Lang/swe/Dictionary.rar
- SHA256 2939aecd6be63272a7f1cc77085aea1d2fe37de2218bfa8e7a91995234a04f4a
- MD5 e270f335bf597b8dee40ecd4cf0c951d
- SHA1 b25b79e7ac8cbcbcacb2dcf38f30db8684de179a
- SHA512 b62e0215418d74e1679ee069e6aeb3d08ffe4643d1d943225edea55f4aebee4ebb2e49215c64564cb78862e661db5f05ba526e8445fa4598f3b31e94f81d89cc
- SSDEEP 1536:u4uY4RSA2LP+Fz/yXYhGOdoOV8uWO46+oWQs/:DTA2UOHoVNioWj
- TLSH T10E330248F6FF94A7B8ACC13C54A356A721C8659D1B5A13F94BDF0FC1648963ACB80D28
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/WAWorks/Diagnostic.ini
- SHA256 b91cf65204aa5c41f34c2f3bb7a9e218653b2eed5c7ad84a59a6529850736b33
- MD5 0d72fa96ae7ac807da1f47cd4c2012df
- SHA1 868ffd88edc3aa4f6dbe1a2c001ccf05aeb95a4c
- SHA512 e1ae650c1026c2be1423643a14662db5b96f9046632a492cffef0b25af0d47f4c8babf65671f45e724911a238effb7ed982538485e397761403ca5c7baadd3a9
- TLSH T165719CA1E286054BD0E3A9E95D3BFDA208E1B1D3BBCC40597BE98C0D0D75CB5A50A35F
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/WAWorks/Policies.ini
- SHA256 aa76a0a821c642d066852b63854f7ab7fe2f6aed92e97a98905dc03f958817be
- MD5 ad34444b90770631e1b1c2d4d187679b
- SHA1 51343d8f52bcad417a31df23d19c45694c0be227
- SHA512 c802515c57b4c99f8594d9e23fa2ee08902b8ee63c05edb7ee0e01ccb799f85e5105b62852cb0612a6fdc528fe6d50e9e112daf455c2ef6db3ed0c343c44dd67
- TLSH T18C31E9A36184327BF88EF3CBE86178E679AABF19910775491B1DB6C0274C539031F4B4
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/WAWorks/RptMng.ini
- SHA256 535e18027600ef56934d9e4debb04177f518471a31e8c3a2ae340805f980100e
- MD5 0906fcc0c6d44fe641876541628cc55d
- SHA1 6b43290b0b66bc080cf33fd0214e076c5a2860f6
- SHA512 41b91a804ebf9fcca0a8484a296c530d44e5f2a3ad62c366e215db39806b4149707d0f60a4535537e8d18c2d4466b90ab2b6314b15ac50c97d94106aae2b2d5d
- TLSH T101E0A3126FEB7E9708243D41B02C1F236CC4655F28575EF795C420404DAD1A51B1D057
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/alert.wav
- SHA256 0bc8316444298a865c06bd54881d25ba2ee54930f0a15b92a38fc6bfe206ecdf
- MD5 31dc3771e6b630121086d050ba0ee48e
- SHA1 42676bab69c677c0e5b1f0473fd5b6830a039a21
- SHA512 c00f3c479be927732899f2241e0840749d2b361e38e3e301451b23c96981af4fdff438699dc89713dded0989e84a9e516eb16fcb2fa4a72ad93fc7e693566e64
- SSDEEP 384:mpC+Hcs7nHxgI2fzhdyzDekaposUkqr/PfOlqkumun00D9:GjcsHSd/mRapZfOHOumJo9
- TLSH T1B672BF26E81FF6AE387A00018CB15163E887BAF0AD0AF86750328C41B855F665F5AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/alert2.wav
- SHA256 6e4691136095119b52a9b5d821e4306a6ab333acdc38a9d26bbd2de40699fecb
- MD5 5c1c648fed57ce120bdea574200e5ada
- SHA1 a8b91b41a3a1bddbe78c2bbddd59f90623b074e7
- SHA512 fdd63901da649e8730f1e04d4f40e4ba360f0d5dea2ad6ae6d8aa52c52827f5a33434705dc54da29eb46e1d03b88d166d2fbcdfa0d6a72efa7d15e5c00214245
- SSDEEP 3:A5f1DxEol1tNNhfxbdZlBXpltJJV3dHNjtP1xFB5Zlrrt15rnp3bVnLrb7HfBrXh:ATplLte2lF
- TLSH T17C9286CE88C5969F884D0618ED7CEB5DCA0991D63264B40A53329FA348F24EBB537397
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/connect.wav
- SHA256 bab56092b2e2931f6cf440ca5aedcacc86c86e33abca100e5bb4361d33939624
- MD5 4684880c4469518420c40e06a62c5b85
- SHA1 d5e0a25017c65945140bc617b05d93547198a7bd
- SHA512 090acc97c3fc4e0c65e9c4b2af0bad2b6f26ec3d04b94964fb1c40d07e8d7bda75e521ceb00dd56e551fcfb4964ecfe1d7c9887b4c97554ae3a9c49dfd1ac2be
- SSDEEP 192:/7TKohZT1nuEo5YjiI5+pPAwuI/1KKzXIRQ70QRuyZIq:/72y9tnP5ZBI/ImYRQ70QRu+Iq
- TLSH T1D95234A7909279892A4BC7E9FF1F8A1CB04AFDE1CC9867C96558ED4700B5530C4FAD07
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/disconnect.wav
- SHA256 fc0ca6bee9e0c10432cefd87c673cc8dc1cf9ef520a275ce7c7b11fee45cb0e6
- MD5 a9aaefa64aeed2be1742e5b1c4c4b4bc
- SHA1 3b373edbe84fce3c6db51f4b2518ca40a3b773e2
- SHA512 e9161491ad89e24863f481e6d1c03252d4691de577e32d4f14629412e40cf90f4a73248ecf6f0406bab379925926a2da129ed2cfb4df98545194b679fba0fbb6
- SSDEEP 192:WUvgrCu73CXC6qeMexuWXm2GkH6j1YFc9KqQhSk:TgrCuutLu26Q1FiLG
- TLSH T1EDF1D8A34581B1562146C3FCFF5F86AEA10EBC64CECD97EA92668CF7C8906309576D02
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/email.wav
- SHA256 ee23c6900afd5b36c9dea79cc3f1e085350dcce5c60b04f6d5213a5bdf9cc27d
- MD5 1728ba34dad2d8df5b47970d59333aaf
- SHA1 51f5258d372666972aa3f656c57ff0714c8d291c
- SHA512 836b2385087a73827bef5bfc7b2d09c96374cf1aeac3912714a11178242b08904e15565da6d8bc9095803b31cff07f7cb85e12dd72623a892f0e24e6c1d5d70f
- SSDEEP 768:zRj3Zhtjdb1E/yuWbTPA+gONb3rVgNj/3hAfZ6kL0SyDrzw:zRj3Zhtjdb1E/yrbDAgNb3rONj/mfZ6i
- TLSH T1F7C27CE6B9A22841280B87B9FF3E86B9B747C4D49FAD872A4409DE520076035C5F7E53
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/expert.wav
- SHA256 eb079562389036cf5c21773ed4bf17e6cef3320ee2080615fb8173c639ed90aa
- MD5 7c21a62cdb76c242afa2baa82af776ae
- SHA1 b21d3401467b44fbf56106653edd3cbd7e9b6783
- SHA512 0ab8ce8526183df692359992fa8eea6839bc26e8831519827a7ae93a49fa8239bdfa251668aba6e76ee71a8356cc60f601944b1645236463284330c7337d2bc0
- TLSH T1F851A523C6D13E9924228BB5EF2E549CB30EB9A44EDCAB99011EEDA304B5039C59F701
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/iFilters/msvcp90.dll
- IMPHASH 2dec2d42421b088bfcddeba53b046464
- SHA256 91fd46d7335c9990a20f215b9f6f53bc59551420a9c99ad8110ae2f9ff7598f0
- MD5 871f979d70414c900b35e56222932daf
- SHA1 dd683e4ad54cab6ba1c7b3ce9c0925db0e1d0e66
- SHA512 87e1e585a8a5ffc1bbe87d58e4d8de2831d1589526143ca0cf7fb919b4842c81e50b656cb6a44975d707753063171801cb538d6755a573f8a91cc8be996f7fc0
- SSDEEP 12288:d0/veMyZ137mSEWT0VkypLvNLehUgiW6QR7t5183Ooc8SHkC2eM8Oa:d0SZ13iwJmNLq83Ooc8SHkC2eb
- TLSH T176C4C4233B474AF5E4C273F422C9132297B9BC950720B3D392DBE2A55F993C95673A90
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
42:16:d7:12:ad:45:e9:ed:7f:3e:46:a2:db:df:4f:7c:57:4d:4c:e5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 29, 2008
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0f:78:4d:00:00:00:00:00:03
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 23, 2007 - Feb 23, 2009
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:47:52:ba:00:00:00:00:00:04
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Minor OS version
0
Major OS version
5
Entry point
237015
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcp90.i386.pdb
msvcr90
_Getmonths
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
log
abort
fputc
fputs
__iob_func
rand_s
fgetc
ungetc
fflush
setvbuf
fwrite
fgetpos
fseek
fsetpos
fclose
_wfsopen
mbstowcs_s
atan2
cos
exp
ldexp
pow
sin
sqrt
tan
fgetwc
fputwc
ungetwc
memcpy
_Strftime
strcspn
sprintf_s
_realloc_crt
setlocale
_malloc_crt
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_Getdays
towlower
towupper
strcmp
_create_locale
_ui64toa_s
_free_locale
__pctype_func
_errno
___mb_cur_max_l_func
___lc_codepage_func
___lc_handle_func
__crtCompareStringA
___lc_collate_cp_func
__crtLCMapStringA
isupper
_calloc_crt
islower
__crtGetStringTypeW
__crtLCMapStringW
__crtCompareStringW
isspace
tolower
strtod
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
___mb_cur_max_func
??_V@YAXPAX@Z
_Gettnames
localeconv
free
??0exception@std@@QAE@ABQBDH@Z
__CxxFrameHandler3
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??0exception@std@@QAE@XZ
memset
memchr
strlen
memcmp
wcslen
memmove_s
memcpy_s
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__uncaught_exception
??0exception@std@@QAE@ABQBD@Z
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??$?5DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?5GU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAG@Z
??$?5GU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
??$?5GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?5MDU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5MGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5M_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5NDU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5NGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5N_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5ODU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5OGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5O_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAC@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAE@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAC@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??$?5_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AA_W@Z
??$?5_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@PA_W@Z
??$?5_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?6GU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@G@Z
??$?6GU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
??$?6GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?6MDU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6MGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6M_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6NDU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6NGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6N_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6ODU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6OGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6O_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@C@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@E@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBC@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBE@Z
??$?6_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@PB_W@Z
??$?6_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@_W@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?8M@std@@YA_NABMABV?$complex@M@0@@Z
??$?8M@std@@YA_NABV?$complex@M@0@0@Z
??$?8M@std@@YA_NABV?$complex@M@0@ABM@Z
??$?8N@std@@YA_NABNABV?$complex@N@0@@Z
??$?8N@std@@YA_NABV?$complex@N@0@0@Z
??$?8N@std@@YA_NABV?$complex@N@0@ABN@Z
??$?8O@std@@YA_NABOABV?$complex@O@0@@Z
??$?8O@std@@YA_NABV?$complex@O@0@0@Z
??$?8O@std@@YA_NABV?$complex@O@0@ABO@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?9M@std@@YA_NABMABV?$complex@M@0@@Z
??$?9M@std@@YA_NABV?$complex@M@0@0@Z
??$?9M@std@@YA_NABV?$complex@M@0@ABM@Z
??$?9N@std@@YA_NABNABV?$complex@N@0@@Z
??$?9N@std@@YA_NABV?$complex@N@0@0@Z
??$?9N@std@@YA_NABV?$complex@N@0@ABN@Z
??$?9O@std@@YA_NABOABV?$complex@O@0@@Z
??$?9O@std@@YA_NABV?$complex@O@0@0@Z
??$?9O@std@@YA_NABV?$complex@O@0@ABO@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?DM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?DM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?DM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?DN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?DN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?DN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?DO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?DO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?DO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?GM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?GN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?GO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?HN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?HO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@_WABV10@@Z
??$?KM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?KM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?KM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?KN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?KN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?KN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?KO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?KO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?KO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$_Fabs@M@std@@YAMABV?$complex@M@0@PAH@Z
??$_Fabs@N@std@@YANABV?$complex@N@0@PAH@Z
??$_Fabs@O@std@@YAOABV?$complex@O@0@PAH@Z
??$abs@M@std@@YAMABV?$complex@M@0@@Z
??$abs@N@std@@YANABV?$complex@N@0@@Z
??$abs@O@std@@YAOABV?$complex@O@0@@Z
??$arg@M@std@@YAMABV?$complex@M@0@@Z
??$arg@N@std@@YANABV?$complex@N@0@@Z
??$arg@O@std@@YAOABV?$complex@O@0@@Z
??$conj@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$conj@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$conj@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$cos@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$cos@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$cos@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$cosh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$cosh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$cosh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$exp@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$exp@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$exp@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
??$getline@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$getline@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@G@Z
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@_W@Z
??$imag@M@std@@YAMABV?$complex@M@0@@Z
??$imag@N@std@@YANABV?$complex@N@0@@Z
??$imag@O@std@@YAOABV?$complex@O@0@@Z
??$log10@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$log10@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$log10@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$log@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$log@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$log@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$norm@M@std@@YAMABV?$complex@M@0@@Z
??$norm@N@std@@YANABV?$complex@N@0@@Z
??$norm@O@std@@YAOABV?$complex@O@0@@Z
??$polar@M@std@@YA?AV?$complex@M@0@ABM0@Z
??$polar@M@std@@YA?AV?$complex@M@0@ABM@Z
??$polar@N@std@@YA?AV?$complex@N@0@ABN0@Z
??$polar@N@std@@YA?AV?$complex@N@0@ABN@Z
??$polar@O@std@@YA?AV?$complex@O@0@ABO0@Z
??$polar@O@std@@YA?AV?$complex@O@0@ABO@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@H@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@H@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@H@Z
??$real@M@std@@YAMABV?$complex@M@0@@Z
??$real@N@std@@YANABV?$complex@N@0@@Z
??$real@O@std@@YAOABV?$complex@O@0@@Z
??$sin@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sin@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sin@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$sinh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sinh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sinh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$sqrt@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sqrt@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sqrt@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$tan@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$tan@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$tan@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$tanh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$tanh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$tanh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??0?$_Complex_base@MU_C_float_complex@@@std@@QAE@ABM0@Z
??0?$_Complex_base@NU_C_double_complex@@@std@@QAE@ABN0@Z
??0?$_Complex_base@OU_C_ldouble_complex@@@std@@QAE@ABO0@Z
??0?$_Mpunct@D@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@D@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@D@std@@QAE@I_N@Z
??0?$_Mpunct@G@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@G@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@G@std@@QAE@I_N@Z
??0?$_Mpunct@_W@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@_W@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@_W@std@@QAE@I_N@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@QAE@ABV01@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@IAE@V?$allocator@G@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@QAE@ABV01@@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@QAE@ABV01@@Z
??0?$allocator@D@std@@QAE@ABV01@@Z
??0?$allocator@D@std@@QAE@XZ
??0?$allocator@G@std@@QAE@ABV01@@Z
??0?$allocator@G@std@@QAE@XZ
??0?$allocator@X@std@@QAE@ABV01@@Z
??0?$allocator@X@std@@QAE@XZ
??0?$allocator@_W@std@@QAE@ABV01@@Z
??0?$allocator@_W@std@@QAE@XZ
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@1@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@1@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@IIABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_WABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WIABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$codecvt@DDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@DDH@std@@QAE@I@Z
??0?$codecvt@GDH@std@@IAE@PBDI@Z
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@GDH@std@@QAE@I@Z
??0?$codecvt@_WDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
??0?$collate@D@std@@IAE@PBDI@Z
??0?$collate@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@D@std@@QAE@I@Z
??0?$collate@G@std@@IAE@PBDI@Z
??0?$collate@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@G@std@@QAE@I@Z
??0?$collate@_W@std@@IAE@PBDI@Z
??0?$collate@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@_W@std@@QAE@I@Z
??0?$complex@M@std@@QAE@ABM0@Z
??0?$complex@M@std@@QAE@ABU_C_double_complex@@@Z
??0?$complex@M@std@@QAE@ABU_C_float_complex@@@Z
??0?$complex@M@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@M@std@@QAE@ABV?$complex@N@1@@Z
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@N@std@@QAE@ABN0@Z
??0?$complex@N@std@@QAE@ABU_C_double_complex@@@Z
??0?$complex@N@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@N@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@N@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@O@std@@QAE@ABO0@Z
??0?$complex@O@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@O@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@O@std@@QAE@ABV?$complex@N@1@@Z
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@D@std@@QAE@PBF_NI@Z
??0?$ctype@G@std@@IAE@PBDI@Z
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@G@std@@QAE@I@Z
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@_W@std@@QAE@I@Z
??0?$messages@D@std@@IAE@PBDI@Z
??0?$messages@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@D@std@@QAE@I@Z
??0?$messages@G@std@@IAE@PBDI@Z
??0?$messages@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@G@std@@QAE@I@Z
??0?$messages@_W@std@@IAE@PBDI@Z
??0?$messages@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@_W@std@@QAE@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$moneypunct@D$00@std@@IAE@PBDI@Z
??0?$moneypunct@D$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@D$00@std@@QAE@I@Z
??0?$moneypunct@D$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@D$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@D$0A@@std@@QAE@I@Z
??0?$moneypunct@G$00@std@@IAE@PBDI@Z
??0?$moneypunct@G$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@G$00@std@@QAE@I@Z
??0?$moneypunct@G$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@G$0A@@std@@QAE@I@Z
??0?$moneypunct@_W$00@std@@IAE@PBDI@Z
??0?$moneypunct@_W$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@_W$00@std@@QAE@I@Z
??0?$moneypunct@_W$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@_W$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@_W$0A@@std@@QAE@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$numpunct@D@std@@IAE@PBDI_N@Z
??0?$numpunct@D@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$numpunct@D@std@@QAE@I@Z
??0?$numpunct@G@std@@IAE@PBDI_N@Z
??0?$numpunct@G@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$numpunct@G@std@@QAE@I@Z
??0?$numpunct@_W@std@@IAE@PBDI_N@Z
??0?$numpunct@_W@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$numpunct@_W@std@@QAE@I@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAE@PBDI@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0Init@ios_base@std@@QAE@XZ
??0_Init_locks@std@@QAE@XZ
??0_Locimp@locale@std@@AAE@ABV012@@Z
??0_Locimp@locale@std@@AAE@_N@Z
??0_Locinfo@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0_Locinfo@std@@QAE@HPBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
??0_Lockit@std@@QAE@XZ
??0_Mutex@std@@QAE@XZ
??0_Timevec@std@@QAE@ABV01@@Z
??0_Timevec@std@@QAE@PAX@Z
??0_UShinit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0codecvt_base@std@@QAE@I@Z
??0ctype_base@std@@QAE@I@Z
??0facet@locale@std@@IAE@I@Z
??0id@locale@std@@QAE@I@Z
??0ios_base@std@@IAE@XZ
??0ios_base@std@@QAE@ABV01@@Z
??0locale@std@@AAE@PAV_Locimp@01@@Z
??0locale@std@@QAE@ABV01@0H@Z
??0locale@std@@QAE@ABV01@@Z
??0locale@std@@QAE@ABV01@PBDH@Z
??0locale@std@@QAE@PBDH@Z
??0locale@std@@QAE@W4_Uninitialized@1@@Z
??0locale@std@@QAE@XZ
??0messages_base@std@@QAE@I@Z
??0money_base@std@@QAE@I@Z
??0strstreambuf@std@@QAE@H@Z
??0strstreambuf@std@@QAE@P6APAXI@ZP6AXPAX@Z@Z
??0strstreambuf@std@@QAE@PACH0@Z
??0strstreambuf@std@@QAE@PADH0@Z
??0strstreambuf@std@@QAE@PAEH0@Z
??0strstreambuf@std@@QAE@PBCH@Z
??0strstreambuf@std@@QAE@PBDH@Z
??0strstreambuf@std@@QAE@PBEH@Z
??0time_base@std@@QAE@I@Z
??1?$_Mpunct@D@std@@MAE@XZ
??1?$_Mpunct@G@std@@MAE@XZ
??1?$_Mpunct@_W@std@@MAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_fstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_fstream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ifstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ifstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@UAE@XZ
??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ofstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@UAE@XZ
??1?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@UAE@XZ
??1?$codecvt@DDH@std@@MAE@XZ
??1?$codecvt@GDH@std@@MAE@XZ
??1?$codecvt@_WDH@std@@MAE@XZ
??1?$collate@D@std@@MAE@XZ
??1?$collate@G@std@@MAE@XZ
??1?$collate@_W@std@@MAE@XZ
??1?$ctype@D@std@@MAE@XZ
??1?$ctype@G@std@@MAE@XZ
??1?$ctype@_W@std@@MAE@XZ
??1?$messages@D@std@@MAE@XZ
??1?$messages@G@std@@MAE@XZ
??1?$messages@_W@std@@MAE@XZ
??1?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1?$moneypunct@D$00@std@@MAE@XZ
??1?$moneypunct@D$0A@@std@@MAE@XZ
??1?$moneypunct@G$00@std@@MAE@XZ
??1?$moneypunct@G$0A@@std@@MAE@XZ
??1?$moneypunct@_W$00@std@@MAE@XZ
??1?$moneypunct@_W$0A@@std@@MAE@XZ
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1?$numpunct@D@std@@MAE@XZ
??1?$numpunct@G@std@@MAE@XZ
??1?$numpunct@_W@std@@MAE@XZ
??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ
??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Init_locks@std@@QAE@XZ
??1_Locimp@locale@std@@MAE@XZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Mutex@std@@QAE@XZ
??1_Timevec@std@@QAE@XZ
??1_UShinit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1codecvt_base@std@@UAE@XZ
??1ctype_base@std@@UAE@XZ
??1facet@locale@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??1locale@std@@QAE@XZ
??1messages_base@std@@UAE@XZ
??1money_base@std@@UAE@XZ
??1strstreambuf@std@@UAE@XZ
??1time_base@std@@UAE@XZ
??4?$_Allocator_base@D@std@@QAEAAU01@ABU01@@Z
??4?$_Allocator_base@G@std@@QAEAAU01@ABU01@@Z
??4?$_Allocator_base@_W@std@@QAEAAU01@ABU01@@Z
??4?$_Complex_base@MU_C_float_complex@@@std@@QAEAAV01@ABV01@@Z
??4?$_Complex_base@NU_C_double_complex@@@std@@QAEAAV01@ABV01@@Z
??4?$_Complex_base@OU_C_ldouble_complex@@@std@@QAEAAV01@ABV01@@Z
??4?$_Ctraits@M@std@@QAEAAV01@ABV01@@Z
??4?$_Ctraits@N@std@@QAEAAV01@ABV01@@Z
??4?$_Ctraits@O@std@@QAEAAV01@ABV01@@Z
??4?$_Iosb@H@std@@QAEAAV01@ABV01@@Z
??4?$_Locbase@H@std@@QAEAAV01@ABV01@@Z
??4?$_String_val@DV?$allocator@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$_String_val@GV?$allocator@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$_String_val@_WV?$allocator@_W@std@@@std@@QAEAAV01@ABV01@@Z
??4?$allocator@D@std@@QAEAAV01@ABV01@@Z
??4?$allocator@G@std@@QAEAAV01@ABV01@@Z
??4?$allocator@X@std@@QAEAAV01@ABV01@@Z
??4?$allocator@_W@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??4?$char_traits@D@std@@QAEAAU01@ABU01@@Z
??4?$char_traits@G@std@@QAEAAU01@ABU01@@Z
??4?$char_traits@_W@std@@QAEAAU01@ABU01@@Z
??4?$complex@M@std@@QAEAAV01@ABM@Z
??4?$complex@M@std@@QAEAAV01@ABV01@@Z
??4?$complex@N@std@@QAEAAV01@ABN@Z
??4?$complex@N@std@@QAEAAV01@ABV01@@Z
??4?$complex@O@std@@QAEAAV01@ABO@Z
??4?$complex@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@C@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@D@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@F@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@G@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@H@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@I@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@J@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@K@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@N@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_J@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_K@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_W@std@@QAEAAV01@ABV01@@Z
??4Init@ios_base@std@@QAEAAV012@ABV012@@Z
??4_Container_base_secure@std@@QAEAAV01@ABV01@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
??4_Num_base@std@@QAEAAU01@ABU01@@Z
??4_Num_float_base@std@@QAEAAU01@ABU01@@Z
??4_Num_int_base@std@@QAEAAU01@ABU01@@Z
??4_String_base@std@@QAEAAV01@ABV01@@Z
??4_Timevec@std@@QAEAAV01@ABV01@@Z
??4_UShinit@std@@QAEAAV01@ABV01@@Z
??4_Winit@std@@QAEAAV01@ABV01@@Z
??4ios_base@std@@QAEAAV01@ABV01@@Z
??4locale@std@@QAEAAV01@ABV01@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAO@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAPAX@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??7ios_base@std@@QBE_NXZ
??8locale@std@@QBE_NABV01@@Z
??9locale@std@@QBE_NABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADU_Size_type_nosscl@01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDU_Size_type_nosscl@01@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGU_Size_type_nosscl@01@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGU_Size_type_nosscl@01@@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WU_Size_type_nosscl@01@@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WU_Size_type_nosscl@01@@Z
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBEPAXXZ
??X?$complex@M@std@@QAEAAV01@ABM@Z
??X?$complex@M@std@@QAEAAV01@ABV01@@Z
??X?$complex@N@std@@QAEAAV01@ABN@Z
??X?$complex@N@std@@QAEAAV01@ABV01@@Z
??X?$complex@O@std@@QAEAAV01@ABO@Z
??X?$complex@O@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$complex@M@std@@QAEAAV01@ABM@Z
??Y?$complex@M@std@@QAEAAV01@ABV01@@Z
??Y?$complex@N@std@@QAEAAV01@ABN@Z
??Y?$complex@N@std@@QAEAAV01@ABV01@@Z
??Y?$complex@O@std@@QAEAAV01@ABO@Z
??Y?$complex@O@std@@QAEAAV01@ABV01@@Z
??Z?$complex@M@std@@QAEAAV01@ABM@Z
??Z?$complex@M@std@@QAEAAV01@ABV01@@Z
??Z?$complex@N@std@@QAEAAV01@ABN@Z
??Z?$complex@N@std@@QAEAAV01@ABV01@@Z
??Z?$complex@O@std@@QAEAAV01@ABO@Z
??Z?$complex@O@std@@QAEAAV01@ABV01@@Z
??_0?$complex@M@std@@QAEAAV01@ABM@Z
??_0?$complex@M@std@@QAEAAV01@ABV01@@Z
??_0?$complex@N@std@@QAEAAV01@ABN@Z
??_0?$complex@N@std@@QAEAAV01@ABV01@@Z
??_0?$complex@O@std@@QAEAAV01@ABO@Z
??_0?$complex@O@std@@QAEAAV01@ABV01@@Z
??_7?$_Mpunct@D@std@@6B@
??_7?$_Mpunct@G@std@@6B@
??_7?$_Mpunct@_W@std@@6B@
??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_filebuf@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_fstream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_fstream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_fstream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ifstream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_7?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@6B@
??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ofstream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_7?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@6B@
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@
??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_7?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@6B@
??_7?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_7?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@6B@
??_7?$codecvt@DDH@std@@6B@
??_7?$codecvt@GDH@std@@6B@
??_7?$codecvt@_WDH@std@@6B@
??_7?$collate@D@std@@6B@
??_7?$collate@G@std@@6B@
??_7?$collate@_W@std@@6B@
??_7?$ctype@D@std@@6B@
??_7?$ctype@G@std@@6B@
??_7?$ctype@_W@std@@6B@
??_7?$messages@D@std@@6B@
??_7?$messages@G@std@@6B@
??_7?$messages@_W@std@@6B@
??_7?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$moneypunct@D$00@std@@6B@
??_7?$moneypunct@D$0A@@std@@6B@
??_7?$moneypunct@G$00@std@@6B@
??_7?$moneypunct@G$0A@@std@@6B@
??_7?$moneypunct@_W$00@std@@6B@
??_7?$moneypunct@_W$0A@@std@@6B@
??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$numpunct@D@std@@6B@
??_7?$numpunct@G@std@@6B@
??_7?$numpunct@_W@std@@6B@
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@
??_7_Locimp@locale@std@@6B@
??_7codecvt_base@std@@6B@
??_7ctype_base@std@@6B@
??_7ios_base@std@@6B@
??_7messages_base@std@@6B@
??_7money_base@std@@6B@
??_7strstreambuf@std@@6B@
??_7time_base@std@@6B@
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_fstream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??_8?$basic_fstream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??_8?$basic_fstream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_fstream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_ifstream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@7B@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@
??_8?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??_8?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B@
??_8?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@7B@
??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_ofstream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@7B@
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@
??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@
??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??_8?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B@
??_8?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@7B@
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??_8?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??_8?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@
??_8?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_D?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_F?$_String_val@DV?$allocator@D@std@@@std@@QAEXXZ
??_F?$_String_val@GV?$allocator@G@std@@@std@@QAEXXZ
??_F?$_String_val@_WV?$allocator@_W@std@@@std@@QAEXXZ
??_F?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??_F?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEXXZ
??_F?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_F?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_F?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_F?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_F?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_F?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_F?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_F?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_F?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_F?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_F?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_F?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??_F?$codecvt@DDH@std@@QAEXXZ
??_F?$codecvt@GDH@std@@QAEXXZ
??_F?$codecvt@_WDH@std@@QAEXXZ
??_F?$collate@D@std@@QAEXXZ
??_F?$collate@G@std@@QAEXXZ
??_F?$collate@_W@std@@QAEXXZ
??_F?$complex@M@std@@QAEXXZ
??_F?$complex@N@std@@QAEXXZ
??_F?$complex@O@std@@QAEXXZ
??_F?$ctype@D@std@@QAEXXZ
??_F?$ctype@G@std@@QAEXXZ
??_F?$ctype@_W@std@@QAEXXZ
??_F?$messages@D@std@@QAEXXZ
??_F?$messages@G@std@@QAEXXZ
??_F?$messages@_W@std@@QAEXXZ
??_F?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F?$moneypunct@D$00@std@@QAEXXZ
??_F?$moneypunct@D$0A@@std@@QAEXXZ
??_F?$moneypunct@G$00@std@@QAEXXZ
??_F?$moneypunct@G$0A@@std@@QAEXXZ
??_F?$moneypunct@_W$00@std@@QAEXXZ
??_F?$moneypunct@_W$0A@@std@@QAEXXZ
??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F?$numpunct@D@std@@QAEXXZ
??_F?$numpunct@G@std@@QAEXXZ
??_F?$numpunct@_W@std@@QAEXXZ
??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ
??_F_Locimp@locale@std@@QAEXXZ
??_F_Locinfo@std@@QAEXXZ
??_F_Timevec@std@@QAEXXZ
??_Fcodecvt_base@std@@QAEXXZ
??_Fctype_base@std@@QAEXXZ
??_Ffacet@locale@std@@QAEXXZ
??_Fid@locale@std@@QAEXXZ
??_Fmessages_base@std@@QAEXXZ
??_Fmoney_base@std@@QAEXXZ
??_Fstrstreambuf@std@@QAEXXZ
??_Ftime_base@std@@QAEXXZ
?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Addfac@locale@std@@QAEAAV12@PAVfacet@12@II@Z
?_Addstd@ios_base@std@@SAXPAV12@@Z
?_Atexit@@YAXP6AXXZ@Z
?_BADOFF@std@@3JB
?_BADOFF_func@std@@YAABJXZ
?_Callfns@ios_base@std@@AAEXW4event@12@@Z
?_Cerr_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Chassign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXIID@Z
?_Chassign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXIIG@Z
?_Chassign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEXII_W@Z
?_Cin_func@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@XZ
?_Cl@?5???$log@N@std@@YA?AV?$complex@N@1@ABV21@@Z@4NB
?_Clocptr@_Locimp@locale@std@@0PAV123@A
?_Clocptr_func@_Locimp@locale@std@@CAAAPAV123@XZ
?_Clog_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXII@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXII@Z
?_Copy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEXII@Z
?_Copy_s@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPADIII@Z
?_Copy_s@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGIII@Z
?_Copy_s@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPA_WIII@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?_Copy_s@?$char_traits@G@std@@SAPAGPAGIPBGI@Z
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?_Cosh@?$_Ctraits@M@std@@SAMMM@Z
?_Cosh@?$_Ctraits@N@std@@SANNN@Z
?_Cosh@?$_Ctraits@O@std@@SAOOO@Z
?_Cout_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Debug_message@std@@YAXPBD0@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Do_narrow_s@?$ctype@D@std@@MBEPBDPBD0DPADI@Z
?_Do_narrow_s@?$ctype@G@std@@MBEPBGPBG0DPADI@Z
?_Do_narrow_s@?$ctype@_W@std@@MBEPB_WPB_W0DPADI@Z
?_Do_widen_s@?$ctype@D@std@@MBEPBDPBD0PADI@Z
?_Do_widen_s@?$ctype@G@std@@MBEPBDPBD0PAGI@Z
?_Do_widen_s@?$ctype@_W@std@@MBEPBDPBD0PA_WI@Z
?_Donarrow@?$ctype@G@std@@IBEDGD@Z
?_Donarrow@?$ctype@_W@std@@IBED_WD@Z
?_Dowiden@?$ctype@G@std@@IBEGD@Z
?_Dowiden@?$ctype@_W@std@@IBE_WD@Z
?_Endwrite@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAE_NXZ
?_Endwrite@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAE_NXZ
?_Endwrite@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@IAE_NXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXI@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXI@Z
?_Eos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEXI@Z
?_Exp@?$_Ctraits@M@std@@SAFPAMMF@Z
?_Exp@?$_Ctraits@N@std@@SAFPANNF@Z
?_Exp@?$_Ctraits@O@std@@SAFPAOOF@Z
?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADDH@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADDH@Z
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z
?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDIIII@Z
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDIIII@Z
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDIIII@Z
?_Fpz@std@@3_JA
?_Fpz_func@std@@YAAA_JXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$collate@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$collate@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$collate@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$messages@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$messages@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$messages@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@D$00@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@D$0A@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@G$00@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@G$0A@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@_W$00@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$moneypunct@_W$0A@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$numpunct@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$numpunct@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getdateorder@_Locinfo@std@@QBEHXZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1ABVlocale@2@@Z
?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1ABVlocale@2@@Z
?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1ABVlocale@2@@Z
?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z
?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z
?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z
?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z
?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAH@Z
?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAAH@Z
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAH@Z
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getmfld@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@AAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0_NAAVios_base@2@@Z
?_Getmfld@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@AAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0_NAAVios_base@2@@Z
?_Getmfld@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@AAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0_NAAVios_base@2@@Z
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getname@_Locinfo@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Getptr@_Timevec@std@@QBEPAXXZ
?_Getstate@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEHH@Z
?_Getstate@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEHH@Z
?_Getstate@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAEHH@Z
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEHXZ
?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEHXZ
?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEHXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAE_NI_N@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAE_NI_N@Z
?_Grow@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAE_NI_N@Z
?_Hexdig@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABEHDDDD@Z
?_Hexdig@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABEHGGGG@Z
?_Hexdig@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABEH_W000@Z
?_Id_cnt@id@locale@std@@0HA
?_Id_cnt_func@id@locale@std@@CAAAHXZ
?_Id_func@?$codecvt@GDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$codecvt@_WDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@D@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@G@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@_W@std@@SAAAVid@locale@2@XZ
?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADPBDH@Z
?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADPBDH@Z
?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Index@ios_base@std@@0HA
?_Index_func@ios_base@std@@CAAAHXZ
?_Infv@?$_Ctraits@M@std@@SAMM@Z
?_Infv@?$_Ctraits@N@std@@SANN@Z
?_Infv@?$_Ctraits@O@std@@SAOO@Z
?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$_Mpunct@G@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
?_Init@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
?_Init@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAPAG0PAH001@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPAPA_W0PAH001@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z
?_Init@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXPBGIH@Z
?_Init@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEXPB_WIH@Z
?_Init@?$codecvt@DDH@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$codecvt@GDH@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$codecvt@_WDH@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$collate@D@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$collate@G@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$collate@_W@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$ctype@_W@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$messages@D@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$messages@G@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$messages@_W@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$numpunct@G@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z
?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?_Init@ios_base@std@@IAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Init@strstreambuf@std@@IAEXHPAD0H@Z
?_Init_cnt@Init@ios_base@std@@0HA
?_Init_cnt@_UShinit@std@@0HA
?_Init_cnt@_Winit@std@@0HA
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z
?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAV?$codecvt@DDH@2@@Z
?_Initcvt@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAEXPAV?$codecvt@GDH@2@@Z
?_Initcvt@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$codecvt@_WDH@2@@Z
?_Inside@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAE_NPBD@Z
?_Inside@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAE_NPBG@Z
?_Inside@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAE_NPB_W@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z
?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z
?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z
?_Isinf@?$_Ctraits@M@std@@SA_NM@Z
?_Isinf@?$_Ctraits@N@std@@SA_NN@Z
?_Isinf@?$_Ctraits@O@std@@SA_NO@Z
?_Isnan@?$_Ctraits@M@std@@SA_NM@Z
?_Isnan@?$_Ctraits@N@std@@SA_NN@Z
?_Isnan@?$_Ctraits@O@std@@SA_NO@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_MP_Add@tr1@std@@YAXQA_K_K@Z
?_MP_Get@tr1@std@@YA_KQA_K@Z
?_MP_Mul@tr1@std@@YAXQA_K_K1@Z
?_MP_Rem@tr1@std@@YAXQA_K_K@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makpat@?$_Mpunct@D@std@@AAEXAAUpattern@money_base@2@III@Z
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@III@Z
?_Makpat@?$_Mpunct@_W@std@@AAEXAAUpattern@money_base@2@III@Z
?_Move_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?_Move_s@?$char_traits@G@std@@SAPAGPAGIPBGI@Z
?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?_Mutex_Lock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_Unlock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_ctor@_Mutex@std@@CAXPAV12@@Z
?_Mutex_dtor@_Mutex@std@@CAXPAV12@@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ
?_Myptr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEPAGXZ
?_Myptr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IBEPBGXZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IBEPB_WXZ
?_Nanv@?$_Ctraits@M@std@@SAMM@Z
?_Nanv@?$_Ctraits@N@std@@SANN@Z
?_Nanv@?$_Ctraits@O@std@@SAOO@Z
?_Narrow_s@?$ctype@D@std@@QBEPBDPBD0DPADI@Z
?_Narrow_s@?$ctype@G@std@@QBEPBGPBG0DPADI@Z
?_Narrow_s@?$ctype@_W@std@@QBEPB_WPB_W0DPADI@Z
?_Nomemory@std@@YAXXZ
?_Oneplusroot2low@?CA@???$_Fabs@N@std@@YANABV?$complex@N@1@PAH@Z@4NB
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Pdif@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KAIV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?_Pdif@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@KAIV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0@Z
?_Pdif@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KAIV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEHXZ
?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEHXZ
?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Ptr_cerr@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Ptr_cin@std@@3PAV?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Ptr_clog@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Ptr_cout@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Ptr_wcerr@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A
?_Ptr_wcerr@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Ptr_wcin@std@@3PAV?$basic_istream@GU?$char_traits@G@std@@@1@A
?_Ptr_wcin@std@@3PAV?$basic_istream@_WU?$char_traits@_W@std@@@1@A
?_Ptr_wclog@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A
?_Ptr_wclog@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A
?_Ptr_wcout@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Put@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@I@Z
?_Put@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@I@Z
?_Put@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@I@Z
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z
?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBGI@Z
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z
?_Putc@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z
?_Putc@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBDI@Z
?_Putc@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PBDI@Z
?_Putgrouped@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDID@Z
?_Putgrouped@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBDIG@Z
?_Putgrouped@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PBDI_W@Z
?_Putmfld@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@_NAAVios_base@2@D1V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?_Putmfld@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@_NAAVios_base@2@G1V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?_Putmfld@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_NAAVios_base@2@_W1V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Random_device@tr1@std@@YAIXZ
?_Read_s@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADIH@Z
?_Read_s@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGIH@Z
?_Read_s@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WIH@Z
?_Readsome_s@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHPADIH@Z
?_Readsome_s@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHPAGIH@Z
?_Readsome_s@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHPA_WIH@Z
?_Rep@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z
?_Rep@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z
?_Rep@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@CA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z
?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z
?_Rng_abort@tr1@std@@YAXPBD@Z
?_Root2@?CA@???$_Fabs@N@std@@YANABV?$complex@N@1@PAH@Z@4NB
?_Setgloballocale@locale@std@@CAXPAX@Z
?_Sgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADIH@Z
?_Sgetn_s@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHPAGIH@Z
?_Sgetn_s@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPA_WIH@Z
?_Sinh@?$_Ctraits@M@std@@SAMMM@Z
?_Sinh@?$_Ctraits@N@std@@SANNN@Z
?_Sinh@?$_Ctraits@O@std@@SAOOO@Z
?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
?_Stinit@?1??_Init@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
?_Stinit@?1??_Init@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
?_Sync@ios_base@std@@0_NA
?_Sync_func@ios_base@std@@CAAA_NXZ
?_Throw@std@@YAXABVexception@stdext@@@Z
?_Tidy@?$_Mpunct@D@std@@AAEXXZ
?_Tidy@?$_Mpunct@G@std@@AAEXXZ
?_Tidy@?$_Mpunct@_W@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEX_NI@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
?_Tidy@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXXZ
?_Tidy@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXXZ
?_Tidy@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEXXZ
?_Tidy@?$ctype@D@std@@IAEXXZ
?_Tidy@?$numpunct@D@std@@AAEXXZ
?_Tidy@?$numpunct@G@std@@AAEXXZ
?_Tidy@?$numpunct@_W@std@@AAEXXZ
?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AAEXXZ
?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AAEXXZ
?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AAEXXZ
?_Tidy@ios_base@std@@AAAXXZ
?_Tidy@strstreambuf@std@@IAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Widen_s@?$ctype@D@std@@QBEPBDPBD0PADI@Z
?_Widen_s@?$ctype@G@std@@QBEPBDPBD0PAGI@Z
?_Widen_s@?$ctype@_W@std@@QBEPBDPBD0PA_WI@Z
?_XLgamma@tr1@std@@YAMM@Z
?_XLgamma@tr1@std@@YANN@Z
?_XLgamma@tr1@std@@YAOO@Z
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?_Xfsopen@std@@YAPAU_iobuf@@PB_W0H@Z
?_Xfunc@tr1@std@@YAXXZ
?_Xinvalid@tr1@std@@YAXPBD@Z
?_Xinvarg@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Xmem@tr1@std@@YAXXZ
?_Xoutrange@tr1@std@@YAXXZ
?_Xran@_String_base@std@@SAXXZ
?_Xran@ctype_base@std@@KAXXZ
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?_Xsgetn_s@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHPAGIH@Z
?_Xsgetn_s@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WIH@Z
?_Xweak@tr1@std@@YAXXZ
?address@?$allocator@D@std@@QBEPADAAD@Z
?address@?$allocator@D@std@@QBEPBDABD@Z
?address@?$allocator@G@std@@QBEPAGAAG@Z
?address@?$allocator@G@std@@QBEPBGABG@Z
?address@?$allocator@_W@std@@QBEPA_WAA_W@Z
?address@?$allocator@_W@std@@QBEPB_WAB_W@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?allocate@?$allocator@D@std@@QAEPADIPBX@Z
?allocate@?$allocator@G@std@@QAEPAGI@Z
?allocate@?$allocator@G@std@@QAEPAGIPBX@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WIPBX@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG0@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?assign@?$char_traits@D@std@@SAPADPADID@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?assign@?$char_traits@G@std@@SAPAGPAGIG@Z
?assign@?$char_traits@G@std@@SAXAAGABG@Z
?assign@?$char_traits@_W@std@@SAPA_WPA_WI_W@Z
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?atan2@?$_Ctraits@M@std@@SAMMM@Z
?atan2@?$_Ctraits@N@std@@SANNN@Z
?atan2@?$_Ctraits@O@std@@SAOOO@Z
?bad@ios_base@std@@QBE_NXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?capacity@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?capacity@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?classic@locale@std@@SAABV12@XZ
?classic_table@?$ctype@D@std@@KAPBFXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?clear@ios_base@std@@QAEXH@Z
?clear@ios_base@std@@QAEXH_N@Z
?clear@ios_base@std@@QAEXI@Z
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ
?close@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@XZ
?close@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@XZ
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?close@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?close@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?close@?$messages@D@std@@QBEXH@Z
?close@?$messages@G@std@@QBEXH@Z
?close@?$messages@_W@std@@QBEXH@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@II@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@II@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBGI@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIABV12@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIABV12@II@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIPB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIPB_WI@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?compare@?$char_traits@G@std@@SAHPBG0I@Z
?compare@?$char_traits@_W@std@@SAHPB_W0I@Z
?compare@?$collate@D@std@@QBEHPBD000@Z
?compare@?$collate@G@std@@QBEHPBG000@Z
?compare@?$collate@_W@std@@QBEHPB_W000@Z
?construct@?$allocator@D@std@@QAEXPADABD@Z
?construct@?$allocator@G@std@@QAEXPAGABG@Z
?construct@?$allocator@_W@std@@QAEXPA_WAB_W@Z
?copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPADII@Z
?copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGII@Z
?copy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPA_WII@Z
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?copy@?$char_traits@_W@std@@SAPA_WPA_WPB_WI@Z
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV12@ABV12@@Z
?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEAAV12@ABV12@@Z
?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z
?cos@?$_Ctraits@M@std@@SAMM@Z
?cos@?$_Ctraits@N@std@@SANN@Z
?cos@?$_Ctraits@O@std@@SAOO@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?curr_symbol@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?curr_symbol@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?curr_symbol@?$_Mpunct@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ
?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ
?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?deallocate@?$allocator@G@std@@QAEXPAGI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?decimal_point@?$_Mpunct@D@std@@QBEDXZ
?decimal_point@?$_Mpunct@G@std@@QBEGXZ
?decimal_point@?$_Mpunct@_W@std@@QBE_WXZ
?decimal_point@?$numpunct@D@std@@QBEDXZ
?decimal_point@?$numpunct@G@std@@QBEGXZ
?decimal_point@?$numpunct@_W@std@@QBE_WXZ
?denorm_min@?$numeric_limits@C@std@@SACXZ
?denorm_min@?$numeric_limits@D@std@@SADXZ
?denorm_min@?$numeric_limits@E@std@@SAEXZ
?denorm_min@?$numeric_limits@F@std@@SAFXZ
?denorm_min@?$numeric_limits@G@std@@SAGXZ
?denorm_min@?$numeric_limits@H@std@@SAHXZ
?denorm_min@?$numeric_limits@I@std@@SAIXZ
?denorm_min@?$numeric_limits@J@std@@SAJXZ
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?denorm_min@?$numeric_limits@M@std@@SAMXZ
?denorm_min@?$numeric_limits@N@std@@SANXZ
?denorm_min@?$numeric_limits@O@std@@SAOXZ
?denorm_min@?$numeric_limits@_J@std@@SA_JXZ
?denorm_min@?$numeric_limits@_K@std@@SA_KXZ
?denorm_min@?$numeric_limits@_N@std@@SA_NXZ
?denorm_min@?$numeric_limits@_W@std@@SA_WXZ
?destroy@?$allocator@D@std@@QAEXPAD@Z
?destroy@?$allocator@G@std@@QAEXPAG@Z
?destroy@?$allocator@_W@std@@QAEXPA_W@Z
?digits10@?$numeric_limits@C@std@@2HB
?digits10@?$numeric_limits@D@std@@2HB
?digits10@?$numeric_limits@E@std@@2HB
?digits10@?$numeric_limits@F@std@@2HB
?digits10@?$numeric_limits@G@std@@2HB
?digits10@?$numeric_limits@H@std@@2HB
?digits10@?$numeric_limits@I@std@@2HB
?digits10@?$numeric_limits@J@std@@2HB
?digits10@?$numeric_limits@K@std@@2HB
?digits10@?$numeric_limits@M@std@@2HB
?digits10@?$numeric_limits@N@std@@2HB
?digits10@?$numeric_limits@O@std@@2HB
?digits10@?$numeric_limits@_J@std@@2HB
?digits10@?$numeric_limits@_K@std@@2HB
?digits10@?$numeric_limits@_N@std@@2HB
?digits10@?$numeric_limits@_W@std@@2HB
?digits10@_Num_base@std@@2HB
?digits@?$numeric_limits@C@std@@2HB
?digits@?$numeric_limits@D@std@@2HB
?digits@?$numeric_limits@E@std@@2HB
?digits@?$numeric_limits@F@std@@2HB
?digits@?$numeric_limits@G@std@@2HB
?digits@?$numeric_limits@H@std@@2HB
?digits@?$numeric_limits@I@std@@2HB
?digits@?$numeric_limits@J@std@@2HB
?digits@?$numeric_limits@K@std@@2HB
?digits@?$numeric_limits@M@std@@2HB
?digits@?$numeric_limits@N@std@@2HB
?digits@?$numeric_limits@O@std@@2HB
?digits@?$numeric_limits@_J@std@@2HB
?digits@?$numeric_limits@_K@std@@2HB
?digits@?$numeric_limits@_N@std@@2HB
?digits@?$numeric_limits@_W@std@@2HB
?digits@_Num_base@std@@2HB
?do_always_noconv@?$codecvt@GDH@std@@MBE_NXZ
?do_always_noconv@?$codecvt@_WDH@std@@MBE_NXZ
?do_always_noconv@codecvt_base@std@@MBE_NXZ
?do_close@?$messages@D@std@@MBEXH@Z
?do_close@?$messages@G@std@@MBEXH@Z
?do_close@?$messages@_W@std@@MBEXH@Z
?do_compare@?$collate@D@std@@MBEHPBD000@Z
?do_compare@?$collate@G@std@@MBEHPBG000@Z
?do_compare@?$collate@_W@std@@MBEHPB_W000@Z
?do_curr_symbol@?$_Mpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_curr_symbol@?$_Mpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?do_curr_symbol@?$_Mpunct@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ
?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ
?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ
?do_decimal_point@?$_Mpunct@D@std@@MBEDXZ
?do_decimal_point@?$_Mpunct@G@std@@MBEGXZ
?do_decimal_point@?$_Mpunct@_W@std@@MBE_WXZ
?do_decimal_point@?$numpunct@D@std@@MBEDXZ
?do_decimal_point@?$numpunct@G@std@@MBEGXZ
?do_decimal_point@?$numpunct@_W@std@@MBE_WXZ
?do_encoding@codecvt_base@std@@MBEHXZ
?do_falsename@?$numpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_falsename@?$numpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?do_falsename@?$numpunct@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?do_frac_digits@?$_Mpunct@D@std@@MBEHXZ
?do_frac_digits@?$_Mpunct@G@std@@MBEHXZ
?do_frac_digits@?$_Mpunct@_W@std@@MBEHXZ
?do_get@?$messages@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@HHHABV32@@Z
?do_get@?$messages@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@HHHABV32@@Z
?do_get@?$messages@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@HHHABV32@@Z
?do_get@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?do_get@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?do_get@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?do_get@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?do_get@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?do_get@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?do_grouping@?$_Mpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_grouping@?$_Mpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_grouping@?$_Mpunct@_W@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_grouping@?$numpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_grouping@?$numpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_grouping@?$numpunct@_W@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_hash@?$collate@D@std@@MBEJPBD0@Z
?do_hash@?$collate@G@std@@MBEJPBG0@Z
?do_hash@?$collate@_W@std@@MBEJPB_W0@Z
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
?do_in@?$codecvt@GDH@std@@MBEHAAHPBD1AAPBDPAG3AAPAG@Z
?do_in@?$codecvt@_WDH@std@@MBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
?do_is@?$ctype@G@std@@MBE_NFG@Z
?do_is@?$ctype@_W@std@@MBEPB_WPB_W0PAF@Z
?do_is@?$ctype@_W@std@@MBE_NF_W@Z
?do_length@?$codecvt@DDH@std@@MBEHABHPBD1I@Z
?do_length@?$codecvt@GDH@std@@MBEHABHPBD1I@Z
?do_length@?$codecvt@_WDH@std@@MBEHABHPBD1I@Z
?do_max_length@?$codecvt@GDH@std@@MBEHXZ
?do_max_length@?$codecvt@_WDH@std@@MBEHXZ
?do_max_length@codecvt_base@std@@MBEHXZ
?do_narrow@?$ctype@D@std@@MBEDDD@Z
?do_narrow@?$ctype@D@std@@MBEPBDPBD0DPAD@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z
?do_narrow@?$ctype@_W@std@@MBED_WD@Z
?do_narrow@?$ctype@_W@std@@MBEPB_WPB_W0DPAD@Z
?do_neg_format@?$_Mpunct@D@std@@MBE?AUpattern@money_base@2@XZ
?do_neg_format@?$_Mpunct@G@std@@MBE?AUpattern@money_base@2@XZ
?do_neg_format@?$_Mpunct@_W@std@@MBE?AUpattern@money_base@2@XZ
?do_negative_sign@?$_Mpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_negative_sign@?$_Mpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?do_negative_sign@?$_Mpunct@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?do_open@?$messages@D@std@@MBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?do_open@?$messages@G@std@@MBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?do_open@?$messages@_W@std@@MBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?do_out@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
?do_out@?$codecvt@GDH@std@@MBEHAAHPBG1AAPBGPAD3AAPAD@Z
?do_out@?$codecvt@_WDH@std@@MBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?do_pos_format@?$_Mpunct@D@std@@MBE?AUpattern@money_base@2@XZ
?do_pos_format@?$_Mpunct@G@std@@MBE?AUpattern@money_base@2@XZ
?do_pos_format@?$_Mpunct@_W@std@@MBE?AUpattern@money_base@2@XZ
?do_positive_sign@?$_Mpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_positive_sign@?$_Mpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?do_positive_sign@?$_Mpunct@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?do_put@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@_NAAVios_base@2@DABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?do_put@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@_NAAVios_base@2@DO@Z
?do_put@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@_NAAVios_base@2@GABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?do_put@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@_NAAVios_base@2@GO@Z
?do_put@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_NAAVios_base@2@_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?do_put@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_NAAVios_base@2@_WO@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z
?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z
?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z
?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_scan_is@?$ctype@_W@std@@MBEPB_WFPB_W0@Z
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_scan_not@?$ctype@_W@std@@MBEPB_WFPB_W0@Z
?do_thousands_sep@?$_Mpunct@D@std@@MBEDXZ
?do_thousands_sep@?$_Mpunct@G@std@@MBEGXZ
?do_thousands_sep@?$_Mpunct@_W@std@@MBE_WXZ
?do_thousands_sep@?$numpunct@D@std@@MBEDXZ
?do_thousands_sep@?$numpunct@G@std@@MBEGXZ
?do_thousands_sep@?$numpunct@_W@std@@MBE_WXZ
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_tolower@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z
?do_tolower@?$ctype@_W@std@@MBE_W_W@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_toupper@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z
?do_toupper@?$ctype@_W@std@@MBE_W_W@Z
?do_transform@?$collate@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD0@Z
?do_transform@?$collate@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@PBG0@Z
?do_transform@?$collate@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PB_W0@Z
?do_truename@?$numpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?do_truename@?$numpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?do_truename@?$numpunct@_W@std@@MBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?do_unshift@?$codecvt@DDH@std@@MBEHAAHPAD1AAPAD@Z
?do_unshift@?$codecvt@GDH@std@@MBEHAAHPAD1AAPAD@Z
?do_unshift@?$codecvt@_WDH@std@@MBEHAAHPAD1AAPAD@Z
?do_widen@?$ctype@D@std@@MBEDD@Z
?do_widen@?$ctype@D@std@@MBEPBDPBD0PAD@Z
?do_widen@?$ctype@G@std@@MBEGD@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
?do_widen@?$ctype@_W@std@@MBEPBDPBD0PA_W@Z
?do_widen@?$ctype@_W@std@@MBE_WD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?empty@locale@std@@SA?AV12@XZ
?encoding@codecvt_base@std@@QBEHXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?endl@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?ends@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
?ends@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?eof@?$char_traits@D@std@@SAHXZ
?eof@?$char_traits@G@std@@SAGXZ
?eof@?$char_traits@_W@std@@SAGXZ
?eof@ios_base@std@@QBE_NXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?epsilon@?$numeric_limits@C@std@@SACXZ
?epsilon@?$numeric_limits@D@std@@SADXZ
?epsilon@?$numeric_limits@E@std@@SAEXZ
?epsilon@?$numeric_limits@F@std@@SAFXZ
?epsilon@?$numeric_limits@G@std@@SAGXZ
?epsilon@?$numeric_limits@H@std@@SAHXZ
?epsilon@?$numeric_limits@I@std@@SAIXZ
?epsilon@?$numeric_limits@J@std@@SAJXZ
?epsilon@?$numeric_limits@K@std@@SAKXZ
?epsilon@?$numeric_limits@M@std@@SAMXZ
?epsilon@?$numeric_limits@N@std@@SANXZ
?epsilon@?$numeric_limits@O@std@@SAOXZ
?epsilon@?$numeric_limits@_J@std@@SA_JXZ
?epsilon@?$numeric_limits@_K@std@@SA_KXZ
?epsilon@?$numeric_limits@_N@std@@SA_NXZ
?epsilon@?$numeric_limits@_W@std@@SA_WXZ
?eq@?$char_traits@D@std@@SA_NABD0@Z
?eq@?$char_traits@G@std@@SA_NABG0@Z
?eq@?$char_traits@_W@std@@SA_NAB_W0@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?exceptions@ios_base@std@@QAEXH@Z
?exceptions@ios_base@std@@QAEXI@Z
?exceptions@ios_base@std@@QBEHXZ
?exp@?$_Ctraits@M@std@@SAMM@Z
?exp@?$_Ctraits@N@std@@SANN@Z
?exp@?$_Ctraits@O@std@@SAOO@Z
?fail@ios_base@std@@QBE_NXZ
?falsename@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?falsename@?$numpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?falsename@?$numpunct@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$char_traits@D@std@@SAPBDPBDIABD@Z
?find@?$char_traits@G@std@@SAPBGPBGIABG@Z
?find@?$char_traits@_W@std@@SAPB_WPB_WIAB_W@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?flags@ios_base@std@@QAEHH@Z
?flags@ios_base@std@@QBEHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?flush@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?flush@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
?flush@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?frac_digits@?$_Mpunct@D@std@@QBEHXZ
?frac_digits@?$_Mpunct@G@std@@QBEHXZ
?frac_digits@?$_Mpunct@_W@std@@QBEHXZ
?freeze@strstreambuf@std@@QAEX_N@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QBEHXZ
?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QBEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WH@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WH_W@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?get@?$messages@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@HHHABV32@@Z
?get@?$messages@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@HHHABV32@@Z
?get@?$messages@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@HHHABV32@@Z
?get@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?get@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?get@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?get@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?get@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0_NAAVios_base@2@AAHAAO@Z
?get@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0_NAAVios_base@2@AAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?get_allocator@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$allocator@D@2@XZ
?get_allocator@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$allocator@G@2@XZ
?get_allocator@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$allocator@_W@2@XZ
?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WH@Z
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WH_W@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?global@locale@std@@SA?AV12@ABV12@@Z
?good@ios_base@std@@QBE_NXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?grouping@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?grouping@?$_Mpunct@G@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?grouping@?$_Mpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?grouping@?$numpunct@G@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?has_denorm@_Num_base@std@@2W4float_denorm_style@2@B
?has_denorm@_Num_float_base@std@@2W4float_denorm_style@2@B
?has_denorm_loss@_Num_base@std@@2_NB
?has_denorm_loss@_Num_float_base@std@@2_NB
?has_infinity@_Num_base@std@@2_NB
?has_infinity@_Num_float_base@std@@2_NB
?has_quiet_NaN@_Num_base@std@@2_NB
?has_quiet_NaN@_Num_float_base@std@@2_NB
?has_signaling_NaN@_Num_base@std@@2_NB
?has_signaling_NaN@_Num_float_base@std@@2_NB
?hash@?$collate@D@std@@QBEJPBD0@Z
?hash@?$collate@G@std@@QBEJPBG0@Z
?hash@?$collate@_W@std@@QBEJPB_W0@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?id@?$codecvt@GDH@std@@2V0locale@2@A
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?id@?$collate@G@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$ctype@G@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$messages@D@std@@2V0locale@2@A
?id@?$messages@G@std@@2V0locale@2@A
?id@?$messages@_W@std@@2V0locale@2@A
?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$moneypunct@D$00@std@@2V0locale@2@A
?id@?$moneypunct@D$0A@@std@@2V0locale@2@A
?id@?$moneypunct@G$00@std@@2V0locale@2@A
?id@?$moneypunct@G$0A@@std@@2V0locale@2@A
?id@?$moneypunct@_W$00@std@@2V0locale@2@A
?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$numpunct@G@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@HH@Z
?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@HG@Z
?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@HG@Z
?imag@?$_Complex_base@MU_C_float_complex@@@std@@QAEMABM@Z
?imag@?$_Complex_base@MU_C_float_complex@@@std@@QBEMXZ
?imag@?$_Complex_base@NU_C_double_complex@@@std@@QAENABN@Z
?imag@?$_Complex_base@NU_C_double_complex@@@std@@QBENXZ
?imag@?$_Complex_base@OU_C_ldouble_complex@@@std@@QAEOABO@Z
?imag@?$_Complex_base@OU_C_ldouble_complex@@@std@@QBEOXZ
?imbue@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@GDH@std@@QBEHAAHPBD1AAPBDPAG3AAPAG@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ
?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ
?infinity@?$numeric_limits@C@std@@SACXZ
?infinity@?$numeric_limits@D@std@@SADXZ
?infinity@?$numeric_limits@E@std@@SAEXZ
?infinity@?$numeric_limits@F@std@@SAFXZ
?infinity@?$numeric_limits@G@std@@SAGXZ
?infinity@?$numeric_limits@H@std@@SAHXZ
?infinity@?$numeric_limits@I@std@@SAIXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
?infinity@?$numeric_limits@K@std@@SAKXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
?infinity@?$numeric_limits@N@std@@SANXZ
?infinity@?$numeric_limits@O@std@@SAOXZ
?infinity@?$numeric_limits@_J@std@@SA_JXZ
?infinity@?$numeric_limits@_K@std@@SA_KXZ
?infinity@?$numeric_limits@_N@std@@SA_NXZ
?infinity@?$numeric_limits@_W@std@@SA_WXZ
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z
?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@D@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@II@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@00@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD1@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@G@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@II@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIG@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@00@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@IG@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXV?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@PBG1@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IABV12@@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IABV12@II@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@00@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@I_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PB_W1@Z
?intl@?$moneypunct@D$00@std@@2_NB
?intl@?$moneypunct@D$0A@@std@@2_NB
?intl@?$moneypunct@G$00@std@@2_NB
?intl@?$moneypunct@G$0A@@std@@2_NB
?intl@?$moneypunct@_W$00@std@@2_NB
?intl@?$moneypunct@_W$0A@@std@@2_NB
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?is@?$ctype@G@std@@QBEPBGPBG0PAF@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?is@?$ctype@_W@std@@QBEPB_WPB_W0PAF@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?is_bounded@_Num_base@std@@2_NB
?is_bounded@_Num_float_base@std@@2_NB
?is_bounded@_Num_int_base@std@@2_NB
?is_exact@_Num_base@std@@2_NB
?is_exact@_Num_float_base@std@@2_NB
?is_exact@_Num_int_base@std@@2_NB
?is_iec559@_Num_base@std@@2_NB
?is_iec559@_Num_float_base@std@@2_NB
?is_integer@_Num_base@std@@2_NB
?is_integer@_Num_float_base@std@@2_NB
?is_integer@_Num_int_base@std@@2_NB
?is_modulo@?$numeric_limits@_N@std@@2_NB
?is_modulo@_Num_base@std@@2_NB
?is_modulo@_Num_float_base@std@@2_NB
?is_modulo@_Num_int_base@std@@2_NB
?is_open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QBE_NXZ
?is_open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QBE_NXZ
?is_open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QBE_NXZ
?is_open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?is_open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QBE_NXZ
?is_open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QBE_NXZ
?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?is_open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QBE_NXZ
?is_open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QBE_NXZ
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?is_open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QBE_NXZ
?is_open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QBE_NXZ
?is_signed@?$numeric_limits@C@std@@2_NB
?is_signed@?$numeric_limits@D@std@@2_NB
?is_signed@?$numeric_limits@E@std@@2_NB
?is_signed@?$numeric_limits@F@std@@2_NB
?is_signed@?$numeric_limits@G@std@@2_NB
?is_signed@?$numeric_limits@H@std@@2_NB
?is_signed@?$numeric_limits@I@std@@2_NB
?is_signed@?$numeric_limits@J@std@@2_NB
?is_signed@?$numeric_limits@K@std@@2_NB
?is_signed@?$numeric_limits@_J@std@@2_NB
?is_signed@?$numeric_limits@_K@std@@2_NB
?is_signed@?$numeric_limits@_N@std@@2_NB
?is_signed@?$numeric_limits@_W@std@@2_NB
?is_signed@_Num_base@std@@2_NB
?is_signed@_Num_float_base@std@@2_NB
?is_specialized@_Num_base@std@@2_NB
?is_specialized@_Num_float_base@std@@2_NB
?is_specialized@_Num_int_base@std@@2_NB
?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ
?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?iword@ios_base@std@@QAEAAJH@Z
?ldexp@?$_Ctraits@M@std@@SAMMH@Z
?ldexp@?$_Ctraits@N@std@@SANNH@Z
?ldexp@?$_Ctraits@O@std@@SAOOH@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?length@?$char_traits@G@std@@SAIPBG@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
?length@?$codecvt@DDH@std@@QBEHABHPBD1I@Z
?length@?$codecvt@GDH@std@@QBEHABHPBD1I@Z
?length@?$codecvt@_WDH@std@@QBEHABHPBD1I@Z
?log@?$_Ctraits@M@std@@SAMM@Z
?log@?$_Ctraits@N@std@@SANN@Z
?log@?$_Ctraits@O@std@@SAOO@Z
?lt@?$char_traits@D@std@@SA_NABD0@Z
?lt@?$char_traits@G@std@@SA_NABG0@Z
?lt@?$char_traits@_W@std@@SA_NAB_W0@Z
?max@?$numeric_limits@C@std@@SACXZ
?max@?$numeric_limits@D@std@@SADXZ
?max@?$numeric_limits@E@std@@SAEXZ
?max@?$numeric_limits@F@std@@SAFXZ
?max@?$numeric_limits@G@std@@SAGXZ
?max@?$numeric_limits@H@std@@SAHXZ
?max@?$numeric_limits@I@std@@SAIXZ
?max@?$numeric_limits@J@std@@SAJXZ
?max@?$numeric_limits@K@std@@SAKXZ
?max@?$numeric_limits@M@std@@SAMXZ
?max@?$numeric_limits@N@std@@SANXZ
?max@?$numeric_limits@O@std@@SAOXZ
?max@?$numeric_limits@_J@std@@SA_JXZ
?max@?$numeric_limits@_K@std@@SA_KXZ
?max@?$numeric_limits@_N@std@@SA_NXZ
?max@?$numeric_limits@_W@std@@SA_WXZ
?max_exponent10@?$numeric_limits@M@std@@2HB
?max_exponent10@?$numeric_limits@N@std@@2HB
?max_exponent10@?$numeric_limits@O@std@@2HB
?max_exponent10@_Num_base@std@@2HB
?max_exponent@?$numeric_limits@M@std@@2HB
?max_exponent@?$numeric_limits@N@std@@2HB
?max_exponent@?$numeric_limits@O@std@@2HB
?max_exponent@_Num_base@std@@2HB
?max_length@codecvt_base@std@@QBEHXZ
?max_size@?$allocator@D@std@@QBEIXZ
?max_size@?$allocator@G@std@@QBEIXZ
?max_size@?$allocator@_W@std@@QBEIXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?max_size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?min@?$numeric_limits@C@std@@SACXZ
?min@?$numeric_limits@D@std@@SADXZ
?min@?$numeric_limits@E@std@@SAEXZ
?min@?$numeric_limits@F@std@@SAFXZ
?min@?$numeric_limits@G@std@@SAGXZ
?min@?$numeric_limits@H@std@@SAHXZ
?min@?$numeric_limits@I@std@@SAIXZ
?min@?$numeric_limits@J@std@@SAJXZ
?min@?$numeric_limits@K@std@@SAKXZ
?min@?$numeric_limits@M@std@@SAMXZ
?min@?$numeric_limits@N@std@@SANXZ
?min@?$numeric_limits@O@std@@SAOXZ
?min@?$numeric_limits@_J@std@@SA_JXZ
?min@?$numeric_limits@_K@std@@SA_KXZ
?min@?$numeric_limits@_N@std@@SA_NXZ
?min@?$numeric_limits@_W@std@@SA_WXZ
?min_exponent10@?$numeric_limits@M@std@@2HB
?min_exponent10@?$numeric_limits@N@std@@2HB
?min_exponent10@?$numeric_limits@O@std@@2HB
?min_exponent10@_Num_base@std@@2HB
?min_exponent@?$numeric_limits@M@std@@2HB
?min_exponent@?$numeric_limits@N@std@@2HB
?min_exponent@?$numeric_limits@O@std@@2HB
?min_exponent@_Num_base@std@@2HB
?move@?$char_traits@D@std@@SAPADPADPBDI@Z
?move@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?move@?$char_traits@_W@std@@SAPA_WPA_WPB_WI@Z
?name@locale@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEDGD@Z
?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBED_WD@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z
?narrow@?$ctype@G@std@@QBEDGD@Z
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?narrow@?$ctype@_W@std@@QBED_WD@Z
?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z
?neg_format@?$_Mpunct@D@std@@QBE?AUpattern@money_base@2@XZ
?neg_format@?$_Mpunct@G@std@@QBE?AUpattern@money_base@2@XZ
?neg_format@?$_Mpunct@_W@std@@QBE?AUpattern@money_base@2@XZ
?negative_sign@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?negative_sign@?$_Mpunct@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?not_eof@?$char_traits@D@std@@SAHABH@Z
?not_eof@?$char_traits@G@std@@SAGABG@Z
?not_eof@?$char_traits@_W@std@@SAGABG@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDHH@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDI@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBGHH@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBGI@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PB_WHH@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PB_WI@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PBDHH@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PBDI@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PBGHH@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PBGI@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PB_WHH@Z
?open@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PB_WI@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PBDHH@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PBDI@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PBGHH@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PBGI@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PB_WHH@Z
?open@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PB_WI@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDI@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBGHH@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBGI@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPB_WI@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPBDHH@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPBDI@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPBGHH@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPBGI@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPB_WI@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDI@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGHH@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGI@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDI@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBGI@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDI@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBGI@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDI@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGI@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDI@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBGI@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDI@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBGI@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPB_WI@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDI@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGHH@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPBGI@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WI@Z
?open@?$messages@D@std@@QBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?open@?$messages@G@std@@QBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?open@?$messages@_W@std@@QBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ABVlocale@2@@Z
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ
?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ
?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE_NXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@GDH@std@@QBEHAAHPBG1AAPBGPAD3AAPAD@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?overflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?overflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?overflow@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?overflow@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z
?overflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
?overflow@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MAEGG@Z
?overflow@strstreambuf@std@@MAEHH@Z
?pbackfail@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?pbackfail@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?pbackfail@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z
?pbackfail@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
?pbackfail@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MAEGG@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pcount@strstreambuf@std@@QBEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?pos_format@?$_Mpunct@D@std@@QBE?AUpattern@money_base@2@XZ
?pos_format@?$_Mpunct@G@std@@QBE?AUpattern@money_base@2@XZ
?pos_format@?$_Mpunct@_W@std@@QBE?AUpattern@money_base@2@XZ
?positive_sign@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?positive_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?positive_sign@?$_Mpunct@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?pow@?$_Ctraits@M@std@@SAMMM@Z
?pow@?$_Ctraits@N@std@@SANNN@Z
?pow@?$_Ctraits@O@std@@SAOOO@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?precision@ios_base@std@@QAEHH@Z
?precision@ios_base@std@@QBEHXZ
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@JHH@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@JII@Z
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@JHH@Z
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@JII@Z
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@JHH@Z
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@JII@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@V32@I@Z
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@I@Z
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@V32@I@Z
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PADH@Z
?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAGH@Z
?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PA_WH@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ
?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?push_back@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXG@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?put@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@_NAAVios_base@2@DABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?put@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@_NAAVios_base@2@DO@Z
?put@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@_NAAVios_base@2@GABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?put@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@_NAAVios_base@2@GO@Z
?put@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_NAAVios_base@2@_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?put@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_NAAVios_base@2@_WO@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@PBG3@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?pword@ios_base@std@@QAEAAPAXH@Z
?quiet_NaN@?$numeric_limits@C@std@@SACXZ
?quiet_NaN@?$numeric_limits@D@std@@SADXZ
?quiet_NaN@?$numeric_limits@E@std@@SAEXZ
?quiet_NaN@?$numeric_limits@F@std@@SAFXZ
?quiet_NaN@?$numeric_limits@G@std@@SAGXZ
?quiet_NaN@?$numeric_limits@H@std@@SAHXZ
?quiet_NaN@?$numeric_limits@I@std@@SAIXZ
?quiet_NaN@?$numeric_limits@J@std@@SAJXZ
?quiet_NaN@?$numeric_limits@K@std@@SAKXZ
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?quiet_NaN@?$numeric_limits@O@std@@SAOXZ
?quiet_NaN@?$numeric_limits@_J@std@@SA_JXZ
?quiet_NaN@?$numeric_limits@_K@std@@SA_KXZ
?quiet_NaN@?$numeric_limits@_N@std@@SA_NXZ
?quiet_NaN@?$numeric_limits@_W@std@@SA_WXZ
?radix@_Num_base@std@@2HB
?radix@_Num_float_base@std@@2HB
?radix@_Num_int_base@std@@2HB
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rbegin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@XZ
?rbegin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@XZ
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rdbuf@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_filebuf@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_fstream@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_filebuf@GU?$char_traits@G@std@@@2@XZ
?rdbuf@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_filebuf@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_filebuf@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_filebuf@GU?$char_traits@G@std@@@2@XZ
?rdbuf@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_filebuf@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPAV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rdbuf@?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPAV?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?rdbuf@?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPAV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?rdbuf@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_filebuf@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_filebuf@GU?$char_traits@G@std@@@2@XZ
?rdbuf@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_filebuf@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPAV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rdbuf@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPAV?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?rdbuf@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPAV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?rdbuf@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPAV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rdbuf@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPAV?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?rdbuf@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPAV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?rdstate@ios_base@std@@QBEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_WH@Z
?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHPAGH@Z
?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHPA_WH@Z
?real@?$_Complex_base@MU_C_float_complex@@@std@@QAEMABM@Z
?real@?$_Complex_base@MU_C_float_complex@@@std@@QBEMXZ
?real@?$_Complex_base@NU_C_double_complex@@@std@@QAENABN@Z
?real@?$_Complex_base@NU_C_double_complex@@@std@@QBENXZ
?real@?$_Complex_base@OU_C_ldouble_complex@@@std@@QAEOABO@Z
?real@?$_Complex_base@OU_C_ldouble_complex@@@std@@QBEOXZ
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rend@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@XZ
?rend@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@XZ
?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@II@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@000@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ID@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBD1@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBDI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@II@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIIG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@000@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0ABV12@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0IG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0PBG1@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0PBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@2@0PBGI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@II@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@III_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@000@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0I_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0PB_W1@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0PB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0PB_WI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXIG@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI_W@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WII@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?round_error@?$numeric_limits@C@std@@SACXZ
?round_error@?$numeric_limits@D@std@@SADXZ
?round_error@?$numeric_limits@E@std@@SAEXZ
?round_error@?$numeric_limits@F@std@@SAFXZ
?round_error@?$numeric_limits@G@std@@SAGXZ
?round_error@?$numeric_limits@H@std@@SAHXZ
?round_error@?$numeric_limits@I@std@@SAIXZ
?round_error@?$numeric_limits@J@std@@SAJXZ
?round_error@?$numeric_limits@K@std@@SAKXZ
?round_error@?$numeric_limits@M@std@@SAMXZ
?round_error@?$numeric_limits@N@std@@SANXZ
?round_error@?$numeric_limits@O@std@@SAOXZ
?round_error@?$numeric_limits@_J@std@@SA_JXZ
?round_error@?$numeric_limits@_K@std@@SA_KXZ
?round_error@?$numeric_limits@_N@std@@SA_NXZ
?round_error@?$numeric_limits@_W@std@@SA_WXZ
?round_style@_Num_base@std@@2W4float_round_style@2@B
?round_style@_Num_float_base@std@@2W4float_round_style@2@B
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?scan_is@?$ctype@D@std@@QBEPBDFPBD0@Z
?scan_is@?$ctype@G@std@@QBEPBGFPBG0@Z
?scan_is@?$ctype@_W@std@@QBEPB_WFPB_W0@Z
?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z
?scan_not@?$ctype@_W@std@@QBEPB_WFPB_W0@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@JH@Z
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@JH@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekoff@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekoff@strstreambuf@std@@MAE?AV?$fpos@H@2@JHH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekpos@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekpos@strstreambuf@std@@MAE?AV?$fpos@H@2@V32@H@Z
?set_new_handler@std@@YAP6AXXZH@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?setbuf@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PADH@Z
?setbuf@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAGH@Z
?setbuf@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PA_WH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAGH@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_WH@Z
?setf@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z
?setstate@ios_base@std@@QAEXH@Z
?setstate@ios_base@std@@QAEXH_N@Z
?setstate@ios_base@std@@QAEXI@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHPAGH@Z
?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPA_WH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?signaling_NaN@?$numeric_limits@C@std@@SACXZ
?signaling_NaN@?$numeric_limits@D@std@@SADXZ
?signaling_NaN@?$numeric_limits@E@std@@SAEXZ
?signaling_NaN@?$numeric_limits@F@std@@SAFXZ
?signaling_NaN@?$numeric_limits@G@std@@SAGXZ
?signaling_NaN@?$numeric_limits@H@std@@SAHXZ
?signaling_NaN@?$numeric_limits@I@std@@SAIXZ
?signaling_NaN@?$numeric_limits@J@std@@SAJXZ
?signaling_NaN@?$numeric_limits@K@std@@SAKXZ
?signaling_NaN@?$numeric_limits@M@std@@SAMXZ
?signaling_NaN@?$numeric_limits@N@std@@SANXZ
?signaling_NaN@?$numeric_limits@O@std@@SAOXZ
?signaling_NaN@?$numeric_limits@_J@std@@SA_JXZ
?signaling_NaN@?$numeric_limits@_K@std@@SA_KXZ
?signaling_NaN@?$numeric_limits@_N@std@@SA_NXZ
?signaling_NaN@?$numeric_limits@_W@std@@SA_WXZ
?sin@?$_Ctraits@M@std@@SAMM@Z
?sin@?$_Ctraits@N@std@@SANN@Z
?sin@?$_Ctraits@O@std@@SAOO@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHPBGH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?sqrt@?$_Ctraits@M@std@@SAMM@Z
?sqrt@?$_Ctraits@N@std@@SANN@Z
?sqrt@?$_Ctraits@O@std@@SAOO@Z
?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?str@?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?str@?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?str@?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?str@?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?str@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?str@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?str@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?str@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?str@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?str@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?str@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?str@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?str@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@@Z
?str@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?str@strstreambuf@std@@QAEPADXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?sync@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?sync@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ
?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?sync_with_stdio@ios_base@std@@SA_N_N@Z
?table@?$ctype@D@std@@IBEPBFXZ
?table_size@?$ctype@D@std@@2IB
?tan@?$_Ctraits@M@std@@SAMM@Z
?tan@?$_Ctraits@N@std@@SANN@Z
?tan@?$_Ctraits@O@std@@SAOO@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ
?thousands_sep@?$_Mpunct@D@std@@QBEDXZ
?thousands_sep@?$_Mpunct@G@std@@QBEGXZ
?thousands_sep@?$_Mpunct@_W@std@@QBE_WXZ
?thousands_sep@?$numpunct@D@std@@QBEDXZ
?thousands_sep@?$numpunct@G@std@@QBEGXZ
?thousands_sep@?$numpunct@_W@std@@QBE_WXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@PAV32@@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PAV32@@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?tinyness_before@_Num_base@std@@2_NB
?tinyness_before@_Num_float_base@std@@2_NB
?to_char_type@?$char_traits@D@std@@SADABH@Z
?to_char_type@?$char_traits@G@std@@SAGABG@Z
?to_char_type@?$char_traits@_W@std@@SA_WABG@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?to_int_type@?$char_traits@G@std@@SAGABG@Z
?to_int_type@?$char_traits@_W@std@@SAGAB_W@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?toupper@?$ctype@D@std@@QBEDD@Z
?toupper@?$ctype@D@std@@QBEPBDPADPBD@Z
?toupper@?$ctype@G@std@@QBEGG@Z
?toupper@?$ctype@G@std@@QBEPBGPAGPBG@Z
?toupper@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?transform@?$collate@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD0@Z
?transform@?$collate@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@PBG0@Z
?transform@?$collate@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PB_W0@Z
?traps@_Num_base@std@@2_NB
?traps@_Num_float_base@std@@2_NB
?truename@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?truename@?$numpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?truename@?$numpunct@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?uflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?uflow@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?uncaught_exception@std@@YA_NXZ
?underflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?underflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?underflow@?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHXZ
?underflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGXZ
?underflow@?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MAEGXZ
?underflow@strstreambuf@std@@MAEHXZ
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?unsetf@ios_base@std@@QAEXH@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?unshift@?$codecvt@GDH@std@@QBEHAAHPAD1AAPAD@Z
?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A
?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A
?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?widen@?$ctype@D@std@@QBEDD@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?widen@?$ctype@G@std@@QBEGD@Z
?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z
?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?width@ios_base@std@@QAEHH@Z
?width@ios_base@std@@QBEHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBGH@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_WH@Z
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
?ws@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@AAV21@@Z
?ws@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?xalloc@ios_base@std@@SAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHPAGH@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHPBGH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPB_WH@Z
_Cosh
_Denorm
_Dnorm
_Dscale
_Dtest
_Eps
_Exp
_FCosh
_FDenorm
_FDnorm
_FDscale
_FDtest
_FEps
_FExp
_FInf
_FNan
_FRteps
_FSinh
_FSnan
_FXbig
_Getcoll
_Getctype
_Getcvt
_Getdateorder
_Getwctype
_Getwctypes
_Hugeval
_Inf
_LCosh
_LDenorm
_LDscale
_LDtest
_LEps
_LExp
_LInf
_LNan
_LPoly
_LRteps
_LSinh
_LSnan
_LXbig
_LZero
_Mbrtowc
_Mtxdst
_Mtxinit
_Mtxlock
_Mtxunlock
_Nan
_Once
_Poly
_Rteps
_Sinh
_Snan
_Stod
_Stodx
_Stof
_Stofx
_Stold
_Stoldx
_Stoll
_Stollx
_Stolx
_Stoul
_Stoull
_Stoullx
_Stoulx
_Strcoll
_Strxfrm
_Tolower
_Toupper
_Towlower
_Towupper
_Wcrtomb
_Wcscoll
_Wcsxfrm
_Xbig
__Wcrtomb_lk
towctrans
wctrans
wctype
Name
.text
Size
525KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=128, id=1, productName=Unmarked objects,
count=1, id=150, version=20413,
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/iFilters/msvcr90.dll
- IMPHASH 0fda4497453286b1daa098623dfc53ce
- SHA256 cf420aced0d810e1d75f6811dd986f2d9fded2fbb8d61fc9a7024520c475febb
- MD5 4d03ca609e68f4c90cf66515218017f8
- SHA1 545e440940073d5ec49d47fefd421730f8b33efb
- SHA512 1b52d09f94bd37850d098ae7222e85e16a4f6df14cfdfc28526cd98b81fb009865fa75774ee4feaa2e5d5861bea27759fe4fb979c902f8ea60afa8c3e1f723fe
- SSDEEP 12288:1hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:5e2g5gmO791I0E5uO9FAN9mRyyzE
- TLSH T18ED48D51B6E2C032C8E611B8569CEB725A7F64B0032468E3BBD50FEDC9647C0E63775A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
54:13:79:94:a8:94:70:d8:e8:ea:19:5c:85:d8:c4:57:81:82:2d:8c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 29, 2008
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0f:78:4d:00:00:00:00:00:03
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 23, 2007 - Feb 23, 2009
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:47:52:ba:00:00:00:00:00:04
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Minor OS version
0
Major OS version
5
Entry point
142656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcr90.i386.pdb
kernel32
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetLongPathNameW
GetCurrentThreadId
TlsGetValue
DebugBreak
OutputDebugStringA
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapSize
HeapReAlloc
VirtualAlloc
HeapValidate
HeapCompact
HeapWalk
VirtualProtect
GetSystemInfo
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
CreateFileA
FlushFileBuffers
CreatePipe
CreateFileW
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetEndOfFile
GetFileInformationByHandle
PeekNamedPipe
InterlockedExchange
LockFile
UnlockFile
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetStringTypeA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
GetLocaleInfoW
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
GetModuleHandleA
$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_amblksiz
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_sbh_threshold
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initptd
_initterm
_initterm_e
_inp
_inpd
_inpw
_invalid_parameter
_invalid_parameter_noinfo
_invoke_watson
_iob
_isalnum_l
_isalpha_l
_isatty
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_isnan
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_itoa
_itoa_s
_itow
_itow_s
_j0
_j1
_jn
_kbhit
_lfind
_lfind_s
_loaddll
_local_unwind2
_local_unwind4
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_lock
_lock_file
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lsearch_s
_lseek
_lseeki64
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath
_makepath_s
_malloc_crt
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mbctype
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
_memccpy
_memicmp
_memicmp_l
_mkdir
_mkgmtime32
_mkgmtime64
_mktemp
_mktemp_s
_mktime32
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_purecall
_putch
_putch_nolock
_putenv
_putenv_s
_putw
_putwch
_putwch_nolock
_putws
_pwctype
_read
_realloc_crt
_recalloc
_recalloc_crt
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotl64
_rotr
_rotr64
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_searchenv
_searchenv_s
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_SSE2_enable
_set_abort_behavior
_set_amblksiz
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_fmode
_set_invalid_parameter_handler
_set_malloc_crt_max_wait
_set_output_format
_set_printf_count_output
_set_purecall_handler
_set_sbh_threshold
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sopen
_sopen_s
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_splitpath_s
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_stat32
_stat32i64
_stat64
_stat64i32
_statusfp
_statusfp2
_strcoll_l
_strdate
_strdate_s
_strdup
_strerror
_strerror_s
_strftime_l
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strtime
_strtime_s
_strtod_l
_strtoi64
_strtoi64_l
_strtol_l
_strtoui64
_strtoui64_l
_strtoul_l
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_swab
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_sys_errlist
_sys_nerr
_tell
_telli64
_tempnam
_time32
_time64
_timezone
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_tzname
_tzset
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_umask
_umask_s
_ungetc_nolock
_ungetch
_ungetch_nolock
_ungetwc_nolock
_ungetwch
_ungetwch_nolock
_unlink
_unloaddll
_unlock
_unlock_file
_utime32
_utime64
_vcprintf
_vcprintf_l
_vcprintf_p
_vcprintf_p_l
_vcprintf_s
_vcprintf_s_l
_vcwprintf
_vcwprintf_l
_vcwprintf_p
_vcwprintf_p_l
_vcwprintf_s
_vcwprintf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_waccess
_waccess_s
_wasctime
_wasctime_s
_wassert
_wchdir
_wchmod
_wcmdln
_wcreat
_wcscoll_l
_wcsdup
_wcserror
_wcserror_s
_wcsftime_l
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcstod_l
_wcstoi64
_wcstoi64_l
_wcstol_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wctomb_l
_wctomb_s_l
_wctype
_wdupenv_s
_wenviron
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wfullpath
_wgetcwd
_wgetdcwd
_wgetdcwd_nolock
_wgetenv
_wgetenv_s
_wmakepath
_wmakepath_s
_wmkdir
_wmktemp
_wmktemp_s
_wopen
_wperror
_wpgmptr
_wpopen
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wputenv
_wputenv_s
_wremove
_wrename
_write
_wrmdir
_wscanf_l
_wscanf_s_l
_wsearchenv
_wsearchenv_s
_wsetlocale
_wsopen
_wsopen_s
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wsystem
_wtempnam
_wtmpnam
_wtmpnam_s
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wunlink
_wutime32
_wutime64
_y0
_y1
_yn
abort
abs
acos
asctime
asctime_s
asin
atan
atan2
atexit
atof
atoi
atol
bsearch
bsearch_s
btowc
calloc
ceil
clearerr
clearerr_s
clock
cos
cosh
div
exit
exp
fabs
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
floor
fmod
fopen
fopen_s
fprintf
fprintf_s
fputc
fputs
fputwc
fputws
fread
fread_s
free
freopen
freopen_s
frexp
fscanf
fscanf_s
fseek
fsetpos
ftell
fwprintf
fwprintf_s
fwrite
fwscanf
fwscanf_s
getc
getchar
getenv
getenv_s
gets
gets_s
getwc
getwchar
is_wctype
isalnum
isalpha
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
localeconv
log
log10
longjmp
malloc
mblen
mbrlen
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
modf
perror
pow
printf
printf_s
putc
putchar
puts
putwc
putwchar
qsort
qsort_s
raise
rand
rand_s
realloc
remove
rename
rewind
scanf
scanf_s
setbuf
setlocale
setvbuf
signal
sin
sinh
sprintf
sprintf_s
sqrt
srand
sscanf
sscanf_s
strcat
strcat_s
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strerror_s
strftime
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtok_s
strtol
strtoul
strxfrm
swprintf_s
swscanf
swscanf_s
system
tan
tanh
tmpfile
tmpfile_s
tmpnam
tmpnam_s
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vfprintf_s
vfwprintf
vfwprintf_s
vprintf
vprintf_s
vsprintf
vsprintf_s
vswprintf_s
vwprintf
vwprintf_s
wcrtomb
wcrtomb_s
wcscat
wcscat_s
wcschr
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcsftime
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsrtombs
wcsrtombs_s
wcsspn
wcsstr
wcstod
wcstok
wcstok_s
wcstol
wcstombs
wcstombs_s
wcstoul
wcsxfrm
wctob
wctomb
wctomb_s
wprintf
wprintf_s
wscanf
wscanf_s
Name
.text
Size
598KB
Virtual Size
598KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=162, id=1, productName=Unmarked objects,
count=490, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=184, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/iFilters/ooofilt.dll
- IMPHASH 65fe882b6ba3a6a88d7f9e130e69301e
- SHA256 9fdb03072047a23abaa87a1c7d7a836a54eed2803043db4ad74c357ee4a909a8
- MD5 b570ce073f3011907059266d744c5e0b
- SHA1 766ec4f64dc47200982f6c306748502c6f45735d
- SHA512 6e9695e43d0d3b17dbfd5405d3f7b2f445138150794bfc68e45492f051faf4c87edf4a5639a0ed998ed0b8185cae7c70a594082940c95424805cd5562a877480
- SSDEEP 6144:BsEPKVAMlLyHxx3ET7yXevFJIITBqPAXx3WlOKa47A:KByHD3wyXerIITsPo
- TLSH T1EB348D1338C2C47BD1A727B0894CE65816BEBDB20926728F7BEC56EC5F3658186316D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
60658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\build\AOO413\main\shell\wntmsci12.pro\bin\ooofilt.pdb
ole32
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
advapi32
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
RegEnumKeyExA
kernel32
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
GetSystemDefaultLCID
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
GetVersionExW
GetShortPathNameW
LocalFree
FormatMessageA
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
InterlockedExchange
msvcp90
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@1@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
msvcr90
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_wcsicmp
memset
perror
wcstombs
_purecall
memmove_s
_stricmp
_close
_write
_open
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_time64
ferror
??2@YAPAXI@Z
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
memcpy
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
realloc
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
rand
srand
memmove
__CxxFrameHandler3
malloc
fopen
fread
fwrite
ftell
_ftelli64
fseek
_fseeki64
fclose
user32
LoadStringW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVersionInfo
Name
.text
Size
157KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=150, version=20413,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=134, id=1, productName=Unmarked objects,
count=26, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/Sounds/news.wav
- SHA256 a9de4dbd509cad6adcf6f2d7ce6d6f03b6423cef58c67d1ad9addb2f41f96bcf
- MD5 f0cb7bd16723b149ffeb72e2f28f9ff3
- SHA1 36b354e2104d7358985b07b43488bb0503f55513
- SHA512 a19bbf14b29e42c7b097067edfb8c6e786b9d1278334347763a96556602ae8c2e0f914a3bcc5380c6296475238a7e10f5d866784a1bbc649f1e934a9fa1d354a
- SSDEEP 768:p6BvM3ZyMNCyE8w2PAxvnvQiMZ9bHo639pc:cBqZykCgw2PiXQR9joue
- TLSH T11FC2CF78B9808936CE2AB3704B01C3EF63623F40DCA99E9B37D6774FB9746809805A40
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/ok.wav
- SHA256 2a8d3c5d29d6fb002bf3cd0496fa03317c5250c1484d8dd9d9c78ff1cf194d63
- MD5 e3ac97becd57de4ed4681aaab9b08878
- SHA1 37acf4da7d1129d4ffb4b261f961d6a1a7250f7b
- SHA512 e3d0d413f70f5ec4dc5ae39260ce900691e10d4f35a03fa15fa978927101cb32f917154d29ef761b6ca099b0fed5b8b05a61519c2ccb419efcf5612efab6527b
- TLSH T14451EA3610807002AD8A5274BF7BE376F1D30CD342FDABCCE016780508A79248DD758B
- MD5 SHA1 SHA512 TLSH
ispell/Sounds/stops.wav
- SHA256 f8c318c38cf2ffcbdbd632da0db3abc88a52a70efdde38b8255d28f4c2f0f8bc
- MD5 dd1a8be4ddf91f51bb49d7360eef532d
- SHA1 c878c6229c0b0cd5a7983f69254b33386f550cae
- SHA512 537fc911322224465827b19ec69ec869252270179339fdd7cadef521886f2c0b8fc4af71633032c1cad50a4da429b12cf69fe61b8d4b6d56ce26ae20bdeb3cf0
- SSDEEP 96:DFquXl9WDCRk9TFnPZtRa0TV1PX9HYFj+udlptmTLQhwXRRoL5bWM5vJ+JATVUXS:DUG9WMk9Tv/lrX9M+udlptmTEKDolbWC
- TLSH T1CEB1D9F2FC7511CA51034BA0FE2F0421BB68AC9907FE2BAA5C344D575167E98CCE680A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/tick.wav
- SHA256 0e2c13671a29f810b09e38f607d2f2d05f2c51b953bd71c8cc70bbe3919a734a
- MD5 3f9fec91309b1d419ebe018e1d9f2c48
- SHA1 2b80b9d539c2addd8b58138e9de9e79e1c071bfa
- SHA512 bbe72b35e5bf5f15502f3d5b52410ba29f46a81194c4cfe56af7f11f9df86f8c95f229bab7af98d7c13c550eb80f401fe97ed8884f1fa4e8ed011c1a73b8be76
- SSDEEP 384:6KjDs6kh3iFN18+S98y51QcPin7Z8cXIFmKkLBMVy9+MlhSVUs:xs6kViFN++SYcPzRcLBgnMKb
- TLSH T175A2BE93D8F4A4DF745BD5304AE59D500FF066161746802C62B6DFBDA0BB32A74EF08A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/timeout.wav
- SHA256 49998ec981bb7c20d2b299cfc99af3f43113d3464d6b9245091bee3b69528d4e
- MD5 7e57ab05d47a75785832defccb24b4c6
- SHA1 ad6f57e531dfc6611970f8f431fdcb542f4719a1
- SHA512 bd2217584fc77023d3be8470e1a5bbc8cde4a21ee242a97925dfc161fa9937de4680087163af37c4f34b5c142ee5b1cc0c037f8cf9edcf8d61351753a222cf1b
- SSDEEP 192:aFXvaHSX+L3WMuQCAWUgnS9WFZ0k3v5Zz6uTRUNxmPiQPafRUL6zRNIU9Kd6ll55:aFXCBKMdLg0kxldR7q+L2bIU9Kd6H542
- TLSH T15992D66FD0923C892D0B87B6FF7EC62C711EF8858D985F986528AF5600355B1C4BAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/Sounds/wait.wav
- SHA256 f8c318c38cf2ffcbdbd632da0db3abc88a52a70efdde38b8255d28f4c2f0f8bc
- MD5 dd1a8be4ddf91f51bb49d7360eef532d
- SHA1 c878c6229c0b0cd5a7983f69254b33386f550cae
- SHA512 537fc911322224465827b19ec69ec869252270179339fdd7cadef521886f2c0b8fc4af71633032c1cad50a4da429b12cf69fe61b8d4b6d56ce26ae20bdeb3cf0
- SSDEEP 96:DFquXl9WDCRk9TFnPZtRa0TV1PX9HYFj+udlptmTLQhwXRRoL5bWM5vJ+JATVUXS:DUG9WMk9Tv/lrX9M+udlptmTEKDolbWC
- TLSH T1CEB1D9F2FC7511CA51034BA0FE2F0421BB68AC9907FE2BAA5C344D575167E98CCE680A
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/config/ICMarketsSC-Demo01.srv
- SHA256 0fb8dd5ab8eae0e9ddf3bacf09307179ca99c204309d803c45136022090a65fd
- MD5 f0477598a1750b2422da8126b67868e2
- SHA1 865e1737383e80a2d2ab62091eb3f0658601a1ac
- SHA512 376a34ff7a9ce61501645265061c4c2111beb69d7d3ebcb91ac438c3b286892569eec70bfc058c43dd8df0793f0885c9027427436ed8603b0cc235dfd0b1c5f8
- TLSH T14F31D614BBC3D987C381B6B062160A6A606B50A387D6C292053E0C0ED9CC892CAF2586
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Demo02.srv
- SHA256 6207f115b62c32047cd87a87e4e6516f1f27845a9e675787f220b7fc5fbe3f8c
- MD5 a0a88f876454715a9effa263743ea108
- SHA1 781f71d7cf59a16f44c8b3fb964871d2e5f27164
- SHA512 2b92ffd310869c816d102abf330460cd3c2e36527ac0d502059b19b178239c2c4ab77ebf79c35a3d972efa49c817754a09b6c4a321a57d5367f38921f242c4b8
- TLSH T11521524AFAAD4854F08252382CF74D119CB079845B6449E18DEA1F6036BFE5017A7950
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Demo03.srv
- SHA256 4b0d472f1578023a7671046f5bc23415299e1b30adbada5e9403b6802111deea
- MD5 54525b47f2ffa5ad52fc0d7c6052223b
- SHA1 f326e5857d2b30e3ca2a2c8793ea68840bd05f18
- SHA512 4f58c4e647c40bb0c8cd86bbc21a97462cdb80452cb47d43e33110040698e40a1dc85def49709a2bf7d12033302192d893676363519ab841a4745ac5c65b154d
- TLSH T1F9411D35A8B6BFABC97322F747AD01A701D46831212E64F451E10C3442F2D9D2D70DAD
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Demo04.srv
- SHA256 02a5e54faf932559bac2e55a21f50b0f08e1f1daebd7584217282633899c6330
- MD5 cf26c809cd22b5e31e843d6d1c0d0216
- SHA1 cf1f0d75962232704db1500533dc635aab2ecb3c
- SHA512 f471e16fa0c3c95362c630389b8be55d2c3461f1afa65276a0f2a30e5637b7d49ca1018a96a08e3b490187186b94f94112b233138ee0d02b6626c1c06c1f477f
- TLSH T1C141F959D702999DCD1ECABCD6224BCB5675BFC0BB151684A12009B2E08DA7B2859C37
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Demo06.srv
- SHA256 ec871a0af159164a9d31bebdad471c5aa44ff918a8920999c520fba57727718a
- MD5 f998a55e1dadd1274be495cc19c56d51
- SHA1 6508b207aaa11977e8fbedc305cc734549cae4f4
- SHA512 ac044f50b8fc04e82908d00e90207f5706d1ae11e920442633f8bc82e5984ec6917e5ef37921aa7455931d373bae9f25a75cbd02712748bbacd58a6c27666780
- TLSH T1A72196FF7F1F005CE6EB7A7DC8C8461D104DA99402CC016B50980C37B8E974162853A0
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live01.srv
- SHA256 23178779abde710c441fcf36afea40326560a1b721e83def24d2e0b383942c26
- MD5 baa88bfeed26b4222ae59653f138f8d7
- SHA1 f4f0815db1333321dead1781c038c615ebfe038f
- SHA512 478f5112532afd3e46b614c7154d8a2c97624e83b9560890929019493628738adba6d0e710acdf02ba68491b6952cb36307aac867a3aeda31657460a04576e0e
- TLSH T13C514B7BF7E06D85D29DBF7809E6028BFB498C1701D3021336059875E95DD086C56BB2
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live02.srv
- SHA256 874bed75e3c31a339e39a9d98db423a2ab5adae64d5b5cadb95a1d156eeea327
- MD5 839701bd3fd404b311ac2f0750170aad
- SHA1 f13646b4c172cc62b1ebe05f6334aaecd8fb4f93
- SHA512 77b00f95963412235033c95da93bf2ab8286a520639e6d531a1399c93af6f5d2f99730dbf726ab9acc233e5855cb19875f9b7b5cc0d90749a10a9f3cbdb1b32c
- TLSH T1AE616DD70F5CF673E3649238C081F7B75D84424DB9B868F6AA58E8C4A91C5B047CF090
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live03.srv
- SHA256 df5e94462cb0cb4e530a444f2400dc5bca05277997a483f14a5c1c24e8242910
- MD5 289bf9506d641ccae972f2516583b41f
- SHA1 4bb4869c58bd7d79d2e20168bd4f34fb104d694d
- SHA512 1c1c91f2db625428dc89badf9a5986b9c8eb115b4fafa4395be6e0c5c5293947127346241224dc0d9948c779c1cf83bf87527a1b710af2d214ab21039d84291e
- TLSH T16D5119AD1C71CF47FE568ABC27B4637FA352201B620B4463B62F9134932A387E901523
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live04.srv
- SHA256 545fdc1d62987d27629cf81482d68cc4ba48ae80bef56124609b721a14b4c66b
- MD5 93400a3724d60f3473448431d389a0ad
- SHA1 e7c803fb2a5f458c4398626b9fa91670a76ec979
- SHA512 62c2392a95284b11f421fcde01ff11bc234f9ffb84ccc6b8824f33768a3eb7bc1e074162ea148e57bb729410d30858df3aeba18145e8a91bd78a7ad3ed3ec1ec
- TLSH T106513A6A38B38C43FA79D6F200BA4AA2187B849EA0E514763A9C0589927B587D01D720
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live05.srv
- SHA256 50fed22e9d8f0d535f932f661592fa50165433729fb0665de4b6589e4293aa37
- MD5 831e126206001b1201601d8e557417bb
- SHA1 8ff6d206ff17d94110452c118604ec2d49e15fee
- SHA512 0327610f50c5b748901e415115816d51f9252b93b43a981628e46223fcf9474f02565b92b125215bc8952914cefdb4bdaa6cdffc04d97086b365721d136a2366
- TLSH T110612A487FB80BD8D991AEBD106B4F82110617817883E0DA4C8C9CF982C866D51CFD69
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live06.srv
- SHA256 b9fc407979804c7665810515685db62826ff5ab3df3be72e2e159d926ca7b07f
- MD5 19dd373eb83e38b0a87074d0893e0b9b
- SHA1 71567d8604d3b439ab47fdcebcf8bde4ecfc06bc
- SHA512 3c7d33536b496c500c7300619acfda5f2bbab3294edecbbccf9dc3a37ec7ee89f649f8d4a5e1381ee12765e99711d3f7cc55a0524656e37f51964d7b38506b92
- TLSH T1C1511AFE3922765AE0D82FB132650AC71F89A24D97BC8090D4CD9E840FF661CA55FD11
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live07.srv
- SHA256 f082fa9e48ee7219a72bf152d2fa5b895fd015f68d24b601ce9b90ad0b1e5e92
- MD5 03890ee2278faec0ef4cdd6e93fba151
- SHA1 58b46a214c94dd465edfcfa13aacecc3e1e388be
- SHA512 1bed346071cefcefbbd3159127400e28372fab42bd11569c7f8521e187f603a7d71ee4ce2a02ca8c02b6534fa985dbb5753c623d26f04946facd4525def3b4e9
- TLSH T1E5513C2D33586970FF501FB8752321420E79DD98255ED5B34A6880669F3F116EE58AC3
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live08.srv
- SHA256 8741a9396f8e418c1deaea8f4f2ffca174029ea511ecdc5dcf36a04f32b604f3
- MD5 9e16a912abd8e68cacd0b8e2a37205df
- SHA1 1effccfacbae6149d9b968fc3d191d7e2effe3d4
- SHA512 be43d6d6ac84607fa7e63d849e6efb8db817e03cb18250df5b6e4e6e5d47bb728a0bf355258563a19e0eb8811b5feb23b29db44a1de1b9e25b66afd7856deefa
- TLSH T1A5617E5454B56204DA9ACB397DA0C8EF24F535F3A70D40D4790BC38558B4F56A5EC862
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live09.srv
- SHA256 c92945afe73eec9f955d82020d551f3cf85c9fb1b34c8d361033b2d340566ed9
- MD5 da24c3a2933a7a539bd8e8c7cebbd03e
- SHA1 4c0c264cc69e528679aa700930ce6833cd57536b
- SHA512 cdd8c74ea6ed3f47e0031e86e356909787319e7d2d409ca1fbdc2b6d0b9c2990e226f6fdca9a56cd9556500d1fec059ebe48ea867f970cec35c03270a96800c0
- TLSH T1DF615C6154B3F876DEF5127A460438C4CC8A1E32948E0AC0B835193313CA64D1B59F5A
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live10.srv
- SHA256 f22649e48e2587380606d4ff4ad6e913021fb4bea6fa1853bbac1fccbd1a9188
- MD5 6afc4084dc58fb9625b743aec1787716
- SHA1 fbd4fd481b4719d48675ddd49cdb26f2386b1d73
- SHA512 35e6d2d8418236035b7e3835e55133134e3e053432f424f741f349e69254961022c3034aaa1b5971e11b686ec376deb06d8d3d0b875f6931d8638013bfde6dd2
- TLSH T1EF616E1F236367D0D5A9C7377EBC854D8948C5E8129DA321081FDD594152B70B80CB32
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live11.srv
- SHA256 67822802b3a337034f89a1595a39243e9c965d0c634bfca08d5fa6cec506b70a
- MD5 5639577703df85ca99cce6938c87135b
- SHA1 e56aa24ebb970f4aaa0325609a050b4dab2289e0
- SHA512 baf14a43f842509bb06a1952d06e7a74cd955c832b37f95f82d8aa3525eb2cfcb8d37f629abc972cd8e4930b5b9dc4bfde0978f54cab6cd5d4d92bde06625d0e
- TLSH T1F1614D1C86B37850D13684B8A121E3F72936F5BE6FE994424578C224924F7AC5F33EB5
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live12.srv
- SHA256 727e28b2aa0a5b0cc5cc049c89b9da2b3317e0d87ab7fea9f91d6e766adf747d
- MD5 7f71b756b2fe41be8dbea10a6b32ccf2
- SHA1 d735a29e8b04c2857a3e4fa1b3390fe355176a39
- SHA512 bc25103b1deb707d3694d00caa5c58e3101af986c0fd097905d4c9c56643ca965d81eb055c0c8c50763c3e3347e2278499ddd96797a72829be208010b4b9b733
- TLSH T137513AE72C06D701EE62B3F1A1305826D8A819FAD1CA61B2B9BA1D10DE1B6D7814DA35
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live14.srv
- SHA256 ef06af52f5980e794e4296c822b7fe7f89fe91f896e1c49adb2c25e3a2737800
- MD5 a916c832b3d3b19690ae6b3331f8a2ec
- SHA1 2db6fd7d7ad8127a0efd34eea1c13284e04e3fc5
- SHA512 d6e186e6aa56faf8bade538d533360515fda4e9f3ca3cc94448848c02b2c064782d67d7ee69120dc9e4ca021afba54a38c5b149b6e9d4be4f6e030f09bd1c695
- TLSH T17C5109276A00FEA1DC6E15B5FCA8D4AB8A714DB9F8A00440D70B4C865718D5D3F68D47
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live15.srv
- SHA256 f0f3b420208283ea83119f91249e4843020311d8d92298f4374d5599600b8c08
- MD5 eb1c4ab01039dccef3225bb74a2ce0e8
- SHA1 3e8ff09f4badd6c38ac131edc55ee5dc17dcb3c2
- SHA512 a53f4b468298e77257164ed5f25277579207f69716eb0a42890e36dc94fb1f2cfe42b12417e2cdaef339e4300af429b0c545f747bb41ff1d7cc45e02a8bf827b
- TLSH T18B513C2C6D182F94DEC513B103839B63064819DA630E86FA5AC2558B5AC6D40FC8AE05
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live16.srv
- SHA256 b2200b1be0a7603aa3fe493d74e0ebbb7c80dc02e7a2aae5cae60717381792cf
- MD5 02d8a0a3a57e647ffdc422f64f27a25d
- SHA1 54e21ce778765b39046787c879d579631bc565ed
- SHA512 9359e5468e147259e3f51ccc9d4804e014df025d22baa4e563e945d2c7769a9a21da78bc68054b646425d095e9c4af85db417f03b9699c11cc7ac88f42ed0849
- TLSH T1B2514A9D38748F8CCCADE27B4C28A8FB160159744370887D44DD4ED4C758928B66D93E
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live17.srv
- SHA256 f7f5b7f264c2cedbf22fd2a2cd6f03ad746a6057c71d223abc158ea61fddc4dc
- MD5 fa66f082b7181d4bf8a51a9193c371dc
- SHA1 6358e41ed1ecfee3120d53cb3cb2d4cc6edbb3bc
- SHA512 d566b3316de092fc7d73ccab90475da3ab6eafb1760b46c37a35e3056ae2d7d64dbc80ab5687972324418baee9f9c1b96d9bb3d38dd851d4598147533a232b5f
- TLSH T179513B37B0BD4D31C59CB6F87CAECDA890604D7C9A5121F22A08D0A20EBEEC7C459830
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live18.srv
- SHA256 e437f64bae1afe19a76a23b46d29575b6ae1a647d19bb79738b892725a64ce49
- MD5 7fe56e5d9564eb66eb2f438585db79c6
- SHA1 cb52e90352d3d0572482ce2a58296e30355b21d7
- SHA512 50a1df6b588201211d318110a69dfcb6855a581185a37ece16bd049b44d8c4c843f1ddcaaa3cffb9c40a15327fadd6304451ec15a27f470067c1ebd965770388
- TLSH T1E6513B7552B96A60CE9B3BFF38010C90822DA3F3FFD6669B59011D9CC2B0E9CC25E605
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live19.srv
- SHA256 efc62c488709063ee66061d294b294e6e6e8edc937ce8c2f45d12607c80b487b
- MD5 c85fa8673df2eba09b7e03526e1a3a42
- SHA1 ffba38d36b3e41a609aaa1ca19bb16257ed8a399
- SHA512 16ba03320ddb49ed3565064d98249ce88fa51c1c2a30af8ec480aacb7f53c7dff3b6ff9f0e11b1284b1c4dc6336d9931268fda771e925154348c1b3d0cf29e05
- TLSH T1785129C51C3230EAF1D25BB51D9E67F9D8C624E4A1E0EFB7128F48E8C82117C3675168
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live20.srv
- SHA256 75f575a9b76f1c2d29b3e8d19e5abf559b9fc50db06ee417ccdf8fe310229b2f
- MD5 5e78624b85273d297b29e4314f81dee9
- SHA1 58d5bdc0a5ebeb734f893e48995da104e8f90ec9
- SHA512 edeac931294129421c3c08ca2bc7215f60876349f6b91951e668c653328f48386e9de412f6fd125207d168807ebd1fab768a0c05e2eeb67229584394285cf6a2
- TLSH T134513CCE77B87654D54494384530CC360B8F8E5DA6454ADAC9F38CBF1C65352157C533
- MD5 SHA1 SHA512 TLSH
ispell/config/ICMarketsSC-Live21.srv
- SHA256 12f34408384892b48b4110c0c6f7a1f4e8698392376f7290072c6f8abb6c24c6
- MD5 21811b3dea22f2f0cec06151c346cab9
- SHA1 ec8c6f4f3089350470097b84661bfe90bea593ad
- SHA512 75f95c54a544892ad92c91855820d86bea4db0b524e0860ce53cc4a1f38d4ef76ea4dd69edfb446811db8a60d9aa792681cf15f27a4c5ec1acbaada259658133
- TLSH T1E0714BEAB978829FCE48373C4DD7095AF85689B1B3C092D8B28678C6BDD98584324043
- MD5 SHA1 SHA512 TLSH
ispell/profiles/British Pound/chart01.CHR
- SHA256 67daa9da824098d6215fdc5dc9ca9d09ad94651ae604eacba5bd61269af15bbd
- MD5 fb039b7b6818aa0b1b93dad2edffe9bb
- SHA1 c8d4a508ef2bd9051347d182a221443b2c208a3c
- SHA512 3d77026510de3b2750a10d6dd24caca186e2867816e9d40cec97e48f4f54b49c81ccd6cc790d6d0616cac9b9fd9cad035e175e890e2cf6b3ac8f4ccc4cadb5d8
- TLSH T1D5317670D5A2680FE033242E02BDA60C31E1756A03F7F3A1B39CD5A72C269D3AB512DC
- MD5 SHA1 SHA512 TLSH
ispell/profiles/British Pound/chart02.CHR
- SHA256 78bfdc6664f61f77c139a27fc47f0bc1fb2bb3a5d62085f6a319a4c22ca77b38
- MD5 91ca3cb8e3fff0e65c6a344cbbd7dec3
- SHA1 85032818a3824778384f9b6c795795665c17b3e2
- SHA512 d6ccbd6dcd1f7bb1e17c2a8ac655151055602d943e13eb7687d4149daae82f8e6fa5974e74d76bf8e4d8fd5007e350b79001393fcdf482c2dc4acee5d209f20e
- TLSH T182317670D5A2680FE033242E02BDA60C31F1756A06F7F3A1B39C95A72D269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/British Pound/chart03.CHR
- SHA256 ce6f24a8b1ba06f703aff1ee5e7be53b36d9a5b2fdafd6c595f014e8321f4936
- MD5 e70e75a48fcde1bdccbf60eefdf7e1de
- SHA1 46c529e2473e0a1b47a89a120615364f2312403a
- SHA512 759e49908f4c1af19b424250fc758a9baee38b8bde987dd016faf19584ebbf6fd3d856d5ea32b89f130f31ac9b4ed3217024b9c74e5360bd6a06fd9d6d864ebf
- TLSH T160315670D5A2680FE033252E43BDA60C31E1756A06F7F3A1B29CD5A72D269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/British Pound/order.wnd
- SHA256 a0a2d5f1521ecc527f378a2d5201d85f4213c05dadc5f06fe3b53cceb19df2a6
- MD5 2547e671f549e0c3b143ee8032fde665
- SHA1 64cfe6e68f351c82e39eee6e333d6afd92a3f855
- SHA512 782f1bc185029faa1b9b14c5f0b2d87fe14b722a8d088375eaa5abd01a79181ef8eece1e9856498a0b8e92d72435f87a65722a5bf3a553c5b6755990f3d07911
- MD5 SHA1 SHA512
ispell/profiles/Drivers/prl_dd/amd64/prl_gldd.dl6
- IMPHASH d324f3e0e7eb10e873b752e82c3b6fba
- SHA256 9bf1fa2ccae50530faa4fcce28c316493455a983b416c9d9ec773cda7a6f2bf1
- MD5 4cc8a0cd42b92bd2cae69644b64a76d6
- SHA1 2ce11819a59f709e9fb8c1a2173783dd9fc6e9ef
- SHA512 7ac5261fc14a155c236de8b6d134ec9fb5b06e451418243ea75a84c3b9ab8448f13d89082ac4ecc17ac17dfc728ab95f0a2f0a40b57ced09b86675c381f538b7
- SSDEEP 6144:lPV6AGt0XJ91+ArjTaw43pMiCRYRV45tgNlWah:r1LbM3MRJah
- TLSH T1CC644C4AA52D0C66D9ABC1B85B53AD2FE732740687F143CF2AE003DD9E1B7C92576309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
63:d9:5c:04:e9:a7:44:f4:cf:6a:77:52:ce:42:31:b2:c9:ae:62:87:d0:b6:f9:9c:d4:59:b4:07:44:0d:d3:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
273456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\amd64\prl_gldd.pdb
msvcrt
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_purecall
??2@YAPEAX_K@Z
strrchr
??3@YAXPEAX@Z
strtol
strncmp
memmove
_XcptFilter
strncat
memcpy
memset
memcmp
sqrt
cos
sin
kernel32
TlsGetValue
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TlsSetValue
SetLastError
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
GetCurrentProcessId
TlsFree
GetModuleFileNameW
Sleep
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
user32
GetWindowThreadProcessId
GetMonitorInfoW
UnhookWindowsHookEx
SetWindowsHookExW
WindowFromDC
MonitorFromWindow
ReleaseDC
IsWindowVisible
GetAncestor
GetForegroundWindow
GetDC
GetClientRect
GetWindowInfo
CallNextHookEx
MonitorFromPoint
GetClassLongA
RegisterClassW
CreateWindowExW
DefWindowProcA
GetWindowLongA
SetWindowLongA
UnregisterClassW
DestroyWindow
gdi32
D3DKMTSetVidPnSourceOwner
SetPixelFormat
D3DKMTPresent
D3DKMTCreateContext
GetPixelFormat
D3DKMTDestroyAllocation
D3DKMTWaitForIdle
D3DKMTOpenAdapterFromGdiDisplayName
D3DKMTDestroyDevice
D3DKMTRender
D3DKMTQueryResourceInfo
D3DKMTCreateAllocation
D3DKMTQueryAdapterInfo
D3DKMTSetDisplayMode
D3DKMTEscape
D3DKMTOpenResource
D3DKMTCreateDevice
D3DKMTDestroyContext
D3DKMTCloseAdapter
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
Name
.text
Size
276KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=123, productName=VS2005 build 50727, version=50727,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=89, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/amd64/prl_kmdd.sys
- IMPHASH 5d52d0da8e176989801284ccbf7502f5
- SHA256 ec84851fc9216124d8ce751f42fa88667ab978648b5b60bbd92f1bc78806561c
- MD5 31a2538e0ef2fc81d3068b1fdf10b8f0
- SHA1 6be311c25c88f3620f4c8c2b3b745ad733e29f3d
- SHA512 68230e7482da92d4f133da0c39ee9d365f48085a0e6eb85575373b1678bba44c7534da2bf47b09c483eab19536a3024d58608eeec24f81ede25ae315a680aa19
- SSDEEP 1536:flGnKMwnK+3X/rkr7fCbPWQ5NepvyIP7F1aRaR+2a2EKv7IsWnncsLK/j68+:fIKXe+KQ5NOLFsRaRo2FWnyj68+
- TLSH T193E38D41F7D254CDF46B953596D2A27BFBF238200714CBC79280869AAB177E09E3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f3:14:db:3b:7e:e5:3b:48:f5:e5:86:10:64:3c:5f:a5:59:a5:be:c8:a9:5e:83:a3:a8:cf:45:d3:78:4e:ac:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
156028
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\amd64\prl_kmdd.pdb
ntoskrnl.exe
KeResetEvent
ExReleaseFastMutex
ExAcquireFastMutex
MmMapVideoDisplay
KeSetPriorityThread
RtlInitUnicodeString
KeSetEvent
KeInitializeEvent
ZwSetValueKey
KeInitializeDpc
KeReleaseSpinLock
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseSpinLockFromDpcLevel
KeInitializeTimer
KeDelayExecutionThread
KeFlushQueuedDpcs
PsCreateSystemThread
ZwQueryValueKey
_vsnwprintf
ZwClose
ExFreePoolWithTag
ObReferenceObjectByHandle
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
PsGetCurrentProcessId
ObfDereferenceObject
IoOpenDeviceRegistryKey
KeCancelTimer
KeAcquireSpinLockAtDpcLevel
IoGetDeviceProperty
IoAllocateMdl
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
MmUnmapLockedPages
IoBuildPartialMdl
KeSetTimerEx
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExAllocatePool
ExFreePool
KeBugCheckEx
MmUnmapVideoDisplay
ExAllocatePoolWithTag
IofCallDriver
ZwLoadDriver
IoGetDeviceObjectPointer
ZwUnloadDriver
RtlGetVersion
IoBuildDeviceIoControlRequest
RtlCreateRegistryKey
ZwQueryInformationFile
ZwOpenFile
RtlWriteRegistryValue
RtlQueryRegistryValues
ZwReadFile
RtlUnwindEx
MmGetSystemRoutineAddress
PsGetVersion
hal
KeQueryPerformanceCounter
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=2, id=190, version=30716,
count=63, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/amd64/prl_umdd.dl6
- IMPHASH 9c56b1e0d338fdec99e5cb1f42cee333
- SHA256 f3cee93408c42205f212563a616000db402c7dba8465e53167c161f59574c53b
- MD5 31d54178739d9279e641ea0b446a2015
- SHA1 5e44ba5a68b46439f63caa60d259d926cca9df72
- SHA512 07aa188573a2ed80e7a944c0db112bd49e9f52fd4afa17474b7e3db1e89d1aff6748712b708e0138ca1f530184330f626673863ea7143c47c7891d069a3a2e67
- SSDEEP 1536:d1UB160+s8+mU/3S83AaKAONAucFWQ5NUTbjIPd03fkx6e2Q9a:Y6fs8+S7aKAUACQ5Ngbt3m6e2Q9
- TLSH T13CD38D40E7A1D0D9F46BA835D5A3B63BEBF2751007108BC79384868EEE177D49E3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f1:d5:7c:30:eb:12:7a:4c:29:5a:df:74:36:c4:69:d2:59:f2:48:86:8d:3f:88:44:06:8b:15:9c:56:72:91:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
123724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\amd64\prl_umdd.pdb
msvcrt
__C_specific_handler
free
_initterm
malloc
_XcptFilter
_amsg_exit
memmove
memset
memcpy
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapAlloc
GetCurrentProcess
HeapFree
GetModuleHandleW
VirtualFree
GetProcessHeap
GetModuleFileNameW
FlushInstructionCache
VirtualAlloc
VirtualProtect
QueryPerformanceCounter
GetVersionExA
VirtualQuery
GetLastError
Sleep
user32
EnumDisplayDevicesA
EnumDisplayDevicesW
OpenAdapter
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=42, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/amd64/prl_umdd10.dl6
- IMPHASH d28fb4bd38e90d69c4069db55a549fdd
- SHA256 3175034d35ae122cc91c9264c0758b65e988c3f2ad2e002c070e5eda5cd185e0
- MD5 9a3618c073a6225d97daf69ba9f7e1a3
- SHA1 e08af6e5332574155cdb7310d932b14bd75abd3c
- SHA512 4fddcba39055ebbda7cf0cf17111cdd5949d8d5abde15e402e2a355a5a186b8b3a2821a70cce4ad81c161bfce72601e1eee48accfd6b260afa2e6366cfd9b258
- SSDEEP 3072:+66XypGQott3IrUWwZQQ5NSc71EHevNft:WXyYQyt3FQyZr
- TLSH T164C38E55F2A180E9F1AB9035E2D29B3BEBF5741047009BCB5284868DBF17BE19E3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
15:56:89:64:ed:7d:6c:02:c3:33:ff:5d:be:62:ef:2f:a9:ed:39:bd:09:de:f4:23:2b:05:e7:fb:b2:0d:05:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
112620
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\amd64\prl_umdd10.pdb
msvcrt
_amsg_exit
free
_initterm
malloc
_XcptFilter
__C_specific_handler
memmove
memcpy
memset
kernel32
FlushInstructionCache
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapAlloc
GetCurrentProcess
QueryPerformanceCounter
HeapFree
GetModuleHandleW
VirtualFree
GetProcessHeap
GetModuleFileNameW
Sleep
VirtualAlloc
VirtualProtect
QueryPerformanceFrequency
OpenAdapter10
OpenAdapter10_2
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/i386/prl_gldd.dl3
- IMPHASH 071c0372b2839c0d6300a73c3fe32672
- SHA256 59bce86160f8e76e400c53aba87bda8e9244558a2197586711b1570e407a7009
- MD5 1bf205bda53185512a2af292f5f29483
- SHA1 bac8a7c95002c0a333e512671ab3adff7a04a0ac
- SHA512 79a868dff8ebb449a7cdbb91bbe00eefb7890956c0a4f4964eeadec658c5e1f826afa13d79325a54bfa3a9541ff03918d28529bd82f1960f38e4385247c07960
- SSDEEP 6144:q/VaAGTkqi94qmKyMftuMAxEHAIzTYKPAvTM3F3B:BigUubxEHAIzTYKPAvTM3Fx
- TLSH T13D3409539C10C7FDF9C1B5F10AAE34EA253E916B933372CB286896F2D4465E119B21CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5f:f7:97:00:c3:67:e6:59:9f:9e:42:8f:50:08:40:2e:b1:68:6d:ae:96:fa:03:ab:11:05:11:bd:7c:9c:a2:ad
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
212255
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\i386\prl_gldd.pdb
msvcrt
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_CIsqrt
_CIcos
_CIsin
_purecall
strrchr
strtol
strncat
_ftol2_sse
memmove
memset
strncmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
TlsGetValue
TlsFree
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
TlsAlloc
GetCurrentThreadId
DeleteCriticalSection
SetLastError
GetCurrentProcessId
TlsSetValue
GetModuleFileNameW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
user32
GetWindowLongA
CreateWindowExW
DestroyWindow
SetWindowLongA
UnregisterClassW
IsWindowVisible
GetMonitorInfoW
MonitorFromPoint
UnhookWindowsHookEx
CallNextHookEx
GetAncestor
SetWindowsHookExW
GetWindowThreadProcessId
MonitorFromWindow
GetForegroundWindow
ReleaseDC
GetDC
GetWindowInfo
GetClientRect
WindowFromDC
DefWindowProcA
RegisterClassW
GetClassLongA
gdi32
D3DKMTSetDisplayMode
D3DKMTCloseAdapter
D3DKMTDestroyDevice
D3DKMTCreateContext
SetPixelFormat
D3DKMTQueryResourceInfo
D3DKMTOpenResource
D3DKMTRender
D3DKMTWaitForIdle
D3DKMTPresent
D3DKMTQueryAdapterInfo
D3DKMTEscape
D3DKMTCreateAllocation
D3DKMTDestroyAllocation
D3DKMTSetVidPnSourceOwner
GetPixelFormat
D3DKMTDestroyContext
D3DKMTOpenAdapterFromGdiDisplayName
D3DKMTCreateDevice
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
Name
.text
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=123, productName=VS2005 build 50727, version=50727,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/i386/prl_umdd.dl3
- IMPHASH ea301d794b45e2d896a436222b95619e
- SHA256 070b96f92dacb9ebe4d6f62a3fa3cc2da00e9364357151668aa61c1ce22d77fa
- MD5 5ee2848abcd869dd1a86828081cb8cb2
- SHA1 e461475892065088282e2ba0e840e760648337cc
- SHA512 f9cd6588228ad62bcaf365b37a73f9aabfc056515707464497c1e8e52fe746d1d001047dfd5952aeaf0905e9d33dca3d23c10829e421dfc72ccc6ad440717065
- SSDEEP 3072:mojXDMSxj7I7OWxXNKZ0q3Lmd9dnOVchC:XjTlfC9KZT8dS
- TLSH T1BAC38DB0D64081A8D4F625B1242EB23666BD6F6683B189CB1EC94BD67F54740CF3E34B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
01:58:a9:02:35:ba:5f:2a:e2:09:01:e1:0f:34:e1:20:2e:43:da:29:20:6e:1b:2e:dc:4d:67:7a:eb:58:de:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
107411
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\i386\prl_umdd.pdb
msvcrt
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
memmove
_ftol2
memset
memcpy
kernel32
GetCurrentProcess
GetLastError
VirtualAlloc
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
HeapFree
HeapAlloc
VirtualFree
GetModuleFileNameW
GetModuleHandleW
FlushInstructionCache
GetVersionExA
VirtualProtect
InterlockedExchange
user32
EnumDisplayDevicesW
EnumDisplayDevicesA
OpenAdapter
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/i386/prl_umdd10.dl3
- IMPHASH ce725cdb0dd7886570976a86ff5b125e
- SHA256 d380645736098bb7b4639a2df1bc3a73d5ce7efa47cfe6c147c5d785480aaf78
- MD5 087c08522603f3c0873487b5bfb6e771
- SHA1 a81fdc85f4578f58627d6e740fdf602d93cc08ad
- SHA512 fd57fe424b68d64de32f9676866b67cd0ade4fe731d74b79ab8ed1b070e9bdfdbc2e834105c29b307bc52a974f319b8f4f6d9503f4e181a882c67246e61171f7
- SSDEEP 3072:AKRLyIrjen2WtXHTsFFQNtMlWDGcXCTy:BuIrvm3TsUeW
- TLSH T11AB38D90EA5081F8C5E626F4267FB63596BD6B9283B345CB1D841BC2BA24790CF3D347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
80:ee:64:7c:68:99:b6:e8:30:d9:9e:c3:81:ab:2b:95:02:2c:11:01:0c:eb:37:70:a7:45:a6:07:74:f2:3b:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
103254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\i386\prl_umdd10.pdb
msvcrt
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
memmove
_ftol2
memset
memcpy
kernel32
FlushInstructionCache
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter
QueryPerformanceFrequency
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GetModuleHandleW
GetCurrentProcess
VirtualProtect
GetProcessHeap
OpenAdapter10
OpenAdapter10_2
Name
.text
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_dd/prl_dd.inf
- SHA256 6b726b42ccd5c415aedac078acf0374fcb01c5f9238b9ed428359407797e045c
- MD5 5e2e171056bf7ee8c18f37ac96c84255
- SHA1 56e4c19875f7c17c448f2ec3098ef361e3592373
- SHA512 73343251bce861f552ccfe44f62c33d566f43b1339f73d63e88e2fa3d581a16d843bfa7c47dd2dcc56f4fd3af1b1ec8861cae24a3a55ac4d11cbcc05deef4ecc
- TLSH T1FC6114B301031AB4F1827B8471371ADFAA712000A494796FFADAD47D1F8AC195638DF9
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_dd/prl_dd_x64.cat
- SHA256 cf4a0d1628259ff3d86e8fb160fa8f4b3a51e2d3856d4adb087314a3436931fd
- MD5 8e4a5ebc45e7c100e6e90e897170a61b
- SHA1 d73246d38eefb4e0f9acd28b3151666e269b4e64
- SHA512 12eb336c0b74007fdb7e179a3610214d67b818786797bb11436fe6285325d875db8c39882909eaf6072fbfbd8393514737137b784e67374f652d8f182111b62f
- SSDEEP 192:ahIVcBgePD/7ag95nccAlwBjtlAMuasnZHI1:U/h8OUnPnhI1
- TLSH T10042E8BE0A9D1592F997C4726AD0D51FE831BB52F84885BF305BA3904FC23817B5C52D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_eth5/amd64/prl_eth5.sys
- IMPHASH 8121189fc500112fc5d58ff8ff0e442a
- SHA256 76fda8e8975502f0d12bd10681157bd8d607520d3545b990b1f608ac41cd9252
- MD5 a0afbac16d47658a0a3259aa1aa3fd04
- SHA1 8ddf36370c555b246edadb6ff6044b5065f7ad6e
- SHA512 d8462f2a4835dca3e72ccf98ed67bcde1932ed14b73a918455aad5dbdb4e4e36f49ddb2f7619577ba24b59b7524071aacfa28053bcc812b5a26c4a4d28e08a5c
- SSDEEP 384:Z+V3h7uxPdTBBBu8guzT0HMXaX3jpnYPLQa6jOLeMeQxZ:mhuHBBZvCMXanjpymy
- TLSH T1ECB25C970A6410EFE9E38A34D9F6DA379D32B1502F5A47CF82A0814B5E06FE05B39709
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:90:9a:ff:9b:c5:f5:de:a3:ef:6c:62:f6:fb:91:c2:94:1d:1b:16
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
24736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_eth5.pdb
ntoskrnl.exe
KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
DbgPrint
KeAcquireSpinLockAtDpcLevel
MmMapLockedPagesSpecifyCache
KeReleaseSpinLockFromDpcLevel
IoFreeMdl
KeReleaseSpinLock
ndis.sys
NdisMRegisterMiniport
NdisMRegisterIoPortRange
NdisMMapIoSpace
NdisAllocateMemoryWithTag
NdisAllocateBuffer
NdisMSynchronizeWithInterrupt
NdisDprAllocatePacket
NdisMDeregisterIoPortRange
NdisFreeBufferPool
NdisFreePacket
NdisAllocatePacket
NdisOpenConfiguration
NdisMRegisterAdapterShutdownHandler
NdisMSleep
NdisFreePacketPool
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisMCancelTimer
NdisMUnmapIoSpace
NdisCloseConfiguration
NdisMDeregisterInterrupt
NdisFreeMemory
NdisAllocatePacketPool
NdisMRegisterInterrupt
NdisInitializeWrapper
NdisMSetAttributesEx
NdisAllocateBufferPool
NdisDprFreePacket
NdisMDeregisterAdapterShutdownHandler
NdisSetTimer
NdisMInitializeTimer
NdisMQueryAdapterResources
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
740B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_eth5/prl_eth5.inf
- SHA256 92cc310a241d43172fba005a94893b7658d2de4758cc7af24018e8ff68d547f5
- MD5 15d7668210486b44f971488867b300f5
- SHA1 2aed51fe8064505fa97bb192cb82f5a594a4b28d
- SHA512 5403337fef1821f4afe95e5c39f5c341db7742526d36e8652c7df25e1e1e0255bda401580e559f6e5ed57f71c06df23d3270785880032a621d60841962535830
- TLSH T17F412303188637F4A54D279443B28AF6A138404261BB449DFAEC895B27CBD2D8258B98
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_eth5/prl_eth5_x64.cat
- SHA256 6e0de062a2e0deaf198912522e85471d7d89d5a37315d3b9288d329f5b3c2e05
- MD5 99962e3b0c91535631b5bfbd72d5b836
- SHA1 8bc3aa64494f640054dd38ca21a32afb7e2019c5
- SHA512 531e463243d0fd90eab7352d003eecea41efaceaefbf41af6855d48752e2bfb4866ac9e3a4421bccf4565e5bb19fa7648d1c2eaabbd5d5ea14d83290a57f8225
- SSDEEP 192:Yq22oEhd9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6BDB8r:zVpznYPLQa6jOLeMD6
- TLSH T1BA32D7DB196C1493FD97CD70D6F6D46BEC31B3C66D88542E50BB87911E82BA03B6900E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_fs/amd64/prl_fs.sys
- IMPHASH 24500a380408fea03a0c6e4698d4375e
- SHA256 9e524901c7424213836dd904699ea409d0905403f60836f80b4205fc34eed8ce
- MD5 26233698e63183e5c4dbef88a8ffbe93
- SHA1 b5041ccee657399ece682d3b0f586d026f41cba5
- SHA512 22459a2e221efd2625d296917ec3c81490f98bb0ea2ca9a800f04badc1d4e0f6fe1977113939f55f1605e14b1449bbd018d7e1f6db64d81ffb444aec35fa1cbb
- SSDEEP 3072:N/360FeJf+U9xs+9Qvs4NpdelJ+PTK9fITcxAyFeMfjUKDds/LanZ2HqYPj:ZjFeJWyx8vs4n4lJ+1cVJjg/Lkmq+j
- TLSH T1DC144CA7D2F514E5C8BBC1B5CAA39657FE717804472893DF01A0C7521B27FE0AA39329
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
4a:44:98:53:5a:8a:5c:67:c6:53:d4:3e:cb:3b:65:c4:80:62:d5:8b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
200804
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_fs.pdb
ntoskrnl.exe
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoFreeWorkItem
KeWaitForSingleObject
IoQueueWorkItem
IoCancelIrp
KeSetEvent
IoAllocateWorkItem
KeInitializeEvent
IofCallDriver
RtlInitUnicodeString
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwCreateFile
ZwClose
ObReferenceObjectByHandle
ObfDereferenceObject
FsRtlIsNameInExpression
RtlFreeUnicodeString
RtlUpcaseUnicodeString
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ObfReferenceObject
PsGetVersion
IoDeleteSymbolicLink
IofCompleteRequest
ZwQueryValueKey
ZwOpenKey
ExIsResourceAcquiredExclusiveLite
IoGetCurrentProcess
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
IoAllocateIrp
MmProbeAndLockPages
IoFreeIrp
MmUnlockPages
KeBugCheckEx
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
KeSetTimer
ExRaiseStatus
FsRtlIsNtstatusExpected
MmMapLockedPagesSpecifyCache
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
SeTokenIsRestricted
SeQueryAuthenticationIdToken
SeQuerySessionIdToken
SeQueryInformationToken
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExInitializeResourceLite
FsRtlInitializeFileLock
ExDeleteResourceLite
FsRtlUninitializeFileLock
KeReleaseMutex
IoIsOperationSynchronous
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExpInterlockedPushEntrySList
DbgPrint
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExIsResourceAcquiredSharedLite
ExReleaseResourceForThreadLite
ExAcquireResourceSharedLite
MmQuerySystemSize
RtlGetVersion
ZwQuerySystemInformation
KeInitializeQueue
KeRundownQueue
PsIsThreadTerminating
PsCreateSystemThread
KeResetEvent
ExFreePoolWithTag
ObReferenceObjectByPointer
PsThreadType
KeRemoveQueue
KeInsertQueue
IoGetTopLevelIrp
IoSetTopLevelIrp
MmForceSectionClosed
MmFlushImageSection
KeQueryTimeIncrement
MmCanFileBeTruncated
CcFlushCache
CcPurgeCacheSection
RtlUpcaseUnicodeChar
ExConvertExclusiveToSharedLite
IoReleaseCancelSpinLock
KeInitializeMutex
ExFreePool
ExInitializeNPagedLookasideList
MmGetSystemRoutineAddress
ExDeleteNPagedLookasideList
IoWMIRegistrationControl
IoCreateDevice
IoRegisterFileSystem
FsRtlRegisterUncProvider
IoDeleteDevice
IoUnregisterFileSystem
FsRtlDeregisterUncProvider
SeCaptureSubjectContext
SeReleaseSubjectContext
KeEnterCriticalRegion
KeLeaveCriticalRegion
IoGetStackLimits
ExQueueWorkItem
FsRtlProcessFileLock
IoGetRequestorProcess
FsRtlFastUnlockSingle
ExSetResourceOwnerPointer
RtlIntegerToUnicodeString
FsRtlDoesNameContainWildCards
CcSetFileSizes
IoCheckShareAccess
IoSetShareAccess
IoUpdateShareAccess
PsGetProcessImageFileName
RtlLengthSecurityDescriptor
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
IoRaiseInformationalHardError
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
KeClearEvent
IoFileObjectType
CcMdlReadComplete
CcMdlWriteComplete
CcUninitializeCacheMap
FsRtlPostStackOverflow
FsRtlCheckLockForReadAccess
CcInitializeCacheMap
CcCopyRead
CcMdlRead
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
IoRemoveShareAccess
FsRtlFastUnlockAll
RtlCompareMemory
IoCheckEaBufferValidity
FsRtlNormalizeNtstatus
ProbeForRead
ProbeForWrite
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlCreateUnicodeString
ZwOpenDirectoryObject
FsRtlCheckLockForWriteAccess
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
ExInterlockedAddUlong
RtlUnwindEx
PsTerminateSystemThread
ExAllocatePoolWithTag
LsaFreeReturnBuffer
CcFastCopyRead
IoGetRelatedDeviceObject
CcZeroData
CcFastCopyWrite
ExAllocatePool
ksecdd.sys
GetSecurityUserInfo
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=128, version=50727,
count=175, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=24, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_fs/amd64/prl_np.dl6
- IMPHASH 4238d27184e4bef682b1bd5b5306ae57
- SHA256 fd33d547c2e6e4d1b4fc9b4875391fae8375bae9a0a7a52b6f596d647fbca4fb
- MD5 b21aabff0a7760dcbacda7c795bc79c4
- SHA1 10e9b619797f58832f5e2165f8f0970242cb5feb
- SHA512 60c1091f53b091f9b0eacb60bc9c565e047fa0f7670216b31ae260ae804a99d3affdcf4c7976226dd4fe1696ce7271f273386bd9179f6a110341667a67dcd0b0
- SSDEEP 768:Ywt0U7ep4x4xUNLWkkwuDZTuVwRIMvnpvnmVi36ymc:1Ni0XRWbFTMlMvZ6i30c
- TLSH T168235C56BB6D4035E1E7C4BDC6E3CB1ADA7274917F2922DB1360835E0E67BE09339212
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9b:45:b5:6f:4e:2b:b0:e7:01:33:d2:28:66:5b:51:b0:4c:a0:02:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
25952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_np.pdb
msvcrt
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
??1type_info@@UEAA@XZ
memcpy
memset
memmove
_unlock
__dllonexit
_lock
_onexit
_callnewh
malloc
free
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_errno
__CxxFrameHandler
??0exception@@QEAA@XZ
toupper
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
iswalpha
wcsstr
_wcsnicmp
_wcsicmp
kernel32
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
VirtualProtect
LocalFree
CloseHandle
DeviceIoControl
QueryDosDeviceW
LocalAlloc
DefineDosDeviceW
GetLastError
CreateFileW
SetUnhandledExceptionFilter
NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPFormatNetworkName
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPOpenEnum
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_fs/i386/prl_np.dl3
- IMPHASH 76ffea62b7e11aa64d5ba11c0bfd1d04
- SHA256 1d6781f7a107819862d9b8ff53458b6d3866fd1844bf40ca1bca7d48c625a29b
- MD5 86ddc61606ab2fc19cde1ac9c7e8ca3b
- SHA1 50e1bf85d11ee4dcaeef76e731d7ef18dd47424e
- SHA512 1cbf8f6c5e8d304b8bbf5ad5d181f5277341fd6cd2c36865aed2a6da4478fe96a7de6d0b0ca367795cebe6686e92aca448a54ac03cc826afb419453671e72983
- SSDEEP 384:Zi5qBpiNR5O7oSkKxnJiSuWs3Zo1TdFpDgRABAvnMsModlIgMpcoJTsZw1cNVRn7:ZkqBwmJRuxG1pcRDlMfv1c1ym5
- TLSH T111036A233A4482B6D9DB22B855CDB23655BCE2F01FB152C76A2943E9DEA47D11F301CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
cf:89:80:32:1b:e4:e1:0d:81:1e:21:23:8f:f6:3a:81:c9:ba:af:22
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
21845
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\i386\prl_np.pdb
msvcrt
free
_callnewh
malloc
_XcptFilter
_initterm
_amsg_exit
??1type_info@@UAE@XZ
memmove
_unlock
__dllonexit
_lock
_onexit
_errno
__CxxFrameHandler
??0exception@@QAE@XZ
wcsstr
_wcsicmp
_wcsnicmp
memset
iswalpha
_CxxThrowException
memcpy
toupper
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
QueryDosDeviceW
DefineDosDeviceW
LocalFree
CreateFileW
DeviceIoControl
GetLastError
CloseHandle
NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPFormatNetworkName
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPOpenEnum
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_fs/prl_fs.inf
- SHA256 2f9fbb11a6eaee58c2d9a384f9afcc9217a1b009cf1c85b4d848d02e33077876
- MD5 d3a897cfde0bb3e49995e8373d929320
- SHA1 a2d7dd947a992fe6bf5f415c1f1dafa07a651c7c
- SHA512 1f2ec0dbcf396c8b3d9c059199eca947082229f622ebe9c3bbd4903f34435c2e78237079edd3b7312f04e964ecee9a411683189d12e20cce23f0d6b848d98aec
- TLSH T19A51FFA7068773B874423B40621399E6F2A8A400685E406FB7EDC426DFCBC0C561CEF5
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_fs/prl_fs_x64.cat
- SHA256 643cfd23b3f7c7b4cbef43c747aa596f2bbf5c6f199c33fcc8e5d70d7d98b384
- MD5 5b6d2722d51a4afe1795d4af8eb37820
- SHA1 e0c3f3990ced017aec8fefd526dfeaa674337ef2
- SHA512 cc1fab32c33b4eeb5c426b9369f919a10c48d44e691b9e483bf4d085687c54f0fbe17fe735a6fec95a60c10452357f8d41eb24e9a953cccf88359cee4ba4ddde
- SSDEEP 192:Ki71ZwueM9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6Ru29:FpznYPLQa6jOLeMDZ
- TLSH T1A142E6DB069910A3E997CE70D6F6D4ABEC31B3D6BD48543E11BB83D11E827A0376940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_fs/upgrade_temp/prl_fs.sys
- IMPHASH 24500a380408fea03a0c6e4698d4375e
- SHA256 9e524901c7424213836dd904699ea409d0905403f60836f80b4205fc34eed8ce
- MD5 26233698e63183e5c4dbef88a8ffbe93
- SHA1 b5041ccee657399ece682d3b0f586d026f41cba5
- SHA512 22459a2e221efd2625d296917ec3c81490f98bb0ea2ca9a800f04badc1d4e0f6fe1977113939f55f1605e14b1449bbd018d7e1f6db64d81ffb444aec35fa1cbb
- SSDEEP 3072:N/360FeJf+U9xs+9Qvs4NpdelJ+PTK9fITcxAyFeMfjUKDds/LanZ2HqYPj:ZjFeJWyx8vs4n4lJ+1cVJjg/Lkmq+j
- TLSH T1DC144CA7D2F514E5C8BBC1B5CAA39657FE717804472893DF01A0C7521B27FE0AA39329
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
4a:44:98:53:5a:8a:5c:67:c6:53:d4:3e:cb:3b:65:c4:80:62:d5:8b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
200804
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_fs.pdb
ntoskrnl.exe
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoFreeWorkItem
KeWaitForSingleObject
IoQueueWorkItem
IoCancelIrp
KeSetEvent
IoAllocateWorkItem
KeInitializeEvent
IofCallDriver
RtlInitUnicodeString
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwCreateFile
ZwClose
ObReferenceObjectByHandle
ObfDereferenceObject
FsRtlIsNameInExpression
RtlFreeUnicodeString
RtlUpcaseUnicodeString
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ObfReferenceObject
PsGetVersion
IoDeleteSymbolicLink
IofCompleteRequest
ZwQueryValueKey
ZwOpenKey
ExIsResourceAcquiredExclusiveLite
IoGetCurrentProcess
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
IoAllocateIrp
MmProbeAndLockPages
IoFreeIrp
MmUnlockPages
KeBugCheckEx
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
KeSetTimer
ExRaiseStatus
FsRtlIsNtstatusExpected
MmMapLockedPagesSpecifyCache
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
SeTokenIsRestricted
SeQueryAuthenticationIdToken
SeQuerySessionIdToken
SeQueryInformationToken
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExInitializeResourceLite
FsRtlInitializeFileLock
ExDeleteResourceLite
FsRtlUninitializeFileLock
KeReleaseMutex
IoIsOperationSynchronous
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExpInterlockedPushEntrySList
DbgPrint
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExIsResourceAcquiredSharedLite
ExReleaseResourceForThreadLite
ExAcquireResourceSharedLite
MmQuerySystemSize
RtlGetVersion
ZwQuerySystemInformation
KeInitializeQueue
KeRundownQueue
PsIsThreadTerminating
PsCreateSystemThread
KeResetEvent
ExFreePoolWithTag
ObReferenceObjectByPointer
PsThreadType
KeRemoveQueue
KeInsertQueue
IoGetTopLevelIrp
IoSetTopLevelIrp
MmForceSectionClosed
MmFlushImageSection
KeQueryTimeIncrement
MmCanFileBeTruncated
CcFlushCache
CcPurgeCacheSection
RtlUpcaseUnicodeChar
ExConvertExclusiveToSharedLite
IoReleaseCancelSpinLock
KeInitializeMutex
ExFreePool
ExInitializeNPagedLookasideList
MmGetSystemRoutineAddress
ExDeleteNPagedLookasideList
IoWMIRegistrationControl
IoCreateDevice
IoRegisterFileSystem
FsRtlRegisterUncProvider
IoDeleteDevice
IoUnregisterFileSystem
FsRtlDeregisterUncProvider
SeCaptureSubjectContext
SeReleaseSubjectContext
KeEnterCriticalRegion
KeLeaveCriticalRegion
IoGetStackLimits
ExQueueWorkItem
FsRtlProcessFileLock
IoGetRequestorProcess
FsRtlFastUnlockSingle
ExSetResourceOwnerPointer
RtlIntegerToUnicodeString
FsRtlDoesNameContainWildCards
CcSetFileSizes
IoCheckShareAccess
IoSetShareAccess
IoUpdateShareAccess
PsGetProcessImageFileName
RtlLengthSecurityDescriptor
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
IoRaiseInformationalHardError
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
KeClearEvent
IoFileObjectType
CcMdlReadComplete
CcMdlWriteComplete
CcUninitializeCacheMap
FsRtlPostStackOverflow
FsRtlCheckLockForReadAccess
CcInitializeCacheMap
CcCopyRead
CcMdlRead
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
IoRemoveShareAccess
FsRtlFastUnlockAll
RtlCompareMemory
IoCheckEaBufferValidity
FsRtlNormalizeNtstatus
ProbeForRead
ProbeForWrite
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlCreateUnicodeString
ZwOpenDirectoryObject
FsRtlCheckLockForWriteAccess
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
ExInterlockedAddUlong
RtlUnwindEx
PsTerminateSystemThread
ExAllocatePoolWithTag
LsaFreeReturnBuffer
CcFastCopyRead
IoGetRelatedDeviceObject
CcZeroData
CcFastCopyWrite
ExAllocatePool
ksecdd.sys
GetSecurityUserInfo
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=128, version=50727,
count=175, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=125, productName=VS2005 build 50727, version=50727,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=24, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_memdev/amd64/prl_memdev.sys
- IMPHASH f6fe809d09514e0ec15b4c8043f40ad7
- SHA256 d196a94dcf1ef6c578a55698e0be1dc6c3ab4781e1ea46e01a0720345dd08ad9
- MD5 ea05d08dfcb3d5d23071c459d125eb01
- SHA1 459b2c615129d8b0a1552d5923a7cc1da1c8eb7f
- SHA512 756e301832e3e30e9cd8244c5fec61164fdf6c5df844f053047837513e49358d5d6956f7ea789886783a4362cc259619d2280c6643b737f556ae49420b5d556f
- SSDEEP 384:f0YoNpg/rYOuUuMFnRmiAg10HM1LC3dilxBnYPLQa6jOLeM2:4NWxuoRa+CM1LEdm7ymf
- TLSH T1E7A23A9B1364286AEEC7C879C6D6C6ABDEB0B1506B5556CF4074C1CA1F43FE1273A20A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
da:9b:b4:e6:db:a8:5e:02:7e:ae:07:47:17:f1:79:5e:0a:42:47:a7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_memdev.pdb
ntoskrnl.exe
ExFreePoolWithTag
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
IofCallDriver
MmUnmapLockedPages
ExAllocatePoolWithTag
MmAllocatePagesForMdl
MmGetPhysicalAddress
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeInitializeDpc
MmFreeContiguousMemory
PsCreateSystemThread
PsTerminateSystemThread
KeInsertQueueDpc
ZwClose
IoConnectInterrupt
ObReferenceObjectByHandle
ObfDereferenceObject
IoDisconnectInterrupt
KeSynchronizeExecution
MmAllocateContiguousMemory
IoFreeWorkItem
IoDetachDevice
PoRequestPowerIrp
PoSetPowerState
IoAllocateWorkItem
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
PoCallDriver
IoQueueWorkItem
KeBugCheckEx
ExAllocatePool
ExFreePool
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=46, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_memdev/prl_memdev.inf
- SHA256 06b614c14f38ff2c1a0f064196b8b778ccc2c602a3cb0a891dcb07d7e4ece924
- MD5 1e0fb7ecf00d0069f14805252c1afafc
- SHA1 c2f582c8142c412c2bed55257e89e42194e5a986
- SHA512 e0649308d505fa1f135cb12cdd174115aa0132d19f822a4fda6d1ceb6dcbeec2ad9e655b8d9c954c6d15e038055ea71cbe7c55ee9a77c2891029d282ef2f3585
- TLSH T14E41EF1F0187EBB0EC252749B6EF6293B23F200156974C64F7DC683D4798D489B3A384
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_memdev/prl_memdev_x64.cat
- SHA256 9d3b5f2aef0019413a109745961fbb2ed9e7675b35cd8c51d808046ed88186b7
- MD5 1b4ced81b3b6a162c67ae92da7510100
- SHA1 816777845b25a26ceba4883a34994b343b4ba9a4
- SHA512 e5c4ae68aa0d5146a997fef49ef28858d6b3a510ad5a0997256286a6020f485fabff0dc225581c8af28efd04456f9571de6b6ca437199f80fa434c7c0ad8db95
- SSDEEP 192:MZJEmxInfZJr9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6qMX4:MZefZrpznYPLQa6jOLeMDqR
- TLSH T13332D7DB055D14A3F9D7CE30C6F6D56BEC31B3D2AD88542E10BA87911D82BE17B6800E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_mouf/amd64/prl_mouf.sys
- IMPHASH 55d25eb472136da1f8fc8f90ddaeb0d5
- SHA256 33086ab4f11c4e09eec4b59b0c3601d12ced2118ca204b3fa22c92fd78e53578
- MD5 ed733672bf5dce3c3ff46fb81f5d4978
- SHA1 a8e822a511cfc41c05af3418c4ab29297a1e1f63
- SHA512 7db0455a08b8b79aa98220a3d40e0df898082e110cf58aed8c463dcb5b61de9e7ca347fb1467690bffb14b8b1fbfe3beaf0ae290894d1dbdb8d647cf29219fc9
- SSDEEP 384:mflIkxx7WkwbAxXx3JeDp0HvQnFF60toAULOUKHPnh:mlJUkth6CobFULeh
- TLSH T185A25B9687282482F9F7CE36A4D1C617EE70B950AB79C6DF2025C1496F41BE1B63C326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
30:f3:a2:67:11:14:4c:39:82:f3:f4:76:ae:18:22:89:30:85:ba:46:dc:d8:7c:a1:f8:03:a2:37:16:05:11:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Chains
Nov 6, 2026
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Virtuozzo International GmbH,OU=RnD,O=Virtuozzo International GmbH,L=SCHAFFHAUSEN,ST=SCHAFFHAUSEN,C=CH
Serial Number
5a:93:96:7a:fe:10:0b:b2:07:d5:75:1b:ee:f0:b1:a6
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 12, 2017 - Dec 7, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
28680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\Drivers\amd64\prl_mouf.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
RtlEqualUnicodeString
PoStartNextPowerIrp
IofCompleteRequest
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateDevice
IoGetDeviceProperty
IofCallDriver
ExAllocatePool
ExFreePool
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_mouf/prl_mouf.inf
- SHA256 f69f43c5d103e906ae3fdfaf1eeb81d1a4c2a4955f3f789bd8adba8bdfb0d5d1
- MD5 8dc64c8ea3f8f0bee87bf79635958445
- SHA1 2d752eb9a63066fe09df43ad42977a42a5716e06
- SHA512 ec18c128fc7d84aabb1cc0c18a70fb94ade3a0997e1481e0b7ff8d7e930cfc7eb1c050e2e547006072a95f6bd2a6c60e7e6f80f7908fb27919b6e39148964ec6
- TLSH T12C7134CF58480EF0B8077379BB93699763653408C0DB62577BFC8454ABE4C0C9319ADA
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_mouf/prl_mouf_x64.cat
- SHA256 59948a5af92f606b742caba29e9faa368858584a8cdaccd50d07e6a20b8ed29b
- MD5 f7574f24bbf823f9f20cfb91bc5cd975
- SHA1 a366cb8be6b144817a0d663e296d85fa844afdd2
- SHA512 c71f3fb1a70bef66af60de61d4e01fdbe25245ce81ff7bf5310792b4cae8805e155a21de48cd6815f7c017e69c2d1c033a719e815b7961786c722e9d7367ac1f
- SSDEEP 96:g0mp5IWbxkmg95XEeRRcuDnCDGeeElfC9zSDi3s6TeDuHfw4pbTA/FCACaEGC9hL:g3p5I0g95nccAlwBjtlANWyuasnZHx
- TLSH T1EA221AEA0A5D2852FD97C83076E0D51FAD31B792B99884BB305ED3904FC2782775C22E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_net_inst.exe
- IMPHASH a77a98593c7f3f4d3280c765e03e3205
- SHA256 169bb0a0910d3f7953cd6f039aa1a83b057ba20d7b206d18230353013b6780ff
- MD5 d971fdfd2ee69f5d83d03619b8607fce
- SHA1 a3b073d75eb07cf6a3e9e943a8507ebb9e4624e6
- SHA512 a551e2ae0f0f81764312923e0b0a77709ca561063d25c526e63a94b7cc5fa8d891d4549e3e90cd45208de90b05f1b4c708a1fda8270074948ca4778770bdeb48
- SSDEEP 1536:0g9isUkdGIu4GqhxurRsxBS45WkPN/F1fUupW:0g0saIu4GG8RsxBS45ZzfUuk
- TLSH T19583496A77A444BAD1B7C17DC8E28B46D7B37825577503CF0325826A0F236E65E3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
22968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Drivers\amd64\prl_net_inst.pdb
advapi32
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
kernel32
FormatMessageA
GetSystemDirectoryW
CopyFileW
GetLastError
LocalFree
CreateFileW
SetStdHandle
WriteConsoleW
CloseHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
VirtualQuery
GetSystemInfo
GetVersionExW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
OutputDebugStringA
GetCPInfo
GetACP
GetOEMCP
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
Sleep
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
prl_net_install
InstallClientDriver
InstallPnpDriver
?ListNetAdapters@@YAHXZ
IsNetComponentInstalled
CleanupCachedInfFiles
?RemoveDriverFile@@YAHPEBG@Z
ListNetComponents
InstallProtocolDriver
UninstallProtocolDriver
InstallVMAdapter
UninstallPnpDriver
UninstallClientDriver
Name
.text
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=107, id=1, productName=Unmarked objects,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_net_install.dll
- IMPHASH 89d14f286648ac0d9170e17c8f340fa9
- SHA256 48285bf009e30b25c252d2f74d916efae8b62eb7de977f523cdd9210ee7f0dbd
- MD5 9099dea46fda3c0b961d95a3848b3f48
- SHA1 039c1cfcb167bc5b59d0dbe5bc7be404ee6b736b
- SHA512 faa45ddaa83332fb4283fa1a851124f71af57d0a4eecc8837905fe1a43acf17f6548a031e7b58dfda336a29f08e617b355984fb88bb1667b1317b21ebba1a85e
- SSDEEP 3072:Uy/adLmiHvH1zCf78cDixc08sdVJVRrqOTy+ev+mSIyFBcmi3Y9mS4gzAJm7B7:B/adLmiHvHVe8c+CZorq3pNSIaBSsXzr
- TLSH T109142959B3A4807AD0BBC17ED9D29785F6B278050B3247CB1361877E1E337E5963A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
74204
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Drivers\amd64\prl_net_install.pdb
ole32
StringFromGUID2
CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
advapi32
RegDeleteValueW
SetEntriesInAclW
BuildTrusteeWithSidW
AddAce
DeleteAce
CopySid
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegFlushKey
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetAclInformation
GetAce
EqualSid
GetLengthSid
setupapi
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsW
CM_Get_DevNode_Status_Ex
SetupDiGetDeviceInfoListDetailW
SetupDiGetDeviceInstanceIdW
SetupCopyOEMInfW
SetupDiGetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetINFClassW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
newdev
UpdateDriverForPlugAndPlayDevicesW
kernel32
SetEndOfFile
GetProcessHeap
GetCommandLineA
CreateFileW
CreateFileA
LoadLibraryExW
SetStdHandle
WriteConsoleW
ReadFile
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
VirtualProtect
GetStringTypeW
IsValidCodePage
IsValidLocale
GetVersionExW
LoadLibraryA
GetProcAddress
GetLastError
DeleteFileA
FindFirstFileW
FindNextFileW
FindClose
LoadLibraryW
VirtualQuery
FormatMessageW
LocalFree
SetLastError
LocalAlloc
lstrlenW
lstrcmpiW
DeleteFileW
Sleep
GetWindowsDirectoryW
GetCurrentProcess
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FlsSetValue
HeapFree
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
RaiseException
RtlPcToFileHeader
HeapAlloc
RtlUnwindEx
LCMapStringW
MultiByteToWideChar
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
GetACP
GetOEMCP
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
?AdapterIsEnabled@@YAHPEAUNetAdapterFind@@PEAH@Z
?EnableAdapter@@YAHPEAUNetAdapterFind@@H@Z
?FindCloseAdapter@@YAXPEAUNetAdapterFind@@@Z
?FindFirstNetAdapter@@YAPEAUNetAdapterFind@@XZ
?FindIfComponentInstalled@@YAJPEBG@Z
?FindNextAdapter@@YAHPEAUNetAdapterFind@@@Z
?GetAdapterDescription@@YAHPEAUNetAdapterFind@@PEAPEAGPEAK@Z
?GetAdapterHardwareIds@@YAHPEAUNetAdapterFind@@PEAPEAGPEAK@Z
?GetAdapterInstanceId@@YAHPEAUNetAdapterFind@@QEAG@Z
?HrInstallNetComponent@@YAJPEBGW4NetClass@@0@Z
?HrIsComponentInstalled@@YAJPEBG@Z
?HrRebindNetAdapterDown@@YAJPEBG@Z
?HrShowBindingPathsOfComponent@@YAJPEBG@Z
?HrShowNetAdapters@@YAJXZ
?HrShowNetComponents@@YAJXZ
?HrStoreNetAdapterName@@YAJPEBGW4NetClass@@0@Z
?HrUninstallNetComponent@@YAJPEBG@Z
?ListNetAdapters@@YAHXZ
?RemoveDriverFile@@YAHPEBG@Z
CleanupCachedInfFiles
HrGetNetAdapterName
InstallClientDriver
InstallPnpDriver
InstallProtocolDriver
InstallVMAdapter
IsNetComponentInstalled
ListNetComponents
UninstallClientDriver
UninstallPnpDriver
UninstallProtocolDriver
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=153, id=1, productName=Unmarked objects,
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_pv/amd64/prl_pv64.sys
- IMPHASH 5160139df400406f6de624419aaded6f
- SHA256 fc8a0399b11d339e3a6a4a0fc1bf5db8f27630f6d2b87022bac368cd0fbd6a23
- MD5 e3fa367607f7112fada181d2aa3cad2e
- SHA1 4a3bae7cd8adc48cb5630f42e5bad05fdd65f09c
- SHA512 a40c1f2d2b0a61e2fbf2f17636a66b09f1a6421cfbb7ec309ff0a5fbd72bc97d20cbfef03b336097deb1d0f551a628ab283dc8bba09192445adf4568ea562e47
- SSDEEP 384:h7BHR3MimJXmLzskHE3z7xtq0HPLtuBZknYPLQa6jOLeMc:htHyNJwskKpUCPLtuBZkymh
- TLSH T1BFC319C2176010EAF9E7CA34DAD6C623EE71B6905F9597CF4474818A1E42FE06F3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
be:5a:90:ad:89:c7:59:68:1c:e9:a2:68:b8:e5:84:cd:57:c6:1e:49
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
122980
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_pv64.pdb
ntoskrnl.exe
PsGetVersion
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
PoRequestPowerIrp
PoSetPowerState
PoStartNextPowerIrp
IofCompleteRequest
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
IoCreateDevice
IofCallDriver
MmUnmapLockedPages
ExAllocatePoolWithTag
ExFreePoolWithTag
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
KeBugCheckEx
ExAllocatePool
ExFreePool
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pvstub
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_pv/prl_pv32.inf
- SHA256 e78d4b80de6f4d1d62136b6093504ee4b95154cc70b4018746c0d3196c5cbbf2
- MD5 914fde79d06a7ef2a1485b75f2535aa8
- SHA1 00653f368336635ddb0b3d7480f3e6f2f583a91f
- SHA512 ae326ac3255402e6b12ed42d5636d3291e26948418794e6fc5a816f1cb7e79697aeb67e797c73e8786b4903f69311ee63de092f0225660c25d625965610dadd2
- TLSH T1A941DDA311470EF0F85BA795B3B76693B176220120AD8C5EB3DCA122A7DDC18671C5D5
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_pv/prl_pv32_x64.cat
- SHA256 7119fde0ec1dd97fcec8a0c21e0cf717b337c85f873c93a5a308ffc81d7bc155
- MD5 bf127239d88650ea3d6d4210982cdc1d
- SHA1 fd14b20aaa1e385a1367d7f20d03a26ecebf2dcd
- SHA512 f59f26ade8a63fab866cfbe8eecbce99d214792ab2d1feda8ca9036833a7ec55dc7945866c4eff8f6eda53e9b30234464f51dfff4077fe8b1533355d586adbc5
- SSDEEP 192:jwsmDC8B9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6aB:jw9dpznYPLQa6jOLeMDu
- TLSH T12032D6C7195C0492FD978E70D6F2D4ABAC31B3C26D88582E11BB87911E82BE07B6940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_scsi/prl_scsi.inf
- SHA256 fe5c0f8b0f88ef3191ae650114c33e45720e9c0329301a28d78054fdbbe16526
- MD5 35933d29437afa336a41b387b46b3559
- SHA1 f1664329d4061803ed1c583169db4c5799223af6
- SHA512 60eff5140f21b7c38e902798d2a69b2204947e29b8aa55d634deb68b1c0e39e3495eb387c13abbc0971ad0e5635e1b582b0fa1c98e3b5be869da7ea82e3a42c6
- TLSH T1F8515467054B4DB0B1A73309BBE374D3A624604950D45814F3EC616747EED1CE778AEA
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_scsi/prl_scsi.sys
- IMPHASH 0bc40c9cd51662cc6d3c3d8b8cff1fbd
- SHA256 112be01dbfc6559333e2148a8122d6d7f9039546ca08f4109555258e08a340a2
- MD5 5a4e54ccf88430acb2d25ff0ca219b47
- SHA1 6a1ac2fc54fe29e126a02c544c7bdeef10ad0c99
- SHA512 2b5dba92219eb5bdf1c61433d08d1bf5d58e9cb378d90dbf5a97d01b401fc248e9968e39267fc9aa9909cfb1d0bc9db77a483ea77461dd72686f773288665d39
- SSDEEP 768:5knEXycBoRuCY1pXH4b/9+6lTa6cdyZym3w:OEi4G+pXH4b/9xdJX3w
- TLSH T160E23B871B2604A2DF978279A7C29133ADF1B678179680DF01A544870F82FD7AB39D37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8f:ce:cf:8a:b8:d2:87:ff:a7:66:b4:a4:c1:5b:46:47:3e:2e:f9:e5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
37296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_scsi.pdb
storport.sys
StorPortPauseDevice
StorPortGetDeviceBase
StorPortResumeDevice
StorPortLogError
StorPortStallExecution
StorPortInitialize
StorPortNotification
StorPortCompleteRequest
StorPortReady
StorPortGetUncachedExtension
StorPortConvertUlongToPhysicalAddress
StorPortGetVirtualAddress
StorPortGetPhysicalAddress
StorPortValidateRange
StorPortDebugPrint
ntoskrnl.exe
KeBugCheckEx
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
780B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=1, productName=Unmarked objects,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_scsi/prl_scsi_x64.cat
- SHA256 9dbd540a51dc7e7da201011b52b68966cf0144489457644362e63c9bd0f80161
- MD5 9cff80c7563d2e83ff7ce5adba785b7c
- SHA1 af8534e3056f0150aa96c65b0a328d08de132fd1
- SHA512 cd4d42c5c53acba433f2be7a08f9cc68221276e75b8716854602f1035149be6e20e9caaca9d0b0a92da9be4343a37a99aaac71aba8a7b258ce3c94e522bedf34
- SSDEEP 192:kBk9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr67CG7b:tpznYPLQa6jOLeMD7xb
- TLSH T1E932E7D719691492FDD7CE60C6F6D5ABEC31B3C27D88542E40BA83D11E82BE07B6900E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_scsi/prl_scsi_x86.cat
- SHA256 4dd1029cf0cf423a9877c57d07a1a5a42bb32503077ebfed624940dd30a2ef16
- MD5 0cf8eb89d9ed77740d75eabb02d01272
- SHA1 e680e5e59af3f39f9bc9083362dcc9f95f48f148
- SHA512 05a14d7b9fe47fa91c553be9c40b41faa0da132d8b2ebac7a1bcd5b732e679e680aab8ab74bc752a8e4a1344bd916e5bac8474a5eebe3076cec7966f9a61314e
- SSDEEP 192:mTnTTSdyHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6mae9o:ETayznYPLQa6jOLeMDx
- TLSH T13032E8C7096D1492EDC7CE30D2E5D56BAC35B3C27D88542E04BB87D12E82BE07B6940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_sound/amd64/prl_sound.sys
- IMPHASH ede749f0571a9b65f5584472e46a7376
- SHA256 d92bde86eb56fdafe282b35c29dc8183a58d89c1d8a9d5b6fec13970e4f9785e
- MD5 525df9331a92e9a3b39e5478d9d1dacb
- SHA1 1e43e73b1dd1a0356dd7e416864ecab34f145167
- SHA512 8ceacdf281a5e8814971faf9c8a03405ecebf4be5cbe6c974a358464dfd2c6c207a28026f5e13e4d63d1aa4f7d0c9c19264cb0ce2c0c66b345f571e35b6d75a2
- SSDEEP 768:chEdI1mw/RZetaFw4iWaGEeDlONa4GYHPyPVqrMpNd/K8RSymy4:FImteDsNqPVbFK8Rsy4
- TLSH T198234A966AB82025F2B6817CCBE6C755DBB1B2D04B4583CF1262424E1F63FE61E39335
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
90:57:12:6b:71:21:59:21:e3:d2:88:65:f0:db:90:b9:a0:4a:2e:90
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
49272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_sound.pdb
ntoskrnl.exe
RtlInitUnicodeString
KeReleaseMutex
KeDelayExecutionThread
KeInitializeMutex
DbgPrint
ExAllocatePoolWithTag
KeBugCheckEx
KeWaitForSingleObject
ExFreePoolWithTag
ExFreePool
hal
KeStallExecutionProcessor
portcls.sys
PcRegisterPhysicalConnection
PcInitializeAdapterDriver
PcNewInterruptSync
PcNewPort
PcRegisterSubdevice
PcNewMiniport
PcNewServiceGroup
PcNewRegistryKey
PcAddAdapterDevice
PcRegisterAdapterPowerManagement
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
914B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
818B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=23, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_sound/prl_sound.inf
- SHA256 c0df12b018e3cb40b26439a172efbe9f973d937c1d41669b496a04ad4f6b9fbe
- MD5 ef5386c54e4bbeab07819dd0d99fa30a
- SHA1 7dbdc84115b736cee9688f02713a07d0e616b470
- SHA512 b40a8d0668e05c84895d357aae34873c4ea27128c15e2e59cd35460197a2e3ee3b09465732823e1300212c8dfdd683af42d6440d88a6ec92d415d6acd59c9877
- SSDEEP 384:0db9vHDWsQaJ1KW+2w9/ipVkNyPrHpACIp6sjuaBOBj0iDgH1PByXqZ+7ouhsI3C:C9F7E2rj6R9hQvzb8GHkL
- TLSH T11B92DCDB919A76A983531238E4533D42268234C0C7E65F803F9C668A6DCDDCE6EF1F94
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_sound/prl_sound_x64.cat
- SHA256 f8460d19ea3e25a0b6b33dbcb31d37627f35fd2311002739448c8b4d9db8db36
- MD5 44d415c13407892fe249d8208ab78fbd
- SHA1 d2619a1c3b3a2bbee1a4691fbae3d9b10d4e7fc6
- SHA512 3cce9fdbf518126b2f52ddd734317c1c96833010ead3d3486481c8b04883dc690e6cd81eea686bdc8b8f31c81e5dc9b9d4ce32d7df11691ddb4d17a1afc007cc
- SSDEEP 192:NU9at6o9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6fRi8aH:+wpznYPLQa6jOLeMDfMd
- TLSH T1A632D7D70A5D1493FDD78E30C6E2D5ABEC31B3C27D88542E41BA87911D82BD07B6941E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_strg/amd64/prl_strg.sys
- IMPHASH f2b1d27e73b9df8b9b7c4f3c87419813
- SHA256 d7091bd20a3aaf19e12ed4542a234d748428d52643594f8f0206cc8cfe624754
- MD5 4044227f010eacbf014ac3969c6fa750
- SHA1 647bc1584cd8d42674b4423f1be9c1a9dce1ea90
- SHA512 39ebde275d35418c3039431ecaad8524abc276e445b3c677c33b02726af079f07d9de54196909393f7079d789ab0294c9c26e53b0ffb179f9b49682f14473d73
- SSDEEP 768:80Z13WwHWvqxGEYUVhehXECMATXrANiNFym9:e3rxUGbLXeih9
- TLSH T1CA037C9793601869F9F7C678C6E5C61BEEB0B8405B199BCF016482C61F13FF0663A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
51:95:5b:4f:23:55:8d:3c:54:f8:04:c8:2b:0a:ee:85:f0:a5:21:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
42112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_strg.pdb
ntoskrnl.exe
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
_vsnprintf
MmGetSystemRoutineAddress
PsGetVersion
ZwQuerySystemInformation
IoInitializeRemoveLockEx
IoRegisterPlugPlayNotification
ZwOpenKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
ExInitializeNPagedLookasideList
ObfDereferenceObject
ExUnregisterCallback
IoReleaseRemoveLockAndWaitEx
IoGetDeviceObjectPointer
IoAcquireRemoveLockEx
ExCreateCallback
ExRegisterCallback
IoUnregisterPlugPlayNotification
ExDeleteNPagedLookasideList
PoStartNextPowerIrp
IofCompleteRequest
PoCallDriver
IoReleaseRemoveLockEx
IoAllocateWorkItem
IoQueueWorkItem
PoSetPowerState
IoFreeWorkItem
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
IoDeleteDevice
IoDetachDevice
KeInitializeEvent
KeSetEvent
IofCallDriver
KeWaitForSingleObject
IoFreeIrp
ExpInterlockedPushEntrySList
ExQueryDepthSList
DbgPrint
ExpInterlockedPopEntrySList
IoAllocateIrp
IoBuildDeviceIoControlRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
KeBugCheckEx
RtlCompareUnicodeString
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
MmFreeContiguousMemory
KeResetEvent
IoGetCurrentProcess
strncpy
KeDelayExecutionThread
IoCancelIrp
MmUnlockPages
IoFreeMdl
IoReleaseCancelSpinLock
ExFreePool
ExAllocatePool
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=64, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_strg/prl_strg.inf
- SHA256 7f56f3127d367c82c10c4e68714629155c8bd2fec44113227cf432e39d20d896
- MD5 c6d313b369949eb5d2cc40116da2a7ea
- SHA1 4af12a814817ea720fa1ea3ce7956952ee28b5b2
- SHA512 9ad1626b749107a644416610902de124551e298f6190a0f2a6901b720c88a1fe14aec6e5dad095fe21563e61cd42b1c00e9d6465582da4cfef3cce4310715acb
- TLSH T1D9310D4B4043ABB4612732E8E77B4D8291BD354A2985641876FD885377C2E2CCB7AF8D
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_strg/prl_strg_x64.cat
- SHA256 fb2ea8be7103c1d94ccc5f244a7204d2d39574a6a1154c7c825a6fc6f3e29ac4
- MD5 eedec708984ed219e3c680e4df2c8ca3
- SHA1 3f96191ec04d7e164a8b62341c717456c7395640
- SHA512 3779a2838718bd19655bd3d879788b540c68803a158494f481c7f0ddd7db68a2bb8f90036e8168a2d0b5ba1bcbd43e3c596b58755436e295396ac409396f1029
- SSDEEP 192:4nBID99pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6xEtpS:4ybpznYPLQa6jOLeMDqW
- TLSH T14732D6D7065D0493FDD78E70C6F2D46BAC71B3C26D88582E11BB87911E82BE07B2940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_tg/amd64/prl_tg.sys
- IMPHASH 81b4f0cf7cbfd4f3d598075059b555f7
- SHA256 1e9fa296d0c0e093c0152ff82f184864ac197212bca0ed41ddc8921832a4e9f3
- MD5 bacf09f6bb0c5fb94757e112df949f42
- SHA1 ff1b716860a8f4c85961ae425a017c8c2d587d5b
- SHA512 be4c4b87dc9ad9dfa528b9a1807c44d8c0427614ac0fc52e082ca36c00523e63ddb806c39511e0a6dae026055b8e8b178cc74c38dc15ae4186d0bd53492fd673
- SSDEEP 384:EfbNldkaE8I76TJYfPzr69UQ0oJqH0HkpltWTl+gunYPLQa6jOLeMB:Gb7dkBVvLO0YACkTtc+guymk
- TLSH T1F8C25BC717B4349AE9E7CA75D6D6D16BAEB0B1915F1086CF0070C68A1F07BE06B3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
56:d8:76:15:5d:ef:2a:c3:e1:25:b4:fd:64:56:0d:b6:97:f2:2e:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
16008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_tg.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
IoAcquireRemoveLockEx
IoDeleteSymbolicLink
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
RtlInitUnicodeString
IoDeleteDevice
IoIs32bitProcess
KeInitializeDpc
IoReleaseRemoveLockEx
KeReleaseSpinLock
IoDetachDevice
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseSpinLockFromDpcLevel
RtlFreeUnicodeString
ExFreePool
KeInsertQueueDpc
IofCompleteRequest
IoConnectInterrupt
MmProbeAndLockPages
IoAttachDeviceToDeviceStack
MmUnlockPages
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
IoDisconnectInterrupt
KeAcquireSpinLockAtDpcLevel
ExCreateCallback
IoReleaseCancelSpinLock
IoAllocateMdl
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeSetEvent
ExNotifyCallback
IoFreeWorkItem
KeInitializeEvent
PoRequestPowerIrp
PoSetPowerState
IoAllocateWorkItem
PoStartNextPowerIrp
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
PoCallDriver
IoQueueWorkItem
MmGetSystemRoutineAddress
PsGetVersion
KeBugCheckEx
ExAllocatePool
__C_specific_handler
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
640B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
128B
Virtual Size
11B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=54, id=1, productName=Unmarked objects,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_tg/prl_tg.inf
- SHA256 0776607fcf26376fd9cc2d7d57808e1acf75f35d9fae08a2847b94cede957caa
- MD5 702b8ab2b89dc7bebcc1f8b4816bfe73
- SHA1 c89f69b795b3db7d7a08ee8f07a3bebdf277d742
- SHA512 49695f7412e719477de6f801c172e7fc90bae3acfda9aada121f3c4cde0df8a4291fdcd82192cdd29f75eed3c1f1769399148fa81f12bf1f58e0d3e381895f7a
- TLSH T11C31104B138E6BF4A10B3BA047A78DD6B4742001A059605EF7E9C467ABC4D2D8A1CADD
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_tg/prl_tg_x64.cat
- SHA256 43a90ddc59ce693a6edebffd3aa22e4786f418cb034a7a3af0cc769eeff2167f
- MD5 27986dbea9b63b6dcc4a6a219849e1db
- SHA1 4136a8ea0b891e8c3c0213ca6cb8fa22f9c02db2
- SHA512 60c86b26d2d02e3a265b7f683f444574c07ebeed1800484b101c29d68b88361f85943f3c1f75a563da8a26f0c415d90b926ea3896df1af9967cb75a297725c99
- SSDEEP 192:/fmts2B9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6iTz:/cpznYPLQa6jOLeMDi3
- TLSH T15132D7DB055C10A3FD97CE30D6E6D46BDC31B3C6AD88542E01BB83912E82BD13B6940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_time/amd64/prl_time.sys
- IMPHASH 5f119e3e77008643275da4af17e51884
- SHA256 151228abd16826d2b12cdd45c02c76bc9a9681a6db337e866e54c645eb24d080
- MD5 11f890dd360c82f44ef99ab35d688afe
- SHA1 86077b963ceb14ee6ad48bf0a639e30e1e3ff814
- SHA512 5002e4035082a3f6dfbc5af8590b3786ba4165c2c0bd0e1fd195d6d2167e4fa5a6c31266da43546d6960fbd38888874f6b79f0309c6c9b1e043b6ae310b5fa13
- SSDEEP 192:Qrxe3HzDwgng8RD9l0H54OUXYKh+BVWl3OlBLWjnYe+PjPQu7RZgjlDrw5+vnr9I:mxeDkFU0H7UXYiwTBLsnYPLQa6jOLeMP
- TLSH T1D28229C707642092FEE78B35D6D6C657AC70F6916F6A99DF0134818A2D42FF02B3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7f:86:66:82:cd:d1:b9:5b:54:80:71:cd:90:d0:ef:32:54:24:d8:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
24584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_time.pdb
ntoskrnl.exe
ExUnregisterCallback
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
IoIs32bitProcess
ExEventObjectType
IofCompleteRequest
ObReferenceObjectByHandle
ExRegisterCallback
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ExCreateCallback
ExAllocatePoolWithTag
ExFreePool
ExAllocatePool
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
346B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_time/prl_time.inf
- SHA256 c6babd39c4373d18961d4913fdbf4750c2fbb89f9ffb4160e2ce70d5fac80220
- MD5 deab7248a3fc16ee35ec49961d992ebf
- SHA1 00e0ee5c83ef859243eddc40ebc8330ddbf58ac8
- SHA512 dfac6c9b7760950d8fa88f111068a5acdb6c9afef4952123633097cefeeae5afe2215e20e7a3f787398e250efcea063df8f408d5c2644636f6f82240b91705c7
- TLSH T1D931EDCB1166DBF4B6A53B5406534AD3F370200051AA344D3AE9C096ABC1C1D822EEF8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Drivers/prl_time/prl_time_x64.cat
- SHA256 64b953a89c87f85b2901e01a4ff9716964ee10a8589d7c11d797ddfa7e0cdfcc
- MD5 bfaa0a7946b9be1ab90c66422f3792b7
- SHA1 2cc47b9ea8f84da99b9d56596aaa98c0117d047a
- SHA512 7eee9bd1ae605117da10214bc403d007a6668b00d423e01d7c760cc5021611a1c1791d0acfdb230cba69776f0ebebe1b5f8c588a7484e924cdde643eb9cef893
- SSDEEP 192:uqL359pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6VdJlG:uWpznYPLQa6jOLeMDJ4
- TLSH T14C32D6CB056C1493F9978E70D6F2D56BEC31B3D66D88582E11BB83D11E82BE07B6940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_va/amd64/prl_gl.dl6
- IMPHASH fa1baf883758cacd3f34d3409c7789d8
- SHA256 4174bf89d533f4ddac45f8bf6904348df078e96434c725c4803dcc203c602062
- MD5 225f123c422ef2dc80d9408b4666da79
- SHA1 932acd3109a9f89065605e8d659f3ede684eb731
- SHA512 6fc13f80c9ccac2647d749bc917b0b82aa3d917fe9bf0d463eb7a232d2f37c6fa798b419dbc762d87ce9bf2e333a5603a855106f72064f50838190d5d17ba5b2
- SSDEEP 6144:8PV6AGDQ0Fru+5UjyeMtaScJG0CvrNN/L:eOphsJGP
- TLSH T193644B4A75290C66D9ABC0B89B13AC2FE772740787A143DF2AE403DD9E1B7C92577309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
3d:42:dd:7d:25:2c:8c:63:43:63:d2:7c:a8:1e:08:a4:88:b5:54:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
262592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_gl.pdb
msvcrt
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_purecall
??2@YAPEAX_K@Z
strrchr
??3@YAXPEAX@Z
strtol
strncmp
memmove
strncat
memcmp
sqrt
cos
sin
kernel32
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TlsSetValue
SetLastError
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
TlsAlloc
GetCurrentProcessId
TlsFree
GetModuleFileNameW
Sleep
RtlVirtualUnwind
RtlLookupFunctionEntry
TlsGetValue
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
user32
IsWindowVisible
WindowFromDC
ReleaseDC
GetDC
GetClientRect
GetWindowInfo
GetClassLongA
RegisterClassW
CreateWindowExW
DefWindowProcA
GetWindowLongA
SetWindowLongA
UnregisterClassW
DestroyWindow
gdi32
ExtEscape
CreateRectRgn
DeleteObject
SetPixelFormat
GetPixelFormat
GetRandomRgn
DeleteDC
CreateDCW
GetRegionData
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
Name
.text
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=125, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_va/amd64/prl_vadd.dll
- IMPHASH b8276e406cb7035a6c90db136738949e
- SHA256 ae113bfec3b8c698751a0bfdceb91d62a2b558b64484a889b269e297b60fee53
- MD5 c7586fa2a2314632f19f656fef84b628
- SHA1 581f5feeebbf1e2b3c87eb60db189ecba91c8426
- SHA512 4e081202172c45466506e15e424a7819525c790b9d3b1739c6b8313cf0213f2bff07d09b02fead1158a0ef1a37e23388b0aeb55c73317cb60f8738b5e0c17a25
- SSDEEP 3072:fSFdVG0+VtEAcJjdGkXH3ccMZbkAujZAl4ukxO84bGuu12dlNwdRD3:x0+VtEAcJwGwzujpO8xrt
- TLSH T1E8246C41F792E4CDF4BBD035C493A1BBEAB2350413089EF39A8086756B17BD15E3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
46:11:7b:10:e2:9b:24:d2:f6:88:0c:76:c1:fa:5f:d5:e4:e4:a1:80
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
21424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_vadd.pdb
win32k.sys
EngQueryPerformanceCounter
EngQueryPerformanceFrequency
EngDeviceIoControl
EngLineTo
EngDeleteSurface
EngCopyBits
EngGradientFill
EngCreateDeviceSurface
EngModifySurface
EngCreateWnd
EngStrokePath
EngCreatePalette
EngAllocMem
EngCreateDriverObj
CLIPOBJ_cEnumStart
EngStretchBltROP
CLIPOBJ_bEnum
WNDOBJ_vSetConsumer
PALOBJ_cGetColors
EngTransparentBlt
EngAlphaBlend
EngBitBlt
EngDeleteDriverObj
EngStretchBlt
EngDeleteWnd
EngUnlockSurface
EngDeletePalette
PATHOBJ_vGetBounds
EngTextOut
EngLockSurface
EngFillPath
EngStrokeAndFillPath
EngFreeMem
EngSaveFloatingPointState
EngRestoreFloatingPointState
EngFreeUserMem
EngAllocUserMem
__C_specific_handler
Name
.text
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=13, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_va/amd64/prl_vamp.sys
- IMPHASH 07a95b14ee2e5dac343008f79a9152b2
- SHA256 b8067aafb3489a285b343adbac63159174dca75b1cfb3cbd1656eaa9ea705838
- MD5 60aa71682831936b44cbd4f9e569b97c
- SHA1 a8f4fe86371f34fc0c4b6c38012d8b42a43c0fde
- SHA512 8babbffae93d44c9580e06e9a18d4fb417543e57dd4d2a53373266839a0a54e3fd78f74e4f56d381ec2f70549cee7539f4aec0bc27d976ca4543fe7344a549c0
- SSDEEP 384:r2liqRWin0L5y9iBuKbi4yWikg7bIN0m5CFg6hWz/XgR42TLX9FynYPLQa6jOLeb:VsWZoiwd5Jka43Cg6hWz/wVLX9FyymB
- TLSH T190C24BC327A410A6F9BBCA74C9D6C627AD70F5555F2696CF016081A62F02BF09B3D31B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
84:c9:43:03:a3:cf:14:4f:cd:27:fe:3f:77:e1:bb:d6:6d:12:cf:51
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
28680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\amd64\prl_vamp.pdb
ntoskrnl.exe
KeAcquireSpinLockAtDpcLevel
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
MmUnlockPages
MmProbeAndLockPages
KeWaitForSingleObject
ObReferenceObjectByHandle
IoGetCurrentProcess
ExFreePool
MmMapLockedPagesSpecifyCache
KeReleaseSpinLockFromDpcLevel
IoFreeMdl
MmBuildMdlForNonPagedPool
KeReleaseSpinLock
KeInitializeEvent
MmGetSystemRoutineAddress
KeSetEvent
RtlInitUnicodeString
KeResetEvent
ExAllocatePoolWithTag
IoAllocateMdl
MmUnmapLockedPages
__C_specific_handler
videoprt.sys
VideoPortSetRegistryParameters
VideoPortInitialize
VideoPortGetAccessRanges
VideoPortMoveMemory
VideoPortFreeDeviceBase
VideoPortWritePortUshort
VideoPortQueueDpc
VideoPortGetRomImage
VideoPortReadPortUlong
VideoPortWritePortUlong
VideoPortMapMemory
VideoPortReadPortUshort
VideoPortGetRegistryParameters
VideoPortReadPortUchar
VideoPortWritePortUchar
VideoPortUnmapMemory
VideoPortZeroMemory
VideoPortGetDeviceBase
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
98B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_va/i386/prl_gl.dl3
- IMPHASH 0f53a06ef2c783377fbdaa2f90fb5126
- SHA256 559ad1be43c5d321dda551eca627672ef3a20cc3479b99efbf3bb282ac7c5d03
- MD5 e691e477a79e2317935c3c17b13f6848
- SHA1 6f2c4197aef94d34db6e48aa3497ff643bdb4b10
- SHA512 6eb38f589ed04fc003e92bb5366e7a14bb0780db02634afc4b615e3edf4908abc2c266fcced6a4a84443c0a24de7447e0754ba9b38f4e181c898dc947fe44545
- SSDEEP 6144:d/VaAG0RkpF9FtQIoehjpdxeHABytYRPAvT3hF9AD:7IF7+ynxeHABytYRPAvT3hF9AD
- TLSH T14834F953DC5083B9EDD2F5F105BE34A9253ED16BA32272CB2C6896F2D4462F219721CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
c5:52:df:02:96:3a:45:03:57:37:2e:8a:a1:d0:35:31:fe:d8:60:a2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Chains
Aug 31, 2013
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Parallels\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Parallels\, Inc.,L=Renton,ST=Washington,C=US
Serial Number
46:b7:cf:5d:ce:81:06:bf:e4:34:4b:11:b4:df:13:19
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 10, 2012 - Nov 2, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
202783
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\--build-tmp--\tools-win-899017-qx9-08-51-11\z-Build\Tools\Drivers\i386\prl_gl.pdb
msvcrt
_amsg_exit
_initterm
free
malloc
_XcptFilter
_CIsqrt
_CIcos
_CIsin
_purecall
strrchr
strtol
strncat
memmove
memset
strncmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
kernel32
LeaveCriticalSection
TlsGetValue
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
TlsAlloc
TlsFree
DeleteCriticalSection
SetLastError
GetCurrentProcessId
TlsSetValue
GetModuleFileNameW
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
EnterCriticalSection
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
user32
IsWindowVisible
ReleaseDC
GetDC
GetWindowInfo
GetClientRect
WindowFromDC
DefWindowProcA
RegisterClassW
UnregisterClassW
SetWindowLongA
DestroyWindow
CreateWindowExW
GetClassLongA
GetWindowLongA
gdi32
GetRandomRgn
DeleteDC
ExtEscape
SetPixelFormat
CreateRectRgn
CreateDCW
GetRegionData
DeleteObject
GetPixelFormat
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Drivers/prl_va/prl_va.inf
- SHA256 bef6966620897e2dd932a11266a8c23baed5e0f033dd2d972b0f4f3739d598f7
- MD5 69663bcf8104851d4a011962ad87958b
- SHA1 5d3389e86106185476c5c34cf198c259f4a1077f
- SHA512 9046ea62e4793165a76ae629f854512792c470568a0b7580c00702ddc3fa5d2f7fe9e4333349df4b606a778f9f6816440532ae0bd0cba8a643b50a90474e1f97
- SSDEEP 96:O6+0Xs5BHYXtW2tQrFD2tnorD7tbZdg3GFRylslW54ysr9THC:fv8bHYIB5DGmD1zg3GF6sr9THC
- TLSH T1FF810092264762B6B0173B40565B469AFB761240F05281AFFBECD9369F8DC0DC3389E6
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Drivers/prl_va/prl_va_x64.cat
- SHA256 5b7830a5d1cfaad9085885abb27a596d9b889163e0ac81c489365cf878e80dcc
- MD5 97b48be251e8a1ed5a134953ab6cf940
- SHA1 38e64e9028406aa1f2d11e4985f692cca7292022
- SHA512 560c2952b9b535c56356bbbb6744d5d19dd4f9683a1e761c1f6fc1f89b9befe42a40a610c1aa3a0536bd6c2b7c638b266f297f883c4f0fbe6b08fe9699319b01
- SSDEEP 192:beaQp1SAGp/9pHhtnYe+PjPQu7RZgjlDrw5+vnr9ZCspE+TMAr6nzKZL:o+pznYPLQa6jOLeMDA
- TLSH T10B52D7DB0AAD00A3E99BCD71D6F6D46FE831B7D2BD44583E11BB93910D82791372940E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Euro/chart01.CHR
- SHA256 774aa085a942d24153c25dd06ddb802c4b5e68d12110c3c4a8e43a76ca504411
- MD5 b2f9a27089ca86ff32d61c553c0c5399
- SHA1 1abde2f649b676ec1261171a734d98d547c7e18e
- SHA512 b51c3b5c9d671fcab3a24a10d7453feec771d2538598b80b2e9b31fdde147c0926e6109e79bb4b9f06e5f8ff1e70ed22cd598d0992ee0b3a9c6f84e69798ad29
- TLSH T1B5317670D5A2680FE033242E02BDA60C30E1756A03F7F3A1B39C95A72C269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Euro/chart02.CHR
- SHA256 3c5824b89b60e6157e5332de0ffec20682ce4ebc57f2d8d976edc3f2e051cbd8
- MD5 7f285bb4ce156040e3b537516047cc8e
- SHA1 4544783f59a97c77de7ddcd2c97d0f76975c31cb
- SHA512 34c909debfaa7f83899d7407b0bd81679a955e25534d35f3cce3554d76769b5fdd0a9af3baefdcbd2700eabdc0d6a24e10e6442c67436a22ba3b89da9dfde4e6
- TLSH T134317670D1A2280FE033242E02BDA60C31F1756A06F7F3A1B39C95A72D269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Euro/chart03.CHR
- SHA256 b8d172cbab65f0cd16b68b1a233734b4c71715bd0386676787640be38ab9b6fc
- MD5 536bbeade46922fd39946ba84832fd91
- SHA1 f3857a2284fa795d3b384f4c7c0ce5d1ebebac3b
- SHA512 2c2278786c003fb4f9f8d719912de82d0f689cc2fd7eaf852c3ed4ed260f26adf1ccc6b697a766e449e579b032d963028277199ed969c354d1292fe98a421977
- TLSH T1CB315670D1A2680FE033242E43BDA60C71E1756A06F7F3A1B29C95A72D269D3AB512D9
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Euro/order.wnd
- SHA256 39c8278327a573c90bd58827a65a942775641f4d4cfd4646a4405bc5b0789be3
- MD5 dd404d8b3aa934cb8476cfa1c5762c0c
- SHA1 9ad84fdcdae413871a64ddda6774216af4aabd24
- SHA512 f87bb1edd7ebee054dba11e2a0b4e079a7c65562bcaa1aa08bb6875215631eaa2608149c4020e85ba5f722cfa5fb63e6bc41791a36b37749b8810366c92d19cf
- MD5 SHA1 SHA512
ispell/profiles/Market Overview/chart01.CHR
- SHA256 a0f1b43b9da086973b29fe73f61ebc2cdc70aaf23ba39667c8478599d18cbdd0
- MD5 5aa16c6a9edd5076de7583ffb0939bf4
- SHA1 a68eff13fbad846d55b7bd65f1c952dc0aa9c592
- SHA512 61c092717d294c91201c489a69b9932e4dc01b08c99bd244f9511913244cdc83c4533fc8ec33d8a1d5adc1cf65f52ac873c7d86f2abe97641784a8ffedfcae33
- TLSH T1CA310430E6A2A85FF037287E07F1A60C71D214591757B320B32D9077AD26AC3A7D52D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Market Overview/chart02.CHR
- SHA256 ec73fee2e63cce7054201f90058d54930ef9bcc0bc740a702b090168536944c5
- MD5 3acd68a93129afd81d39c16fc8b66a43
- SHA1 5d949400d792ca9fa5491f5a1cde9ee9f14780f4
- SHA512 2c2bb38627b46f7fcd4e3db82c1b0ac4329f568413d6047fce752b6b13d0c2afee3b970cf19fa566f9092625b81a91c5c52e9fae780845a699cebf37a32c4641
- TLSH T10131A830D1A2780FF033257E42F9A60871E0756A03EBF760B35C90676C269D367A12DD
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Market Overview/chart03.CHR
- SHA256 ffd5afc9eabcd6280d6c71d3e4e8e432efac3a2a82de3fc628adb16c55269419
- MD5 a4d44a4fabceba241a0781d6ef9bcd92
- SHA1 a62dc6404ca176f2f6d058fe6249ebba952a2822
- SHA512 5f14bc8b79751eec3ebb1d8d5ae27218c6eee630bb161a26cb303de1c055a3ca7789359865dcc7823f0403cee9eae4df92452296c11814589a4b80d91ffa04af
- TLSH T12F31F230E6A2A85FF037287E07F1E60C71D214591757A320B22E9477AD26AC3A7A52D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Market Overview/chart04.CHR
- SHA256 57739a03ec7fb3b1737c48a9677ca3fa657054acdc43bd160c1e23e4e448f00e
- MD5 629309fa1359f8b047914e827f91a485
- SHA1 ab438e7a07df722c5256276c4ea6bed6d393e1ab
- SHA512 b84e014ff98910d609c0669103f49722f4dcd188d7ea96d845f6e6231a5da9f8521ea20a1ceee28222d2afb9ae44c4de08819f9a4f4fbe285c2adbfc97e03ec3
- TLSH T1FC213670D5A2685FE033287F03E6A60D31E1356D07E7B360639D945B3E269C7A7E12C9
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Market Overview/order.wnd
- SHA256 5edd2401e423bf7f340357e99bfdb9e6737469085410aec2414bdfb16910e6ec
- MD5 374d1a4c11ef82ab86cc86bc9fc3234b
- SHA1 794ddfb5af1c94ec489c4de0d9b368311652f241
- SHA512 b7b2b70e183244576ebd992d2e6eb372e20a764634be2b472e4428167ab6f7d856d948bf6f1e79225809b4637327a9d62f88bd229efbccaf515964f2249c2aa4
- MD5 SHA1 SHA512
ispell/profiles/SIA/SharedIntApp.exe
- IMPHASH ab01c8ade976a6a6f296b70f6bc011ea
- SHA256 6113900cd88bca5bb51236b9a256e67739d2d4731677aac441e74680b226b205
- MD5 3bb3c379275fbf98914c0f157b1f684f
- SHA1 f8806ff59973ba21f573816acbe31e42f59f48ef
- SHA512 7c31fbf4e1580ac0a09e8b972e12bde402d8a3a633efc47ed2f5b6f50660102faf66eaeab0bda83cea09f687a67fa54277878cf6e37a487ce5c3410f3a65e113
- SSDEEP 768:VZuC2NvQMKYtIL80WAyZN+u9V+DBNQ1cs1dKHuU+wXm3/gMeKgYo:IVQMKMD3+G+DBNJIdi+wXmPleyo
- TLSH T1FF235B65ABA80805E5B78B79A4F29714EAB17E116F31C3CF0221825D1F37BE2D939713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
08:ef:fa:ca:d7:06:32:e3:54:3d:14:f7:52:59:4f:2f:e7:9f:8b:bd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
18592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\SharedIntApp.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclW
ConvertStringSidToSidW
kernel32
GetLastError
SetLastError
CloseHandle
LocalFree
ExpandEnvironmentStringsW
VirtualProtect
Sleep
GetFileInformationByHandle
GetLocalTime
CreateDirectoryA
MultiByteToWideChar
CreateFileW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetStartupInfoW
WideCharToMultiByte
WriteFile
GetCommandLineW
GetWindowsDirectoryA
msvcrt
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
memcpy
memset
__C_specific_handler
?terminate@@YAXXZ
_snprintf
__getmainargs
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@XZ
_CxxThrowException
_strlwr
_errno
__CxxFrameHandler
_wcsdup
wcsrchr
_wcslwr
wcsncpy
wcsncmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcsstr
malloc
free
memmove
_wcsicmp
sprintf
strncpy
_vsnprintf
time
shell32
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=64, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/SIA/mapi32.exe
- IMPHASH a59768471dc3cbe491634fa9d9e37a93
- SHA256 dde7f6673ee5f9a1cf67f28a4b9764884efe7e4e8bbca9877fc4f7eb4ec7346f
- MD5 23cb7ab8e92a0da2aad62a60e9ff3bcd
- SHA1 0099240b112788f1203234b758f0c5296788ac64
- SHA512 7680525eb4578bb27e96fd27273ee7ebb30590ae3e1282e997500886b1d506d80b0cee0dbe1a262fa8d096405081340be9b16920aad88717dcee317bc9c78727
- SSDEEP 384:bU2lgi+YIU/mFI+lrhniTzNEe6Hq8bewFV87gw9yiUZidK/DIych1MeK6ju:bUjXYIUA9u25JeE8ZyzZ0K/gMeKgu
- TLSH T1FBE23922AA908434E8F36AB124FC77251B7CF6919B34D3DB614582D98F687D09D343BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6a:74:01:35:a2:cd:74:2b:17:86:e4:ae:52:73:3d:05:ad:ce:3a:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
9795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\i386\mapi32.pdb
kernel32
GetCommandLineW
GetFileInformationByHandle
CreateFileW
MultiByteToWideChar
GetWindowsDirectoryA
CreateDirectoryA
CloseHandle
GetLocalTime
SetLastError
GetLastError
WriteFile
UnhandledExceptionFilter
LoadLibraryW
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
OutputDebugStringA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcAddress
FreeLibrary
LocalFree
GetCurrentProcess
WideCharToMultiByte
msvcrt
??1type_info@@UAE@XZ
memcpy
memmove
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
__set_app_type
_snprintf
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
malloc
_callnewh
free
_strlwr
_errno
__CxxFrameHandler
memset
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
sprintf
_vsnprintf
strncpy
time
shell32
CommandLineToArgvW
SHGetFolderPathW
advapi32
SetSecurityInfo
ConvertStringSidToSidW
GetSecurityInfo
SetEntriesInAclW
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=20, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/Plugins/UserInputEmulation.dll
- IMPHASH 155e16fc859b3ba959c67bec9ba90a21
- SHA256 489500691a0c7f191089edf5dfa297319e6081955147084b7b7099a94d6697b3
- MD5 2c6b6055d53235f07e3d603265142578
- SHA1 bcd1751fefc4dea0786ac64669876b68273f2882
- SHA512 20d8602431ce533e1028acdbc8b55d6542c26380c526b0c7d3551fb6da3236f18aa96b6e74d1f88f52c3433eb4322d177b4efafbb7b7ae7cf5f47d99e2794c87
- SSDEEP 1536:HS55szjtlLmN3aU3Um9pulTHSkMPRIm9KkDh/yJsUusfWUxsFo7SviiM5ljJ2le5:H05wQqMPRnMkDh/B6WUxsogiiMfJ2s
- TLSH T11FA31925A76C00FED16ED57EDAEA9E0AC2723041273647C702118B694E37AF68C74F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b6:c4:c2:b7:8f:28:91:45:c3:3e:d7:e9:f9:fc:fa:79:b4:ad:ee:48
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
47088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\uiemu_cc_plugin.pdb
msvcrt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_callnewh
_CxxThrowException
_strlwr
??1type_info@@UEAA@XZ
__CxxFrameHandler
exit
_beginthreadex
strerror
realloc
??0exception@@QEAA@AEBQEBDH@Z
wcsstr
_wcslwr
memcpy
memset
memmove
_snprintf
_wtoi
free
malloc
tolower
sprintf
strncpy
_vsnprintf
time
_errno
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
isgraph
kernel32
VirtualUnlock
VirtualAlloc
VirtualLock
WaitForSingleObject
VirtualFree
LocalFree
GetFileInformationByHandle
GetLocalTime
CreateDirectoryA
WriteFile
GetWindowsDirectoryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
VirtualProtect
CancelIo
WaitForMultipleObjects
CreateEventW
GetExitCodeThread
GetOverlappedResult
CreateFileW
SetEvent
GetSystemInfo
DeviceIoControl
MultiByteToWideChar
GetVersion
GetProcAddress
LoadLibraryW
CloseHandle
GetCurrentThreadId
SetLastError
GetLastError
WideCharToMultiByte
OpenProcess
user32
IsIconic
GetWindowThreadProcessId
IsWindowVisible
GetClassNameA
GetWindowRect
RegisterWindowMessageW
GetParent
WindowFromPoint
GetScrollInfo
GetCursorPos
EnumChildWindows
SendMessageTimeoutW
GetWindowTextLengthW
SendInput
GetWindow
PostMessageW
GetLastActivePopup
SetForegroundWindow
AttachThreadInput
CharLowerBuffW
EnumWindows
GetForegroundWindow
BringWindowToTop
GetWindowLongW
GetWindowTextW
GetClassNameW
ShowWindow
psapi
GetModuleBaseNameW
GetModuleFileNameExW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
shell32
SHGetFolderPathW
advapi32
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclW
ConvertStringSidToSidW
NotifyTool
StartTool
StopTool
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
378B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=162, id=1, productName=Unmarked objects,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/WoW/coherence.exe
- IMPHASH a1f411eef75c99bd676d8c0b46b89fe8
- SHA256 3231242e77068579de64af409ebf88d2c53614473aefbf7ce12931d9eafb2e80
- MD5 12b096dde36b1409b4ea9c57eb637cd7
- SHA1 6eb2d2416f067b04de04b857c8360d337a97fd8b
- SHA512 9ad8b6922f40af760ece6af64a95374971b2df4078744dc17b742f57f4fd26ceb7f3429e187b3c26674dccaa56d85ebb2a46c67953cad9b171405c3eb5d223c3
- SSDEEP 768:I9cjwH6FtSHaYz9fH3xW7Ec7E1+HKf/gMeKgN:IujwH6rMPfHhW7VHKnlen
- TLSH T17CE21831D6904839E8B76D7436F873126A38FA425F3093CF129585D98BB47C5AD383A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
00:3d:de:55:23:73:99:c2:9f:93:ad:ca:1b:a2:32:6a:b4:47:1c:4b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
13251
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\i386\coherence.pdb
advapi32
CreateProcessAsUserW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetSidSubAuthority
InitializeSid
SetServiceStatus
RegisterServiceCtrlHandlerExW
DeleteService
StartServiceW
QueryServiceStatusEx
ControlService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
StartServiceCtrlDispatcherW
kernel32
SetEvent
WaitForMultipleObjects
CloseHandle
GetOverlappedResult
GetLastError
CreateEventA
DeviceIoControl
FreeLibrary
WaitForSingleObject
ResetEvent
GetCurrentThreadId
CreateThread
CreateFileW
GetProcAddress
LoadLibraryW
CreateEventW
OpenEventW
GetVersionExA
GetModuleFileNameW
GetCurrentProcess
GetCurrentProcessId
Sleep
GetModuleHandleW
CancelIo
WriteFile
GetStdHandle
FormatMessageA
SetLastError
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualLock
VirtualUnlock
UnhandledExceptionFilter
msvcrt
malloc
realloc
free
_controlfp
?terminate@@YAXXZ
memcpy
_cexit
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
__getmainargs
_stricmp
memset
_except_handler3
user32
GetProcessWindowStation
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
CloseDesktop
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
IsIconic
ShowWindow
IsZoomed
PostMessageA
GetLastActivePopup
IsWindowVisible
GetForegroundWindow
SendMessageTimeoutA
DefWindowProcA
SetForegroundWindow
SetWindowPos
wsprintfA
prl_hook
DashUnhook
DashDisableDwm
DashSnapshotWindows
DashGetWindowIcon
DashHook
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=160, id=1, productName=Unmarked objects,
count=77, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/WoW/prl_hook.dll
- IMPHASH 14bc894626f720e7726cca5c9172d29b
- SHA256 09bd5046459e57ed1044e81ec1a10fbc3d1335589202a418d2d2bb1af366ef8c
- MD5 0e017c1adcb0011ff79ce03965a80fc3
- SHA1 4a5f6cdf9f2deb6215290bce7a7cfc288647e42b
- SHA512 98839b2ab8e2a487a767c9a6f62a056e94d3b67e35ca68feb55e911768e395c6859b6839fb164ad545cfb7c07c4eb5b8609ce78cb892de1a3e55efcd8bf8f643
- SSDEEP 768:6FtjrtwuKFHomY1J7FAdIWBsWqb+t7OHtiHwgek6HMqfJU/gMeKgop:6XrtoHomwJ7FAeWBsgt7OHswgIJmleOp
- TLSH T119135B21EB2486FDE9E7667078EC3B3718B9A960572081DF1193DAE49F207D1B938347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f8:53:2b:7c:0e:e1:be:71:23:94:ef:ee:1c:8d:39:d8:13:e4:99:f7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
28774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\i386\prl_hook.pdb
msvcrt
_XcptFilter
malloc
free
_initterm
_amsg_exit
memcpy
memset
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
RtlUnwind
GetVersionExA
SetLastError
InterlockedCompareExchange
InterlockedExchange
VirtualProtect
VirtualAlloc
FlushInstructionCache
VirtualFree
VirtualAllocEx
LoadLibraryW
FreeLibrary
WriteProcessMemory
CreateRemoteThread
ReadProcessMemory
VirtualFreeEx
TlsAlloc
CreateFileW
InitializeCriticalSection
GetModuleFileNameW
GetCurrentProcess
OpenProcess
GetLongPathNameW
OpenEventW
GetCurrentProcessId
CreateEventW
GetLastError
SetEvent
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
UnmapViewOfFile
GetProcAddress
GetModuleHandleW
CancelIo
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
TlsGetValue
DeviceIoControl
MapViewOfFile
CreateFileMappingA
TlsFree
DeleteCriticalSection
WaitForSingleObject
Sleep
user32
GetWindowInfo
UnhookWinEvent
SystemParametersInfoA
SetWinEventHook
DefWindowProcW
SetWindowsHookExW
EndPaint
SetLayeredWindowAttributes
UpdateLayeredWindow
GetTopWindow
FindWindowW
CallNextHookEx
GetActiveWindow
GetWindowTextW
GetDesktopWindow
EnumThreadWindows
EnumChildWindows
FindWindowExW
PostMessageA
PostMessageW
IsWindow
SendMessageTimeoutA
GetClassLongA
DestroyIcon
GetWindowRect
GetIconInfo
GetDC
DrawIconEx
ReleaseDC
IsIconic
SetWindowPos
GetParent
GetWindowDC
GetWindowRgn
EnumWindows
GetWindow
UnhookWindowsHookEx
GetWindowThreadProcessId
GetClassNameW
gdi32
GetCurrentObject
GetPaletteEntries
CreateRectRgn
GetObjectA
GetBitmapBits
CreateDIBSection
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetRegionData
DeleteObject
DashDisableDwm
DashGetWindowIcon
DashHook
DashSnapshotWindows
DashUnhook
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=158, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=65, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/coherence.exe
- IMPHASH 8473dcf79c52977b9b48e93c3e3bce8d
- SHA256 f50d61348f18d14cf9224a3ada2eda8c80ee495b3303773101432a3652e42cad
- MD5 0800b9e11bfdb853bef558843547786e
- SHA1 01eb1ee5ff8dced2fad78a0845b519c9c82d045d
- SHA512 c80c11abb09bc83b29d8b96518cee04338d3009dedb36bf871d91cc884e19b0cee5b73df5bad8fa66b38b460709d42b8babb76c8e2622f85dbdf67af2b8ffde9
- SSDEEP 768:Go20DcO6gVUNJwGLCc7T2GTuJf42+BV+Y/gMeKg7d:GD0DcO6guNJ1C02GTuJe+yleP
- TLSH T150F25C52D7F80485F97FEA35AAF9A313BEB07800673595CF4661C6050B66BD2E83C712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
4f:a6:5a:07:ce:64:e5:6a:8d:3e:00:31:d5:bd:4d:f9:4c:f4:8d:cd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
19604
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\coherence.pdb
advapi32
CreateServiceW
CloseServiceHandle
OpenProcessToken
GetSidSubAuthority
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
RegisterServiceCtrlHandlerExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetTokenInformation
SetSecurityDescriptorDacl
LookupPrivilegeValueW
StartServiceW
DuplicateTokenEx
InitializeAcl
SetServiceStatus
QueryServiceStatusEx
AddAccessAllowedAce
InitializeSid
ControlService
AdjustTokenPrivileges
kernel32
FreeLibrary
CreateProcessW
GetCurrentProcess
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
WriteFile
LoadLibraryW
Sleep
CreateEventA
GetModuleFileNameW
CreateFileW
GetOverlappedResult
GetStdHandle
GetLastError
SetLastError
GetProcAddress
ResetEvent
CreateEventW
DeviceIoControl
WaitForMultipleObjects
CancelIo
OpenEventW
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
VirtualLock
VirtualAlloc
VirtualUnlock
VirtualFree
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemInfo
msvcrt
free
malloc
realloc
?terminate@@YAXXZ
_exit
memset
memcpy
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_stricmp
_XcptFilter
__C_specific_handler
__getmainargs
user32
GetThreadDesktop
MsgWaitForMultipleObjects
CloseWindowStation
GetProcessWindowStation
OpenInputDesktop
wsprintfA
CloseDesktop
TranslateMessage
PeekMessageW
SetThreadDesktop
OpenWindowStationW
DispatchMessageW
IsIconic
IsZoomed
GetLastActivePopup
SetForegroundWindow
GetForegroundWindow
DefWindowProcA
SendMessageTimeoutA
SetWindowPos
ShowWindow
PostMessageA
IsWindowVisible
SetProcessWindowStation
prl_hook
DashSnapshotWindows
DashDisableDwm
DashUnhook
DashGetWindowIcon
DashHook
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=64, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=137, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/install-provider.cmd
- SHA256 469e8888f5281be271287165bf93354ba8068205a0e166cd3548d1b63f9fefd5
- MD5 a871c648667d81ad65015a8459c50550
- SHA1 e0b1c21325e5be93136b50ac3f2e933678f38c9c
- SHA512 95fa1cc16d829a4d33576a9fffb4e145b4e9a0eed1952c5181005d4e8c895959973c41d2c0467382c51685cf17228d1301aff0ddb8930ba52f141716aaa709f7
- TLSH T16FF0A296980B2357D5402A9BB6765913D83394446B0C1712F72B241F60B3D47D8764F8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Services/prl_hook.dll
- IMPHASH e87a1a5ff33aabfa52bd7407222f6dd4
- SHA256 0f8bbc7c2d447657ff2766cce20e2334b6e130e99b7f8c98ad8d712ca3cb83a5
- MD5 1a0c919a489b9a28ffec9cabd09765ea
- SHA1 c3e8e7333cc5b9b6373a00a99c1e90db2e6f4713
- SHA512 4f08669a93733964482e5eea883200ee055f03690cd8980a42b0fdef1b984aecd6384fd9412bdec29940d58ef97f134c8332e2931512d9c8a02a03e1d5c999b7
- SSDEEP 768:Ad7OI11dhWs3LOmeiunaEyQyCMZ1fzgX2vq5l7g1yBiadJx3SFRfeX/gMeKg5F:6yI14sKmX2yhCHlU16i43MfevlerF
- TLSH T15D436A26E7A410A8E8B7C678FBE58A3BD6F27400573865CF4150C9584F23BE2E13C716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
04:00:34:ca:10:2f:4a:88:7d:a2:43:61:9c:b8:19:94:72:82:4b:8c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
37408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\prl_hook.pdb
msvcrt
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetVersionExA
SetLastError
VirtualProtect
VirtualAlloc
FlushInstructionCache
VirtualFree
VirtualQuery
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
LoadLibraryW
VirtualFreeEx
CreateRemoteThread
FreeLibrary
TlsFree
GetCurrentProcessId
CloseHandle
TlsAlloc
GetCurrentThreadId
DeleteCriticalSection
OpenEventW
CancelIo
DeviceIoControl
CreateEventW
CreateFileMappingA
EnterCriticalSection
GetProcAddress
GetLongPathNameW
GetLastError
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
Sleep
OpenProcess
TlsSetValue
InitializeCriticalSection
TlsGetValue
MapViewOfFile
UnmapViewOfFile
HeapAlloc
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
GetModuleHandleW
GetProcessHeap
user32
DestroyIcon
UnhookWinEvent
SetWinEventHook
SetWindowsHookExW
SystemParametersInfoA
DefWindowProcW
EndPaint
UpdateLayeredWindow
GetWindowRect
GetWindowDC
IsIconic
GetTopWindow
PostMessageW
DrawIconEx
GetParent
CallNextHookEx
GetWindowInfo
FindWindowW
GetClassLongPtrA
EnumWindows
GetIconInfo
GetDC
GetWindowTextW
GetClassNameW
ReleaseDC
GetWindowRgn
SendMessageTimeoutA
GetDesktopWindow
SetWindowPos
EnumChildWindows
SetLayeredWindowAttributes
GetActiveWindow
IsWindow
FindWindowExW
PostMessageA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindow
EnumThreadWindows
gdi32
GetBitmapBits
BitBlt
DeleteDC
CreateDIBSection
GetCurrentObject
GetRegionData
DeleteObject
SelectObject
GetPaletteEntries
CreateCompatibleDC
CreateRectRgn
GetObjectA
DashDisableDwm
DashGetWindowIcon
DashHook
DashSnapshotWindows
DashUnhook
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=137, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/prl_tools.exe
- IMPHASH 2a150580ad97bb29c55530e18ccd665b
- SHA256 b6f2735c0e2bc082e2c4e0746b78824fe7ca1ae1c819ed1cd8920012905aded2
- MD5 2b28a796b5c196978a45ce79911a3b88
- SHA1 cdc4378ac4b29708332067edd5f35edaeabdbef9
- SHA512 09aee7f2a983c463f0c7c02697409114d7c5abd4189265abd066ff901cc44f1c1a239dd4aad8e9703805206c6cee26838378e1db35b1df30f87b007d2d3cb2c3
- SSDEEP 6144:U5iBH0XZRnFVHwItjNz5ZD7S8jALAel9l0Uj:U5S0XTFVQyjNz5c8jALAobj
- TLSH T14624B341B3F80154F4B7AF39BEB14656AAB2BC519F3886CF0211866D0D32AE4E975723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
aa:3e:22:8f:cd:cc:73:f7:ba:27:f8:78:f2:09:d7:be:03:97:19:80
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
100908
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\prl_tools.pdb
advapi32
RegQueryValueExW
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyW
RegDeleteKeyA
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
DuplicateTokenEx
RegCreateKeyExW
RegQueryValueExA
RegCreateKeyExA
CheckTokenMembership
AdjustTokenPrivileges
ConvertSidToStringSidW
LookupPrivilegeValueW
SetEntriesInAclW
SetSecurityInfo
GetSecurityInfo
ConvertStringSidToSidW
InitiateSystemShutdownExW
kernel32
CloseHandle
GetCurrentProcessId
CreateThread
GetModuleHandleW
ReadFile
CreateFileW
GetOverlappedResult
OpenMutexW
SetNamedPipeHandleState
SetProcessShutdownParameters
GetVersion
WideCharToMultiByte
SetLastError
ProcessIdToSessionId
SetWaitableTimer
CancelWaitableTimer
GetProcAddress
GetTimeZoneInformation
MultiByteToWideChar
DeviceIoControl
SetSystemTime
CreateWaitableTimerW
FreeLibrary
OpenEventW
FindFirstFileW
FindClose
FindNextFileW
CreateProcessW
InitializeCriticalSection
OpenProcess
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CompareStringW
GetExitCodeThread
GetCurrentProcess
GetExitCodeProcess
TerminateProcess
GetTempPathW
DeleteFileW
LocalFree
ResumeThread
VirtualProtect
GetTempFileNameW
GetModuleHandleA
WaitForMultipleObjects
CreateEventW
MapViewOfFile
LoadLibraryW
ResetEvent
UnmapViewOfFile
MoveFileExW
CreateDirectoryW
GetFileAttributesW
GetLastError
GetVersionExW
SetEvent
WaitForSingleObject
GetCurrentThreadId
SetTimeZoneInformation
GetStartupInfoW
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
VirtualFree
VirtualUnlock
VirtualAlloc
VirtualLock
CancelIo
GetFileInformationByHandle
GetLocalTime
CreateDirectoryA
WriteFile
GetWindowsDirectoryA
CreateFileMappingW
GetFileSizeEx
GetModuleFileNameW
GetSystemInfo
user32
OpenDesktopA
LockWorkStation
LoadStringW
SendMessageTimeoutW
RegisterWindowMessageW
MsgWaitForMultipleObjects
FindWindowW
GetWindowLongPtrW
RegisterClassExW
CreateWindowExW
SetWindowLongPtrW
SendMessageW
DefWindowProcW
DispatchMessageW
EnumDisplayDevicesW
ChangeDisplaySettingsExW
EnumDisplaySettingsExW
MonitorFromPoint
ExitWindowsEx
PeekMessageW
SwitchDesktop
ChangeDisplaySettingsW
GetMonitorInfoW
EnumDisplaySettingsW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
OpenInputDesktop
CloseDesktop
SetThreadDesktop
OpenWindowStationW
GetProcessWindowStation
msvcrt
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
calloc
isdigit
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_iob
_itoa
wctomb
ferror
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
_lseeki64
_write
_isatty
ungetc
_snprintf
memmove
memset
memcpy
strncpy
sprintf
_strdup
??1type_info@@UEAA@XZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_strlwr
__CxxFrameHandler
_wcsdup
_beginthreadex
_purecall
_tzname
time
_tzset
_timezone
strstr
gmtime
wcsstr
_wcsnicmp
_wcsicmp
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_errno
_vsnprintf
shell32
SHGetFolderPathW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
iphlpapi
IpReleaseAddress
GetAdaptersInfo
GetInterfaceInfo
IpRenewAddress
ole32
CoUninitialize
CoInitialize
powrprof
GetPwrCapabilities
CallNtPowerInformation
SetSuspendState
shlwapi
PathAddBackslashW
PathAppendW
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=247, id=1, productName=Unmarked objects,
count=65, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/prl_tools_service.exe
- IMPHASH 723565330aaa5206ecb854807155be3b
- SHA256 3b388ae96dcd8b9d443416d21dcabce661c929d6ad6edd24ed8b584d6f8d8f82
- MD5 a76d76dc9d173d98507c20c85c3955e0
- SHA1 0e340eaa3202f655e5e1cf647b887cfee38429ec
- SHA512 b066c91935d2d45d8a55f2621d41326d14436b809c41c8d8064de25d11b4eb8eafb861737ca4fe25f5d1f2ea773f8036efb067fb5280d937ba8edd38ea027fb1
- SSDEEP 3072:FHAZSjxrDGzkrq09sENHG6BUITW5iYJZ95v4UUr8x19xReq+7ItZsEDxn38ASuK/:pAZSjxrDGOsaG6Bi4Kn5gNr851ds77uq
- TLSH T1BB243816B76800AAD0A7D17E96E28756F7B278411F3847CB4361877E1E37BE1C839326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a5:35:d1:13:3d:cd:e2:df:47:f5:c3:ad:30:96:4f:6a:35:8b:d8:45
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
148724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\prl_tools_service.pdb
advapi32
OpenProcessToken
RegisterServiceCtrlHandlerExW
CreateProcessAsUserW
SetTokenInformation
LookupPrivilegeValueW
DuplicateTokenEx
SetServiceStatus
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatusEx
ControlService
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
EnumServicesStatusExW
RegEnumKeyA
RegOpenKeyExA
RegCreateKeyExA
RegEnumKeyExW
RegQueryValueExW
SetEntriesInAclW
SetSecurityInfo
GetSecurityInfo
RegDeleteKeyW
RegCreateKeyExW
ConvertStringSidToSidW
CryptHashData
kernel32
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
ResetEvent
SetConsoleCtrlHandler
CreateEventW
DeviceIoControl
WaitForMultipleObjects
CancelIo
DeleteCriticalSection
CloseHandle
GetVersion
ResumeThread
GetTickCount
GetCommandLineW
FindVolumeClose
GetDriveTypeW
FreeLibrary
CreateProcessW
GetEnvironmentStringsW
SetHandleInformation
GetVolumePathNameW
WideCharToMultiByte
GetExitCodeProcess
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
ReadFile
MultiByteToWideChar
GetStartupInfoW
GetStdHandle
OpenThread
GlobalMemoryStatusEx
CreatePipe
FreeEnvironmentStringsW
OpenEventW
FlushFileBuffers
GetDiskFreeSpaceExW
FindFirstVolumeW
SetComputerNameExW
GetComputerNameExW
GetEnvironmentVariableW
GetVersionExW
GetFileAttributesW
VirtualProtect
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentProcess
GetCurrentThreadId
UnhandledExceptionFilter
VirtualFree
DisconnectNamedPipe
GetOverlappedResult
CreateFileW
VirtualUnlock
VirtualAlloc
VirtualLock
GetSystemInfo
GetTempFileNameW
GetModuleFileNameW
TerminateProcess
LeaveCriticalSection
Sleep
LoadLibraryW
GetSystemDirectoryW
InitializeCriticalSection
WriteFile
CreateNamedPipeW
GetModuleHandleW
ConnectNamedPipe
SetEvent
WaitForSingleObject
GetEnvironmentVariableA
GetVolumeNameForVolumeMountPointW
GetComputerNameW
LocalFree
GetFileInformationByHandle
GetLocalTime
CreateDirectoryA
GetWindowsDirectoryA
CreateThread
CreateFileMappingW
GetFileSizeEx
GetTempPathW
CreateDirectoryW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
msvcrt
_fileno
_lseeki64
_write
_isatty
__pioinfo
__badioinfo
realloc
ferror
wctomb
_itoa
_snprintf
_iob
isleadbyte
mbtowc
?terminate@@YAXXZ
memmove
memset
??1type_info@@UEAA@XZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
abort
__crtGetStringTypeW
memcpy
__mb_cur_max
__pctype_func
__crtLCMapStringW
__uncaught_exception
setlocale
___lc_handle_func
___lc_codepage_func
___mb_cur_max_func
_callnewh
_strdup
sprintf
strncpy
_vsnprintf
time
_purecall
towupper
atoi
feof
fopen
fread
fclose
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_strlwr
_errno
__CxxFrameHandler
strcspn
printf
_beginthreadex
localeconv
memchr
malloc
free
wcschr
wprintf
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcsrchr
swprintf
_snwprintf
sscanf
_commode
setupapi
SetupDiGetClassDevsExW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiRemoveDevice
shell32
SHGetFolderPathW
user32
wsprintfW
DispatchMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
TranslateMessage
PostMessageW
PostQuitMessage
GetMessageW
SendMessageTimeoutW
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
ole32
CoInitializeEx
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
winspool.drv
EnumPrintersW
DocumentPropertiesW
FindFirstPrinterChangeNotification
ClosePrinter
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
OpenPrinterW
SetPrinterW
GetPrinterW
DeletePrinter
Name
.text
Size
189KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
962B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=286, id=1, productName=Unmarked objects,
count=68, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/prl_vss_provider.dll
- IMPHASH 79cee731ae05a6661f6939ca81559c62
- SHA256 4f60607bf5d849fdbd810cc1f0d06d1e885994003e5b722a7560c3b64c56f560
- MD5 31c14cbfe08eeb593f1cba5409a445f5
- SHA1 37d1958fcd2f7b2f4439effe25c4678bb2f63e18
- SHA512 bc340bc6b42c7a0966f66973a127834e31efbb7ad528b5284ccfffe0e531b960052fef9ae111d7cf5cb9dfc4add4230e0439a58998201b291c93157889cd41d2
- SSDEEP 3072:bBFrFIQpjLhKpFPFeEOEnID+JnWmNdZrQ1A/dV2zrkBcOI058Dd:7XhKpqcn/nXNdZkZ05Id
- TLSH T10CB3286573A80476E07686B9D8E38E49EB72FC410B7587CF4224A25D1F33BD19E39322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5b:bd:78:8d:af:3c:49:ae:52:c1:8c:1b:a7:a9:5c:c5:80:e7:91:6d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Chains
Jan 29, 2018
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Subject
CN=Virtuozzo International GmbH,O=Virtuozzo International GmbH,L=Schaffhausen,C=CH
Serial Number
03:88:b6:07:09:2c:8c:87:38:66:b0:43:98:1d:23:ad
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 27, 2017 - Jan 3, 2019
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
38868
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\jenkins\workspace\pcs-6.12\win-tools\z-Build\Tools\amd64\prl_vss_provider.pdb
kernel32
lstrlenW
RaiseException
GetLastError
GetProcAddress
EnterCriticalSection
CreateEventW
lstrcmpiW
OpenEventW
DeleteCriticalSection
CloseHandle
OutputDebugStringW
WideCharToMultiByte
SetThreadLocale
GetThreadLocale
GetVersionExA
FlsSetValue
GetCommandLineA
GetVersionExW
HeapFree
HeapAlloc
HeapReAlloc
RtlUnwindEx
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
RtlPcToFileHeader
RtlLookupFunctionEntry
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
MultiByteToWideChar
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
OutputDebugStringA
WriteFile
HeapSize
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
SetEvent
WaitForSingleObject
LoadLibraryExW
LoadResource
FreeLibrary
GetStdHandle
FindResourceW
user32
CharNextW
UnregisterClassA
advapi32
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegisterEventSourceW
DeregisterEventSource
ReportEventW
RegDeleteValueW
ole32
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
oleaut32
SysFreeString
SysAllocString
SysStringLen
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=146, id=1, productName=Unmarked objects,
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=97, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=46, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ispell/profiles/Services/register_app.vbs
- SHA256 d8a2ce55e210f351b133a168e7bd4882d4a690305ff3eec6307f49e4301c8d32
- MD5 5c19768f23787234961f0cc933003611
- SHA1 2c074ebf165cf9b340b1391c10184fa81fca3508
- SHA512 fa7acdd7cfa0892f377d2680c9878347bb71f011a6e4ef8301e7b8ec8a9fbcf320585dfccb58e5eac3b551234ccdedf677ec03922e56d447e0e90813aec3617f
- SSDEEP 192:H3uoEP12t1A9CEE5S3TMg7nLhGiSvyGBa8AQU/YCk1p1r0SC3LZ2yovcDBh4kOT0:eonDm1w0x3LZ2yZWgH
- TLSH T15B3231237E83AF1212F236562CB289C9FD642125532395287DAFF539235CFA1CD7A05E
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/profiles/Services/uninstall-provider.cmd
- SHA256 138e6221669dc77a4eff0ee666d1cc80cd9231749f04dedfaaafbb490a5cb343
- MD5 19eb2e3c60e20f23391a837a3370a4f8
- SHA1 a48a59e71fcaad807c9a6741f97824c9ffc3d6f0
- SHA512 3c1ed2fe298d0e22c2c2122b70bc3752b29f47ce0c356bfe3da3d05bee4a80f1fcaca59cb3cf29b7ee906fea916e50a27062055660fd520ebdf9418eefba6689
- TLSH T16FE0C0FB8403326152501885FBB28D734206C4CC2B962179336315239062D07FC010AC
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Swiss Franc/chart01.CHR
- SHA256 acb49e3a852696d9c00b8a18d4200664098b5eb824b2018b9f502caccc643e87
- MD5 a1dcfe0165a0ec56c2a7add71cf64720
- SHA1 a1c48b213c4300731d93de96a44284358bbeb476
- SHA512 9fd5be91f116d7af696259dc9c4cf11b24954bfd21ae12cb24fd9c35ef6dd1098ca52b6842223bc1bb9b8041160b79ce1ad3d9e5f2fcea3d93fd079ef678afe6
- TLSH T1DE317670D5A2680FE033252E02BDA60C31E1756A03E7F3A1B39C95A76C269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Swiss Franc/chart02.CHR
- SHA256 4a54928032f2efa381da20f147e9bc80e8644d0d01d0a48b2b4c103af026541d
- MD5 2842e45a276daeb26f153de925222959
- SHA1 3469c6f7e61c7436b8c05335e86b9421a25af2dc
- SHA512 157bdaec4bb28b975725b9c9d03076526bf7177c060df211c1aedc23fec44a509ca9d30d74f12ed1b68f2a4f609aeca210db61681edabb13f0a9559728e8a855
- TLSH T177317470D1A2280FE033252E02BDA60C31F1756A06E7F3A1B39C95A72D269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Swiss Franc/chart03.CHR
- SHA256 e133902f73140796efad41aca3da903d1e158dc41cd546363a66e1ae3294ba6f
- MD5 34b5854ae81208a46b56978b83ce2b0a
- SHA1 3a70a5bb524eaa0071d2bd5e6c6baa0da2c91dce
- SHA512 f77e490731ac236b834a8573a4ea3109478b0e05f0caaea3fbda9e0b6d69c8d41a625da8a61b9b21710ec55a16ea86a2fb36fe89bce6cbbe99530af67ce54875
- TLSH T13E317670D1A2280FE033242E03BDA60C31E1756A06F7F3A1B29C95A72D269D3AB512D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/Swiss Franc/order.wnd
- SHA256 8716dae9d97cde6377e17ba9355fc88fb7c730863182186154803f71ab9bf04d
- MD5 160ce6235904b9dd0c0bc5debd46c2a9
- SHA1 4cb0104005f671db25fa56b29a4e897f9a3f88d5
- SHA512 bd3c1b997490db498c1b680aed4102154656ff39fdf52dc34d8529b81d88e34bd2a66057f1869bbb5a84bddacebca9adec20a636f8030682ec5e6a72dc9f54dd
- MD5 SHA1 SHA512
ispell/profiles/default/chart01.CHR
- SHA256 ec5ae1a4126438fd3595953ca9407aa3140e8ea1dbb8041a3e8a8ab474bf3cc0
- MD5 e40994752a145890e922b500b9efcef7
- SHA1 dfafbcbea4ed59d21ce1477083dffbb9c29cc655
- SHA512 1b2e5f935ebcd22ed41579b52544e84a1d5b3b219b34e962ef825fdd35308af195c126270ca5b47aef122530d3651c8ac419529b900c574b65eef5047e756f01
- TLSH T152019C30D161A40FF23B29BD66F2EA0C31E4046527B367007B0ED46B6E136E327A72D8
- MD5 SHA1 SHA512 TLSH
ispell/profiles/default/chart02.CHR
- SHA256 d6a0fb8366a2724a0edf9d99b10451e06d7a7832594d78620cf3aefe11c88b5e
- MD5 a8413bde8cf6c9b8a815bd38981b5c4e
- SHA1 7e49be0e818642a19f6d33473eecd0e3c2204a8f
- SHA512 418f06602d2f3635c3d215be1e8f221a6803cd34f963c9d5b7a0b8f18b865ca1a502d38ea1d5bda464c4755b5721c6b10c9ba2f64dcec496f5cfcb980ee80f19
- TLSH T155014830D561A81FF13724AE17F1E60C32E0556927A3A700B61DE4673E136E366932DD
- MD5 SHA1 SHA512 TLSH
ispell/profiles/default/chart03.CHR
- SHA256 2417e8b00b4479870a57df6f1ff082d33f2cbb6f879611e263064b480b8470a1
- MD5 3b738b2f0543172a85239248938c81e1
- SHA1 39f0e0d659fd8bac5d4a1b1a4a6bbdd194df759f
- SHA512 224a835d8749459a287e9cef43eef72a7d6a9162dc148bfb709d38b77237fa9f19d2f00783fdbd86be08d8ff4bbec0a0b009f145b9f36ef4f6a26bf8c8bfec8e
- TLSH T1A9016831D161A40FF13B69BD57F2EA0C31E004652763A7006A1ED4673E136E32BA62DC
- MD5 SHA1 SHA512 TLSH
ispell/profiles/default/chart04.CHR
- SHA256 d288cd11900a881ecaf7a48bf58b0b701fdd59865f771eb7743d1591387da3f4
- MD5 36e98c7362a0d27d2a596d939a144743
- SHA1 513e161c8d29934f30400f98caaba57fbd8ef1ac
- SHA512 a6e27097ca64e6c20341871b32568e1ec5fa06e0ecf99a477683b9796bf071e837cecf376789bd883fe3359be5cdd429b195d9c662b8325b83202daa03e2e25c
- TLSH T1B3115930D1A1680FF137246E43E9AA0C30F4655927A3A350B759D5AB3E572D35A962CC
- MD5 SHA1 SHA512 TLSH
ispell/profiles/default/order.wnd
- SHA256 c5467fd664935820918fbde7bdd79fbaf423ee043c38fbfa83788ef1ec1f75ee
- MD5 bec51eabd4a915e9bf5c33d98e202f1b
- SHA1 2167448793743468ebed9ca020e02517ac632dba
- SHA512 1814c14bec7476829a3f6042c700aa2dbe4c51b771a0edd88ffd5e0a36d1ce271917ebad8305ca56c3dcfa71c11eddf05aa0af9c96a736978264005ddc3c401f
- MD5 SHA1 SHA512
ispell/profiles/lastprofile.ini
- SHA256 e97e0f176d36639fd89a6f64264f0ba4cbaa9a49bb968d5d75b914e94402f3c7
- MD5 6ed31c5fd5171d4861e07e797fe42375
- SHA1 66e0bf1e4962c5e70d45a4a65501bf8346253081
- SHA512 de6726363a00a44793d8222ce29bcd6cc9e5d238da9bfada27677daf12199d4b10ac7f82d3898008d1c0e9eca321e34a3a00a57928550882341655da06603bfc
- MD5 SHA1 SHA512
ispell/templates/ADX.tpl
- SHA256 f57b9c2a2b58469fb54c27af8a934e5c45e6245f71f495f6e7a8998be85ea7f1
- MD5 05ca4c0a3568e2f0352f5c28e33f54f7
- SHA1 9da006aa8ec2a50064b38d8b18595ab9ff3ca995
- SHA512 b3522a8d0134a6cb37d7ce2c9d202c2ac245df60e6459b6f46741f0ba587b1048a6b26fba4b16915a42ca157c66ffcd3fa5d53bedfb4bfd48da10a8d4385963d
- TLSH T15E119E30E5A2784FF137287E17F1D60C71E004691367A310675D956B7E23AD367A62DC
- MD5 SHA1 SHA512 TLSH
ispell/templates/BollingerBands.tpl
- SHA256 3cc9e457716dc3116e0c5e94b0a08d52bc04781936ee6b42085325e157c812bc
- MD5 ffb7ac27b5b6271afb5dfb3435a05a4c
- SHA1 3f3382a9c0285d8f3f834475983c849a7a5f2d44
- SHA512 23b526a6f14a75ffabc3354b0249ac027507af8313805872114e34fe6a6094f0fe7b8458bdaef41b7056de7428f90d3d0262ca9e50fde93dfffcce0fce61bdf8
- TLSH T19D216030D5A2681FF137247E57F1AA0C70E0146917B3B320675D94673D226D367A53CD
- MD5 SHA1 SHA512 TLSH
ispell/templates/Layers.tpl
- SHA256 bcd45609070340aeb991e2e144eb8f223b9f552cfbff510400a9e194fd2e4827
- MD5 ab09fe90952e30f625cea1a8ee37c03d
- SHA1 32f0b0509fc38a0ef89683151b13de053f34ec86
- SHA512 8122daa66c51bccb9a7b6b4b6a3208209a448c5f7f46427cb95deaf0e9bcf7bb830aaea62d0a41c42db2d8ffe5bb3bc8dac53cd25401fdfa31fa42a4f4bae05c
- TLSH T1EF712470D6A2384FE023297E01FCA10871F0356A03E7FB6172ACA5AB6D169D27B553DD
- MD5 SHA1 SHA512 TLSH
ispell/templates/Momentum.tpl
- SHA256 c7f8dacc1aefba1c965b6fea94a029d80a5161a011f81edbd5e4f5d15e554b28
- MD5 255b513a661f9808a09ebc1b03660653
- SHA1 fa36e73dc0f3a95c585965b24b74f51095627bd6
- SHA512 c20eb2f5a8481c26174b9fdf7d073750d9bb5286cec6f7df4551b5b438d40cf8ed5e3d8e43d9e6dc96e9e4f0f91866b093bcf5461de2d7be43fd0f3b44f8028a
- TLSH T11D413670D6E1784FE033252E42BDB60830E1356A06FBF7A0729C95A76C165D66B503D8
- MD5 SHA1 SHA512 TLSH
ispell/templates/OptimizationReport.htm
- SHA256 2ed4af3129fb1479732be1ac2db94adc89c0caae1fc366884fb63240c8d8268a
- MD5 6ec497dc13e18be3e4fe4f68b5293aeb
- SHA1 1a295d4047314583741e6e1a414676e8445f6ba1
- SHA512 d204a688fdb2fcf6d486bcd44b0ac8a668ff92aaddcd6b6299c76c3f62a2d8caa86134739fa9d31eb453ca57188c80b5e4c561a8689b879e5b79ab62e8309031
- TLSH T121219E1E0191AE1D86335671E2F1238ADE36964F93CD4CB4316F29176FE2610854B7AC
- MD5 SHA1 SHA512 TLSH
ispell/templates/Popular.tpl
- SHA256 ef2b0177a970b6d6df52a9d03a004eca68b6f410f91047050023024d6cb4f8bb
- MD5 8c2fb164cfe9ea09bd4657f05c9a9777
- SHA1 1e8cb5e86ea8e5617b8f18d9bd97220da56707bb
- SHA512 6f751dc8ecc31a0e8d9943db2f90db8e1e53abae15d8c42bc0e08cb3a35ea7c0d27e815b91a516fc4be33f6d593212dba11bd270fc4544ca1df0885332c7b0ec
- TLSH T18E314370C6E1380FE023253E42BDB60870F1756A06F7F3A172A896A72C179D2AB503DD
- MD5 SHA1 SHA512 TLSH
ispell/templates/StatementDetailed.htm
- SHA256 c90650f5f5dca0f85ad00f9426f707399e48afd2338acf388861408f15e2200e
- MD5 bdf05b272de664ab93e5cb43ed2c1949
- SHA1 33ffeeec47af92be867cf3fd20bb2b41f7d60c6a
- SHA512 ded5cd31e4bd7693d1620acfcad74c9438c44c87fc6621581d06bedc80148004bd1367a9efbcdcd5b18e8c4b1eb19fde8a0b171c8fed9b0b4d5754285e843933
- SSDEEP 96:C6QWGrvLG2eWu4H+O/XjUpmEyhUMOfhYsAVatRBUzm7znKUoUHdtRv2tVRyopn/C:C6zGvG2e2e3YSUk+V9O
- TLSH T15FE1C62305C8B73A6A36025AE8662EC2EDE2C877D79A4D017C5F58CF5FA15A4F10378D
- MD5 SHA1 SHA512 SSDEEP TLSH
ispell/templates/Volume.tpl
- SHA256 1e1cb0866dbc2091a39a98219395f6bf50e19633050ad63e40bf538def9e3ee8
- MD5 71e7d43363787423f997d2911f841733
- SHA1 949da5891e655f523d835bb15f7ec49d70277c91
- SHA512 52433a21d2b9001c76b2eca135269f9a286710dbe08b3d10c38ea8830fa4fc55b445ca6655f0fc0e9fefbd3563a6dcdeafaaf5be56d9bd736dcf1f20a55cec21
- TLSH T1E9312670D5A2685FE023243E03E9A60C70E1346D07E7F370739C95AB2D269C7ABA13D9
- MD5 SHA1 SHA512 TLSH
ispell/templates/Williams.tpl
- SHA256 da71cd87ffbd0a92179b23fa28c7adbbe9f7f79960d4e41affeeaa8c0ed99293
- MD5 4d1db2b7c191d170c7d606d7653a8514
- SHA1 457c90064fd5aa586fecd600e1b7cb6f7e0ba69f
- SHA512 cfb735e50ba99b9b0efbe5caa3bf81f21d0342467aa442814ef113f2e73741f6657eb8e9c2fa0ce11dd873a26219d17688d3e4fffd9a592b38e7fbf1edc99b94
- TLSH T139310730E6A2A85FF137287E07F1E60C71D114591727B320B36D9077BD21AD3A7952D8
- MD5 SHA1 SHA512 TLSH
ispell/templates/statement.htm
- SHA256 0cb8cb10b03d02fdaa0474ab79ca11117793812417f8043e5ebab60481ebaf99
- MD5 482d253dc8684499b50eb9fe1d90cc11
- SHA1 c0e4af8b34c20c047de05fdc13331241ecdd74e7
- SHA512 d370ddbaf8f9b381a1f7530a320ebbb3eae0c363bc4b6896734498cbb7e7b18a5d61926852b962f120c95e88979321454bd4d1436816344d2b5f3d4d41ac1ec2
- TLSH T12881E32605C8BB3A6A360156E8653EC2EDF1887793A94C007C1F5CCB9FA15B4E243799
- MD5 SHA1 SHA512 TLSH
ispell/templates/strategytester.htm
- SHA256 bc11a2ea23005e246d554b458c35b8bbd9c1853b5ce92afa29d20d843cb0aeac
- MD5 14eabfe565f4093c112aca11e4af3b9c
- SHA1 8492575d00d8158ef5c70836a421b9dad7ba3660
- SHA512 f516fe61b8ebe82f91d088252dc8b80750c77ad06153fe1f4d1665dcb96f0f033946b5a4d160422765e00f0731f487d3e569f8d7214e249b6bdd7672680d2c3e
- TLSH T111219E1E0191AE1D86335671F2F2238ADE369A4F92CD4CB4316F29276FE2610854B7AC
- MD5 SHA1 SHA512 TLSH
libswscale-8.dll
- IMPHASH 0b68447ccf56d04b7ca81380933d7bd7
- SHA256 b80dd69f7c0879a950928a7e1a43aa08349ddb8d804332b7cc633d8a40166136
- MD5 2d45d3e79fb29610e9afe585c3d2b9d5
- SHA1 6e8baa2e1beb682a7cd0e3d8a7429d6ee106c871
- SHA512 2034f941cf0441d64058765694f1c5893ff322bed531f3e9a52ec963793a5ba9039b6f65afe767f1f98cd874affeebfec25cd8c898bb0efbb6bff4d5cd91f10d
- SSDEEP 12288:B5UFSV/7hoPBeuRgkUHpjQTWudHxkOf4oF+o0JQW7lIrJlYHBOnTcDGS2hkSg6PD:B5UFSV/DlIqiT3S2hkSga1QYJ
- TLSH T108359E5070814255DCF521BA83FDFBA9057C62B903119DFB56D81EF7DA30AC27A33A8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15681
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\buildworker\libav_win32\build\ffmpeg-7.0.1\libswscale\libswscale-8.pdb
libavutil-59
av_pix_fmt_desc_get
av_frame_free
av_frame_alloc
avpriv_slicethread_free
avpriv_slicethread_create
av_opt_get_int
av_opt_set_int
av_opt_copy
av_opt_set_defaults
av_free
av_fast_realloc
av_malloc_array
av_mallocz_tracked
av_image_alloc
av_pix_fmt_swap_endianness
av_pix_fmt_get_chroma_sub_sample
av_get_bits_per_pixel
av_get_pix_fmt_name
avpriv_slicethread_execute
av_frame_get_buffer
av_frame_unref
av_frame_ref
av_get_cpu_flags
av_fast_malloc
av_freep
av_calloc
av_malloc_tracked
av_log
kernel32
TlsSetValue
CloseHandle
CreateFileW
OutputDebugStringW
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
SetEnvironmentVariableW
InitOnceBeginInitialize
InitOnceComplete
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FreeEnvironmentStringsW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
WriteConsoleW
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetConsoleCtrlHandler
DecodePointer
GetCurrentThread
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
sws_allocVec
sws_alloc_context
sws_alloc_set_opts
sws_convertPalette8ToPacked24
sws_convertPalette8ToPacked32
sws_frame_end
sws_frame_start
sws_freeContext
sws_freeFilter
sws_freeVec
sws_getCachedContext
sws_getCoefficients
sws_getColorspaceDetails
sws_getContext
sws_getDefaultFilter
sws_getGaussianVec
sws_get_class
sws_init_context
sws_isSupportedEndiannessConversion
sws_isSupportedInput
sws_isSupportedOutput
sws_normalizeVec
sws_receive_slice
sws_receive_slice_alignment
sws_scale
sws_scaleVec
sws_scale_frame
sws_send_slice
sws_setColorspaceDetails
swscale_configuration
swscale_license
swscale_version
Name
.text
Size
948KB
Virtual Size
947KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
270B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=137, id=261, version=30795,
count=33, id=260, version=30795,
count=2, id=257, version=30795,
count=21, id=259, version=33731,
count=16, id=260, version=33731,
count=31, id=261, version=33731,
count=3, id=257, version=33817,
count=111, id=1, productName=Unmarked objects,
count=7, productName=Unmarked objects (old),
count=21, id=260, version=33817,
count=1, id=256, version=33817,
count=1, id=255, version=33817,
count=1, id=258, version=33817,
libx264-142.dll
- IMPHASH 732b16853cb18b3c4bb606be16cc85b3
- SHA256 062f3d64fbf943a3e804354fb19098eac681b7f9ec48fc252e485270d195ced8
- MD5 171788ace04d1b54d496db77a4e8d005
- SHA1 bb50a3b9bafee371ca54331ea0d1a9190d06b3bc
- SHA512 21544c19d7ba54a619b522a9ce68c4fe4e62980113cdcefade68bc2474865f9e0832d970591431ce7698f7a4834e59e2f80a778a3b4dcbe617885531b2a7f28c
- SSDEEP 24576:23oB2MQ/r51NmMrHPyZCBv5aW2ZrAGl+q:TfqcCZL2p3
- TLSH T188158D84FA9768F2E54B2931D42FF27F72742A099064EC71DF886B1AF437E636116702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
GetConsoleMode
GetCurrentProcess
GetCurrentThread
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStdHandle
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReleaseSemaphore
SetEvent
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleW
msvcrt
_strdup
__dllonexit
__mb_cur_max
_assert
_beginthreadex
_errno
_filelengthi64
_fstat64
_ftime64
_iob
_stricmp
_strnicmp
_wfopen
_wrename
_wstat64
_wunlink
abort
atoi
calloc
exp
fclose
fflush
fgetpos
floor
fprintf
fputc
fread
free
frexp
fsetpos
fwrite
getenv
ldexp
localeconv
log
log10
malloc
memcmp
memcpy
memmove
memset
setlocale
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strpbrk
strspn
strstr
strtod
strtok
strtol
vfprintf
wcslen
x264_adaptive_quant_frame
x264_add16x16_idct8_avx
x264_add16x16_idct8_mmx
x264_add16x16_idct8_sse2
x264_add16x16_idct_avx
x264_add16x16_idct_avx2
x264_add16x16_idct_dc_avx
x264_add16x16_idct_dc_avx2
x264_add16x16_idct_dc_mmx2
x264_add16x16_idct_dc_sse2
x264_add16x16_idct_dc_ssse3
x264_add16x16_idct_mmx
x264_add16x16_idct_sse2
x264_add4x4_idct_avx
x264_add4x4_idct_mmx
x264_add4x4_idct_sse4
x264_add8x8_idct8_avx
x264_add8x8_idct8_avx.skip_prologue
x264_add8x8_idct8_mmx
x264_add8x8_idct8_mmx.skip_prologue
x264_add8x8_idct8_sse2
x264_add8x8_idct8_sse2.skip_prologue
x264_add8x8_idct_avx
x264_add8x8_idct_avx.skip_prologue
x264_add8x8_idct_avx2
x264_add8x8_idct_avx2.skip_prologue
x264_add8x8_idct_dc_mmx2
x264_add8x8_idct_dc_ssse3
x264_add8x8_idct_mmx
x264_add8x8_idct_sse2
x264_add8x8_idct_sse2.skip_prologue
x264_analyse_free_costs
x264_analyse_init_costs
x264_analyse_prepare_costs
x264_analyse_weight_frame
x264_bit_depth
x264_bitstream_init
x264_cabac_block_residual_8x8_rd_c
x264_cabac_block_residual_c
x264_cabac_block_residual_rd_c
x264_cabac_context_init
x264_cabac_contexts
x264_cabac_encode_bypass_asm
x264_cabac_encode_bypass_bmi2
x264_cabac_encode_bypass_c
x264_cabac_encode_decision_asm
x264_cabac_encode_decision_bmi2
x264_cabac_encode_decision_c
x264_cabac_encode_flush
x264_cabac_encode_init
x264_cabac_encode_init_core
x264_cabac_encode_terminal_asm
x264_cabac_encode_terminal_c
x264_cabac_encode_ue_bypass
x264_cabac_entropy
x264_cabac_init
x264_cabac_mb_skip
x264_cabac_range_lps
x264_cabac_renorm_shift
x264_cabac_size_unary
x264_cabac_transition
x264_cabac_transition_unary
x264_cache_mv_func_table
x264_cache_mvd_func_table
x264_cache_ref_func_table
x264_cavlc_init
x264_chroma_format
x264_chroma_inter_body_avx
x264_chroma_inter_body_mmx2
x264_chroma_inter_body_sse2
x264_chroma_intra_body_avx
x264_chroma_intra_body_mmx2
x264_chroma_intra_body_sse2
x264_coeff0_token
x264_coeff_abs_level_m1_offset
x264_coeff_flag_offset_chroma_422_dc
x264_coeff_last15_mmx2
x264_coeff_last15_sse2
x264_coeff_last15_sse2_lzcnt
x264_coeff_last16_mmx2
x264_coeff_last16_sse2
x264_coeff_last16_sse2_lzcnt
x264_coeff_last4_mmx2
x264_coeff_last4_mmx2_lzcnt
x264_coeff_last64_avx2_lzcnt
x264_coeff_last64_mmx2
x264_coeff_last64_sse2
x264_coeff_last64_sse2_lzcnt
x264_coeff_last8_mmx2
x264_coeff_last8_mmx2_lzcnt
x264_coeff_level_run15_avx2_lzcnt
x264_coeff_level_run15_mmx2
x264_coeff_level_run15_sse2
x264_coeff_level_run15_sse2_lzcnt
x264_coeff_level_run15_ssse3
x264_coeff_level_run15_ssse3_lzcnt
x264_coeff_level_run16_avx2_lzcnt
x264_coeff_level_run16_mmx2
x264_coeff_level_run16_sse2
x264_coeff_level_run16_sse2_lzcnt
x264_coeff_level_run16_ssse3
x264_coeff_level_run16_ssse3_lzcnt
x264_coeff_level_run4_mmx2
x264_coeff_level_run4_mmx2_lzcnt
x264_coeff_level_run4_ssse3
x264_coeff_level_run4_ssse3_lzcnt
x264_coeff_level_run8_mmx2
x264_coeff_level_run8_mmx2_lzcnt
x264_coeff_level_run8_ssse3
x264_coeff_level_run8_ssse3_lzcnt
x264_coeff_token
x264_copy_column8
x264_count_cat_m1
x264_cpu_cpuid
x264_cpu_cpuid_test
x264_cpu_detect
x264_cpu_emms
x264_cpu_names
x264_cpu_num_processors
x264_cpu_sfence
x264_cpu_xgetbv
x264_cqm_delete
x264_cqm_init
x264_cqm_parse_file
x264_dct4_weight2_tab
x264_dct4_weight_tab
x264_dct4x4dc_mmx
x264_dct8_mmx
x264_dct8_weight2_tab
x264_dct8_weight_tab
x264_dct_init
x264_deblock_h_chroma_422_avx
x264_deblock_h_chroma_422_intra_avx
x264_deblock_h_chroma_422_intra_mmx2
x264_deblock_h_chroma_422_intra_sse2
x264_deblock_h_chroma_422_mmx2
x264_deblock_h_chroma_422_sse2
x264_deblock_h_chroma_avx
x264_deblock_h_chroma_intra_avx
x264_deblock_h_chroma_intra_mbaff_mmx2
x264_deblock_h_chroma_intra_mmx2
x264_deblock_h_chroma_intra_sse2
x264_deblock_h_chroma_mbaff_mmx2
x264_deblock_h_chroma_mbaff_sse2
x264_deblock_h_chroma_mmx2
x264_deblock_h_chroma_sse2
x264_deblock_h_luma_avx
x264_deblock_h_luma_intra_avx
x264_deblock_h_luma_intra_mmx2
x264_deblock_h_luma_intra_sse2
x264_deblock_h_luma_mmx2
x264_deblock_h_luma_sse2
x264_deblock_init
x264_deblock_strength_avx
x264_deblock_strength_avx2
x264_deblock_strength_mmx2
x264_deblock_strength_sse2
x264_deblock_strength_ssse3
x264_deblock_v8_luma_intra_mmx2
x264_deblock_v8_luma_mmx2
x264_deblock_v_chroma_avx
x264_deblock_v_chroma_intra_avx
x264_deblock_v_chroma_intra_mmx2
x264_deblock_v_chroma_intra_sse2
x264_deblock_v_chroma_mmx2
x264_deblock_v_chroma_sse2
x264_deblock_v_luma_avx
x264_deblock_v_luma_intra_avx
x264_deblock_v_luma_intra_sse2
x264_deblock_v_luma_sse2
x264_decimate_score15_mmx2
x264_decimate_score15_sse2
x264_decimate_score15_ssse3
x264_decimate_score16_mmx2
x264_decimate_score16_sse2
x264_decimate_score16_ssse3
x264_decimate_score64_avx2
x264_decimate_score64_mmx2
x264_decimate_score64_sse2
x264_decimate_score64_ssse3
x264_decimate_table4
x264_decimate_table8
x264_deinterleave_shufd
x264_denoise_dct_avx
x264_denoise_dct_avx2
x264_denoise_dct_mmx
x264_denoise_dct_sse2
x264_denoise_dct_ssse3
x264_dequant_4x4_avx
x264_dequant_4x4_avx2
x264_dequant_4x4_flat16_avx2
x264_dequant_4x4_flat16_mmx
x264_dequant_4x4_flat16_sse2
x264_dequant_4x4_mmx
x264_dequant_4x4_sse2
x264_dequant_4x4_xop
x264_dequant_4x4dc_avx
x264_dequant_4x4dc_avx2
x264_dequant_4x4dc_mmx2
x264_dequant_4x4dc_sse2
x264_dequant_8x8_avx
x264_dequant_8x8_avx2
x264_dequant_8x8_flat16_avx2
x264_dequant_8x8_flat16_mmx
x264_dequant_8x8_flat16_sse2
x264_dequant_8x8_mmx
x264_dequant_8x8_sse2
x264_dequant_8x8_xop
x264_encoder_close
x264_encoder_delayed_frames
x264_encoder_encode
x264_encoder_headers
x264_encoder_intra_refresh
x264_encoder_invalidate_reference
x264_encoder_maximum_delayed_frames
x264_encoder_open_142
x264_encoder_parameters
x264_encoder_reconfig
x264_encoder_reconfig_apply
x264_exp2_lut
x264_expand_border_mbpair
x264_field_vsad
x264_filler_write
x264_fopen
x264_frame_cond_broadcast
x264_frame_cond_wait
x264_frame_copy_picture
x264_frame_deblock_row
x264_frame_delete
x264_frame_delete_list
x264_frame_expand_border
x264_frame_expand_border_chroma
x264_frame_expand_border_filtered
x264_frame_expand_border_lowres
x264_frame_expand_border_mod16
x264_frame_filter
x264_frame_init_lowres
x264_frame_init_lowres_core_avx
x264_frame_init_lowres_core_avx2
x264_frame_init_lowres_core_cache32_mmx2
x264_frame_init_lowres_core_mmx2
x264_frame_init_lowres_core_sse2
x264_frame_init_lowres_core_ssse3
x264_frame_init_lowres_core_xop
x264_frame_new_slice
x264_frame_pop
x264_frame_pop_blank_unused
x264_frame_pop_unused
x264_frame_push
x264_frame_push_blank_unused
x264_frame_push_unused
x264_frame_shift
x264_frame_unshift
x264_free
x264_hadamard_ac_2x2max_mmx2
x264_hadamard_ac_4x4_mmx2
x264_hadamard_ac_8x8_avx
x264_hadamard_ac_8x8_avx2
x264_hadamard_ac_8x8_mmx2
x264_hadamard_ac_8x8_sse2
x264_hadamard_ac_8x8_sse4
x264_hadamard_ac_8x8_ssse3
x264_hadamard_ac_8x8_ssse3_atom
x264_hadamard_ac_8x8_xop
x264_hadamard_load
x264_hpel_filter_c_avx
x264_hpel_filter_c_avx2
x264_hpel_filter_c_mmx2
x264_hpel_filter_c_sse2
x264_hpel_filter_c_ssse3
x264_hpel_filter_h_avx
x264_hpel_filter_h_avx2
x264_hpel_filter_h_mmx2
x264_hpel_filter_h_sse2
x264_hpel_filter_h_ssse3
x264_hpel_filter_v_avx
x264_hpel_filter_v_avx2
x264_hpel_filter_v_mmx2
x264_hpel_filter_v_sse2
x264_hpel_filter_v_ssse3
x264_hrd_fullness
x264_hsub_mul
x264_idct4x4dc_mmx
x264_idct8_mmx
x264_integral_init4h_avx2
x264_integral_init4h_sse4
x264_integral_init4v_avx2
x264_integral_init4v_mmx
x264_integral_init4v_sse2
x264_integral_init4v_ssse3
x264_integral_init8h_avx
x264_integral_init8h_avx2
x264_integral_init8h_sse4
x264_integral_init8v_avx2
x264_integral_init8v_mmx
x264_integral_init8v_sse2
x264_intel_cpu_indicator_init
x264_intra_sa8d_x3_8x8
x264_intra_sa8d_x3_8x8_mmx2
x264_intra_sad_x3_16x16
x264_intra_sad_x3_16x16_avx2
x264_intra_sad_x3_16x16_mmx2
x264_intra_sad_x3_16x16_sse2
x264_intra_sad_x3_16x16_ssse3
x264_intra_sad_x3_4x4
x264_intra_sad_x3_4x4_mmx2
x264_intra_sad_x3_8x16c
x264_intra_sad_x3_8x16c_mmx2
x264_intra_sad_x3_8x16c_sse2
x264_intra_sad_x3_8x8
x264_intra_sad_x3_8x8_mmx2
x264_intra_sad_x3_8x8c
x264_intra_sad_x3_8x8c_avx2
x264_intra_sad_x3_8x8c_mmx2
x264_intra_sad_x3_8x8c_ssse3
x264_intra_sad_x9_4x4_avx
x264_intra_sad_x9_4x4_sse4
x264_intra_sad_x9_4x4_ssse3
x264_intra_sad_x9_8x8_avx
x264_intra_sad_x9_8x8_avx2
x264_intra_sad_x9_8x8_sse4
x264_intra_sad_x9_8x8_ssse3
x264_intra_satd_x3_16x16
x264_intra_satd_x3_16x16_mmx2
x264_intra_satd_x3_16x16_ssse3
x264_intra_satd_x3_4x4
x264_intra_satd_x3_4x4_mmx2
x264_intra_satd_x3_4x4_ssse3
x264_intra_satd_x3_8x16c
x264_intra_satd_x3_8x16c_avx
x264_intra_satd_x3_8x16c_mmx2
x264_intra_satd_x3_8x16c_sse2
x264_intra_satd_x3_8x16c_sse4
x264_intra_satd_x3_8x16c_ssse3
x264_intra_satd_x3_8x16c_xop
x264_intra_satd_x3_8x8c
x264_intra_satd_x3_8x8c_mmx2
x264_intra_satd_x3_8x8c_ssse3
x264_intra_satd_x9_4x4_avx
x264_intra_satd_x9_4x4_sse4
x264_intra_satd_x9_4x4_ssse3
x264_intra_satd_x9_4x4_xop
x264_is_pipe
x264_iter_kludge
x264_lambda2_tab
x264_lambda_tab
x264_last_coeff_flag_offset
x264_last_coeff_flag_offset_8x8
x264_level_token
x264_levels
x264_load_deinterleave_chroma_fdec_mmx
x264_load_deinterleave_chroma_fdec_sse2
x264_load_deinterleave_chroma_fdec_ssse3
x264_load_deinterleave_chroma_fenc_mmx
x264_load_deinterleave_chroma_fenc_sse2
x264_load_deinterleave_chroma_fenc_ssse3
x264_log
x264_log2_lut
x264_log2_lz_lut
x264_lookahead_delete
x264_lookahead_get_frames
x264_lookahead_init
x264_lookahead_is_empty
x264_lookahead_put_frame
x264_macroblock_analyse
x264_macroblock_bipred_init
x264_macroblock_cache_allocate
x264_macroblock_cache_free
x264_macroblock_cache_load_interlaced
x264_macroblock_cache_load_progressive
x264_macroblock_cache_save
x264_macroblock_deblock
x264_macroblock_deblock_strength
x264_macroblock_encode
x264_macroblock_encode_p4x4
x264_macroblock_encode_p8x8
x264_macroblock_probe_skip
x264_macroblock_slice_init
x264_macroblock_thread_allocate
x264_macroblock_thread_free
x264_macroblock_thread_init
x264_macroblock_tree_read
x264_macroblock_write_cabac
x264_macroblock_write_cavlc
x264_malloc
x264_mb_encode_chroma
x264_mb_mc
x264_mb_mc_8x8
x264_mb_predict_mv
x264_mb_predict_mv_16x16
x264_mb_predict_mv_direct16x16
x264_mb_predict_mv_pskip
x264_mb_predict_mv_ref16x16
x264_mbtree_propagate_cost_avx
x264_mbtree_propagate_cost_avx2_fma3
x264_mbtree_propagate_cost_fma4
x264_mbtree_propagate_cost_sse2
x264_mc_chroma_avx
x264_mc_chroma_avx2
x264_mc_chroma_mmx2
x264_mc_chroma_sse2
x264_mc_chroma_ssse3
x264_mc_chroma_ssse3_cache64
x264_mc_copy_w16_aligned_sse
x264_mc_copy_w16_mmx
x264_mc_copy_w16_sse
x264_mc_copy_w4_mmx
x264_mc_copy_w8_mmx
x264_mc_init
x264_mc_init_mmx
x264_mc_offsetadd_w12_mmx2
x264_mc_offsetadd_w12_sse2
x264_mc_offsetadd_w16_mmx2
x264_mc_offsetadd_w16_sse2
x264_mc_offsetadd_w20_mmx2
x264_mc_offsetadd_w20_sse2
x264_mc_offsetadd_w4_mmx2
x264_mc_offsetadd_w8_mmx2
x264_mc_offsetsub_w12_mmx2
x264_mc_offsetsub_w12_sse2
x264_mc_offsetsub_w16_mmx2
x264_mc_offsetsub_w16_sse2
x264_mc_offsetsub_w20_mmx2
x264_mc_offsetsub_w20_sse2
x264_mc_offsetsub_w4_mmx2
x264_mc_offsetsub_w8_mmx2
x264_mc_weight_w12_mmx2
x264_mc_weight_w16_avx2
x264_mc_weight_w16_mmx2
x264_mc_weight_w16_sse2
x264_mc_weight_w16_ssse3
x264_mc_weight_w20_avx2
x264_mc_weight_w20_mmx2
x264_mc_weight_w20_sse2
x264_mc_weight_w20_ssse3
x264_mc_weight_w4_mmx2
x264_mc_weight_w4_ssse3
x264_mc_weight_w8_avx2
x264_mc_weight_w8_mmx2
x264_mc_weight_w8_sse2
x264_mc_weight_w8_ssse3
x264_mdate
x264_me_refine_bidir_rd
x264_me_refine_bidir_satd
x264_me_refine_qpel
x264_me_refine_qpel_rd
x264_me_refine_qpel_refdupe
x264_me_search_ref
x264_memcpy_aligned_mmx
x264_memcpy_aligned_sse
x264_memzero_aligned_avx
x264_memzero_aligned_mmx
x264_memzero_aligned_sse
x264_nal_encode
x264_nal_escape_mmx2
x264_nal_escape_sse2
x264_noise_reduction_update
x264_optimize_chroma_2x2_dc_avx
x264_optimize_chroma_2x2_dc_sse2
x264_optimize_chroma_2x2_dc_sse4
x264_optimize_chroma_2x2_dc_ssse3
x264_param2string
x264_param_apply_fastfirstpass
x264_param_apply_profile
x264_param_default
x264_param_default_preset
x264_param_parse
x264_pb_0
x264_pb_01
x264_pb_1
x264_pb_3
x264_pb_a1
x264_pb_shuf8x8c
x264_pb_unpackbd1
x264_pb_unpackbd2
x264_pd_1
x264_pd_1024
x264_pd_32
x264_pd_ffff
x264_picture_alloc
x264_picture_clean
x264_picture_init
x264_pixel_ads1_avx
x264_pixel_ads1_avx2
x264_pixel_ads1_mmx2
x264_pixel_ads1_sse2
x264_pixel_ads1_ssse3
x264_pixel_ads2_avx
x264_pixel_ads2_avx2
x264_pixel_ads2_mmx2
x264_pixel_ads2_sse2
x264_pixel_ads2_ssse3
x264_pixel_ads4_avx
x264_pixel_ads4_avx2
x264_pixel_ads4_mmx2
x264_pixel_ads4_sse2
x264_pixel_ads4_ssse3
x264_pixel_ads_mvs_mmx
x264_pixel_ads_mvs_ssse3
x264_pixel_asd8_sse2
x264_pixel_asd8_ssse3
x264_pixel_avg2_w12_cache32_mmx2
x264_pixel_avg2_w12_cache64_mmx2
x264_pixel_avg2_w12_mmx2
x264_pixel_avg2_w16_cache32_mmx2
x264_pixel_avg2_w16_cache64_mmx2
x264_pixel_avg2_w16_cache64_sse2
x264_pixel_avg2_w16_cache64_ssse3
x264_pixel_avg2_w16_mmx2
x264_pixel_avg2_w16_sse2
x264_pixel_avg2_w20_avx2
x264_pixel_avg2_w20_cache32_mmx2
x264_pixel_avg2_w20_cache64_mmx2
x264_pixel_avg2_w20_cache64_sse2
x264_pixel_avg2_w20_mmx2
x264_pixel_avg2_w20_sse2
x264_pixel_avg2_w4_mmx2
x264_pixel_avg2_w8_cache32_mmx2
x264_pixel_avg2_w8_cache64_mmx2
x264_pixel_avg2_w8_mmx2
x264_pixel_avg_16x16_avx2
x264_pixel_avg_16x16_mmx2
x264_pixel_avg_16x16_sse2
x264_pixel_avg_16x16_ssse3
x264_pixel_avg_16x8_avx2
x264_pixel_avg_16x8_mmx2
x264_pixel_avg_16x8_sse2
x264_pixel_avg_16x8_ssse3
x264_pixel_avg_4x16_mmx2
x264_pixel_avg_4x16_ssse3
x264_pixel_avg_4x2_mmx2
x264_pixel_avg_4x2_ssse3
x264_pixel_avg_4x4_mmx2
x264_pixel_avg_4x4_ssse3
x264_pixel_avg_4x8_mmx2
x264_pixel_avg_4x8_ssse3
x264_pixel_avg_8x16_mmx2
x264_pixel_avg_8x16_sse2
x264_pixel_avg_8x16_ssse3
x264_pixel_avg_8x4_mmx2
x264_pixel_avg_8x4_sse2
x264_pixel_avg_8x4_ssse3
x264_pixel_avg_8x8_mmx2
x264_pixel_avg_8x8_sse2
x264_pixel_avg_8x8_ssse3
x264_pixel_avg_w16_avx2
x264_pixel_avg_w16_mmx2
x264_pixel_avg_w16_sse2
x264_pixel_avg_w4_mmx2
x264_pixel_avg_w8_mmx2
x264_pixel_avg_weight_w16_avx2
x264_pixel_avg_weight_w16_mmx2
x264_pixel_avg_weight_w16_sse2
x264_pixel_avg_weight_w16_ssse3
x264_pixel_avg_weight_w4_mmx2
x264_pixel_avg_weight_w4_ssse3
x264_pixel_avg_weight_w8_mmx2
x264_pixel_avg_weight_w8_sse2
x264_pixel_avg_weight_w8_ssse3
x264_pixel_hadamard_ac_16x16_avx
x264_pixel_hadamard_ac_16x16_avx2
x264_pixel_hadamard_ac_16x16_mmx2
x264_pixel_hadamard_ac_16x16_sse2
x264_pixel_hadamard_ac_16x16_sse4
x264_pixel_hadamard_ac_16x16_ssse3
x264_pixel_hadamard_ac_16x16_ssse3_atom
x264_pixel_hadamard_ac_16x16_xop
x264_pixel_hadamard_ac_16x8_avx
x264_pixel_hadamard_ac_16x8_avx2
x264_pixel_hadamard_ac_16x8_mmx2
x264_pixel_hadamard_ac_16x8_sse2
x264_pixel_hadamard_ac_16x8_sse4
x264_pixel_hadamard_ac_16x8_ssse3
x264_pixel_hadamard_ac_16x8_ssse3_atom
x264_pixel_hadamard_ac_16x8_xop
x264_pixel_hadamard_ac_8x16_avx
x264_pixel_hadamard_ac_8x16_mmx2
x264_pixel_hadamard_ac_8x16_sse2
x264_pixel_hadamard_ac_8x16_sse4
x264_pixel_hadamard_ac_8x16_ssse3
x264_pixel_hadamard_ac_8x16_ssse3_atom
x264_pixel_hadamard_ac_8x16_xop
x264_pixel_hadamard_ac_8x8_avx
x264_pixel_hadamard_ac_8x8_mmx2
x264_pixel_hadamard_ac_8x8_sse2
x264_pixel_hadamard_ac_8x8_sse4
x264_pixel_hadamard_ac_8x8_ssse3
x264_pixel_hadamard_ac_8x8_ssse3_atom
x264_pixel_hadamard_ac_8x8_xop
x264_pixel_init
x264_pixel_sa8d_16x16_avx
x264_pixel_sa8d_16x16_mmx2
x264_pixel_sa8d_16x16_sse2
x264_pixel_sa8d_16x16_sse4
x264_pixel_sa8d_16x16_ssse3
x264_pixel_sa8d_16x16_ssse3_atom
x264_pixel_sa8d_16x16_xop
x264_pixel_sa8d_8x8_avx
x264_pixel_sa8d_8x8_avx2
x264_pixel_sa8d_8x8_internal_avx
x264_pixel_sa8d_8x8_internal_avx2
x264_pixel_sa8d_8x8_internal_mmx2
x264_pixel_sa8d_8x8_internal_sse2
x264_pixel_sa8d_8x8_internal_sse4
x264_pixel_sa8d_8x8_internal_ssse3
x264_pixel_sa8d_8x8_internal_ssse3_atom
x264_pixel_sa8d_8x8_internal_xop
x264_pixel_sa8d_8x8_mmx2
x264_pixel_sa8d_8x8_sse2
x264_pixel_sa8d_8x8_sse4
x264_pixel_sa8d_8x8_ssse3
x264_pixel_sa8d_8x8_ssse3_atom
x264_pixel_sa8d_8x8_xop
x264_pixel_sad_16x16_cache32_mmx2
x264_pixel_sad_16x16_cache64_mmx2
x264_pixel_sad_16x16_cache64_sse2
x264_pixel_sad_16x16_cache64_ssse3
x264_pixel_sad_16x16_mmx2
x264_pixel_sad_16x16_sse2
x264_pixel_sad_16x16_sse2_aligned
x264_pixel_sad_16x16_sse3
x264_pixel_sad_16x8_cache32_mmx2
x264_pixel_sad_16x8_cache64_mmx2
x264_pixel_sad_16x8_cache64_sse2
x264_pixel_sad_16x8_cache64_ssse3
x264_pixel_sad_16x8_mmx2
x264_pixel_sad_16x8_sse2
x264_pixel_sad_16x8_sse2_aligned
x264_pixel_sad_16x8_sse3
x264_pixel_sad_4x16_mmx2
x264_pixel_sad_4x4_mmx2
x264_pixel_sad_4x8_mmx2
x264_pixel_sad_8x16_cache32_mmx2
x264_pixel_sad_8x16_cache64_mmx2
x264_pixel_sad_8x16_mmx2
x264_pixel_sad_8x16_sse2
x264_pixel_sad_8x4_cache32_mmx2
x264_pixel_sad_8x4_cache64_mmx2
x264_pixel_sad_8x4_mmx2
x264_pixel_sad_8x8_cache32_mmx2
x264_pixel_sad_8x8_cache64_mmx2
x264_pixel_sad_8x8_mmx2
x264_pixel_sad_x3_16x16_avx
x264_pixel_sad_x3_16x16_avx2
x264_pixel_sad_x3_16x16_cache32_mmx2
x264_pixel_sad_x3_16x16_cache64_mmx2
x264_pixel_sad_x3_16x16_cache64_sse2
x264_pixel_sad_x3_16x16_cache64_ssse3
x264_pixel_sad_x3_16x16_mmx2
x264_pixel_sad_x3_16x16_sse2
x264_pixel_sad_x3_16x16_sse3
x264_pixel_sad_x3_16x16_ssse3
x264_pixel_sad_x3_16x8_avx
x264_pixel_sad_x3_16x8_avx2
x264_pixel_sad_x3_16x8_cache32_mmx2
x264_pixel_sad_x3_16x8_cache64_mmx2
x264_pixel_sad_x3_16x8_cache64_sse2
x264_pixel_sad_x3_16x8_cache64_ssse3
x264_pixel_sad_x3_16x8_mmx2
x264_pixel_sad_x3_16x8_sse2
x264_pixel_sad_x3_16x8_sse3
x264_pixel_sad_x3_16x8_ssse3
x264_pixel_sad_x3_4x4_mmx2
x264_pixel_sad_x3_4x8_mmx2
x264_pixel_sad_x3_8x16_cache32_mmx2
x264_pixel_sad_x3_8x16_cache64_mmx2
x264_pixel_sad_x3_8x16_cache64_sse2
x264_pixel_sad_x3_8x16_mmx2
x264_pixel_sad_x3_8x16_sse2
x264_pixel_sad_x3_8x4_mmx2
x264_pixel_sad_x3_8x4_sse2
x264_pixel_sad_x3_8x8_cache32_mmx2
x264_pixel_sad_x3_8x8_cache64_mmx2
x264_pixel_sad_x3_8x8_mmx2
x264_pixel_sad_x3_8x8_sse2
x264_pixel_sad_x4_16x16_avx
x264_pixel_sad_x4_16x16_avx2
x264_pixel_sad_x4_16x16_cache32_mmx2
x264_pixel_sad_x4_16x16_cache64_mmx2
x264_pixel_sad_x4_16x16_cache64_sse2
x264_pixel_sad_x4_16x16_cache64_ssse3
x264_pixel_sad_x4_16x16_mmx2
x264_pixel_sad_x4_16x16_sse2
x264_pixel_sad_x4_16x16_sse3
x264_pixel_sad_x4_16x16_ssse3
x264_pixel_sad_x4_16x8_avx
x264_pixel_sad_x4_16x8_avx2
x264_pixel_sad_x4_16x8_cache32_mmx2
x264_pixel_sad_x4_16x8_cache64_mmx2
x264_pixel_sad_x4_16x8_cache64_sse2
x264_pixel_sad_x4_16x8_cache64_ssse3
x264_pixel_sad_x4_16x8_mmx2
x264_pixel_sad_x4_16x8_sse2
x264_pixel_sad_x4_16x8_sse3
x264_pixel_sad_x4_16x8_ssse3
x264_pixel_sad_x4_4x4_mmx2
x264_pixel_sad_x4_4x8_mmx2
x264_pixel_sad_x4_8x16_cache32_mmx2
x264_pixel_sad_x4_8x16_cache64_mmx2
x264_pixel_sad_x4_8x16_cache64_sse2
x264_pixel_sad_x4_8x16_mmx2
x264_pixel_sad_x4_8x16_sse2
x264_pixel_sad_x4_8x16_ssse3
x264_pixel_sad_x4_8x4_mmx2
x264_pixel_sad_x4_8x4_sse2
x264_pixel_sad_x4_8x4_ssse3
x264_pixel_sad_x4_8x8_cache32_mmx2
x264_pixel_sad_x4_8x8_cache64_mmx2
x264_pixel_sad_x4_8x8_mmx2
x264_pixel_sad_x4_8x8_sse2
x264_pixel_sad_x4_8x8_ssse3
x264_pixel_satd_16x16_avx
x264_pixel_satd_16x16_avx2
x264_pixel_satd_16x16_mmx2
x264_pixel_satd_16x16_sse2
x264_pixel_satd_16x16_sse4
x264_pixel_satd_16x16_ssse3
x264_pixel_satd_16x16_ssse3_atom
x264_pixel_satd_16x16_xop
x264_pixel_satd_16x4_internal_mmx2
x264_pixel_satd_16x8_avx
x264_pixel_satd_16x8_avx2
x264_pixel_satd_16x8_internal_avx2
x264_pixel_satd_16x8_mmx2
x264_pixel_satd_16x8_sse2
x264_pixel_satd_16x8_sse4
x264_pixel_satd_16x8_ssse3
x264_pixel_satd_16x8_ssse3_atom
x264_pixel_satd_16x8_xop
x264_pixel_satd_4x16_avx
x264_pixel_satd_4x16_mmx2
x264_pixel_satd_4x16_sse2
x264_pixel_satd_4x16_sse4
x264_pixel_satd_4x16_ssse3
x264_pixel_satd_4x16_ssse3_atom
x264_pixel_satd_4x16_xop
x264_pixel_satd_4x4_avx
x264_pixel_satd_4x4_mmx2
x264_pixel_satd_4x4_sse4
x264_pixel_satd_4x4_ssse3
x264_pixel_satd_4x4_xop
x264_pixel_satd_4x8_avx
x264_pixel_satd_4x8_mmx2
x264_pixel_satd_4x8_sse2
x264_pixel_satd_4x8_sse4
x264_pixel_satd_4x8_ssse3
x264_pixel_satd_4x8_ssse3_atom
x264_pixel_satd_4x8_xop
x264_pixel_satd_8x16_avx
x264_pixel_satd_8x16_avx2
x264_pixel_satd_8x16_mmx2
x264_pixel_satd_8x16_sse2
x264_pixel_satd_8x16_sse4
x264_pixel_satd_8x16_ssse3
x264_pixel_satd_8x16_ssse3_atom
x264_pixel_satd_8x16_xop
x264_pixel_satd_8x4_avx
x264_pixel_satd_8x4_mmx2
x264_pixel_satd_8x4_sse2
x264_pixel_satd_8x4_sse4
x264_pixel_satd_8x4_ssse3
x264_pixel_satd_8x4_ssse3_atom
x264_pixel_satd_8x4_xop
x264_pixel_satd_8x8_avx
x264_pixel_satd_8x8_avx2
x264_pixel_satd_8x8_internal_avx
x264_pixel_satd_8x8_internal_avx2
x264_pixel_satd_8x8_internal_mmx2
x264_pixel_satd_8x8_internal_sse2
x264_pixel_satd_8x8_internal_sse4
x264_pixel_satd_8x8_internal_ssse3
x264_pixel_satd_8x8_internal_ssse3_atom
x264_pixel_satd_8x8_internal_xop
x264_pixel_satd_8x8_mmx2
x264_pixel_satd_8x8_sse2
x264_pixel_satd_8x8_sse4
x264_pixel_satd_8x8_ssse3
x264_pixel_satd_8x8_ssse3_atom
x264_pixel_satd_8x8_xop
x264_pixel_ssd_16x16_avx
x264_pixel_ssd_16x16_avx2
x264_pixel_ssd_16x16_mmx
x264_pixel_ssd_16x16_sse2
x264_pixel_ssd_16x16_sse2slow
x264_pixel_ssd_16x16_ssse3
x264_pixel_ssd_16x16_xop
x264_pixel_ssd_16x8_avx
x264_pixel_ssd_16x8_avx2
x264_pixel_ssd_16x8_mmx
x264_pixel_ssd_16x8_sse2
x264_pixel_ssd_16x8_sse2slow
x264_pixel_ssd_16x8_ssse3
x264_pixel_ssd_16x8_xop
x264_pixel_ssd_4x16_mmx
x264_pixel_ssd_4x16_ssse3
x264_pixel_ssd_4x4_mmx
x264_pixel_ssd_4x4_ssse3
x264_pixel_ssd_4x8_mmx
x264_pixel_ssd_4x8_ssse3
x264_pixel_ssd_8x16_avx
x264_pixel_ssd_8x16_mmx
x264_pixel_ssd_8x16_sse2
x264_pixel_ssd_8x16_sse2slow
x264_pixel_ssd_8x16_ssse3
x264_pixel_ssd_8x16_xop
x264_pixel_ssd_8x4_avx
x264_pixel_ssd_8x4_mmx
x264_pixel_ssd_8x4_sse2
x264_pixel_ssd_8x4_sse2slow
x264_pixel_ssd_8x4_ssse3
x264_pixel_ssd_8x4_xop
x264_pixel_ssd_8x8_avx
x264_pixel_ssd_8x8_mmx
x264_pixel_ssd_8x8_sse2
x264_pixel_ssd_8x8_sse2slow
x264_pixel_ssd_8x8_ssse3
x264_pixel_ssd_8x8_xop
x264_pixel_ssd_nv12
x264_pixel_ssd_nv12_core_avx
x264_pixel_ssd_nv12_core_avx2
x264_pixel_ssd_nv12_core_mmx2
x264_pixel_ssd_nv12_core_sse2
x264_pixel_ssd_wxh
x264_pixel_ssim_4x4x2_core_avx
x264_pixel_ssim_4x4x2_core_mmx2
x264_pixel_ssim_4x4x2_core_sse2
x264_pixel_ssim_end4_avx
x264_pixel_ssim_end4_sse2
x264_pixel_ssim_wxh
x264_pixel_var2_8x16_avx2
x264_pixel_var2_8x16_mmx2
x264_pixel_var2_8x16_sse2
x264_pixel_var2_8x16_ssse3
x264_pixel_var2_8x16_xop
x264_pixel_var2_8x8_avx2
x264_pixel_var2_8x8_mmx2
x264_pixel_var2_8x8_sse2
x264_pixel_var2_8x8_ssse3
x264_pixel_var2_8x8_xop
x264_pixel_var_16x16_avx
x264_pixel_var_16x16_avx2
x264_pixel_var_16x16_mmx2
x264_pixel_var_16x16_sse2
x264_pixel_var_16x16_xop
x264_pixel_var_8x16_avx
x264_pixel_var_8x16_mmx2
x264_pixel_var_8x16_sse2
x264_pixel_var_8x16_xop
x264_pixel_var_8x8_avx
x264_pixel_var_8x8_mmx2
x264_pixel_var_8x8_sse2
x264_pixel_var_8x8_xop
x264_pixel_vsad_mmx2
x264_pixel_vsad_sse2
x264_plane_copy_c
x264_plane_copy_core_mmx2
x264_plane_copy_deinterleave_mmx
x264_plane_copy_deinterleave_sse2
x264_plane_copy_deinterleave_ssse3
x264_plane_copy_deinterleave_v210_c
x264_plane_copy_interleave_c
x264_plane_copy_interleave_core_mmx2
x264_plane_copy_interleave_core_sse2
x264_popcnt_table
x264_pps_init
x264_pps_write
x264_predict_16x16_dc_avx2
x264_predict_16x16_dc_c
x264_predict_16x16_dc_core_avx2
x264_predict_16x16_dc_core_mmx2
x264_predict_16x16_dc_core_sse2
x264_predict_16x16_dc_left_core_avx2
x264_predict_16x16_dc_left_core_mmx2
x264_predict_16x16_dc_left_core_sse2
x264_predict_16x16_dc_mmx2
x264_predict_16x16_dc_sse2
x264_predict_16x16_dc_top_avx2
x264_predict_16x16_dc_top_mmx2
x264_predict_16x16_dc_top_sse2
x264_predict_16x16_h_c
x264_predict_16x16_h_mmx2
x264_predict_16x16_h_ssse3
x264_predict_16x16_init
x264_predict_16x16_init_mmx
x264_predict_16x16_p_c
x264_predict_16x16_p_core_avx
x264_predict_16x16_p_core_avx2
x264_predict_16x16_p_core_mmx2
x264_predict_16x16_p_core_sse2
x264_predict_16x16_v_c
x264_predict_16x16_v_mmx2
x264_predict_16x16_v_sse
x264_predict_4x4_dc_c
x264_predict_4x4_dc_mmx2
x264_predict_4x4_ddl_mmx2
x264_predict_4x4_ddr_mmx2
x264_predict_4x4_ddr_ssse3
x264_predict_4x4_h_c
x264_predict_4x4_hd_mmx2
x264_predict_4x4_hd_ssse3
x264_predict_4x4_hu_mmx2
x264_predict_4x4_init
x264_predict_4x4_init_mmx
x264_predict_4x4_v_c
x264_predict_4x4_vl_mmx2
x264_predict_4x4_vr_mmx2
x264_predict_4x4_vr_ssse3
x264_predict_4x4_vr_ssse3_cache64
x264_predict_8x16c_dc_c
x264_predict_8x16c_dc_mmx2
x264_predict_8x16c_dc_top_mmx2
x264_predict_8x16c_h_c
x264_predict_8x16c_h_mmx2
x264_predict_8x16c_h_ssse3
x264_predict_8x16c_init
x264_predict_8x16c_init_mmx
x264_predict_8x16c_p_c
x264_predict_8x16c_p_core_avx
x264_predict_8x16c_p_core_avx2
x264_predict_8x16c_p_core_mmx2
x264_predict_8x16c_p_core_sse2
x264_predict_8x16c_v_c
x264_predict_8x16c_v_mmx
x264_predict_8x8_dc_c
x264_predict_8x8_dc_left_mmx2
x264_predict_8x8_dc_mmx2
x264_predict_8x8_dc_top_mmx2
x264_predict_8x8_ddl_avx
x264_predict_8x8_ddl_mmx2
x264_predict_8x8_ddl_sse2
x264_predict_8x8_ddl_ssse3
x264_predict_8x8_ddr_avx
x264_predict_8x8_ddr_mmx2
x264_predict_8x8_ddr_sse2
x264_predict_8x8_filter_mmx2
x264_predict_8x8_filter_ssse3
x264_predict_8x8_h_c
x264_predict_8x8_h_mmx2
x264_predict_8x8_hd_avx
x264_predict_8x8_hd_mmx2
x264_predict_8x8_hd_sse2
x264_predict_8x8_hu_mmx2
x264_predict_8x8_hu_sse2
x264_predict_8x8_hu_ssse3
x264_predict_8x8_init
x264_predict_8x8_init_mmx
x264_predict_8x8_v_c
x264_predict_8x8_v_mmx2
x264_predict_8x8_vl_avx
x264_predict_8x8_vl_mmx2
x264_predict_8x8_vl_sse2
x264_predict_8x8_vr_avx
x264_predict_8x8_vr_mmx2
x264_predict_8x8_vr_sse2
x264_predict_8x8_vr_ssse3
x264_predict_8x8c_dc_c
x264_predict_8x8c_dc_mmx2
x264_predict_8x8c_dc_top_mmx2
x264_predict_8x8c_h_c
x264_predict_8x8c_h_mmx2
x264_predict_8x8c_h_ssse3
x264_predict_8x8c_init
x264_predict_8x8c_init_mmx
x264_predict_8x8c_p_c
x264_predict_8x8c_p_core_avx
x264_predict_8x8c_p_core_avx2
x264_predict_8x8c_p_core_mmx2
x264_predict_8x8c_p_core_sse2
x264_predict_8x8c_v_c
x264_predict_8x8c_v_mmx
x264_predict_lossless_16x16
x264_predict_lossless_4x4
x264_predict_lossless_8x8
x264_predict_lossless_chroma
x264_prefetch_fenc
x264_prefetch_fenc_420_mmx2
x264_prefetch_fenc_422_mmx2
x264_prefetch_ref_mmx2
x264_pthread_cond_broadcast
x264_pthread_cond_destroy
x264_pthread_cond_init
x264_pthread_cond_signal
x264_pthread_cond_wait
x264_pthread_create
x264_pthread_join
x264_pthread_mutex_destroy
x264_pthread_mutex_init
x264_pthread_mutex_lock
x264_pthread_mutex_unlock
x264_pthread_num_processors_np
x264_pw_00ff
x264_pw_1
x264_pw_16
x264_pw_2
x264_pw_256
x264_pw_32
x264_pw_32_0
x264_pw_3fff
x264_pw_4
x264_pw_512
x264_pw_64
x264_pw_8
x264_pw_8000
x264_pw_ff00
x264_pw_m2
x264_pw_pixel_max
x264_pw_pmmpzzzz
x264_pw_pmpmpmpm
x264_pw_ppmmppmm
x264_pw_ppppmmmm
x264_quant_2x2_dc_mmx2
x264_quant_2x2_dc_ssse3
x264_quant_4x4_avx2
x264_quant_4x4_dc_avx2
x264_quant_4x4_dc_mmx2
x264_quant_4x4_dc_sse2
x264_quant_4x4_dc_sse4
x264_quant_4x4_dc_ssse3
x264_quant_4x4_mmx
x264_quant_4x4_sse2
x264_quant_4x4_sse4
x264_quant_4x4_ssse3
x264_quant_4x4_trellis
x264_quant_4x4x4_avx2
x264_quant_4x4x4_mmx
x264_quant_4x4x4_sse2
x264_quant_4x4x4_ssse3
x264_quant_8x8_avx2
x264_quant_8x8_mmx
x264_quant_8x8_sse2
x264_quant_8x8_sse4
x264_quant_8x8_ssse3
x264_quant_8x8_trellis
x264_quant_chroma_dc_trellis
x264_quant_init
x264_quant_luma_dc_trellis
x264_ratecontrol_delete
x264_ratecontrol_end
x264_ratecontrol_init_reconfigurable
x264_ratecontrol_mb
x264_ratecontrol_mb_qp
x264_ratecontrol_new
x264_ratecontrol_qp
x264_ratecontrol_set_weights
x264_ratecontrol_slice_type
x264_ratecontrol_start
x264_ratecontrol_summary
x264_rc_analyse_slice
x264_rd_cost_part
x264_rdo_init
x264_reduce_fraction
x264_reduce_fraction64
x264_reference_build_list_optimal
x264_rename
x264_run_before
x264_safe_intel_cpu_indicator_init
x264_sei_avcintra_umid_write
x264_sei_avcintra_vanc_write
x264_sei_buffering_period_write
x264_sei_dec_ref_pic_marking_write
x264_sei_frame_packing_write
x264_sei_pic_timing_write
x264_sei_recovery_point_write
x264_sei_version_write
x264_sei_write
x264_significant_coeff_flag_offset
x264_significant_coeff_flag_offset_8x8
x264_slicetype_analyse
x264_slicetype_decide
x264_slurp_file
x264_sps_init
x264_sps_write
x264_stack_align
x264_stat
x264_store_interleave_chroma_mmx2
x264_store_interleave_chroma_sse2
x264_sub16x16_dct8_avx
x264_sub16x16_dct8_mmx
x264_sub16x16_dct8_sse2
x264_sub16x16_dct8_ssse3
x264_sub16x16_dct_avx
x264_sub16x16_dct_avx2
x264_sub16x16_dct_mmx
x264_sub16x16_dct_sse2
x264_sub16x16_dct_ssse3
x264_sub16x16_dct_xop
x264_sub4x4_dct_mmx
x264_sub4x4_dct_ssse3
x264_sub8x16_dct_dc_sse2
x264_sub8x16_dct_dc_ssse3
x264_sub8x8_dct8_avx
x264_sub8x8_dct8_avx.skip_prologue
x264_sub8x8_dct8_mmx
x264_sub8x8_dct8_mmx.skip_prologue
x264_sub8x8_dct8_sse2
x264_sub8x8_dct8_sse2.skip_prologue
x264_sub8x8_dct8_ssse3
x264_sub8x8_dct8_ssse3.skip_prologue
x264_sub8x8_dct8_xop
x264_sub8x8_dct8_xop.skip_prologue
x264_sub8x8_dct_avx
x264_sub8x8_dct_avx.skip_prologue
x264_sub8x8_dct_avx2
x264_sub8x8_dct_dc_mmx2
x264_sub8x8_dct_dc_sse2
x264_sub8x8_dct_mmx
x264_sub8x8_dct_sse2
x264_sub8x8_dct_sse2.skip_prologue
x264_sub8x8_dct_ssse3
x264_sub8x8_dct_ssse3.skip_prologue
x264_sub8x8_dct_xop
x264_sub8x8_dct_xop.skip_prologue
x264_sw_64
x264_sync_frame_list_delete
x264_sync_frame_list_init
x264_sync_frame_list_pop
x264_sync_frame_list_push
x264_thread_sync_ratecontrol
x264_threading_init
x264_threadpool_delete
x264_threadpool_init
x264_threadpool_run
x264_threadpool_wait
x264_threads_distribute_ratecontrol
x264_threads_merge_ratecontrol
x264_threadslice_cond_broadcast
x264_threadslice_cond_wait
x264_total_zeros
x264_total_zeros_2x2_dc
x264_total_zeros_2x4_dc
x264_validate_levels
x264_vfprintf
x264_weight_none
x264_weight_scale_plane
x264_weighted_reference_duplicate
x264_weights_analyse
x264_win32_threading_destroy
x264_win32_threading_init
x264_zigzag_init
x264_zigzag_interleave_8x8_cavlc_avx
x264_zigzag_interleave_8x8_cavlc_avx2
x264_zigzag_interleave_8x8_cavlc_mmx
x264_zigzag_interleave_8x8_cavlc_sse2
x264_zigzag_scan_4x4_field_mmx2
x264_zigzag_scan_4x4_frame_avx
x264_zigzag_scan_4x4_frame_mmx
x264_zigzag_scan_4x4_frame_ssse3
x264_zigzag_scan_4x4_frame_xop
x264_zigzag_scan_8x8_field_mmx2
x264_zigzag_scan_8x8_field_xop
x264_zigzag_scan_8x8_frame_mmx2
x264_zigzag_scan_8x8_frame_sse2
x264_zigzag_scan_8x8_frame_ssse3
x264_zigzag_scan_8x8_frame_xop
x264_zigzag_sub_4x4_field_avx
x264_zigzag_sub_4x4_field_ssse3
x264_zigzag_sub_4x4_frame_avx
x264_zigzag_sub_4x4_frame_ssse3
x264_zigzag_sub_4x4ac_field_avx
x264_zigzag_sub_4x4ac_field_ssse3
x264_zigzag_sub_4x4ac_frame_avx
x264_zigzag_sub_4x4ac_frame_ssse3
Name
.text
Size
695KB
Virtual Size
694KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
mlocate/Images/HeaderDocImage.png
- SHA256 c34c49a1b2f7245d6ee893ad2529c523fa5b1c4d3e34edfaec82178849fe6fa0
- MD5 be254687635c3192af214443cd97ea59
- SHA1 4eb7977a48a62c660f828b02db694e6635de909e
- SHA512 eed76083f089e5d79f849a2f26fb5ed07c26e17074e67f2cee0d9b63175e7ecb6fa32bb6cb45f41841e2dcdc32312635b8785e2e3f879e8bf3a28607696b8ee0
- TLSH T138C012C226255DEC964D452A73524105B45655FE10E1750F6A5BE114013C79446D5F53
- MD5 SHA1 SHA512 TLSH
mlocate/Images/HeaderImage.png
- SHA256 a8833ce5eb41b85ddf8069c6607c49c35cafc32111b84014a70595a3fbcbaf70
- MD5 057988059d93082000a2dcba13f3d107
- SHA1 3b743e7a50b7b1b2af7c181a9ccaa40a534f7f18
- SHA512 14a03037703f078599d488252ef628091df5df5c2c82393de78feba193cc57812fc3706d9e10834a13178a0bd68c66da27409e4a3dfa22e669456768cb73bb1c
- TLSH T1F1D022C3AB09AC9CAD49897E52B39041A2A35EFE85A23918AE68D004805D8A64EA4916
- MD5 SHA1 SHA512 TLSH
mlocate/Images/Reports/ConsignmentSoldReport.frx
- SHA256 01b1e66609ccc36db78feeb51ed550ce98359fa6a32edd364a694529720fdbc6
- MD5 1c3f97bfbfc831c348d6420961b0c846
- SHA1 808159939de834993a2d4df88975e745be8ab70c
- SHA512 aac5f309e650049aae75caa365a0ac739ba25e453ef281288adb329af9c19e001c700d5b42fed6cb14cf13c1b3e3bca120146d83e6c127677a672cb33bca5e2f
- SSDEEP 192:6qjClX9LZGGnucavkx0a6LooozNNxCbWFt:ZM/GGnucaMx0a6MLRbCbWFt
- TLSH T17542CA6B74869F78C2A560F253A49C84E8B193F210DC8AD1F09E7723DF77895267331A
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a1.jpg
- SHA256 3347c503260f35f12e05e4fb8aeee72a8f42c3a6b5d35722bdf2eeb3cc006be9
- MD5 1eeec19af2564ccab82ee1622e54a34f
- SHA1 e884956cac166c895a09316cc5bffcd1ad74f6be
- SHA512 d2e67692a5b3d05ee13ecf15e8cc72f9ca2ead010abf6dd82d9d2ca7b1d996f4080c83f2b480f99534b2e416253ca52c1852804f00c2ce4bad521294fe6ea4d4
- TLSH T1C2712AAE0FD63519EFBF1E3980CC7B25225112F8866502F6C57F9A8CB419CF38203699
- MD5 SHA1 SHA512 TLSH
mlocate/Images/a2.jpg
- SHA256 22c5f70142282015b1aa1e8611a895fed56efb2db0045afe0fa124d2a1973d3c
- MD5 4ed3451730c199bc4fa64d0d8d516a7b
- SHA1 885763575345280388708eb8767635575acbc5e7
- SHA512 271f1ee9525a104f40e6296d449c912bbb9c482f717ebbcc64d5d9436602249b326b39d94e73abe07281cf9e9035a8c482691ec9b7b0e8e24c174b2074252442
- SSDEEP 384:b923LuTjOHUmasMsINYgsTeKaeAKbQPUZ+LGREt/styykS7EQ:oLwO027wYSeAKb/yxd+EQ
- TLSH T1CB92D15E3FA979E2927FE6BF3A400E4E9951ADC439DC375400509ED2EAE8C0F059463D
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a3.jpg
- SHA256 8dd4e1298cba0e9a96d69480dad8c9eed54d66eeb6c1b8b2f0bd15ea54779b11
- MD5 7fd3bba1d5a0a326a29d0081057b2e42
- SHA1 79e173c45d2b4de3d2e9d34d71ffa57021019388
- SHA512 0af1fe22246002acd19f48133f5760ab9b4f51ec20e55ae4318cb32883fb721c9b01627f1fa775eebe75d5ac52cd724c4b863f2d7d4d1da758985e6122d8eb7f
- SSDEEP 192:km9zGOebvyQssOeXVvNyI90bzFG547RdWGd9v58NwbNL/J3:km3TENNv0PFlFv5OqLh3
- TLSH T17DE18E3A48732233BCEDB87707C1F35578A7E62CA164A3364940AEFA41AD066DE15157
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a4.jpg
- SHA256 cdc1ea54c688f34a97c8b4e4ac4d364f17bec50c10c5d3417eb0e128778076ac
- MD5 27a3d8580ab76f5302f7326deeff40d1
- SHA1 25f32aab74a0443414c8eb708d2f2ed00f7563d6
- SHA512 bdc793c832761f2acadf51c5d803ee9bc9f9d37f5602285f4c093813b96bf483ffdb23ceb337cc23d7c0705c578afa16b8054afa8fa576583194feabf740e15d
- SSDEEP 96:SmwLq+VDMj36wumjuv0YucEHuLUSIV2pcWszgbbA0VYZNeKX8:tB+VDI3DuMYucLFpcPzgQ0OsKs
- TLSH T151C19D96E90B1689EEE41ABF919F8DB4B9168C1BDFC87D09AE7458F51C013C8CA74207
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a5.jpg
- SHA256 61775d1e31e343eeeff5250df462d3a0476f5e7a33800ea81c1b2556492ba6b2
- MD5 d2d1ddad6d40dc828f56a0d51d7bbb10
- SHA1 8a0769426d73570cee64353c3363aab5839577bc
- SHA512 bd4f3462a63a8cacba2c6daf6c53ac8b910605028d439e812405a8b57ee451cf58d9b47df601a30c43c80f0edb702845edef21b29e2bc4f9346d140daf1d00dd
- SSDEEP 96:slVpn2DwPQMsYU31Q2prDHBtOXpJc7GPq/ywnKtPhe:slvFTsNHBUo7nwPc
- TLSH T164913CC72A154902E4FF49F85F63E42CB7BD74FE4C6D077A561020F7662152163A2C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a6.jpg
- SHA256 b8e9007bb4a531d1918165879a8a86b3d084c2774c2962f429074dec66bb3b75
- MD5 6339180afd928ccb36620e08d10918d5
- SHA1 7f3be42c260d96326fe19c707080867dd230d3b0
- SHA512 f8472e83ff019e2c8705cd7a21bb9da65a2a32f4d811725a29d128938d540714905d072e2c96715bc0258cd5d431b5b67eb1ae414692d43615626854dcd000cf
- TLSH T1CF713B60666C61C8EBFD1A34E5650B53DF593D60CFDA8B8D04E2192D3B1FAC168085DF
- MD5 SHA1 SHA512 TLSH
mlocate/Images/a7.jpg
- SHA256 c7806379f3161478bd1e297f60f0822b97d7e39c0a2087c0badbafe79c4abef1
- MD5 dc339f2294c01abd464c50c8fda4b3c4
- SHA1 ded235f770622173f69f84474a01cf7a6e733d54
- SHA512 539b65e3d6dc59012cf4118b53c6ccfaaf60da1a232c4db5d9693e761df19d625f2993b49a2c8d60499f0349bc4531790bfed20918393b1858fc22fb6eb42775
- SSDEEP 192:Pv0M1KcA4tRa9c2cX4wutsV1Qh+3GM0Gvqr8qXreF9WX9Atu6zduZNXdIpIEa:P8ncAmowutsV1t3GXGvA8qbZX9AtvzdA
- TLSH T1DE32BF2236D589EA7EA977326280138C54488AF99CD7A3C88C3E7E64D73169D23D04A6
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/a8.jpg
- SHA256 19ef84b7d694fe0b264a03cf5237e837311e869c0e3779e50e976339749844bb
- MD5 c02c168c51350207570e7594484e7a98
- SHA1 6fec2bbcfbfc320237fc6f142222b53f3cfea9d5
- SHA512 d4b1b0b23ac81f6c59220b1f893105abcdfc612f277e305e9a3a3935d63ca5a317dad3412fa80f26d2277c3647816bfd0db35b55ecd1e8b251e17c4a319457b4
- SSDEEP 192:iZ2ofyxwN4y4lPay2ofyxZknWRhMKK6HXWxDRidRO+Ea6EbhPnx/9kfthDG0:VQiMCnWRhjbHmN8d34iud
- TLSH T199728D242753AE02FAD022749CF6C3939725FA46A2531A4B3CED3852FF713914E2D65A
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/angular_logo.png
- SHA256 812d8315e3f9c6d19dc771441f555f52cbd4ca936976dce27bb9d8cfa4ca8e88
- MD5 bd1d7187b474b223360e5030622c4807
- SHA1 9b815c166e249b631a6d253364111d4f3e2c3b58
- SHA512 8a4f9d7a4df7e80d7b90450c3e731fc101a3a1e2259b9c48544e9aea53075f8382dea6b3e5a2ab50f8422620d49b7d45478cd819fca6cc5a3fb453ac370877a7
- SSDEEP 384:AJXE05vvV1JbkDxXN8RYaRKICGtRvISOUO2vcWNrr:835v7Jbk998RRRxtehkcWNrr
- TLSH T1E262D0717720FC5C9BAC62E90DCC256AEEF87384CE3B226844A2B445F14065AA6A43D9
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/background.png
- SHA256 ef074bce7e5c5cc701ccec22616f795017bf1bade6ec01764fc3e65889ef8665
- MD5 9ebe8509f111c78f16448a0e4bc85470
- SHA1 25cc58e467cf97388ed62814ab4a6bf5e50cdaa1
- SHA512 b6379ba8611cdd389254c31f711c32cb1e7d43c84c1114cf87672ff31fee5a756909f14f3685c731f680dc4533346ec7ad12e39eedb53f8261a7051ad3fe8731
- SSDEEP 1536:lz87ODMpFqeHIuWrQ7uuKuoG491va/56UCwY7li0VaHwVzYeAYxxNehr7Zubgaqn:lz8A3R0vDIhi0VaQOjm+57kxLG
- TLSH T1C2A379A9390B56D15FF70A23897877F187DE9AA97340174DCE904BE3B34B06CA46EC84
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/email_3.jpg
- SHA256 fe5265bb752c9829e3f2bce87265f49c1ac9f1d63bc1de0780bc832fd0c69e13
- MD5 db4eab0ab2e8d96d512f0d7a6e8e7be9
- SHA1 9a592a1bfa7605f64a1109fd5b61d58eb95a2323
- SHA512 29330a23ac0c3648912d5df305ff66ae016f76936a71fcf61f770697cfb1502d4f40d41860e9452a8dec885c50807ccc9a0af19a370d4aa8c6547443c233a3c9
- SSDEEP 3072:ZABVvVZOAyWVbYTdGZdkOkQgQV8ImPq8T0czp8:StZO25Y5GPkTQ1V7mPq8x8
- TLSH T152B359608D71BB05EEA14828539227AB011D6D6F1AF6060C785CEE1F7767CEA39EFC05
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/header.jpg
- SHA256 08eb486329a8ce3e981e5cd5a787ff383ac2f36c3fc693933c373913738bc416
- MD5 57baa1274bf94c55fe7f0b645a0e730b
- SHA1 45b7582a17f1ee9ed04bcfd3455ec76c2ef7a2fc
- SHA512 b6f7acade03a1ca6513e7385a5f6e769cdff643f1f227df20441a8f39567477507bf88c33982f27fccc14b783be872e596a26d946fc9ee09e88100095f980bbd
- SSDEEP 768:QqYyuOOYyutcYyc9Pu2PN/u84VG4qQ+A5LuNg:hMgcoAeBMVGm9wg
- TLSH T1CBF26EB6DAB1FF53F6B25D3C23B09E559140293A9FDA1100B4AED38123939A1752F1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar1.jpg
- SHA256 2a329f39a2d45589ce8b58c29befaff1d967743736a9ec540a8e0f69dd996ec2
- MD5 8209b36180407bfd83ac71c02a300235
- SHA1 cf54d580334e4ac3d70c5ba9b41ab8aafc9b6b65
- SHA512 928bc597327c32f48f3aa8786455328a58841ab6730e8ef2a56cf8393ba516cb6a45897e4017be404f9268ca08c21cc1b61bedda1bffd6b2a1aef2240c141120
- SSDEEP 96:J894vF0eo7ap8t6BzipvzuNjXo03MXc//kl0FzSWE:yfeeuUEiNGkcMXQ/kOFzSF
- TLSH T13F915BA20F749324EC4D4BB0E19167A4D34F7F21A523EB0C5392802FB7799E0EB6460C
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar2.jpg
- SHA256 05d39e962c8d2f77283141b88d03328786542fb84a23b3b45b39986715388428
- MD5 57cc73cfbc3aca7236feef9ca769ce43
- SHA1 be3797efe2cf85672025e64ab7f0c81cc95faa84
- SHA512 be1374d72272c01173dac566f2ec6333cde37e84d6a535c45899522abc148254c2cb2f34ec38b3e76785bfcd855312f675dd3dbc5e950aec0d46f745b5172a37
- SSDEEP 96:L894vwZimZrwHSVatow3XbL3DwntnbBD0b4i2L3:4l3wHeCow3XbL3WbBD0bYz
- TLSH T19E916DD3BE45CA14E0283D7DB1A09632D39577B8679B83B5C44105326BDC6D2C1B022F
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar3.jpg
- SHA256 b8731e0e8c3fd577047e903b797db2a74b0958514028e0373cf9ecba4d2b8ade
- MD5 8793b2ba50b325e9b4dae57617fd48d0
- SHA1 d05603af31613a61549444774e78e640654ef486
- SHA512 83edafc91a2c0ac8d477f096bdc30bf9ab6025d017614ed93e0bea0f1c2891d503d7f41f67af70e9baf1dcffaf7ebc38f6186c2ad32a53543f03e64a326dd872
- TLSH T170814B7F438C9A98CA2D1EF1B6962B70B7115DA09443F32B908085D233868E3E50C356
- MD5 SHA1 SHA512 TLSH
mlocate/Images/landing/avatar4.jpg
- SHA256 3198882643452676b89b90f09dd80dd0db5f7ca70b930b0b5b95b5157ad9302e
- MD5 043401f0ef7528fba8a1bb2aeba51bd8
- SHA1 dd20b96107acaff3c92387c53f293c318acc1a3e
- SHA512 302bc1513adc9d2a74ca44cf79e93d9901458ea91fccf1048e9f36405a0848475098b416f637e832e3216a7001b66476ae7a4750761f029e4936c697daad300f
- SSDEEP 192:b98IM8d9uzv4KOOAT2TburnzXHzjJH1YrQYgZ9sGxRRSOeKGNZhdB+q1AdtbpQdK:b9i8qDOt0grTBxY/GxWOevPotFQd1BS
- TLSH T19E62E17B9D9059ABC41808E3F673BAE7A780A05B10A5279CF005101CE58F6C738749DD
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar5.jpg
- SHA256 0c158b486462046cb8385cd582973b0bc69e0152c0ac6105119ac4b3c9020fa2
- MD5 d32f398cc2736c9a8c6e5ff38dc3e9d7
- SHA1 8f35c81110b9ca377a570fa0b024e79a4217ec69
- SHA512 95e8ddbd3f1f0f63b572c46d33a955edd5c25d47a0d6f03ce9638ae9c23575253864fdf22103d565a62d3aece2d214dac7f4174eb794ac469ff1f133ff6c0fbe
- SSDEEP 192:7YNMtKwZqY+xlXNqip7R2SbkLknXlKJZwsaPIex3DcWK:7YNg7ZqY+xRNqmR2ewJZ7agMcWK
- TLSH T193029E75DEA36363C93ED674FC75AB209AD2E939D760AA00F52E432203092D89FB4107
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar6.jpg
- SHA256 2938af07757d8ef42b78561810f1acaf25a3cd3b7a932e3a8cb5870811b4f2dc
- MD5 1d73c0ea341cef6138642f8826c92d71
- SHA1 b86168a0056c0a16cc2d91f08972cfcb8b8e8f45
- SHA512 9c02f46c74d5adae9571f18b22f10aa20eb1e66fce1f84a6136902a14dc7c1cbeaec75f565f5d105f340452e15fd9a5c8c1bd0c31b39d0c22668ac3ddbe14372
- SSDEEP 192:mUQ1N9KeeiTHV2SQNTJpSqZw/zN8FmmggCSl:mUQv9KeeiTRQxJJZFmH4
- TLSH T16ED1AF640B147D47C0AEB336F921C755EEAB1E2559856FDCC28A6B6513EC087CA680CE
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/avatar7.jpg
- SHA256 9c4ff0987ccf2df7af1b741fe5e0edfd8debe85fbd81e69fb549cde1ba7432e3
- MD5 6bcdb8736b377b8cc0996723c94c8d01
- SHA1 02639cdb218bbc96a7f947a27229ea3d585ef92d
- SHA512 8bc4f2cb72b2819cf6550ae1c592713bfe08298e0771495c6896fd3bc446876b4adfe83142f72a38750e8eb39c867434c2eb3177871038797d1daa12a5fc3eb1
- TLSH T1B5615BE16A9F7242DB05B2381AC9805413636E597C84B0BBD0037BA4202ECF86E209DD
- MD5 SHA1 SHA512 TLSH
mlocate/Images/landing/avatar8.jpg
- SHA256 6252a3b6790cbb48919cb8ea756a4e1ce829f3271a141731226871b3c3df9d6d
- MD5 95d6154558ab4c717cc0b1784a27ff01
- SHA1 ef8d837e220adb23dfb327c0e41df6235627fd9d
- SHA512 3076d75355a81fa296c577d78030bd0f50dede717f2e96bece246122e78477bb8de630d531cd781a1a4201b3ff00046f7bc1a3a431f24dc725ca23cdc2e16ff8
- TLSH T191410A6756E99402EFEABF3A10E6DE5D631013A25803CC70598DD9854D5BCF1EC48F58
- MD5 SHA1 SHA512 TLSH
mlocate/Images/landing/avatar9.jpg
- SHA256 66c0374361282f4a86f55d998d4cc01fcb38a355b21321e7d34182ccf75523fb
- MD5 286c5240fea2dfb997e14e9a4d314a7d
- SHA1 2ddc0742517b625be6644081381e58c919b1ea2d
- SHA512 d4edcc0f411f35db856d5312946821b4b62f9c0376c93de35f07060a32c19c210e8cfb3b116a475a156a6cc9730aaf1ca0b052328c704c5f0250b9df16f0ca99
- TLSH T16031093509791084EA100573DDC5C9FA39ABA62383BBD16B3A9A24AE7F9BEE5CD40100
- MD5 SHA1 SHA512 TLSH
mlocate/Images/landing/dashboard.png
- SHA256 6eab9fec0b4e3b3877c75d1347177345390632dcdfbcd488593a78200dab9049
- MD5 96ce7d43999dc0ded09039a7cade5418
- SHA1 5069dc82ace6cae880a0007ce331d3936872de65
- SHA512 2c479ff502b2a8e27cddd3677804f34da650e57299584d6ae5cd22d8c10c261785f780b50d145a4f5a8afc85339e50b7f0d9175743d70bdcbdedb87fb45778d1
- SSDEEP 1536:tDC3AUxhSVKFOFMQpKZp5q3GBp3RMh44P6I+GWVGVBYr3p:gwUxPiMQpKU3GBp3RMFPwVGqp
- TLSH T14C7302D58F3AEE0C24AC2954E8DF7B91073016D38B3160BE936A019B551D9AF3BE5CD1
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/iphone.jpg
- SHA256 b4d7df0d01aa03f8798b9680d39d6383a9383e57d176fc9ee7a7e9581713f672
- MD5 8c2511f8617a8f5da5381831ab442662
- SHA1 fc79fb474c0a92350d8122d84a95824791a24600
- SHA512 bf73a8fc809a9d664e2a18b75afb7c59dcbe98e3b61394f0e824a272865fc6d722a52981b5e76a45a49a64c338de18c66b2b6cab6a3a4e1dd08e99c2b0c607e2
- SSDEEP 3072:0HRWqNTE7dT7+44Pw8dRxxUvhE/NGi4Oey7ebX:CWUUd0Y8/xVv4OeZX
- TLSH T15E146C74AB390BD09DC67E535348C9718B760FC087122AE2FFAD3B08579DD6984291AF
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/laptop.png
- SHA256 693a6e4a608b001a1250a089b7f5d0b748585ff4974a168c14c17d4568b149e3
- MD5 91d4951645be909f4d2995e2d09ef23d
- SHA1 f2c40aef5bf2cfd436c6b76be71268eb0913bc03
- SHA512 f7c6b411fe0dd0afff8f1dc41a832bbf49ed146040bf5fc8e85383c424245f01a57a702cc0813f2f55f99d9b5fcab469a89b60ac814a7117a234d9c07903f53e
- SSDEEP 1536:4f44SGjduWqNfwCe3mqQ2hreI9pNxdfMSE0cYmyclK7jwPcMi7b:4JnZqNAQipdfFRwvIb
- TLSH T1DD73019691F012AADDE6780B55D33684E57F886FC83B333678CE24AD80025067AE18F3
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/landing/perspective.png
- SHA256 922ef880053df80311dcda1df45fc263640a89cdced348817d7f118d23c6b6f5
- MD5 a4917eb581c22a07fa9c35b3e4c9bab9
- SHA1 e378ae3d7c30c86300fa8a8b59a9bd1e9ffd7bed
- SHA512 74342bc34d43b3074a020a768c84782a7a881603ddffcfe3768047b0aa73c33c882d36a2790ecabac0a9bff8ac40ec2eed9754bc4d7ef7fa67bcd4b401816175
- SSDEEP 12288:gpUDTGxK5AsvBZoaFVwB6DbHC2kI24vjSZmHhMR/rs8:g+DCxwAsv7EB6D5kIfSwHhMRjp
- TLSH T115B423D26636C862FC9D03E1C477D52F3E4380D8C99E61794BBA31CB9430A5EA3558AF
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/logo.png
- SHA256 71110a4af363c8c7bcd7baca1f6fe268e4cb14d0c33fa140e87a3ac323e85ddd
- MD5 9018cc2e729fc76f76d9dba62fb98ae7
- SHA1 d41ce41b6a54f0edfcf34cedb023af4686b07ca4
- SHA512 6c773a31a98412d211bfa9436d898dac364e4394f990c020ec2bc09652932fcd6e81bd190c529a50fa76d52a1b9f6cd6ac45801f349173756e847a1a1bc7d7b2
- SSDEEP 1536:YLF0EIG/RzRxLKP/DnuSpWvHMHUKcEnOYal0jjEANG:Y2Ed/Rzv+3DPpVHKuamPEIG
- TLSH T16763F1129D82F90AEA59D3767CC465C6A2428A6B8EB3FFC0343EC41DDF50B131FA5915
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/p3.jpg
- SHA256 a274d168792b8a601b276e2cd34cf837d38a37796e3aead4699598ebd9ea03f8
- MD5 aa6af324962786fac1fcd19d856bbf3a
- SHA1 0cdbf8fd35d8c505372386ac9f2016804f184677
- SHA512 02d542f7670e290a11f067d0835eccfb8fcf1b2fa62dbe30e06d5ec1c2631f578032c3fae2359530fff3a10df330cb185664b5ab31e06867f7dba1647bb46b53
- SSDEEP 3072:PIW2NW2/C3odFEQbPFEpLQadUnkqzCYmku:PH242azc9EpLQPxCYzu
- TLSH T166C3029E6BB19971FA61CAF188E1CBA1E661F90DA723A3C03D6C1705B7900C5CD1859B
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/p4.jpg
- SHA256 907455e25cc635057e16941f70d3cff18b977bf188f01e725b183df9a478d978
- MD5 0e7a09ebc8f8b8fc06fad517e0848799
- SHA1 5f5ff4facdb00940d05748ebd64c5b14e77114c4
- SHA512 bd6de9061bcaabfcfb2d6326c678bdc41b909227e310344471e54aa4898efa05eca8368f477d90a7637ee189cce255aede8d69a95b67e73f3a587db9c6817a01
- SSDEEP 1536:B8bL8bR9pOckFR5uIeW/IX0YYYsdG85VJ/usdUw4zFYDMWG9qesB:BgLg3pyL5YWAe9b5VJ/uKUwM+GqD
- TLSH T16DA3025D97C28E21F4DADBBAE082DFD68701EB8C2B134F46758C2349F7B72C12914622
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/p7.jpg
- SHA256 0b86080e5aa45524d17cfc5d1bcf8dec966df42291699290ab8ac4aa0ac116cc
- MD5 aaca3241ad302ca0d7e285377ef954dc
- SHA1 488a0ff4d2c6bc09726b7f1e8d38d5dded85ebf2
- SHA512 25f49b597763518861b41fe0f88363f3dff6592b55fb6a5c965a7d738c4b15b2738e4763f28c3ffd154339382f613518e6506f1e06e9d424379055be80693574
- SSDEEP 1536:/+NP4xEtPinsKq5+yaIOqQzQEbzwVim8ZOylUV+nUNz6O0v9upaFwVoZCb9Ih:k4xUiRqlNOqKQdVijZvGD6O0vYaFHK4
- TLSH T106A3021987EFEE15F9D5ADB540AECB4303204A0A6743A7DB78BC065173783894D6C732
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/p8.jpg
- SHA256 a2660c216acb24eedd5fd09ab68cdbb10fbdfcee75ec53875e2c16d5db47afab
- MD5 712e6d06a7b59465ef83fe259604e932
- SHA1 6254a10a981d0371a4ed2a70d8b92f18a6efc52b
- SHA512 0931c64880e46f6f4da5c992061f37bf1b23c34ae82be9a42d8f97d0bca7a506033b3160321a625ebe29ee40d6d7b976d44a6b2bab1ffec7f9543899016f4542
- SSDEEP 1536:97hkMT1l67fduOzon0C/vWdSJqlv7y/mMw:/kenA+0CWpO/c
- TLSH T15563F130D323EF10E9D17A7989F0DB56B301AB7167231B16395D7A027F9A6D2CE9D0A0
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/pdf.png
- SHA256 b0a65f9399943fa3b7f4d7911d70c4dbf9821d0d18879836e7e07fba6b5a97fc
- MD5 47a9b6b57790eea7c50d1ab8d09822cf
- SHA1 fcbba260bf11c03c6c69d640ed09db1fbbeb9b4d
- SHA512 c870915ad3eb0d22878710c6b7fcc4cc78e5023e132ad1f0ef693fd5b38c8874b1bc3df0c5feee62bdc9facda0a5f962298cccfb631c003ae7e9660adc931790
- TLSH T1AEF023C6331CAD3ED7CD992B0537C443A13985C44774889F3496AF2BBB2404056E8855
- MD5 SHA1 SHA512 TLSH
mlocate/Images/picture.png
- SHA256 cd47844380a2c1f0dccbd66ca4f90500aab134be21f2b5a4526e73591f2f709e
- MD5 a2047d9df27db8c5c457b6cec0b542be
- SHA1 f19b910e6c1c167a7f8ec1061218ffc2e7571a0c
- SHA512 b7ada65645c56e4aefd84c999ea2d83233616b005e6351432262f0c93f6f2bb0fb7e3b1c2fee86daabd80a458fc65ff502bb752e980516258a1cce736fefca4e
- TLSH T164E07D8B21CA18EDD7A95617039BE19068391ABD0B44621E7C11D4755AA9F885170CC6
- MD5 SHA1 SHA512 TLSH
mlocate/Images/profile.jpg
- SHA256 f018668af3ca45933efdd10394da139bd34b6bc64db391fa4878c9797dbe9005
- MD5 3b37c7c3cad7a8061a0cf7b80be163a0
- SHA1 747da2f75065b25091b0892b80feb76a8afd5db5
- SHA512 a7b5f2b57de129006eff96e6ebe65a4d2d64ec8d37868b70920cd34499feeaaa2a99bf61fea8482c521223c298480e8cccb5cc81ca85ca38e2b6f4791d1adf76
- SSDEEP 192:DvkDvDv1LtkikKfAEWad7UBo88zlmO6/1vg:LcdJkXWWOYN8zl8/1o
- TLSH T14BE19E8511AC6C8EC76FAC4087566E3AD8FD29252C655FC1EF25C60D2F7D18E06F221C
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/Images/profile_small.jpg
- SHA256 04dcf35b71d627dbe867cfdbef76092e5ef30cd5aa56fceaa5c0f05a48414fd6
- MD5 1345d6d00eae3d528031ef12a4bd0ef2
- SHA1 ab9e4ec1990fb8fe904e3bf986bfad925aad266d
- SHA512 95c503f7d3e746f8369a3eae7e89e1f598be1d2e0735aa4e345d97e4484d93ee8549903eb501d3b89090a85370a370f9d9e84c9737dfa2f506fbcc9070e5501d
- TLSH T128411A036B723E50EEF240F15E10D789A6ECE740305F5B166A31486A7992CE58DA2D6C
- MD5 SHA1 SHA512 TLSH
mlocate/Images/zender_logo.png
- SHA256 39eb1facb90e09a5c280a1d22e9b28bad254fc691c0317a34b9e9c60e563d2cd
- MD5 f9801885fd13cd7ae911d9e99508c35e
- SHA1 b4e6b78471d39b6a1a1d16e584b680369aa7a645
- SHA512 028716aac18977b9000dd120fd31404e6f224dcdef4ad181d536f691977cd238cffd059e33d213065f1d3bf33e52b46864ab29c8d7870b2a7a61d6d2aaa2b6ac
- TLSH T12F817DAB4260B02EB0DE716109DC514DFB1B225D953336B920D2A9DE3491D0BBBC6871
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/css/font-awesome.css
- SHA256 082b0736a3408950e50fd65a090921003fe83d89ec6e3084549a01d5dfa9e854
- MD5 5343ee1a287a65ff20961476fd8a6188
- SHA1 b488600451227b445414796e9b8550e7c1bd6d29
- SHA512 11a6a5760819b780cf28c6016b5e37bf15d0a8bab92c4dbd0c6ff43a855e9e8cb10eb012718adc61c1c8bb160ef583532103200fc73c808514f05430ed6a5749
- SSDEEP 768:r0j++A4CSIDqvnI+YTBrQPvVlJjPiRAiq:Ij++A4GDUI+Y9rMVLjPiI
- TLSH T1B4E230ECE5BF18904391E0D16386A370BB3DBB2C9C4A6D9CD2A6798CB1C1255D2C63DD
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/css/font-awesome.min.css
- SHA256 ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
- MD5 4fbd15cb6047af93373f4f895639c8bf
- SHA1 12d6861075de8e293265ff6ff03b1f3adcb44c76
- SHA512 f8be32cba15170319b5c9f663c6f0c4ffdd4083cf047d80f7b214d302b489eca25fbee66ddb9366d758a7598efc9b9a886b02c9f751ae71f207cb9db1356243a
- SSDEEP 384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T
- TLSH T13BC230F8E54C01D66731C48BFF81B36862B6F73DD5814D99F01F690C29D22A522C5BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/FontAwesome.otf
- SHA256 7ed24c05432403117372891543f0cb6a7922100919e7ae077c1f3faf67658dc2
- MD5 87d8ca3ddc57e7d2da6226e480f90457
- SHA1 42c179eef588854b5ec151bcf6a3f58aa8b79b11
- SHA512 4c46571059f4e4cbe17afd1a046ef21f151f0776624ad04a108b67225cc247030e09f012a7ed913a841050ccb9426b4838660300d605328232dca6f48a4ae6c1
- SSDEEP 3072:BUPhms6wRdDlpQnkjueie6D5+2MlM+MWX+/Xr1pMpkFzJ7:BAQdwX7QnkjWeK6lM+MLpMpkFzJ7
- TLSH T108B3E1275539B306D382933EF927E3CA2072F344EE098356E710B58979B1B216497B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.eot
- SHA256 e219ece8f4d3e4ac455ef31cd3a7c7b5057ea68a109937fc26b03c6e99ee9322
- MD5 32400f4e08932a94d8bfd2422702c446
- SHA1 986eed8dca049714e43eeebcb3932741a4bec76d
- SHA512 47f19282f19cfc7a40a31c6af428f100c7011167858b46b415556fd9b65d48da2783dc22b101a6a89d95b05cbcee625652c87d421a83d40ac7482c2b0b3d86a2
- SSDEEP 1536:/PEOVdNaSNYXdU47Z67/Ry+YcWqlr7pq:UidIYYNUssAqlrg
- TLSH T1AB630150234761C6EE7DDB133E0622558858F28A565BCFCE82E6C9ED0D034DAAFBCD18
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.svg
- SHA256 d67041fe5d50eef9ef671643968f7ce6b130eaaaaa2ce4d496b18d0a33aeb87b
- MD5 f775f9cca88e21d45bebe185b27c0e5b
- SHA1 b06b5c8f67fd632cdc62a33b62ae4f74194131b3
- SHA512 e13afecebf1c4519f325a589d0ec953c4b4e9418dc259e98496282ea7ee9b3c5b8a08f1804d840f09612d16493fd886d3d969c2efa7a5e02cf9d4764015a4541
- SSDEEP 3072:pnw+ubvqCDOzAIvK+jRwXxSbs3KErNKyOAXzr3Omq2OEsunSGwoyHTBOs:AUlFySpx
- TLSH T1EB74A568F95107B9CBDC42C09A7E0E94532D916E18753E68067E98F05D0AB2E4FCFEC9
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.ttf
- SHA256 7b5a4320fba0d4c8f79327645b4b9cc875a2ec617a557e849b813918eb733499
- MD5 a3de2170e4e9df77161ea5d3f31b2668
- SHA1 6484f1af6b485d5096b71b344e67f4164c33dd1f
- SHA512 94a693ab2ce3c59f7a1d35b4bcc0fd08322dad24ce84203060ceceaf3dac44c4c28413c28dcdab35d289f30f8e28223a43c11cb7d5e9a56d851eb697ff9b9b6b
- SSDEEP 3072:31DuCzsU9393sdVP9Xy2i0iEPGFCMD17VJG6wVcxwDgo69Mc6iGcyKIhwxjtkOc1:31DuCzsU9393sdV1i2ZiEP2CqVVJG6/S
- TLSH T185D37C7EA7FACE7EF05217FC8C6734910AB66E10F229D587B78DF4B6742A040816464E
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.woff
- SHA256 c812ddc9e475d3e65d68a6b3b589ce598a2a5babb7afc55477d59215c4a38a40
- MD5 a35720c2fed2c7f043bc7e4ffb45e073
- SHA1 4a313eb93b959cc4154c684b915b0a31ddb68d84
- SHA512 0b9bdac9f99cc9f9e95039213f6c265a39f53f880792015b43b224661f253da9d2f77a3683fafd6a3f8099338286bcc1898a2c913422057ac6772893a0c8a11c
- SSDEEP 1536:d1wM46limmvAcuQ2+8TQe2ZZhKNfzXFGPCiNDYlzberHorvXvd3:zwKlid4cuQrbBZZhKxXFGdSberuvXvR
- TLSH T1798312254F03204CA0C94A7B29B8A12B1DD7DD038989C4EFE5618BE1FECE5F16695BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/fonts/fontawesome-webfont.woff2
- SHA256 ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995
- MD5 db812d8a70a4e88e888744c1c9a27e89
- SHA1 638c652d623280a58144f93e7b552c66d1667a11
- SHA512 17222f02957b3335849e3fe277b17c21c4aaf0c76cd3da01a4ca39c035629695d29645913865b78e097066492f9cee5618af5159560363d2723bed7c3b9cf2a8
- SSDEEP 1536:P7P0ehdxE792JHJ2qrz+MoCpeUtsG9eDeh9Zw+ZyqJ:PPlYw1re8Lsqh7MqJ
- TLSH T1AE5302303406AB26ECDF0E8776B888F2B4DA91D37B5F22C753AA84115DC91D5D94CA3E
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/less/animated.less
- SHA256 c7035423d5a1e03d36bcfd6465481e4c4d5c91f316fa878a6e5103afe1b0bbf6
- MD5 08baef05e05301cabc91599a54921081
- SHA1 421f2c4e10191f148c13b8a34e5ff3f484d4c393
- SHA512 285de8b339ae691c8c95230462b8760949850ecbd1a4f8b98b0f85347f1187ca7727507a50ba7ee362b57b1ccc94efe57fa99bb501bbea93561ca3104f73084c
- TLSH T1CA014CA93D494043D32BCE1483DE0528E51874235E29ACCA737F640DCF55E6862ACE1F
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/bordered-pulled.less
- SHA256 e3d168a292ba33d4e3215919963a304dc25732a73cebdde6e7ebe4d47ab43eb6
- MD5 898f90e40876883214bbd121b0c20e9f
- SHA1 a2c292137b17406183ad0fdbf4880fd648b9a5ca
- SHA512 666a33697b525aa25d773c94360b96dd6ff833dedf99178af931b040aa93239c5814bfdd433a841d77c2a3addcc444d7ec95c83073b9d30e48ed5fff4e82a111
- TLSH T1EAF0903DACD9D8315811DDAFF0904894D50752703A3FE4A9BAF31924E529FA8084DE57
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/core.less
- SHA256 a4a93d598134f656ac6c7a0a5f375afa941e71e348e68ecf3cd6feb7616acf9e
- MD5 fb4efe4ae63737706875bbbfc7b7e9af
- SHA1 1a37352286619b789d151a06eb4b7551e4c1aaa2
- SHA512 88b310200bdd13129f343e8f9b581e3a376fd5aec4c7a604815101774d31ca3fb469d345321aee80303842309b10273885195545f69fb81ea13215e751ef5187
- TLSH T1DCF0DC267E8190B52009CC83F30A2B12F3288433920080AA8A038B04449197722FF76E
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/fixed-width.less
- SHA256 0ef853a3192742d207ea0e793dc8bcc6322dcb9e50d41f4b981c4ebac2dac7ac
- MD5 5e07ec001f8d21bd279c12ee542813f7
- SHA1 ec0c24b97184dab86177660f486b8d08cd636c42
- SHA512 b7bf0de65815043012e95e8b1bac895e85c9a07c047c99ba4f5c132a00ace5aeb3e838f2aac26d8451b38d193fde8199c45d58a2a79931e5bdbda47f15c8822d
- TLSH T1FEB012204CC56C100111D426BB120309D52FC5317F8FCC91BD92009D0B8B508066E34B
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/font-awesome.less
- SHA256 22725e90aff402898fd0bd8c8610d97262cbb167d562210eba68271cb99c7bce
- MD5 468f606d3d79e0de653ad010c0e24c0d
- SHA1 ecb152f7ee25d5aea42db8cf3694a21d7f7b24c6
- SHA512 e4e4e36f349e9cc0c6aecaac8ffbf8339ddd05c64ae3d3109f19783ea94a04b26b88d97c5f368eeb4f78b8070d1110c741106b4f6935f2c9430cf2f950e154cf
- TLSH T176F0152B1210091A8687BAE92C9913396FF3448CFF4B37442506377AF7E0E7728B4368
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/icons.less
- SHA256 751e8ba79ee98a6115c2a02d9b4ac6e212c3305bc9f5adabad5411d77260d1e3
- MD5 e307cef3a4e7ea676babf6150d0265a7
- SHA1 429f141f3fb8d208aa120b27f56b2752e11e2969
- SHA512 36681dab950c4f3a370a5fb9c327a06e54e56aed8d690561850e1dbb7de6646dba4b49dd6d93cfa1af2d7e25bad5a23d7ddc01eba716435b851e849de99a0013
- SSDEEP 384:WP878zES3MVYrpth8brOL3O7Z7wMvX3rAvpDDVNP:WP8AzES3MVYrbh8brG3OZkMvrAvpDDV1
- TLSH T1A913ADB5D8CCCC645724D8FAF2863340AA77F130FA209C59F957099D82D6B195393BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/less/larger.less
- SHA256 dfc79d4325804e9ade21ab65145b23b1c4193d24a893690bc47b5c0739ca3c0a
- MD5 8cb65280c0f889daf72626c21a7c8628
- SHA1 e7119e82dc50540dbc3472bba7d74282815a7ecc
- SHA512 5ba01d3b3c917dfcc0bf20a283397e677d420addb83c74d29f81d77658105c8d9e48784d2e8f5214919877141056a74f06d3081fa291269f92c4506ac089a745
- TLSH T1B9E092266E58CC60304CDC3AB3831BA0EE6E88B4E9206079A41344144076B31030CB4F
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/list.less
- SHA256 024abb930e6669f215ddee19f58077571f1cabb7aee1274bf96b226c296b73d3
- MD5 975571323cf880a4a30601998236b027
- SHA1 f53bc20884a1410d950b4a36a330c5181a8b55ab
- SHA512 a13c48c3ab87469b5e720287f5f1720f0588bb45a0700968879cbba7ba008d070cdcd69b41d374cb504311c0a20bc4e727872855ae5e90fc76b1589104acc07f
- TLSH T154E0D8614D5798641016E3A3A2C10206F569D834BFBFC84644721060FE5E79C163E766
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/mixins.less
- SHA256 5f6ee27de444452a1279787946f8d9d5db3b88e3376b7f951abb9c997c5439f0
- MD5 63afa4054431cd255dd522314d42fe01
- SHA1 3a0717f78374197641fd7a9ff30dffe4c3207e10
- SHA512 365476ecd1a9bcb0f10172c01fe855bbcb2aa03b67ff670d76e352ab880ac8608b32282dd1a631089d9f9fd35dda2b8a8ec34a26e9eb0e9aeaa741b9b313229d
- TLSH T1A211BD95BC8110516926CC02F3DF0A25E36C83A71D018FDB764FA60D4B807BA0ADEB56
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/path.less
- SHA256 79727cb6aa668b4515e0c6187653120129783e82e3f47e9e12a8d7b9cce59241
- MD5 3ae443e0386cc3a69ff47d641aefb74b
- SHA1 47108f118b6a9643774b718dd4c56f4c81ce681b
- SHA512 5aedb307ec6cf9bb8f83a5654f6da30274e510640f3731415145d3669ebb765070460d7a9d252e602325201694c11af23ee1955bf4f73dd3c550e01e3676af01
- TLSH T12D012D829E81BDC59214DB1C3BD74391CF4800A26D16364D713659644FD7F3E526DF8C
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/rotated-flipped.less
- SHA256 d67df95488eec84d2d0caf79727825a8ff4b2df90c604151783e3ec2388dad38
- MD5 a8476cdc50c264abd11ff59d6a9dd025
- SHA1 95de5de9009714692430b04f9cd4388be8fba8f3
- SHA512 a906cde529bac0abc118201866c6e81ceed53ea5859795ebe87e52e1d04f1c32b0ae1dc2a9297e2d6a2cc44a7bbfcdccd01ead571198027430b98190ce5efa67
- TLSH T144F04F71DDC8EC300D90EC2BB288A801C5278131BF74F45DA9A7522689A2BA9435DB9A
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/stacked.less
- SHA256 3f9de6c3e0f1a2bc71579a417d7c415f82f2a3d3f4792161a8588bb8bdd75450
- MD5 518e2b2d263982d2caa1e6514b4b4eac
- SHA1 f044077bc8be1a989c245254e81eb084d52d29a7
- SHA512 0f07e1507d430c8ade9cbf2460c8148d69fdce6b5b7c659247953e0e0235c5128cec1cd1a329790b9bfa42967cbafd36776d81f6e4ff80520149f8ff4a6ba629
- TLSH T10CF0E2708D94CE20905AE53EB2C02301DA6F8031BF76D829FDF31214981EB592B0DBD7
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/less/variables.less
- SHA256 ded827f2c2a33c5a50b1a88d87248c1674f2629362edd393039cd5153a784eab
- MD5 49b82ead1bba3097f60dd1c8d4128a3c
- SHA1 77cf688c0d91127a538fafe76c897d17fcb7b3d1
- SHA512 4a9e14d4ac1f9f1e0b741cefc0c98e763b81abb3360f8fbe08c1d7d3261ecdacb2ee22555a014e76432006692e88693a24791db3ec1d46d66b9fb82ef408a5ce
- SSDEEP 192:OFcExQ+cs6eCpV473CqmYOoihy9NwiAhAIO/RHLlvJCQiQP0Pckn40yNvanAD6T5:oxXHCpV4HE4NhAhkfvJCQL0ENvanAWt
- TLSH T12092450DB64E3015A71E51A140DEBBCC773E8A9DFC56067C7205BAAC2299237F5B3836
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/scss/_animated.scss
- SHA256 900e2531ca7544fa8f6e0db9996bd28d3970185ed810717a0a4879da135e5478
- MD5 39ff4f359a7b81d6585075715f41e5dc
- SHA1 8daf189b2f8a404495b8424b6fd1ba630dd1c2dc
- SHA512 5d8be64ce5136d02dcc2dc38341491c2cafca5633a8bbcf6bc6931da2ec95e2e29ffddd8a058842da4764620824914f7c7c7048a6c9e54d3e97bd7ab995834f5
- TLSH T13A01D8A93D4C0453D32BCA1583DD1528E11875235A25AC8A737F640DCF55E6862ACA1F
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_bordered-pulled.scss
- SHA256 d1d28d405b9328313c843f7c1a40951ee1a738d632081beb76a0e072b407f549
- MD5 4cad0df17bf40327feae33fa9a6c6ba2
- SHA1 164b6a0a2b307cd293f4a914ab0fcdf643950374
- SHA512 01095953afd37d399f8715168a67a2e60c23623f3ead4eb4360f8800e30cb9572ee5d90b48ab4d0e07271f75b11da2d4a4cc39115a872e2f001000cfb46a8bea
- TLSH T11BF0F03DAC9DA8314816DDABF08048A4C16352703A7FE4A9BBF34904F129FB8484CE53
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_core.scss
- SHA256 e6e81949b0ac466839c5239a1450967ec32af30eb7c25d1845569621e8a1c8fc
- MD5 ef059a98cf9de6ca5b77ee6850771cf0
- SHA1 55a14a34267edc401b82e5ee41d8bd84fbb5da3f
- SHA512 78b807ddc8ac17eebfd4f59eb923a7f8bac8e7b76bc83985d593382b1964f1d98539af83c95c4aaf99e3e492304e08d452980879213fc13d9b9f69539f1f74c6
- TLSH T16BF05C267E8264B5201DCC43F74A2B62E3788537920194AA9B078B08549597726FF7AE
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_fixed-width.scss
- SHA256 b8b0b3478e04e868ef0cd5fa3fb291524f1932144d1bd3427d156afe369194e9
- MD5 9277ab6964a434d499873687b00be906
- SHA1 224417ca266c657849afb2bbcb6dc455894ff387
- SHA512 27392694f9bd1a671cd21517721a86c24725c51fcad4acaf09cb75a9e36bea34176af900c82e061eb0ee6b60a1bd0d9e99213119c5175c2f48b6800258ba840d
- TLSH T19DB012204CCC3C200111D822BB120319D17FC5317FCFCC91AEA2008D1B8B508066E34B
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_icons.scss
- SHA256 f514630d052af09ba6ff9f60c29e3a38b9dbd36c750def2bef09f44edccefaa4
- MD5 2718c9b0b198345b31c19d3830c223df
- SHA1 dc8b100d2977dc34e71e7af8f5f5a6fc47977946
- SHA512 e8d5d9c9093cd0b2ef0f9d9ea5ca8cc8de98c7cfcaca7e9d269be23d7bfa703f8399d204aef73c1805149dcb27932f2494a35359eb0e1137427bc9ba31e654e5
- SSDEEP 384:/ho/DfdNH46s42UMHvoTl3pW98A0w6OfH3QPiRtI:/ho7fdNH46s4ZMHvoR3M9t00fH3QPiRO
- TLSH T1B213B1B5D40C9CF01708D8E2B2863354A5B7F134FAA09D58D667198DE6D632AD383BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/scss/_larger.scss
- SHA256 fb4e8e7d5d03074da402f544d36bd6adb6adaed7ad816c4bcb3f53fe03273c17
- MD5 e95931566f6fc6ad5685c4fa9802e206
- SHA1 940e1c5ebc690283bfaee92560cf15fabedbf6a9
- SHA512 ed6e63e7cdc9bae34810146c3dfd52b912f7b20219555994249f6f3dbd528673af58b69deecd9819f28f71713076c6694f6db0e31148e8e726f714312f404a73
- TLSH T128E092266E1CDC70304CDC3673831BB0E6BE88B4EDA06079862344046076B32430CB4F
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_list.scss
- SHA256 d5430a6695febcd9e7f5898041aed2b62060d1b8d7b782e0f4975210a0ddf38e
- MD5 7107e80b053928271d5fcf422dc29490
- SHA1 4b53ee01513df8b9ce76442b2d8f1851613a435c
- SHA512 d8b110a513c41ba8a00620143aa01b2bca59f21306b64e96cb82e4739ea88beddc0d3ba2679f277a34c89fa5cfa3d4b0f8ac5b16d9beccccae36b2f8450ef75b
- TLSH T109E092614D5E5864000AE293A181022AF2799434BBBFC84646320050FE9A7AC163E765
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_mixins.scss
- SHA256 f007a6e985c4064b7c8f993b22566b06138f6f0983bf8cc0a5dcba30fe841857
- MD5 2052155a929be2769df84be98617f310
- SHA1 624682da7da2566b3c8d2d5fb268d8a73899b3ea
- SHA512 d1b8762d284b021502fbaf52ed48a0b2f84149dae1bf7b21468a75cf9c628db5ddd7f8a6fde146e88fc44fd330ab4ea814e22563406fca9003750d8fbb42edd4
- TLSH T1F511CE407C8198626929CC12FBCA0F60F32C151718018E88B74FD10D07866F9059EB4E
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_path.scss
- SHA256 0e035e21bbdf7f14f1453fa126aaf39f0b62479471f3cba649a64dd2daa54e26
- MD5 ab5a9e8388563e097b5ce835601f01d2
- SHA1 080158aeb1bf6df59ec98b2bbed44da61d9c9ca3
- SHA512 9eaa7d29bb402c790bf1ad40ee849e26743d198bff3cfce0182c2320afd9d47f4377b2bfb147999a057604dcfed33e408065577a516be0f3623fc0df75120912
- TLSH T1E0014983AE953DF5951CC92C3BE783B1CF6800A26D1A3259633A5D504ED5F3E126CF98
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_rotated-flipped.scss
- SHA256 ff0686d76acde3581d679be874fbf73a8bcae4110fa7b6c7aa08ab204a7f3b7a
- MD5 9f5d4bc6fadea89328d2aac26574a9d8
- SHA1 ca08a0af3da63c2f2a7d3c27a8747637744cc785
- SHA512 89a2a4009628540c88c9375c7f04bade6bb9b901575c12fe22d0031c10011f4c5c3b7834d4caf6b1cfb84501a5a77d5c4e6cebc9a8ff92c8bc6c82ec6bfed40f
- TLSH T19101AD71DD5CBC310D58ED637289A420C1779033BEE4B44C8BA31409B5A2BBD822EB0A
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_stacked.scss
- SHA256 70f33fd079ab708587c63b5884e04b31a3f46fd33923cb046621ff18b1bd99d2
- MD5 5594237226aedfbca2fa1c7f4604c214
- SHA1 cf6752ee609af36eb293a7197c88d31ecacbbc74
- SHA512 25492b5ff68a6d2c8f9ddcebbea75b1f14a7f47d599bea5d75e1f5fabdb5e3d43147e6df2c435c7ea639c094811872e53941ccb79f204026b6fe2cae172df7ac
- TLSH T159F0B4708D1CAD30505EE53A72802311D2BA9031BEB6D4299EB21104A41A75A6B0DB96
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/font-awesome/scss/_variables.scss
- SHA256 755b5233515e27fcb49cdb775487b4f1439297d330198a7cf41574bf8c6ff493
- MD5 8d253b1500cfc4214f23820d7d9a13c3
- SHA1 86410d7bed9d06c1d1bb6070207a4f5f1283d3d4
- SHA512 b86626ea361115c6705283854f0065a03f8e71051cf641e9650ebf57ea74fc34866732ff432a41df6cebcd7a406470db037933c2305d43c507a8510b8b883d2c
- SSDEEP 384:cQAqavfCZhj83MYBJAxEoIvVyMv4g5Hvu7/XIW0Gx:c5qavfCZhj83MYBqVIvVyMwg5Hvu7/XX
- TLSH T14692644DBA4F2011E71E45A1C0DEB7CCB33E899CED550D7C72097A6C269A256F1B383A
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/font-awesome/scss/font-awesome.scss
- SHA256 2fc30d0c2b6da3dce5880a020d88d3fde5dc3fbba7ab580159dc1d053663326e
- MD5 507b6625f2be2b82b178a2658a338ade
- SHA1 d502e54ad1a043e65f2af901a9ab425efa38aea1
- SHA512 a64a2878822db68ce3b087bdc73a45d6d8afb5f830fb5907829f3e2524f3a98e2b14986fbd8393e8ac10c99778d747e2993736338789c1fef694cd945921b109
- TLSH T17DE0DF2B12000C5A06848A2B3C8A07751B31809FFF5B3A8468070B3AB3E4F7B2DB4368
- MD5 SHA1 SHA512 TLSH
mlocate/fonts/glyphicons-halflings-regular.eot
- SHA256 f495f34e4f177cf0115af995bbbfeb3fcabc88502876e76fc51a4ab439bc8431
- MD5 7ad17c6085dee9a33787bac28fb23d46
- SHA1 f3a9a3b609133c3d21d6b42abbf7f43bd111df72
- SHA512 830f534f97a8eb849fa7e67e533d89d150ca79233c0a31a9a54f27b4757a86c345f94533c41fc239899e642502fde7800170e6889d1544de69bd6809ade8387b
- SSDEEP 384:p3UNFqlPNyqPi1q5z/J2hbrOnjkw3DAtfEJDk5GqAXzbX09HDklzPyO8:BUfMP8giA5z/ibrOkw1RqAfCjklryO8
- TLSH T18792C0C09532C68BE8123270B61B1D10C309FC9AD236B5574E8D1DB227F496FF684ABE
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/glyphicons-halflings-regular.svg
- SHA256 5d234508037dc13a419ef6ce48f3fc73dbb477f1a162c052b872182b494e626e
- MD5 ff423a4251cf2986555523dfe315c42b
- SHA1 66b1fc67e37d01ee45ca75c4eefb144d2dbe98fa
- SHA512 94b9b2263796425a74b86f521dc255071e04f587664929972aa67270b1b2572a791360d575a4da8146779f1a8ca2aaf41f24130881ee7e973d2862c5cb0b5f73
- SSDEEP 1536:5KgJvfdwnzGLAyy27Xjx94XstJZLqIcCKh4pJzXvcvxcH9S8rW+1FukaBPfBDAtn:cgJvfdw1yy27zx0oJZOIwh4Pz/gxs8wz
- TLSH T13A53240CE8480FB0AFDC82966AB97F94125C428E723438D44D79E5E0BA59F254F9D6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/glyphicons-halflings-regular.ttf
- SHA256 bd18efd3efd70fec8ad09611a20cdbf99440b2c1d40085c29be036f891d65358
- MD5 e49d52e74b7689a0727def99da31f3eb
- SHA1 aafafdc09404c4aa4447d7e898a2183def9cc1b1
- SHA512 f47c250403fbb7f2dfe1cb7068ea3a1496fd26d9df6bfc3a701d3909c5a2b69f43bab042df0dcb66e64c308945745b76b0e9ad2a750c69cc0c7271c6d6051a96
- SSDEEP 768:jv6vFypOMd5TCARjclsRYfZqVbBHSfnWXkNm7xNkZb20qxVCzd:j6NYOWZxRglsHbCNm7xaZ6a
- TLSH T182033A03D68EBBAEDE325D734A5650CC47F3AB3F19852ABE8D0934EE444B076DE80594
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/fonts/glyphicons-halflings-regular.woff
- SHA256 fc969dc1c6ff531abcf368089dcbaf5775133b0626ff56b52301a059fc0f9e1e
- MD5 68ed1dac06bf0409c18ae7bc62889170
- SHA1 22037a3455914e5662fa51a596677bdb329e2c5c
- SHA512 88beda715a3de8ea031048feb71fd3ffff9c695fd9874b06c8b1d31c88c7a8a653c4a67efab3b6f0b1f4dedc3c18a6436a4455984c0abce10a210baca0cb689d
- SSDEEP 384:nPImthkcJE4kdRJe7gl601jRx2GbhjBrr7plKUl2yCIvSAF2KFXthj1D:PImth2Je70jxphjZp0UMyPSyhD
- TLSH T11EA2D0E7AF93450FF75E1279C384429E368DAC09A19B0DC546EDAC1D91C80BCED426F5
- MD5 SHA1 SHA512 SSDEEP TLSH
mlocate/mlocate.db
- SHA256 5b7fba18ad520ee24d2dcae4cdd87d3160a4479b8d95cdbeb40f8610801ac22e
- MD5 08799fd65c6aefb9143fcf8508f7a8dc
- SHA1 f3d0a2fb098706ddafbefe88a7e28f1a8b08bcd4
- SHA512 495991271724ff0c523d2a75e6233defc833f0330e4f12627671802c98b510dbf7d2ca3ff0fcfd152bdd00ac9bd2d3abcae4fc1d16b39a76e49a44f8ff6a61a6
- SSDEEP 6144:qwdBQZSizyzDT4Ue3VAT73GuCO3xKASH6L/+B3/nu9adOLWSJu1ea+PfVOe7BFsc:re3VAT6uCO3xKASH6L/+B3/nu9adOLWQ
- TLSH T1FB840F47F3AF6C3AFA8CA9769FC30307BAAD3990D01F7950608615E4A49427E06DFC25
- MD5 SHA1 SHA512 SSDEEP TLSH
openvr_api.dll
- IMPHASH 2a3e13c083c45f8c989efdd2e836b63c
- SHA256 d958b1c862a9579bc46840f8aa32eee1b6fb3daf2dea2f46e800c2d5c0d8ae4b
- MD5 4cb82733dbc4cc8b996ac99a79477836
- SHA1 71d10a2cd1da38b535da2f4d55e080846050a13e
- SHA512 f0efd57f45ecf04a1bcf3d6a0a6466dd7bc5d5850fa15e9101871238ef1a8ba4078677162950cefad8c968127a70259511d950e482f1cb89a11b30cdac943f10
- SSDEEP 12288:ZgTh6XZ7cPCjwGJmqfbT0zaGQhrqflCSBu/FXt:ZgTh6XZjc00zwhrqdqXt
- TLSH T136D4BF627981C0B7E46E023149E8B73445FEB9601B709AEB7BA44F3D5FB01C26732A57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
42:4b:9e:1d:9d:90:83:64:c2:a0:3a:8b:15:b8:ff:6e:e0:72:e2:63
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
Chains
Aug 19, 2022
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
Serial Number
06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 7, 2021 - Oct 9, 2024
Minor OS version
0
Major OS version
6
Entry point
90477
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\buildslave\steamvr_rel_hotfix_win32\build\src\openvr_api\Retailopenvr_api\win32\2017\openvr_api.pdb
kernel32
FindClose
GetModuleFileNameW
WideCharToMultiByte
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
MultiByteToWideChar
GetACP
SetEnvironmentVariableA
GetEnvironmentVariableA
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
TryEnterCriticalSection
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LoadLibraryW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
ReadFile
GetDriveTypeW
GetFullPathNameW
GetCurrentDirectoryW
CreateFileW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetCurrentThread
HeapFree
GetStdHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
HeapAlloc
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapReAlloc
GetTimeZoneInformation
FlushFileBuffers
HeapSize
SetEndOfFile
WriteConsoleW
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
shell32
SHGetFolderPathW
LiquidVR
VRControlPanel
VRHeadsetView
VRPaths
VRVirtualDisplay
VR_GetGenericInterface
VR_GetInitToken
VR_GetRuntimePath
VR_GetStringForHmdError
VR_GetVRInitErrorAsEnglishDescription
VR_GetVRInitErrorAsSymbol
VR_InitInternal
VR_InitInternal2
VR_IsHmdPresent
VR_IsInterfaceVersionValid
VR_IsRuntimeInstalled
VR_RuntimePath
VR_ShutdownInternal
Name
.text
Size
417KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
pam/account
- SHA256 9f0f66ec5d201dd496bda06760e5871fa68e349fb9d423eac447d332652f6f13
- MD5 e18e9ff98c3ac7939cd3d38d678b0303
- SHA1 aaf1f678b3e27b0f3ac1da0d973f6f611d70bb01
- SHA512 5821a3967c966d1df672443be54d2a7d5146e15735f1c78ebf64da6d3b1f7a4521b1913b1db1763a6a6c09a296c16644c8159ef5950badfa1812d06eabd0d9d4
- TLSH T181A0223F2280CECE80002820C008222C88A0CB0B03C33020EBACE0C00CCC0C02082828
- MD5 SHA1 SHA512 TLSH
pam/auth
- SHA256 1119b101213fb5d7dab9f2fda236e12205fd3a1940d2715ea4d0c1dcd867000c
- MD5 597c846fddd7491f3f2f3c5ad923095e
- SHA1 23a23fe4f4b998b2d2c2caf3c8fd9f7d1b639dec
- SHA512 c13b08905190e8847cc9b55ca8cc154fe62d68b43eb99342b7624d82abfdb02dfd27228f385aff0e944b8583437a06b7db62c261be5a2743aebf8a7713f7af83
- TLSH T18DA002373181CE8E444150208015074D59918E0A039371209B98E9884D991856592918
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/arptables
- SHA256 a07be2d91216c26ea5b0514edaf185452143e93c9de4730f61534a21049e6cc2
- MD5 20854773bc4e78253e1ae69cb458fdaf
- SHA1 d449f65a45ce4bb8b72ac25d5eeef337bd2c1799
- SHA512 d26450fdc74014d8c18e1b3a748ddea6f46b37797ad7b8831c650e859793ef8c355d4eb82fcdf7a0e20d7eb635c554d50206f79f559995899ab3ffb21959ad20
- TLSH T1AFD0C530079EBAB0FC93F87A12200A92B6893BD04E26B03CD4775838C0AC48C1317C19
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/automake
- SHA256 9b7e666cdaf66cd1d7a50fd0eb782f947f4e08d2e2908002032b9c8d6ea8db3f
- MD5 aa6dfdf2c92c9e584c717148c9ae5451
- SHA1 917e571f392db67de15982ff929e2ec7c2444724
- SHA512 e53d5d3fe077c9b5c737a8c589e50069ca2d2aaeb81c261cc8ef6788ac67b60e5787054f03028f5b6b19c0f4cf0c4afb237ff0215194becfa41fc2aa4a5a5a01
- TLSH T17ED04220B5C682F8EED0DDFA7D0282A02BA8B6E4351CBC1442F25042E240A4D538BA2D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/awk
- SHA256 06c7cfca68d405ca5e20fd379b93fe97fd1698841a1449f9b403115cedcf8eba
- MD5 a3ef88b5386743e2b1a5aa4b49617f91
- SHA1 b00462dcbc58ea17e48641ea1af803b637792239
- SHA512 e6d616c27105ea8f73312a9ef4bdb21959a4270bf562b5ddb0b9edb2ca8c9719b5e5e7a3d18077e0ae4ba9aea07b667a78901f5574c859646d46ef2839a94052
- TLSH T186D0C239F8CA80FAEED0FCBE229393DD47DCB3A4B910B95488A01136E441388170B82D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/builtins.7.gz
- SHA256 6cd368606c13e12657f237f25e3ddfd89c6ebc34b52b8391561ff89d0c052f62
- MD5 ea8de40908a0a242f1f5e6028542d7da
- SHA1 549a004fd506ab044b8b29aa213d2eef37406252
- SHA512 b2539f2c46f5e8ee10bd7d6a4defda3899ff6d0f9d6684608d55c0f6a92e59aaa35b0c1ae52052d971f85d50ed565de89671d52c0542c7028f656f582212c916
- TLSH T163A00232F54460FDDE147775F46303D9CF497FF93510752150750043D051048818F915
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/c++
- SHA256 bfdb3f6da6d05d5b201dba789f85b3006ca822ac4794a9dc4821a451b5ae645a
- MD5 9a8da1d44b6cffe8add315aac4202bdf
- SHA1 61126f70ddfdb947383808b24b4ca6fcee4cdbda
- SHA512 dfcfc9f3f3e38e42697fefefac8ddec7d500216f22a90770842b34e7942d871c37a7b77a27201e65b32987152f18b1a0f4d55c535c9aef362cccfe2ba866f705
- MD5 SHA1 SHA512
pam/dpkg/alternatives/c89
- SHA256 a700082a22057e8b32c1eb36f8f0aa1915bf716d4afe25f2ced45c4bcfde2448
- MD5 7d1e0f90185a41af8063a0c24e69082a
- SHA1 33dcf49d8768c5b079d92f6b9a6c7e5ffefd96a3
- SHA512 b99393a1947de16b3fce98822f7d33edb9460979d8a5b911d10270a38852bf2abbdf21843ea64f647b24aedfa975b9ddb12426961e07167a3e674eeae212b909
- TLSH T1F2B00220B28AC0F8FD94ECF7600783D57B99F2983950B91050F51066E41895A675FD9E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/c99
- SHA256 57c1837c1596167a72a43fab88b3b604452e756f26e2238280d3b4d556be2e08
- MD5 d0a32d1cd130e132dde7d2f1b8a42586
- SHA1 7b325089ac20fc66c951a5f611f1853c162202f0
- SHA512 2452334826d7ca4fa93fc0ce856b1cc76f48de404ccd397c2b112fd05aac0d80aed0e1efc02faaac53b0aa6636870207015a626842b7fcf805b7856e4f93dcd2
- TLSH T101B09225B098C1F4EDE4ECF7514687E907C8B2983910BC2140E03113E008D68331F8AE
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/caf
- SHA256 2c5eaaba9b97995a49c664bc830ed03293f0b8f5d4ac689682ab43d92edf32c6
- MD5 f37630caf941f2388e483dbc659c6f0f
- SHA1 d61a18b2d074651f7dca517abae68dd72b6c2547
- SHA512 bbc985cb57d67876c6f69dc379ed8b999c5f06fa3fc381bd8c9e51645285d3f688864b4ef0973217f9111ecabe3a81eb709b0dfc9066e8ee661a08a0b4877a4b
- TLSH T19DB0096AE4E91020FF480862C48A97A06ACE80526C84FD155AD24280EA62ADAAA20A1D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/caf-openmpi
- SHA256 dcec6fc534dfc849bce791e1adfacd25ffe20e214993339eff634cd9a6115ba5
- MD5 56ef7cb02702bd6d43826ce1215402a4
- SHA1 3bd0561b5aac23fee9aa2fe7feceb96ff65f75bd
- SHA512 09d6b0d64f0eaf26447ed68a6302320dfc27a5cb5d383a554b3de68c2fa7224e9e3be5c6386162c1b5a459792fc2496f119771320c4db6c2e0f3749b636016ec
- TLSH T1C8C0C91BC2D96D20EF443C11815CC2F692E480056D00BC22779207D0CA1326AF612C1D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/cc
- SHA256 ec8532697225906ef3ba74fe6c48ca9ea72aef5bb6350729ecee9f731cf06821
- MD5 7068ae2a0483407d579d56965be18be2
- SHA1 0f7b6de379aeb2aa0bc03131a116f98952b796a4
- SHA512 479a92283422f759b54ef7d183f417fbe16b600ead6975f6cbbed0b72f4fa45c5bcc8390170baacdb4ad4766507a3adc62c156d644391b3e0e1a0451f3102a44
- MD5 SHA1 SHA512
pam/dpkg/alternatives/cpp
- SHA256 02cfbe7e905971b53c973ff3533e569c3f84ff5a699afeb6082ac8b0ef8bce7c
- MD5 e99a3a5f8ff9d3967d323a7c4dd8b71d
- SHA1 499dbf5482ff426a939e3b6ce0fb216590a0fa78
- SHA512 08fd8dc8d8b93751aa774b501809b2798cd34f54175b3fd7a2f901471ce22bbc7f9b5553939e14ce6299a2f9265581e9bbe427f939a579556e63f99f892cde7d
- MD5 SHA1 SHA512
pam/dpkg/alternatives/default-GM.sf2
- SHA256 a940f54a7b49f45bf8a2af8c8e852530ccea8ff18ad9bb363c47673ef7cf6d32
- MD5 d5d5d52904e0013d8bf568ffa6e489bd
- SHA1 73f1cfa682827be2eb48461dc0fb03565a922c28
- SHA512 7be5fed385654cfad688a1e846cfda97513e65bf0f3e12b474acb1ee6b2688bcc76657af31aa946ab6dd3697443b8d7ee30e7605f95a0d964cd8332d51460ae7
- TLSH T109A00274E301D5FDC41157B55541178E5B5526D54514F71160901000957411F4117F08
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/default-GM.sf3
- SHA256 a6115297655494305d08ff52d3c79c9ae501056e6d5341736d53caf0466e37bd
- MD5 e6aa10b54d71c8ee19fbb36012786c20
- SHA1 4f232601965c18a92645e07faa5fb1c41caf2258
- SHA512 8177d0c5b2f57362619bf0bfff6b95c61458ded3950b75316968efb6d3a5ca7d2a6d7584e2663eb5117f4d3662a88ea8bf4dff3c3f9d02977bac809bde555d81
- TLSH T163A001B8E7218AFEC8119BB5A542138B5BA526EA8A24FB11A0901000A56821F822BF48
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/ebtables
- SHA256 c6ef9257800a9545077b6f5966c850ec89897e23bd5661cb04056d4c8daaf9ba
- MD5 828843e16a408250d344cf7905f49dfe
- SHA1 c0a4496a6a39cbef2c53fe8d7555e09419243b37
- SHA512 3db2a6f461bbfd5e87d9c2009ddf305cac1e7ca1f5148e6d6aa7e85c9166a4edace793709fedf61c9fea7303ba2f11ce3cc8f1414a1fa33de369d358aa4854ee
- TLSH T175C0C5700712B230CE12F87922200AB198A93BDA42A4B030D4675819C08C42C031FC1E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/editor
- SHA256 8090055979635af47c2646d89c0495fd055430e238e0754e63c61b0e7182f161
- MD5 6ca9882841ef0c11230264e85b45eac9
- SHA1 d40cf416c933a27f251a981dbc00b67d3132e9ad
- SHA512 7626fad4cee1ba4505dc44d5704bf990ded00fea02fbc8a139d5744b5a64c0cf0815a8b6332a6f159a9876afeaa5b1133faa550776c8fe447d4c6ac93ba393b2
- TLSH T16A011A2EF2D4D0F9AE80ECBBA963C3941B89F2E9F454E85490F02943940318C431FF6A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/ex
- SHA256 87aa6bbf8524ff8fe6d6b4184b7b8814be03fdb003c01bbb4d28f76a5bbf9902
- MD5 17407a4bb1cebf29c6f9b2609d10994c
- SHA1 668189073e924a543486686081affa8856d0ac5a
- SHA512 3b1f9107aeb0850b8ab80545b1387d99cf29c617871c055f02c59667e71654af33a6725d0dce4b6d27d1075b911f0c60a2b25c8afc5ec9980511cb6aa4624d0d
- TLSH T184F01424F1E8C2F9AFC0FCFA2967C6941B8DF2E93588A84490F52107C812248031FF5A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/f77
- SHA256 cfffba8cc157ea28edfb73be93dc5651f5e4cdb734df19fcbe35a29ed51283f0
- MD5 934620eb19062e8c543607d9d7caa81d
- SHA1 ee9442363f82c6264287ec98ff222da6edb8d342
- SHA512 a79998798d79a7357d6c7a69e459f2a953520acbbdec120fca7a965cfd78b1827b4a607727cce2b82a2a31c6f888dda2042ee7bef834c8853b71146d49a269bf
- MD5 SHA1 SHA512
pam/dpkg/alternatives/f95
- SHA256 3cf032875ddb29faf9f040600ec2e67d2555f92f70ad9c091efab58b4acaf677
- MD5 1644f138839ab6c376be3f0b8860a813
- SHA1 30c7b4b65b1623ece742a740742cd94a20c3d049
- SHA512 d9b7b795ca90f6b04ce6e8aff9550b19c161d76ec029da4581f8a281782489764f031a3abc7def3e8dbe442d07bd8fd4c98c934b7d33eb9e041e9d7f16440181
- MD5 SHA1 SHA512
pam/dpkg/alternatives/fakeroot
- SHA256 1c19acbeb5b6291b8a2b9fdab4c7fd766ceb76e1e8c9921a3bbc66f2f42b8153
- MD5 cb7c2fadd52816b336350e042e553687
- SHA1 5c6e0f41ae84e7a23729f1fbad419aebeedba92e
- SHA512 ed6e8412e8ab45263ef16205289b898c04dc7757b6967e8395043b65d7ffbac15964c3bb95f76872145bda866ed21f0b249123c791f2ee7c9dbde15b1d548d5c
- TLSH T1EA112F35B4D6D4F9AEC1ECFA6053C2405BA8B6F4F049B910E2F861DB9C29A48430F80E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/figlet
- SHA256 e71fed471cc73091934f184c4f4dc90a323cfa801f63e2a27a1cb790e52974a4
- MD5 06eb002a3cbb5702e94f8f029b7ffbf7
- SHA1 959ce989b0d7c40bba5929d4d69519f3916a7bd6
- SHA512 8f33985ed9ff7e6e612f9f49a4cd5398749d718473d573a228dc67dacb3ca993c23a57936ae22ded35fe4c9b5f751c7f1f654cc11a7519f4f354b4226a824262
- TLSH T1FCC00260F7D441B4ED926CBAD061EBF55A9AFBA43841BB90C1E0101FE21E5E8130B99E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/grape
- SHA256 6424c02641dced13b0f4e7132485a4d118a117c7b504e7a38eb5f47d2045b77e
- MD5 0e852c68e871f3f23ac316cba8dab17f
- SHA1 db829fdee7a31e2eb955267911dcaef036cd0649
- SHA512 5208dbc23f90909170572809f8c7e641d6e2092088b58bc410aeaa38e279d8ce4625a672f3e57c75e295930243dce6ec698f34021c27e715999efb4c109900b9
- TLSH T1E5C04C22F0C889F4ED91DDB6119785978795F4EC3800B48D82E0C03EE504148D61BB2B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/groovy
- SHA256 29497704ea7cba29d5b1848156197b2e9798e545facdbc41ec69e88371c89acb
- MD5 95d62310ccede1f1f4d92c607156b92d
- SHA1 9c3e217831d9936ac515e9a404b344b0a71a1fa2
- SHA512 561e458c8f49f854b0e52578f7ca646817346331118212cdaba7959709cb771589c5883da423b6302c469b61ed221a7bf23365bd6e101b1ba4bb018588895655
- TLSH T1D8C0082370E8CCF8EDA1EEB961BFCBE58799B1F87C41B565C8A05012D1511E8D60B91E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/groovyConsole
- SHA256 aa56199531bf615793937494bfe777874242bde4def4a605c0d7f86bd8e240fe
- MD5 0c0fd6a561e503e22479809ec91016da
- SHA1 0e7571f1fb9d5cc6756fed9123b0c8665999713c
- SHA512 1ba6272df213955f41d91fb8dc446d25f25f511608c16104873c6b3f394c11cda067e351064b9be047d50b159c4d364b4e9b98b067364fdec12d1603bd7b060c
- TLSH T101A0017369C84CB4EC4049A918EA8610C3DB2CF00800B91660A04028D1973C8A60750A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/groovyc
- SHA256 78d941bd1aea4f89487d9a852db9c42e1c6eb31cd16221a33420332010baa401
- MD5 a02cebaee98655f0f0faff32b5cece3a
- SHA1 3a032d19ff35e0d3364acf73d4bb63bfe51e80e1
- SHA512 3977c51f6e54d33d072c484136d274069c09c24ad4f4739131268daa50fbb175ab3c804a06eb9632fd348ad27cdf1e847c42898cc6f7da3042e8bb2fa022941e
- TLSH T171C04C2370C48CF4EE91DDB751BFC595479470F8B801B43440A15016D5011D8D60FC5D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/groovydoc
- SHA256 55b916ec77963471ad111e25436320e8362448a50875dc074d777aaa3a6ad052
- MD5 1e79bc98841bf2348388476b4741b365
- SHA1 d0880461fba08fd088ca76c459efca2467540e2c
- SHA512 74f3b9bed927c3cb4ce8a1c9a2d8b92bcef5c865308d97c8ec7df447447ccc47065ce71e6130f1dd996c5e38ded4ee2076c5032ceb39825b5068fdda32c67385
- TLSH T1A9A0023360C84CF4CC42AD7630FEC710839130B20C00B75550DC4020E1176D8E60690E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/groovysh
- SHA256 ffee79667ce6732d941115a86f7e03be1bf8586d685671ee44fcaefa230a3e0c
- MD5 0ba904b306f8514dc74501a3a72ff0c3
- SHA1 8b6fac0fd7f68e44af88e43586d956ac1405d9b6
- SHA512 bbc6a570e7ed549f1a20f98e85ddbe7438dac4d582ff3b11ef542ef3da3cb978f9dfd3fb7ac33bd4bda8513ef0058d673ecbed42ff41d9907b91454eee086403
- TLSH T17BA0023360C84CF4CD40497392FEC7908393B0B01E00F51540914024D5562C8E70651E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/ip6tables
- SHA256 c2f37f6d19041249fe68436b15d9c98b5192c6c233d4cfbb2607e5e094248295
- MD5 b9a880c85d87f229d8d5b600cd5238f3
- SHA1 4ded9d6a1049d7a1623824087ba3d0c5197a9ac4
- SHA512 e7d7842c8964f255df9beb9eb8a074b40acbf1b116e99833db3ada48834dab4b40677f2bb8f61e20016eb4e27d84f819e187cf6efd6702c9b3d908bb0de8eddc
- TLSH T1CEE07EB1A721B4A0DCB3FC7A14240951D88A3AD242A8B070D86EAA1BD48E85C761ED19
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/iptables
- SHA256 99e3061f761cb5b240f6f1a5de6dc3b70426395295d687079ad2bfc18cb616be
- MD5 712d71e178044fc778393c3adc6132a5
- SHA1 8d68fa0fc469b3321102dc91ea6d1bfe40bc5df6
- SHA512 f12cf4f0de2a7ced04c92cb7ce1121e02791ad671f8d101d38f904e82c0041ab5140efe56c123c87f20f639e6c8349bc2c83db0ca4737c6d980b42f21567e790
- TLSH T102D094B14721F478DCDAFC7A1424095198CB3BD143A8B070D8679219D49CC5C5717D19
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jaotc
- SHA256 a9ec4397bf53da255fb93f76c444e4bf715196ad567e7c8243a8b7731e228cbe
- MD5 8a26fcb3dee81f60ac0c46b1d4b8d575
- SHA1 223b7d3826e6f3e2edd5ac7ecffa118a5770ea34
- SHA512 87749f83cf651f3e878749d70ac873c8eebd8cd4d05c4cb6ade170ebd208557f890c7687ca182562a527905ff53fff647d26d4e20ab296f62cf7b58b7cfb383d
- TLSH T15EA00239FD184574DC1428B51964567C554200212D527551119475C5F3719DE330091E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jar
- SHA256 403b74643f4e6da8e83e7c98dd286182858f1daeb69b9d39607e637b33c6bc64
- MD5 fd5d5c4a7d99137d402a2f2aa836a15e
- SHA1 4e1301e9e3f1b0a614b14de9ea125386dbfa0b29
- SHA512 c76a394adea6ad6af3a30f9f6da37c654b46d1af1873f0c46a6ac4ef057e66c4ae2fb6b90495e15132358d3749b7617de20bab344e352d2f6be6d3ba9b9105bd
- TLSH T11ED09E34F58989F4ED54BCF6191782AC6B8561653858F900506862C3E971D6EE20BC1E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jarsigner
- SHA256 32f88a0f03de9a5f5cb7e2c8e0bc946e656adeadc1930bb391da9cbcfad4208a
- MD5 77a850316ef7e1c817c92e44ed74cc67
- SHA1 af958cf605f0605f7448af181e2106fb8f950923
- SHA512 274c00428dd5b3461df262cde074a763194be6299be6996d710512fdf64762e4e90b3d281ce64d0e944bce0350907997f53181af5e6a48a5ae86753ad7c40fdc
- TLSH T180C0C9A4B74D84B4EC7A7CF99D1182AC4A4990D1B490B64040A690C7E17086FE30EC0E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/java
- SHA256 48581f6aadbad37f3be0aec69bac6299b9520381fdf10786e35573b95bdb80cf
- MD5 f62f9ce214f244627f1937bcf11d5cf7
- SHA1 a3f1a0e053922c926054ca4d376a1198c25907b6
- SHA512 2546485cdcd0869a1bb218e8440d6f4c277e4f9afbbcd52b1d53a7f4716555be4ea7eb40116c1fe6a94e8b36c7f405465b1fc0fe3aaa6b56c18aa17ddc024341
- TLSH T1FFC0123EF54884F4EC647CF51911C2BC6A4650343410B580402550D2F174C9D2206D0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/java2groovy
- SHA256 ec1bfa43271a7b1fc7bb21b04ca2c0da87f21970ca5f96c9df78c36ea85e91ac
- MD5 ce0bf72a31f5dab6df233c7584d5dd11
- SHA1 b90ae1983d0ff2783eb4e11afc3f7f3ddc208aed
- SHA512 b2a0d74f9e501245385ccb2d5eb90f2ce43a6863b94665bf86e8f5391ecc42ac65016716d596b02542c713604536b85cbda662ee0d82cd90b9ad85c34df07e31
- TLSH T12FA00233E1C88C74DC804973103EC7F0829110B01C08B51440904280F156AFA660650C
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/javac
- SHA256 ae02091935bd388ad60b2602df25bcb1a2e4f7a83bc56de46076535e56b05722
- MD5 ff68c13e8c2a384b4a7ccec195b3cdc9
- SHA1 d02090062a7eafd873e475291e0e4cc9b48eb426
- SHA512 8e5c510edfef2d7fdcdcf8a7f0e4cd5df9f299dd13c90d7bfcade7e23554b15488ad53bd9984039cfff7806fca3c159e9805d69883060993ae9192414d521525
- TLSH T1FBC01238F54885B4ED647CF71955C7BC5A4650343611B500403D61D6F570C7D220EC4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/javadoc
- SHA256 530d417fa7b05ca7fdda52432a5f5166a4437829bc2e00d720c0d5b80aaadac9
- MD5 2497cf0e7f151c1eaf888c60e5b1a20b
- SHA1 ab43839aef69c368d4492f89a385949aaa036dbf
- SHA512 20c4677c67ed624e98aaa2074e94fb5bc2d2daee5baa64bc42aafcc0213f93f0d6c6a8994909e7dfb6cbdbf8d06019feb481294be45a6e1122ca21e646b198b4
- TLSH T1B1C01237F54884B4EC647CFB5A11C6BCEA8690347410B583403F60C6F970C5F6286C0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/javap
- SHA256 19afb64761d00945649fe49be86a47e96a25b44d905bc31c1754078dc809c8e2
- MD5 05bdd72971c9b852274e827c2bbd4c27
- SHA1 31ecf2092b25ca7d085550013a27464fe19b479d
- SHA512 383728b359afed0acad0392a5f3e52a218079d1496f859911b0e409e1ad31413a2014229f7941ff14a41cff64577cabf6754c4ea696c85fa86a7d581fba4741d
- TLSH T117C01238F54885F4ECA47CF51911C3AC7F4550343411B500402C51C3F171C6D2226D4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jcmd
- SHA256 8172558bb70fecec52bae37a3ea079779dffd4ca47ff4460f8800c0d8069ee52
- MD5 8cd6fe2afdf063a5337b8914a58feeb0
- SHA1 e13612d0bc8485db6f77aafcc0b4c97a4072733f
- SHA512 ab1661c2a744b6b5bf7c2d53f7e9b4898614c8c8eb874c1d6961024e26af5ea4ce740f4676948edabb22a84746c186b01b8930bb418e5b4e1186ebbfa0c50f20
- TLSH T13BC01238B54C99B8ED647CF91A01825C4E49501134107510202470C2D17086D2306C0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jconsole
- SHA256 dccd36cd579dea5610bffb1c00b4919a4816e973a7f512737f164a0e53d9b83f
- MD5 49ddfdfc4bcd5c0013989249d243b459
- SHA1 d439c8b7ee7215586e1730ecd7558aa5243a71ac
- SHA512 155fc5fd61c1e04684762b59b04ca67af1ac02de66fb1902041c8aa78225d61c1c39aeccee3d262f85cb16f207fc13b034a00a488c34e715ab4fb17a304ed8fa
- TLSH T179C01234BDC885B8EC64BCF91E01825EAA895C103410F51030B450DED2F8CDD3216E1B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jdb
- SHA256 f80ad87b5fde22d1daba3435e5eaa94e042de2113b349179c8002f5f0cec3271
- MD5 d15494d83e0298f5847a3e410f6cd9cc
- SHA1 2de3ef4bb198ed83e1e4057bb54193c55ef575c1
- SHA512 a128e4bd4885499fd2a2a01ce66d09f13eb6faec7e521585780e3989aaa015c62fa7077fe478db22c710d42bda398634c77a992b58f7442d25d2cbe01e32e530
- TLSH T194C01274B988C8F6EC64BCFA9A0182EC4A86601035B0B9000068A9C2D1709AE2206C0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jdeprscan
- SHA256 93abee8c31b3e89ad31ca5aa102890a278aa25a67cdf657c370a838971441f7a
- MD5 8ee8d0eca725d5685efe0fb82d52f5f1
- SHA1 5c3687a6f00e64e32f495c29691d9a7d9d7a3e0d
- SHA512 2141991930c7530e0f5b73d5e2cef0aac42726c97307c861312687e4fd790bd37bd0e398f7cacf28f795df6ea26df6cf79e07dc45bc84bb2edeb19f5e2a21e3b
- TLSH T13AA00235971C4574DC142CB51954665C55C500115A51F9619158B8C3D771DDF751094F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jdeps
- SHA256 92d7b57e0325061cc3f96de3d7cc3fa6cf98214630f1074d80e28e5154d3f4c7
- MD5 6c5693e73b236d828fcd154a2096f96a
- SHA1 58449762b28723b618daae016efec685fc282576
- SHA512 8c7997d635f376e10928b90930293a6f325ac35ba927a4748cd4187a63edc1e082690b54ed7f9aa2a7d2ce2e8fd878fae5339c6b40803610e056347ceb5c3d45
- TLSH T190C01234B549C4B4EC747CF55A21C6DC4BC564183410B5500234B4C2E170C5D2206C4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jexec
- SHA256 ee9d58396327aceef0dc590aa186eecb6e3c7a8ffae570d5ad74ef04c38afe0f
- MD5 172d2709b6ca3cdf9a0bcb2ac72bfbbf
- SHA1 cb53331b9cc5e28c2baa1c92cb10e4d17f709f3c
- SHA512 00b279c84085a70403c9fe32f499df02756faec40014cae222a0619e0742b4a8cfc5859e6ed030c79777d3efa7381e3a5a93b2e3f22652ad42e3830a0b478e60
- TLSH T1B5C08C31EA0C4ABAFC283CFA2EC0072D4B8300212820F540214824C0F5B0CAE6222D0F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jfr
- SHA256 eba3d1efaedb78db23aa49c0e14b2027006d7baa6315c799669f276b079c377d
- MD5 1ec630f10df9ce1d5bebc96019fbc8d5
- SHA1 dc250f99ca30ab6bbb8494775d470c831cb1b28f
- SHA512 baf84a8dd6333d286ac542a0c5b711bb95a468a18c549339bf53f7fe4b227cfdade89570025eeb7d437ebb381b888f1d691e40190777f1346889895776e7f625
- TLSH T13EA00239EA1C4974DC2C3CF61E54931C9AC200595DA1FA511154B8C6E278EEFB200D0F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jhsdb
- SHA256 957d59515d89082e907b7e7a220de1e17a160181aeff33a75b48124915971199
- MD5 7780c188e583b8346f0221c8c9c5c934
- SHA1 f7e7755fc27ba7d256962895105834bd8c35162d
- SHA512 3cb3fc10a6cd00b2aa9cb78b9f9ef5d585f51b45e33b2d66eb7dc15d02f810e49fc10afb61803e8dc607dbf0db7e4224660948b930d598409e2a746c585e45e3
- TLSH T15AA001FBAA594AB8DC2428B61F54926CAAC240219962BA611154A4C1E270BAF3300A0A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jimage
- SHA256 45bc52628459012cb9baa4b78f19c04ed3e8a629769cb83853d80ba692f68c89
- MD5 c7836c476976cffd0c874e635e2490f7
- SHA1 a74e3367d2582c6778039c721e1168157ada7841
- SHA512 5ff61781c00cb254c86d3553c2b734e6aa1cec2d621a6dfb850fa4988df68b7bda2ffd063414a055f3654adeabdf717c4f6985f7e81ce8a8dc6cba7808efd519
- TLSH T186A01138AA080A32CCA02CF22E2A0A0C8A8280080C20FB000000A0C0E330AAE32A0C2B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jinfo
- SHA256 cfa82f79879d8936fe1c80003684f6a37c03169afaae7e2e274debe68578ac89
- MD5 18db30eba76c4d8bbd451e1440941cfe
- SHA1 30e60c631c5fd8c75e222059cb3b55bddc91afd7
- SHA512 ba76832645d2ea5c00b6bc6e927c53ed522f217a1183744b20ff9859cfd8f9227a8930992e20a78c3ab4dfc17b20f462202d01370cedfd4c5974b37d2245fa9d
- TLSH T1CCC01234F54884FEECE47CF91913825C5E45D0943C30F680242450D6F17085D2206C1B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jjs
- SHA256 6e36a5632c8b927dfe7e33be53850f703862eb13d3c4004894fdc0cece0fcb7d
- MD5 cdd553de6e8399f920ff9e367fc81091
- SHA1 b343b943cc3550bdc879f3167520d3967d2b0395
- SHA512 1948239a93816a6305751a891012af7a71e0b679dfe5863285e3b9171601f20be372ec6685d4628cd9ec20bddb5a20e1fcdd62af1eff4fc2989d1146a2f27681
- TLSH T103C01234B54884F4EC647CF5690582BC4A49D95535107520022850C2D57087D2206E3B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jlink
- SHA256 3201cebfe24375dafef50937ca2ca8b172dcc9b3525b539f44b5aabb7f9e06ef
- MD5 9407272933e95e0d8fd27c724871668f
- SHA1 af46f90642f853d1f8a83fd32ccbed2ab0975262
- SHA512 9e404a4a2c01fe40d413040b9b0d6b9ed32cd19dc4f904a4ead0368cf5793a5828c57099dc674b56afb29f5a3703054bb3944fc0bad9653064c574b5fcad3b14
- TLSH T1F9A0123695081438CC302CB94990020CC5C100202A107500414060C0D1309BEB300E0A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jmap
- SHA256 97a239ae5d44898ac4c273b7c63ea279a4c7253d5ccc8d15c34b76a42bb8dd97
- MD5 cdfb50cb7d0594c70c0c48ef0356a2fd
- SHA1 eb7f400a865fb4ecdcb8b884b8fd8f99982e3e69
- SHA512 771f073186dd576631e937eefc2165300a8f1d8bf40d24c12924cb50fcebb690fbea8240eb96fa573b7f976c6ed8e6dd28527fd7a54cb1f2720a0c00dc5dc340
- TLSH T1BCC01234F98889B4ECA4BDFA1B0182EC5BA660103422BB40002C60CBD174CAE221AC0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jmod
- SHA256 8b4d751fc391a639c9d21e66414b5ca1d1b0c81a112a8f5af1c7c00201363d96
- MD5 7287574435b19637adc5058a3c65c41c
- SHA1 017e105eb9d964d0105ae897e19eff438ae00f79
- SHA512 104b66e859b1c53678794fe4c54af60a37ed6638b14cd0e60c8968d7e161c1ad16b3217e4559c8180cc34ca56798f7661756b9d888991b00d6a14df4d52864a4
- TLSH T11EA00179AEAC8D74DC2428BA2A54922CDA8200111961BA521154F4C1EA70AEE720890B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jps
- SHA256 bf76f90694ead800ccaa5854903f15b6b1dc21c688b0fc710570cb75bcabc6b9
- MD5 b2513c5f30b14bb46541fddc7ce3c279
- SHA1 10d13bef50a5f464c14dc306f03bdaacf8a304c4
- SHA512 c4948a0a069a6a18d0446733ca3001598c097a6a0a3c4f92a61bca4a7a3737c6a04a6f0869cb49f74d5725c68e5af8a7b016c532297c4d6915c74243aea76e32
- TLSH T1A1C01276B94884F4EC64BCF55D0582FC4A45581836107520022460C2D17095D2206C0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jrunscript
- SHA256 40fc59b243af82789145d304c611fa6a65033410e4471124f7d56831e6a51459
- MD5 c531554fae00d3c8f6b0ad77ebbbb1a9
- SHA1 7f477c8379e29cd279c8ca63d6aa5c85e090458b
- SHA512 58abdb3f9ebbc6c0c14e71b8bd36189653775faf5da6547d017ddb33c50476f4b8511239ac6b3630351401e51fa87c1a3e8d527386bfa0910a4910540aa155eb
- TLSH T174C0923CAD48C8B4EC6478BD1AF1C35E6B4952283420F58241B49093D160AF92A86C0A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jshell
- SHA256 2f05ce6fb85d5b55c14f7c8c430a01abacf71df348c2fc5a4257b721e0079df0
- MD5 2d49b2d5c3b98c4d99ed749c4743da43
- SHA1 25afe14fd5d3301fd7d1b49aa0704a440926c68e
- SHA512 0b9bf536741f9440692942d41c51f499ab18c196d213a0ae28cf7052c443e973469cfc7fe10b9e3954d65bc90abedcffad270e673b97afdfc66125ee5f70360a
- TLSH T1D0A0023995284D7EED5828B5295C921CD64105111D717551129465C1E170D9E310190A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jstack
- SHA256 63f2680171a55c8b73b79ae809f6a0d4205de16bfba23f6a6b23250c939dac20
- MD5 f6cc698a659c959720e6e9bf768f3deb
- SHA1 136954c39f97f2e79b3ee33c62dd5d9c66773808
- SHA512 1e2bb39d06779f0f9a791c9aee748603448de69728e05cac62138f747dd6d5786fdb281e73c2906887e4baf483dce53762d3bfa7dcfa9e2fc6606c2d4cb0e6df
- TLSH T1D8C01234B54A88F6FC647CF529C9825C4BCD50103430751021AC50D2F1708DD2606C4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jstat
- SHA256 978b208354860138aeca74097b392acc106a7672227beee6baaafb9d3ea2896a
- MD5 ce68425223b11fe41c290c2842b59329
- SHA1 363223af7663ecef0a14be4b07fce9306dcc120e
- SHA512 0a3070311905bf8eade9d3b8fd98a50fa8f746d48b778e6c48f3d6bb84cf8944710f1c03ac5e63becb0a2dca0974dc4c8c28cf75b993d8d87b30ede4c74addc7
- TLSH T160C01234B54889F7EC647CFD2D0D827E5A4550303450B500006950C2F170CDEA20EC0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/jstatd
- SHA256 0456156192d2d68e6e46310533295c1f988caa2022bdfaf280041c038a9a5b30
- MD5 068dedf620b2eccf0f626839cb7ef245
- SHA1 1126514f546914fc394b4d5799d3db550542e276
- SHA512 5e9a9cd2b97aba02e8bb0dc332190e04cc4ffced08c5f954c15b3d77da9803bf8eed3a6ca2f19efba1d4cea3b1befd8d03ceeac4d2fdb1f55978b789b254ce01
- TLSH T166C01234B548BCF7EC6C7CF52909827C4AC5507034527A00A024F0E2F1708DDA31EC0B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/keytool
- SHA256 228a985e0da92a074f984969eed6f4d09472af62ed342ee56f728adcbc3b8f01
- MD5 1652dc714413195428f341b2a8014d06
- SHA1 8dcbf19b6a26a67a2386463a7cce966b2c30496d
- SHA512 ca6d30361cb1de8fe8247e5b76093f396d20237e622f59be5dd314666164d79e41898b891e434c51a6312eedfec667161931c2b19a1fb89e4fea63dca31ad093
- TLSH T1BBC012B4F56A84B4ECE67CF51F018A9ECB85E0D07811764080A650E2E17CE9C3306E2B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/libblas.so.3-x86_64-linux-gnu
- SHA256 7db294f4e3cc0fac150b8c58484c73aa76bb780c6a9c1e71a1b8a001e680493d
- MD5 165077cffdaebcbf4e1c1cf8287c4b8b
- SHA1 1ccee483328c112db63a8edc51db8fb7c8102077
- SHA512 af7bf9f6521bbd3e92b5ec662e30ab56d036295ee942aa06ae6d2e9e32bde60f66b254f87384035c65656c451beb8ae0402ef65737511a23b3e5745cf106d348
- TLSH T1F4B00265078DD52079F57C7D1138164DC1F015D4C544FD30E45916A594116995605DB4
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/liblapack.so.3-x86_64-linux-gnu
- SHA256 f6a0624c9ddf78ac7b47fa5063420ae9b34384e7768cd6830841977f567e8913
- MD5 7827cdc583ca3d6f4d5b78007a8196ee
- SHA1 37c4658ce7e4d0029d3677988eb3fd53ab3aa1d0
- SHA512 5bef6f0b117027a7da0810895d5cab20d1084477c8278884bbe0cf2c66a37140326061d89637446c090dcc04f680b61240a3391f69c603efb1a3633f48c88d87
- TLSH T192B0026607CDD110BBF13F560119154CC1F815D449457DB4A05D157995115F92615EF4
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/libpsm_infinipath.so.1
- SHA256 98b3050ae5e5f7c3638a40888808adba2279fea4b60cc2a594b41df02a57b0ff
- MD5 f844ca99a30c5b8d4b2c20ce432c2e7c
- SHA1 c6a789e3a0d8b792c4c372d8988b4767a26e1d55
- SHA512 8946c0ce8a1103d60af1643ae0251b9a2bb69582f9544a17129929ed6d5952bd604ea4f4e0cbf9ba3b8736429daac234ccf2d72ec013f34ee8b134eda2471f59
- TLSH T107B012681F8E41377116BEF000400128C6B418F4960DBC3020F80AC88002E4C330EDFC
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/locate
- SHA256 9ef0db8392f9235c50f73469d83293a28a857ff223635eaf1bbdb1f4c3bc99b9
- MD5 1f532956d7c97fda55d990250cd61303
- SHA1 fc9be3afd143c6127ee5a537f67a101e07bf35db
- SHA512 674cd1fee07e88a00814b48ff12ec2a80ec4c4dd94ddf7b6d317d63404168776b4c9182a51a262bdf4d084d0dbd69097c6afeb66f01d55773bd42d7c9a308df6
- TLSH T1C1D06771B094E1B4EE60ACF29C4263D4969DB5943842FD0285F39126D1107BE2B1F92E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/lzma
- SHA256 3cd6dc08374d2438ffca146f782633566125368cde29697ed8464f389dda945e
- MD5 97d62a1d3e296f1533285bcdfca22448
- SHA1 d40816dd3fa0fb67fc7e638ebf5ce0eb0beb37cd
- SHA512 333d1d90db6729c13bb64d3ab0530e683ca78f9e19954981ac80c8ea97fd572de6ca5d2c7146dce1c5fadc979eff20e548a7b126b2f35a02522ff192c0a55e88
- TLSH T173219261F4C9C9F8FED4ECBB612287A69AC8B2E47961F94094F56407D048299530FC2E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/mpi
- SHA256 49a3d2bc54c2e4666d7708a0ecc24c69490f995d08b1baa1b083801b3d7d8a2f
- MD5 2e36aa238bebd08aa1b8349065237211
- SHA1 06f7a6fed04f5baeaf673fc9c431e21574667178
- SHA512 abb86154a778bd767b779dd460c28cc42540e30e201979e8803b6959f1e10013231307927dcf8f59d1c246e099e73c1aa541d5cb3bb8c98419e4c3144fe2abd3
- TLSH T1B0118629F0C584F9EED0ECBAA147C2A107C8F1ED3890BE0195E82593954165B271FC6D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/mpi-x86_64-linux-gnu
- SHA256 3228b48ef5a29a55a440b158a8cf04ec4938dda1612fd8fc5f4dd9f35b293e83
- MD5 85cf215d461a9d81a965cfd1377adfc4
- SHA1 1babb022fe1abccf61308f48343747eb4427cb9c
- SHA512 c4b1314e5545504be9aca1cc73682564710c6520a4ce6b26bcf12571137436486da84e1536ab2d4128ddf7f00611f84faaa1f43df0285d0c15624c44ee510807
- TLSH T174014C0B43DCF656BBE13C20523D629DD8B061E992417C34E09E5BB8D45376B4A0ACB8
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/mpirun
- SHA256 7da21bd927851ff7934e35feefab7e5d81dd655f490b78d2d25ee7db42843f75
- MD5 cb254ed8ad234eb553ac167f126125d7
- SHA1 6684d45cb8bf72490857f037c985870136b11a82
- SHA512 f964ace60cb808f83b9ff897cd76dbb8222e4da4581a8b31ca0689f3395a3a2563cba8805f5e5b5e64cb0a2033a21e947fe55bdb23cba395b3cd7e01847c3777
- TLSH T192D04225F1E880F5ED80DCB7558683A00BCBE1FD3450BE8C61B169A7C91556A530B86D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfconsole
- SHA256 b55936b54904ccd8f1427ceb6f97217b850ecd90749d766e8fc4dff19778625d
- MD5 0f99732e80856386e011a6a26a08d120
- SHA1 435e6833559697940b33a7cb61ee8b8d5f9edb83
- SHA512 db1d1376225945449bf86e62ca12ac4dbdc661219502c99fd71c6c03107d3a9811c5ce3324781341d1ecf758b1b058e7ea0fd6503480757a4740707a4e149f74
- TLSH T1F0A001BA68A844F6DE204EA968950300C6C51DA17800F625B1A8012DD4E49A8921768F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfd
- SHA256 8604cc81a7c057a9a727b2cb3eae9e4c434dc05bbad876497c43e8854540cf73
- MD5 b0b7fd5956dc6fe11482f0085cffeb8f
- SHA1 8c0a4b50675b5af4c1a4f1b5ec61855a966147a0
- SHA512 761a19a8f3ac06af25b208b4e32a497017aea5ba795fc6020714863a4991852cdd61415d69a94bb957b006b6dbaf472d9c19314ea3d05d86f08a9d55b9b76570
- TLSH T1BAA0027A707894F5DA204DB175B5039086C014936C00F5B18098112DD4B49FC521778F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfdb
- SHA256 894292e5aaa307f69195a72b007c249aa6296ec06ae9bc6b6224905e5057956c
- MD5 6a11c0be9b30ce8b0fb7afbad3f1ac2f
- SHA1 466fbc3f3eafab2e709e9662764cf8f2ba9e1720
- SHA512 c6d70d68e956a30df667c46371281564834b56283a299f8753f2dd41122aa78646d6c037ba8bceb400fde7dfad2f9da405632f7b36f2dce632a22305bbf0ca8d
- TLSH T1E6A002FA713C44F9DA204DF179BD038096C054B36C00F53181A4422DD4B49ED523779F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfrpc
- SHA256 75a432d80659c6de917ab28dcf10ebafd1940aee85a4e31200bf22d21e0ebeb1
- MD5 d6caf0281ef133437b349fde0b82324c
- SHA1 8f17de50a38859c91b3520141b2387e40e443f7a
- SHA512 b97047c00864029929e3fd7ed9e8cc0c2e4b2884e8eaa3cbc293b618bdb50faf98696a5a05d28c7d5d72b5f6096c1c60ae61d68a678f11fe6df94ebcb65c2568
- TLSH T15EA0016E632844E5DE20DEA276959301AA8814D96800B52194940229D6A49A862176AE
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfrpcd
- SHA256 5c1e37a096e7275aec5da4a550846975626fa8468b471babf8cfe71b30dbd98c
- MD5 ca7100cd28e11c383a305486b7b91aea
- SHA1 937b53383097bb1e2617b82dea3ba55a6d6b3b50
- SHA512 40b87d8806541027c186939127eec59ee9e1bdbf32781d8b7abb3e69254e1a30433a2b1068208719315ac08994630b56d198c2f647ca4b2ca46af246d8cc796e
- TLSH T18BA0112E222880F0EA208CA032802300AA8800C82A00B820C880002AC2B28AC228328E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfupdate
- SHA256 ac1a32cfbbddeaa15d51688d9b4b62f509f570462a15ec8d9ea79cbcf1b956cb
- MD5 7a9be8b113bbefab8e3327a2826d9aa1
- SHA1 c422c16b6d1dd4083117c577b9d6b0e839924a86
- SHA512 e600c0dbcc4ce0d0f9eccadbd37936672f2dfd738119632c152b2d9b41bd1e1b62d17da9a07bb777fc2ef4582e7461d622b6d0cdb92564d51f2ea8e73a1cf6d2
- TLSH T10BA002BAF03AE4F5DB314DB36499030186C114D16C21F66B90B6012DD6B6DEC5A5F78F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/msfvenom
- SHA256 949a8eb28770837572944d371c8a2373c648a23697db7034be74c68ab1eb960d
- MD5 c3f40c838799b73f985b03c740b02886
- SHA1 64b9d455a6d6364cb4946acba0cd6de19840249f
- SHA512 b995304d0c38616cc7d51b37422c06b1c2d2db9ff039e9befc4bf40387491ff8b93e3a2723382d15459f0f9f2b70d3c1e35756b039ca28c1c4bd0d678c392bd4
- TLSH T1E5A0016E602884E5EA244DB66B954300868014A96C02B5228299222DD8B6ABC6A1768F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/mt
- SHA256 69471cf3230d09eeb4264c97b7ab1195dc217a2db9bb21b2d47d0fd59bef82e8
- MD5 bd168eb77f8e587f0c7f9d87b8d66814
- SHA1 0e13ebeb65bb0f57a23241f2586e33ba67cafa3b
- SHA512 6bc868b1a91ac044b23a8e5dbfc697e243f65542b6e29611cd9f5873d5be1b5416757ffef1a5c7cd3cb0f8e34d4b72c28ae524b9fd04ae413f2cced9c53e0995
- TLSH T1ADB0022AB08485B8EED0DDB92942E1AA1789B1983B80796088641502D1145B4261B919
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/open
- SHA256 603b84096cfc3135ca11a22b1dc50880dd504d3b08a8d6b207351169501611bf
- MD5 fb28075f32924bf644d72613f2612090
- SHA1 5e1f7e693578255cb90d74c1ce2cd1bc77cee62b
- SHA512 c8b5d7d0df1ac82660f844ab6789a1026f725dfa1822fd53cfa4959a9c33249382971ff51551ec6aeb5c56cd4c7edcf8a342a5d23fee692ee18717c4b6c01ee2
- TLSH T1E7B00835F5A588F4EDD4ECF6344782A546C8B1E87842FD1142B42096D111B59B21B93F
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/pack200
- SHA256 17c87567b9eeb1790164093dc6d4f86ac8892c3768469af817c2be865b8eb0cd
- MD5 463bc81f579a9b1fbaed57d10f1cc84b
- SHA1 2de4281249cffd13e0add4a5fb4d98ae0bbc76e4
- SHA512 6bc020ef5627e14d2dc1d2541d8bc78485ab2dea5a11b89457d03da7b2d18089f4aa3f7d3bf492850706563be9f10a8f0904269ae1f0d17dc888e4493ff0b3d2
- TLSH T1F4C0C93AFE59C4B8FC687CFD1909869CEE4D509034167500603050C3D1708DC7206E2A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/pager
- SHA256 efb067c8704b11530e836705a78bbfdacbe298b9d13df3a01e1f84ca794747a9
- MD5 248acdfb5ec8dbfc37c7c905e5c3de1b
- SHA1 d9c83374fc56ea64c84226ec0de07857ac78ee9f
- SHA512 f95d1b99f67a3fe8501640ea9ab44d974edb4b7d5d1418ea58b69b0966c6630f61e4339c34fd06ab8575d79f7df1ddd9ddc7e2b7510338b44c5f0351a6183669
- TLSH T132C00260B0C8D4B4EFA5FCB6240282955A8CB1E47841F90595E0500FE510285676F92D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/phar
- SHA256 b8e0c312f5c29aeee543a7f3b1eed05f9abfff520a71f895a226671d2e438bb0
- MD5 7ad4563b6666e77e6437adb57c7742af
- SHA1 76eb3ac9a758cba19c8d15d6aff689b388c0d67e
- SHA512 abe917e9556c61907c106f3ed4dd1ada1a846896c766a51557d49d629ccd0c978025589ec5e821ffff51a82768b93dc8b5b4c4504c908182266a6e92bd7f5747
- TLSH T113B00230F0C4CCF9ED95EDBA2443C39A4FCDB2A47C16FE1454A41453D0105C9574B95E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/phar.phar
- SHA256 b5e1e5e3c94c61b54cc0b09631e6fa8dfcf7e3133a87c1110a1b6fab135c8140
- MD5 86dbbe56757f95e8b73fb1eceb4fa88e
- SHA1 89d3c24acf7571f1dc6dd802facc71b98a1aef97
- SHA512 ae4ec4e56896df9b5b021ca8810960ab7cc534fa9dfc441091abe06a42af8badd9666832e3735a3ed2e1d8c5796cf67f9c8234bfb9870a1d88b395a3ac47c7b8
- TLSH T1B2C00828B0C4CCBDED95BDBA2443839E4BCDA2AC7816FB1454AC1453D8105C9564B95E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/php
- SHA256 c92a36cbd7fa79c7449522c5a90209f74156f49969d8ba1803bd140ab11536e2
- MD5 9b6003e5fb950b68c6d2c19165a04a30
- SHA1 fc21a7a581b33a638060996494823eae6894c505
- SHA512 fa724157ed0eb11c7a4b78ab220c0847a229f528025ccadef200d77f0773c4b164a95f3118dab19d5e968f276a01b69c581d68b21319f30ce135852a86b171c0
- TLSH T154B00230B584F4F4EDD9FDF6650293995FC9B2987C12BD2054E41453D4B0149174B96E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/pico
- SHA256 20a1c88d43c53146d8ba90f261aeb27b25d0773b5440e9e3829127da9ca3e236
- MD5 b11e4900b3a333aed83f410f3f195de7
- SHA1 a4604dada576a6b4824f067122e1d8dadba8893c
- SHA512 fd1753a9cc17b0e10410ff464c157c4850d254f50a8b476d21b1f20e824a0f7b1c12e93668e4a663036e7c434b863363720f7cc0da7f837c2eaa8205c0294dfa
- TLSH T136B09230B088C4FAEFD0EDB9142282FA1E88B198784AB89080FC1103C0041081B0BB2D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/pinentry
- SHA256 0565fadf03128bc0c618f3ddafd5da42d80cc1f01dfd93c3f9dd68b293a38ce0
- MD5 34210069fb562e14c6a8b820706947d8
- SHA1 23af79e1f09866b7ffe33d7ce79768bc1f71e07f
- SHA512 ca0ed184ac02f6b288e91cb704b45b8906c21ad0a8c3b183537db994f27b2cfab455c36560c3a36aedc87eec3163d01109c517e95c5ee87324c1e6de0aea9632
- TLSH T17CC04CB8B3A8C2F5ED819EB7503246DE0E84A1963C8FB501C0E01607DCE0355267B6AD
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/postmaster.1.gz
- SHA256 0fae192028ce23877df6ef5f57328a593be340047d4ced16c5bd54af03d63c93
- MD5 ca618303e5193a4980af75a76f91f6f8
- SHA1 3701dc261679b233939ce60e7c52f853bd1a73f5
- SHA512 ffa63d3328e64a82c93205a0113ed75170db3d0ef72e43f4430c134dd17dd08886d2ae8f73f5e96d56a507ea28065f2df07a285af5da735faaa01a5dbfbe38bf
- TLSH T1D13199217AE0C0FEFDC0ECBB7027D2A00F88B5E9B546A90691F831539A94204631FD29
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/proxychains
- SHA256 ee024fb1ba1211d95a4d247ab8308bfdb4ac06b68186d53c65440fe4d6dfb88f
- MD5 bb833eaade222da5e99f0a5c8c9eb5de
- SHA1 81b1a246e855bc08fbcc68bc8a075cb4a3415ac0
- SHA512 db9dcc5875c2b53b3a5724f4916fc85908eb7569e697ce76bc8b00f02b85d23be711b5bacfa6bd42aeae9de11d7709ea345a987821d196b365ab091257835a19
- TLSH T125C04CE1F18CC4B7DDB9DCBD510343953FB86998F842B61851A30013E800148968FC1E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/psql.1.gz
- SHA256 775ab1189ea8cd7e70c2b23e35e8cdf97dd669ab6563080a50daa6612c6a9d45
- MD5 ab5297b0dfcedffc7e74cae25a3c9f9b
- SHA1 75c8ee6db9f11924d8d68740773b8af4270ab10d
- SHA512 ac122c8f35cb7dec45fa11b6a706e6f21b7dac2ab50e893a8fe62ba84e21af2095f6fcef7ee91a87b8a384b7e0ea51e1e48cc92660894e6e31f89309c5a11228
- SSDEEP 96:0LW9OP61fOdOSvwdwoxsWCBYHqpaZML8R93RZ3+3P09hG+NaI485oP4AX/kDtSYp:uPOOdO3wO57SaG4OdAl1
- TLSH T122A2E96476D0D4F9FE80AD36305315A04F8FF6EAB215B94280F06093AE51A59E39FD3E
- MD5 SHA1 SHA512 SSDEEP TLSH
pam/dpkg/alternatives/rcp
- SHA256 c9975fa4a222b42d470ec7386391dd3c384a95b92880a873903a644f4aa1ed7f
- MD5 bb43d0566a6e495a5647b0907a1ccfde
- SHA1 1ca620f106521bf99e7e1a8236e0461ec1bb64ed
- SHA512 38e8069f7184ebff3731c6d9decbce10a5a68afa5d7a83cbc314755562000244e71470b327045558dd94c5a65dc82f0a11d458c6a2b4cec36b9304bfa8ca1854
- TLSH T189B00271F188C1B8EDD2ECBA204383D54BD8B29A3960BEA441ED151BD021598131BA1D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/regulatory.db
- SHA256 4198f3e1ac3fd4249a073c02fda6204c9497fd05ddfaf2c655f81e02ac2ae4cf
- MD5 55c68a44f982c4b4f350a2e7b010067c
- SHA1 77efdca944977ae4834f9d2eef081151e3564816
- SHA512 0b60d303e7f7112bb13d3c068bb855a5ff85f8f670c1a815a014a2136b130cde20006327368f4363687c31697b1e2658e5ffa249b0abed475b56ffcd608eaf20
- TLSH T127D0BCD9667D6600B623BAC278D4634C23DA14B28E08AA7236C4C3C9E17F109861C915
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rlogin
- SHA256 6c774f99ef8e6eb8bf2204aa51b90df85ad0e635c6c7590e7efd8d7e124472e7
- MD5 42af75a80e0f92700ea4f82b4922f290
- SHA1 2d872955eb4278bd6e377818da153e02cfdf2fb7
- SHA512 d128734ea859d4fa267ae47988b684cdfa62972929c7c78add72c0ec7ecce02360fe389185701f106c7388ca47edd13f5a55dcb930ee172c585c5e33dbd1a42f
- TLSH T11EB002A1B7ACA8B4ED90ECF7249383D547FCB1953850FF3D66B01102EC10A68539B95D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rmic
- SHA256 41094f804372a2b7d424118003f39996c13d3074653c663363ecff1671e9d66d
- MD5 cb356c871e4ba3d6267a3afbb18978f0
- SHA1 108223e5f6505bd6ca558d79b74910f3ff5b3b5b
- SHA512 fcbc5785c88c7e4eb9362ebd468298a5c2364ec62cf253bf988bf9b6b259eb324024c98284064f9c7bb43f29cac03159e61b4c42cb3f9addd617d6f009aef0d7
- TLSH T139C01235F5E884B4EC647CF7690682ED7A86501874107581002160C6F570A9D2206C4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rmid
- SHA256 e61ac2066fb23d1356b5da81eec6a126917e7e245ca92ea379691973988279e0
- MD5 0836d59517a3e89f322cece9d9530a42
- SHA1 24698d1ec767dae488292228a5b6ce05d4690f81
- SHA512 50ade2d28c5b1d3186ed66e3cc6e0a920e32b630a643bc9f14aaf20d45589427dcdcd792f41c9cf612d874f5a1da18a033817406ce540124ec2f9a4373e046d0
- TLSH T10DC01235B5A8A6BCEC647CF6690A82DC5A87501034107581202070C3F971A9C2286C4B
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rmiregistry
- SHA256 eadf372aec1a1970a9a66cbdb1cdd8ed674632ef62f954e7c8b189ec52000936
- MD5 c18f752376cd020c7d90d0f74e71e8db
- SHA1 5111b5096f9120f119dbfac8129eaef0867bd08a
- SHA512 7f90425652fb8f6e86b565393d1f5a796a631eff407ceb17492c0169ee55903018d7fcf3b5e9aa0d2f64240c54acbfc6a18cee6275abe8c94c155250f9db53a3
- TLSH T185D09E6ABDC4C4F7DEA57CBE5D01455D4E47525034587507C23451C2E1609EEA127C46
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rmt
- SHA256 cc31c88e6e9660da820eaf68418b4e9dfd76dfdbbbcebbaed446afe397971dc9
- MD5 de6599a28b6b2b290db30b1b26b01efe
- SHA1 e15e6e95e5ec8136280c7a1fa8924bd2a020065e
- SHA512 8479b604739ff820b095c6cd14afaf433f162b117f0fade8327c3d52b72181bf7853f05271a10f18e2c17c854571d32afea13c367f92e633347b13ec7302adec
- TLSH T16BB00235B4C1E1B8FE10F979205707B99688B5D53462F5518EBA1043F19C5AC435B91D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rsh
- SHA256 3e43a9af7917915af12a4f0658ee06c63426f78680159c615902311243f7e48a
- MD5 9a605436b7ce0dd2c59d795d778e9cd9
- SHA1 1953de0611542d803eaefc9d0f21b9f2fbdd17e7
- SHA512 f4085552499fb81279563bece7f6504b7e9b5ee7aac80b6d2c45972006fe33e5e54ab6b1117960bb241bf632dd4802b3a9c25243bc90a89b106762c07aa00928
- TLSH T14FB00226F58CCCB5ED90ECB62003C7F5468FB1A43D40F91641E59403D01D748178B96E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/rview
- SHA256 be37a1093bcf25e8b5dc4231ac495221c21781ab3d52d01cae68fad96ce27b87
- MD5 17e054652aafdb0d1c6a7581f2fea5fa
- SHA1 0078bb08114cea3cb1aae098b9c77927f062f5d1
- SHA512 95ec43f725c5aedb4a3fdce600f19049ba1751ac28bcff2001c83b23c0e436e2de7b193e7474b44148d971a2163fdfb9a99f21adc7d8511a7f0942308f38d939
- MD5 SHA1 SHA512
pam/dpkg/alternatives/sar
- SHA256 f09b1380fed022624e97178ee627f2129408ba61e4b019e4a1ddb3f13c81f06e
- MD5 e944912f914f7cbb5dc679cbcb11308d
- SHA1 9039a02452941e80737c91baea64f1aa26a0fb23
- SHA512 d39595f2a536fbdb32e7d289122ce1d2e6ef77e5f2305c16e1f95e9bcd712310da76a28003144f194ea4eba4e62d12fde57869c0dd1952aefe1b40d60ba8d568
- TLSH T107B00B20B68784B8DE60DCF5151653E546C971B53C55F51090B91143D615D8BDB0F91D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/serialver
- SHA256 b5c33767ae804dbdc2f106d37450002bc18819dbe78dfb95e77de7455bb04aba
- MD5 89e13f7d30a6345e1153b474327a2ee0
- SHA1 43fa982922fffb40c47a27a28708d2a8873f8508
- SHA512 654fde28aba99fd1a4f8124d5d9d6d0db1be7dc354cc69ad7a754beb72aabd5f04b25bc6024dbcb6acc4621c3e3f2755a166323a36c191b33b99a65085d07c3c
- TLSH T104C0C760A7C4467CDC657CFD1D11836C4B49F21BB914B59200E058C7D1F1C5C6717C4E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/startGroovy
- SHA256 a3ab02d23f2e68a4e89f041187160321e1c58885c3791b1f525bb11ad1ddca26
- MD5 93924d66097c2355e5fffd9e9c6fda9e
- SHA1 445f36966bab5f40114274849340bf235a359bd5
- SHA512 142a6b92785e606a027c440c67f323c5936322982ec158479d7df8f34255e6a2c0e87be8850b8c5907482bbd747b84798471af2c2cb3d4ef27febb9c391b6238
- TLSH T14FA00231E1C8C474DC824BF3103EC750C3D110A81C80B53448B24008D35C2B8663650C
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/unpack200
- SHA256 c7b99b03508b1b2a15fec0957a6fb55e024ba8e78fa9bda6dc7b3d4735d86f9d
- MD5 97436dd320f9940379fff4685dc7e80b
- SHA1 a5f6a9f9b3d006e929dc86c1836ec5c31dcb70f4
- SHA512 bc3871294688a3ebb7abd2f1bb0dbe58563875843dc89a5bdaacaa2d42dfc0cba40af4eee2de85b10249a70386c3c77bc1f4802c5d2bc067dc2d8d76c28bcbcb
- TLSH T1C1C0C932ED69C5B8FC687CF51A0DC69EEA8D92A034187500213264C3D2709DC7206E2A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/vi
- SHA256 79c4674c6375f614bb8b4e932e2126e0affd74086b3df339006e0645b3f88e2c
- MD5 2dfeada756d8169b21dc297c48670822
- SHA1 e4920e7f2e66bfa48ed7c107f6502a45be79ff24
- SHA512 a3ccfd3aab347152a32eede467bbd190ba19a152448b82a6ba20878e00968c11b5227fe0b968785f74c80bfcb1b66e54de8ba1efe60df36c27ecc50af0b20e6e
- TLSH T105F02228F2E5C4FAAFC0ECFA2557C6942B8DF6E93488BC4494F02103D916148232FD4E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/view
- SHA256 4c54cb533b82608a3c364bdb14aa2fea788759e9e455b6dc262d93a3b73ccf9e
- MD5 762b3353ac9c6437e3982fb376aff87d
- SHA1 d8d8d6eb5c7259ecf6df09b0198c80d0f661c64d
- SHA512 565e73f6417bb6ec16d7eec683186b88cb88e613e08ca08ace8f772e720ec9ecea68bce26212b3f542097173e3a6b8f2fe5dd4510cd875dc0910e877cc341f3c
- TLSH T15A010628F1D5C4FBEF90EDFA2557C2952B8DF2F93489AA4494F021079912188432FD5E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/write
- SHA256 4cd218af7c14afb4d2396d63c008fd9b75d83e401e4fce1fd4b02c04855407d2
- MD5 3138353a9db8f9a8656c4852fea14cca
- SHA1 ce46c25c97c0148433bfb78472d820479e7f74c1
- SHA512 2c46f043233b750ac15b2c7860f8b6f4c9a0496f8b064426ce3d3a2bbb54ad9e42ef08e3813f8efbcad22a67d2137bb4c58578c3dcc70635c1fac8dda0476ed8
- TLSH T1B4B00838F098C9F4EF92ACB61616C3E9BB88E1E8B844BB11D0E15016D66514C525BA2E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/x-cursor-theme
- SHA256 b42010c6b1e8c4a1c2e68ec556acf2fe2c59f04b7f7157fb922b05316cfa64b4
- MD5 a8c65519650cc11d9d0ff13fa25b1f8c
- SHA1 b6c3f7ae86fbd02ff3fa893e8a7a849a3a9d3b36
- SHA512 84944c8f452716254cf6576385b18267101e2d8f908f1660762ddc2421494aa8f559412b4062b5930d1adabf9bd0cb4ae0a295bcc82e9b7f443a6ba412ca0536
- TLSH T166A0017A723686BA8E5289706483675697ABF4EE0811F1B4E0D60814D4F414A874F71A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/alternatives/x-terminal-emulator
- SHA256 5f3461e2e9797f7b57b078bd6b2dd82895760f3ea3a7893ca6aad90ca0890333
- MD5 e434fb7552e4476ef3ccec6ed78f038b
- SHA1 6d0571a5f63b6434baee7cf74ae897affebf9fe9
- SHA512 ff42f9aec7e5d29c46875a7b89a10c19b0b940d123016580584a8fcaafc787a4c0da1f44326e332fc2da4ef6e3ef743e7cc8b62681bec916d73e006b0f149cf0
- TLSH T198E0BF24B6D881F5FD68FEBB6403C39707C8B1A57C41FA11A6F05413D003199271F81E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/available
- SHA256 8ac3052abdf9b3ff5af7f20178f365d4258ca2e82cd812ed0b16da962bb0512a
- MD5 658c2d7b9c49e39f8e0ed14b3d3c2cad
- SHA1 46ae1a46c6afce1bea4f43856e7cd55682f0ad04
- SHA512 cc7f605d86a7f8081745168a569d29d85633fc0f927e0a5fbadb7bb22c1938a4488f48d2c1f2640acefcaca5df2c5f4c8bd494a70118bbd3276946bc9c566d7f
- SSDEEP 3072:44PjudCTvqMeAM4xY9e4fInigj5Rx/MTD2ZnZuU:4BMz8MIe4fIigjF/qDugU
- TLSH T1C4042B73EB8453BDB3C79BBB3866A7140A3A2104733746FCFAE5451D51424EA323369A
- MD5 SHA1 SHA512 SSDEEP TLSH
pam/dpkg/cmethopt
- SHA256 162ba45c89e2735aba3a5fcd4a0ad00efd9120edaa2215a8f541058cb895ce29
- MD5 359fdd1165dfe95d043c8de520f6a9f4
- SHA1 4b90dca863ca4d7f93bb47788a32c437ff61afa6
- SHA512 05527db01c2a02d8a224c784b263015f8b5fb70ecc553a0326d0b4fd6db4f0e335640da38ebe6c0e635686365227432f240bb27e5569b6603506b4632845a83c
- MD5 SHA1 SHA512
pam/dpkg/diversions
- SHA256 7325d606d98bdd1d2381ea904cb3d3df4c4cfb171582954fc51dd9f24cde8bbb
- MD5 7361c70927afa51a9feb32a8cd861d40
- SHA1 26b0c419c53a00cd875e1d6fbcdbf92e41e2af33
- SHA512 b11420005a1c3aa458410cd2dded1da9af148534ab300ed1e517f81ee333c5ecf54a4c9789ec1b8e6036e5240a54678e2e080ce0fdd91e0d9ff59b219d8fc59e
- TLSH T1BCD05E66749DD4F6DD959D7932A7E6690B8437E0BC03780080E4B043C59D14E369F41D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/diversions-old
- SHA256 c12e9c5e608287a4c0d6b080ea1834a37219fb660e4d4db2ff9deb53fc6d88ad
- MD5 d28c0de84732a48f588510ec16591670
- SHA1 456439a630b279b9fa437db71669ef69cce68167
- SHA512 17aa97d070c04385a0dced7131e57fc83c30a885ea4ad73f2a4cf08ce1621d271efdb5e83f73bfcd6c974e328e7554969269d036201478a5071092b7a27c9689
- TLSH T1F1C012757898D0F6DD89DD7C3253E5A50B8471E13C03781140D4E183C49D10E325F42E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/statoverride
- SHA256 884a3bf8ac51d4d98d82463e6f67428165b3b06a6a7fc3ec09eabd95f1e64f55
- MD5 04d730dc9a2d06492b65f5552eebff12
- SHA1 e67c2f7101e9ccb7e70e15b3c146799b2359249a
- SHA512 ae4ef342d23370646fc41a2b8ee9b591b98cbf984ae35ac82d764d50910d1cf39920726b49abd083d0db200dddb28f11991ecc91ab12617208025c1745d7ef58
- TLSH T1BED02201340E9E30ADD4EC43B834391D8160202A1900BC0242F250F332DC36E2305E0D
- MD5 SHA1 SHA512 TLSH
pam/dpkg/statoverride-old
- SHA256 851ef9088ab8d90f1b797d1a9b944035c10bd0bc40e813f70c3618886be90358
- MD5 97bce1058bc038b24d623e72d242bd72
- SHA1 c5e8238670d56cc777e73d32fa8a68613392081e
- SHA512 59bb62ef30eeba80359be8883f037fa96f2086e361850dadda14ca9cb155a2d2b959ac7d4436b59d47c47469704214192874a8635e87be454667c54b55832e21
- TLSH T1D4C08C0060099E759E849D43F8353E6A5550006A1D00BC0252F204E372EC3BE7309E0E
- MD5 SHA1 SHA512 TLSH
pam/dpkg/status
- SHA256 b28c76f7d3c590ea85422e0d777e2ef1371aad98659921ec8b242a2b4c456243
- MD5 58e05bf45f2de2b7f9b46c9281caf999
- SHA1 cb37da5256f4852c814fe46af2c6c6c51756ca6a
- SHA512 efd2f8069addc514fd0fff7f1eef32cd31a342866e1a936e2a298dac398890fc429675d1501814886840273fad999eedf8b39e7409f860b4cdf9ba9cd8395443
- SSDEEP 12288:ImY9wg7XX8yEdASGzMwg5gNg4OjYLIYddVbGaS3CRSK+6wq:TY9wUXX8dyzVg5gNgXybGB3Cu6wq
- TLSH T1F4452B73AB406371BBC36BAA35A793004F3A1144737781EC9BDA826D56434EE723725B
- MD5 SHA1 SHA512 SSDEEP TLSH
pam/dpkg/status-old
- SHA256 be48419478c25e0d929ab6555e27215161b7c5393b63bbed99a518a09a2748ad
- MD5 fcde6bd7b1591678c224132d65169965
- SHA1 62c840a0bd41510ccffec270584ef7fb52b9af95
- SHA512 4d90514f6dd0ba765972f209a5cad29e370d08585ebc8add3baa65debdc1f14f8d14d96b1335653fb511fece5d247595e6c8f3bf0c791c7bc2a085f5031682b1
- SSDEEP 12288:ImY9wg7XXGyEdASGzMwg5gNg4OjYLIYddVbGaS3CRSK+6wq:TY9wUXX+dyzVg5gNgXybGB3Cu6wq
- TLSH T13F452B73AB406371BBC36BAA35A793004F3A1144737781EC9BDA826D56434EE723725B
- MD5 SHA1 SHA512 SSDEEP TLSH
pam/dpkg/triggers/File
- SHA256 0680b02eb11e701d4970137d46c931ab37e4a9a86547d811f97d3a86fa910be5
- MD5 273bce8d390e8e57b03ab9057737299e
- SHA1 b732db8a6cfa34f217551d31b6bc867b8acc556b
- SHA512 e9ead7c0f23ae68af60762b116548f4cbd3977c97a2660dd849dd7f48af0aea7a1bb31fbdd74639a9bef761af72e676d855325985e99e6311493be09bc88a27b
- TLSH T15821B6A2527FD777D98D7CF471D664298A92B0EC2C13AC30BBC912C48D95049239EF3A
- MD5 SHA1 SHA512 TLSH
pam/dpkg/triggers/aspell-autobuildhash
- SHA256 b2eb5757b46fc925e6f149607f3aa9ae31755735a438fd9ae3effabab0ebf2ed
- MD5 652b20cd6ff7c0aff5a74fa3f6fabeff
- SHA1 f0d739861692b2a303e4b654bb9de05e251d9e5a
- SHA512 220368aa428174cd5d01b9c3a6fc0b2bb36a8c81d8b58c6d7a6722da304894dee82eb961fd5e24995f0c624750a2eb2b7ad04a165190331e5d0d0d1fe7c70f0c
- MD5 SHA1 SHA512
pam/dpkg/triggers/ispell-autobuildhash
- SHA256 b2eb5757b46fc925e6f149607f3aa9ae31755735a438fd9ae3effabab0ebf2ed
- MD5 652b20cd6ff7c0aff5a74fa3f6fabeff
- SHA1 f0d739861692b2a303e4b654bb9de05e251d9e5a
- SHA512 220368aa428174cd5d01b9c3a6fc0b2bb36a8c81d8b58c6d7a6722da304894dee82eb961fd5e24995f0c624750a2eb2b7ad04a165190331e5d0d0d1fe7c70f0c
- MD5 SHA1 SHA512
pam/dpkg/triggers/ldconfig
- SHA256 e1919c8b2afb858bd2aadc7ccb27c847b3b687ed9dffe00219d645d0c30b8b83
- MD5 5dc9c5998a63eb808cb427adf053dbc6
- SHA1 0100d06fdd8f342168d5d267e98e138bc166310c
- SHA512 bcfb72bee1c74357157290fdbce71b775e7d3a99ba26578b61183e0131eefaf1bf5677e4ba11064d4e5179f1a8d7957501ca70587bfc8cbff7021c8f31b52dea
- MD5 SHA1 SHA512
pam/dpkg/triggers/update-ca-certificates
- SHA256 e4f7fe96541f669b07bf6fd456f38e50a91716997939d95f4379e9aaa97fda08
- MD5 0d6fb00493fb7a2813058bc71a3b339e
- SHA1 ea9cf59652920e0519b097d7c5d98b099ddab249
- SHA512 5fd200f3d1a995dc965d67f3c4667bbb3c68e37648158d0136b744b6873cb4418d13a2fc2d03fcd44beb4831292f186610cfcde4f52c1119695f667e8568032d
- MD5 SHA1 SHA512
pam/dpkg/triggers/update-ca-certificates-fresh
- SHA256 e4f7fe96541f669b07bf6fd456f38e50a91716997939d95f4379e9aaa97fda08
- MD5 0d6fb00493fb7a2813058bc71a3b339e
- SHA1 ea9cf59652920e0519b097d7c5d98b099ddab249
- SHA512 5fd200f3d1a995dc965d67f3c4667bbb3c68e37648158d0136b744b6873cb4418d13a2fc2d03fcd44beb4831292f186610cfcde4f52c1119695f667e8568032d
- MD5 SHA1 SHA512
pam/dpkg/triggers/update-default-ispell
- SHA256 b2eb5757b46fc925e6f149607f3aa9ae31755735a438fd9ae3effabab0ebf2ed
- MD5 652b20cd6ff7c0aff5a74fa3f6fabeff
- SHA1 f0d739861692b2a303e4b654bb9de05e251d9e5a
- SHA512 220368aa428174cd5d01b9c3a6fc0b2bb36a8c81d8b58c6d7a6722da304894dee82eb961fd5e24995f0c624750a2eb2b7ad04a165190331e5d0d0d1fe7c70f0c
- MD5 SHA1 SHA512
pam/dpkg/triggers/update-default-wordlist
- SHA256 b2eb5757b46fc925e6f149607f3aa9ae31755735a438fd9ae3effabab0ebf2ed
- MD5 652b20cd6ff7c0aff5a74fa3f6fabeff
- SHA1 f0d739861692b2a303e4b654bb9de05e251d9e5a
- SHA512 220368aa428174cd5d01b9c3a6fc0b2bb36a8c81d8b58c6d7a6722da304894dee82eb961fd5e24995f0c624750a2eb2b7ad04a165190331e5d0d0d1fe7c70f0c
- MD5 SHA1 SHA512
pam/password
- SHA256 fcbe71121b496f999c1587507bae8109818d82bdf182bc8d1f08d8cf618885b4
- MD5 4e3bd7aa7102cff27fdf36d911e1d03c
- SHA1 1954f362187645097fff6d870838d99a789d78a5
- SHA512 e6da2964ea8f21335c0ee820a2353256a876425f82434a63cebc9f3d5718534bd49bd01cd8beef64b0d8182db483cac93a999e0ed389272b519a18196bf1431c
- TLSH T11BA022332882CE8EA380002088F0030C38800B088383B320CA88F08C0C8828B32A2828
- MD5 SHA1 SHA512 TLSH
pam/seen
- SHA256 25feac6809cf40e81bf89e879459acd3aab6187dd7c29117b3ef9b860afa13f8
- MD5 c8386f0932b7cd4b3a6e644cebcb4ec5
- SHA1 59e1fdd86053e74f7a6065a218bb34dec9585ff7
- SHA512 6efb961fbac03ca8682f042eac1e123fb395db52e29fdcbb768ca109108c0c8974234dbfa468d1291073aa52c0a714d072a91f09f660893e5cea114b8a96804a
- MD5 SHA1 SHA512
pam/session
- SHA256 e4ce15ff72f6f4b37c5a4272012e133dafdc093bf4d81732bc5ccfc6bebe9ba0
- MD5 63b7e63202105699fa12eee4e12fa374
- SHA1 386ba6aaff2193c2f0b875110c1f54d2060f7843
- SHA512 b2f972dcb3475f3fcb10a8c6494b839934f845e4bdb46afcacd11609b89c881b637f2ec02ff49dbb590ef3528052296c40c401a572956c02759ac2d59f16d9d2
- TLSH T15DB09212A304012E16854894D83B498868E0F29A0752B0B4C8DC47F5926D9A893D4D66
- MD5 SHA1 SHA512 TLSH
pam/session-noninteractive
- SHA256 4a0e1452e4462ee2c1337989554acb3fe7a2473086870ec5b16e46aceb48e0e1
- MD5 8e124357fae17a9dc09caeec4898ac47
- SHA1 b9cfbc1405552dc38de03df70d6352dbf3481aaf
- SHA512 12341d70618072c470a0dd1003bf7db06a68578f3e6f0fb8e1926682336f23b9ff4e613790dd0925e0bea7df35ffa24eb20463be4ebc1701efcf385168e1763d
- TLSH T154A02222B300000E23000C88C02F028CA8C0E2CE0323B0B0CCEC0BF802BC2ACA2C020A
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Adefault#003Asysstat
- SHA256 df83ca773bd3100f2402028ef23b2e64641a293805e0e88a4fb892f999bdd09a
- MD5 6f015cbda1bb151c4bcd0ba1b84c2568
- SHA1 01df539618a4aa6e51c921d0091d8b1a61147fd3
- SHA512 fb62be62fa3f22ccbb5fa71437d6a68f7fc6439d9c9fd80c09163219d7cfb365fa4e80259cdd1e64b0e2b61115dc44cd7d582b00e02c8d0fce76d304a40d4079
- TLSH T1ADD02BC9B769D53C19584555A78F9139418CB098AB15521E9CC02059E72258523AC223
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Acalendar.ini
- SHA256 0fbe835f25a303eb942760930f734275c2a5e60049835b0d9bd9f97c9b996d7d
- MD5 0877786daf8479dd91be0f89f223a102
- SHA1 1e3acdf918937140ac67ede66b6fee989994a736
- SHA512 4b2a9623eae483e0ec7d18e104a3369db6397c2fa34636f7ae5999586fcb1028751b605f2a170a28ef7661ce07cdde7d6e529846eb03227378e07f272c9701ce
- TLSH T1CAA024030154DC03403F1D01D513310045FDCFC3100D740440FF75F0104003041C503C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Actype.ini
- SHA256 05e736f9509116eec00fe4fa1b4e0fea51a2fb311262cd46a35ea1f177eb9ff9
- MD5 72def1d4663c5350713006af725f21ae
- SHA1 3a82beeef9f73c46ab6c51c43cea7299354d5ca9
- SHA512 92f3104e1db42216c19921cc45c3d9bef59ebbcd6b436ceea5dbf7734a1c16e911657e1c0d24d9f8040e17fbda726105a6122e6646576c12ae5c61123fe75a1a
- TLSH T19BA0024302B8EC07913B6F42EB6662549ABDCBC6210D504D56EFA5F66150662868A62C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aexif.ini
- SHA256 e7bbc905937019e082d5ad1dd6482b3bb9eaebc47c3939066e5099c1b7b5e9f5
- MD5 7b3bf6064e6bd1749e5f1a3dd56592b3
- SHA1 f0db1da24e4a61aa1851509504a1ad92423ff549
- SHA512 62235b9d8c76241b6d97c1a9291096837a25fa67024c987d8d07b42ef3041ffce1594bc53da8056258e925087e13e206c7918bb97c934380a36788719e9d21fd
- TLSH T1E6A0024302A8ED53D07B6E02EA6762508A7EDFC3610D105959EBA5F570901619A8B23C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Afileinfo.ini
- SHA256 c8a2d1dd0161a50e0ddd031f0abc7a5acfe8559f5ec18423e567f519c456dfcc
- MD5 3eb68bf4e22faed68c673430081b1a08
- SHA1 81dff42af5a3bea0d81ea31ced7ec83afde8d797
- SHA512 e1ec5439a9cb59ead6b737d7364039b02bd03cc46d449c4901eef97687837935d84b76340e3854d255cc27f562817c3965c7adc455f2124da6f9081d8f4d79d7
- TLSH T118A0024302ACEC53D03BAE02EAAF62518A7DDFC3211D755965FBE5FA605016196CA12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aftp.ini
- SHA256 464d61d9d251d63efb02af8698c21125962a18992470080bf8929770292302f9
- MD5 b245857286d2cff077355dd82086c950
- SHA1 cfdec6e72f9ae77d81fce48e0ac25f8e6c96ce50
- SHA512 d2997b2c779ad1bf2b946180a2f2883e4ce7a1a94b2c67cfcc922d4f52a7b9bc5f8c45cd7b3e97f73287981f7cf73ab65cf9e9c6d89761cfc96f0b885724e8a9
- TLSH T1FCA0024302ACEC13D03B6E03EB6662508B7ECFD2211D114995EBA5F6A0502639A9E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Agettext.ini
- SHA256 f502d4781c78fff2b7db83e1f37db6c8bb4648ec0d2ce00decdc079a9b551738
- MD5 7dfbed71c04bbd15100e719b20b7c764
- SHA1 3a69469914ff8b57d35e7c18ee3671896011de36
- SHA512 2c023b34cd8d66982fb685f5ba09704f65569cc7e07320c6bd31df889993d85e9de2e561eb37c15df7886c35d4f1b1c523f4b929a110ba19a0a176f23ae32739
- TLSH T131A004434155DC4350377F01F5555150D77DC7C1110D514555FFD5F55051151554557C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aiconv.ini
- SHA256 922d70e6a207418f4bf87c4dda8685cd19c278c50cf1332b0a11a33e7c32d893
- MD5 f875ac0ca30dea610b2adc421b9e997e
- SHA1 d3460acc4309eca91d5a0d58a91112064693083c
- SHA512 da7e6168bb9556d21b087c4874328e7ad12fb154a117ae5fcc574bf0c479e9f8529d51d502ead261023508686645f2c37486c6fdbffc35ebc71a19871b86f96f
- TLSH T1F8A0024302E8EC03D53B6E02EA6662609A7DDBC2250D104955EBA6F66260265868A52C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Ajson.ini
- SHA256 ea4bace2bae8c8a7cd575d52fcec09db55201bc110123c123e82961ea57577ef
- MD5 0732bc961c57a55cd03a3294554d7a70
- SHA1 b09c9281ca585ed2692e9835f0e77fe857b26a2a
- SHA512 3f4a6608e819953db9a7042fa380613553c92bc95d41d76cbfc441ea1e3216400a9ea60b3d85b67cc5b392bd66cd0a385c90b69f621f55db66b884c95fc8b91f
- TLSH T15BA0024206ADEC03E03F6F03EB5B55509A798FC1315D184999EF90D56540261468A13C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aopcache.ini
- SHA256 eadb95d7c508f3cf42c2dc2ed035be3d0da20136b14e02422476ac0b535a4ce5
- MD5 11686c89e38e05a6c1ef41c186588b21
- SHA1 3764f5d223c96cc03989047dd9f47ecf12acceec
- SHA512 b8d0a6842ab025892b7488bb9c7864d3a17ecf51c4ae94bb33eee1276ab0166ba96b1612fa87e2b6b431e8582a28559e3dcdd10a6230239c69b577ec9b7b4e02
- TLSH T193A012131304DC0342362B02EA455054843C43C01118000460AAD4A480001510DC5010
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Apdo.ini
- SHA256 b072d1e70a5173af7e968b4abf908e017f5f8675d30dda36ea7443dc410d2e5d
- MD5 2bcf2cd02149a7b3118f9a8ed7cfe1b3
- SHA1 cf5354039e953188d5e4a77078ca95777def5d03
- SHA512 2d97da53a09789b87792bfedac54a4c08da8e50ca4bd9706d6192c30c26ea0eeaa13333b3b48500a876ac6b86d851fc5aff802a2dce286d86abdc37e9da548a9
- TLSH T173A0024303A8EC43903B6E02FAA7A250897DCBC2601DA16951DFF6F59050161668E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aphar.ini
- SHA256 fd62472e0bf8b260ed712068086a2a55b9dd71bf13b1f0e07897eeea3bf723e2
- MD5 9dafa1a822dd003107e1686818a191fd
- SHA1 37fa75ad98c661e11ef2c29312e74cf70ba10591
- SHA512 fb96656e2010aabde843513dbc68581a04246e8c071695d7384a8d7f84e589869598e1615d1f7bcd4129991e0383f829cf671a1a7b7f72a35d906cfd7b62c8a6
- TLSH T1EDA0024302E8EC03917FAE02EA677A548A7DCFD2211D505965FFA5F560511A1868E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Aposix.ini
- SHA256 e1a5a7c827fc17ff94cf87beed916be62d6b025346b4a274adb8d835785109b0
- MD5 0f55f144c06b074b7c0a498928001452
- SHA1 b6842cf2bd95ebbba788d4c95af3154d4f61223c
- SHA512 d92bd3c182a467802a0419d2d40eae8e836a6995561b8038bac6fdb430e181a7c9aa08aadb4932da4104d8431c1f749e71c135cb92a8bb7c7a2d255b8ff43210
- TLSH T164A0028303A8FC43903B6F02EA666254CA7DCFC2610D905969EBAAF56590161868B12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Areadline.ini
- SHA256 fa6d93d1de1704dd7b40708204dec039308bd867d549c4cf4aef597d40d4394f
- MD5 04d2378963688a881deb69b0441f2a80
- SHA1 abc4b93b0a882f335f25d742308215fcf33d2801
- SHA512 cfcf2ab2dfed5def1d6c81d0aad137aa2ca54fcd8c20a5d569a1484a0c89a882b0c47cd9dae2356c465c44fc8a8d2ae65f35bf56434e8f171ec3140f8e88539c
- TLSH T135A002420EBCEC0BD83B6F83FA975551BA7CC7C3210A2149D6FFE0C671481A18A9612C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Ashmop.ini
- SHA256 134aafee92de1f650b7eb500cd6336bd33149bdd3fab4fba939894fc7ffc8193
- MD5 894f4d6c5c36f658499b941a02bbc9a7
- SHA1 99f88a477327d4fb8891ef92dd24884d452a8301
- SHA512 89d046d2300cef1a2ac5eae539dc37236d1937144c103137f98a4fcf983fccc10646b231afb02ad601a8396a979e93bbf42736230897ab52180b474d7c89a796
- TLSH T1B9A0024302ACEC53A03BEF02EB6662508B7DCBD2610E104969EBA6F6A494161869E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asockets.ini
- SHA256 eb31eeb6aeb34f31c1c695dbac0c9a69f909874f01341679382da0646641318c
- MD5 5c9f4598aa9e02021783e540fc023c66
- SHA1 d65f65cbec25f7752b0e7dd862c9e8f7d01b1155
- SHA512 1653bc7ffc5a17ab2bc2114bd1bbb177d60c04c4f57418d671d98b915fe023a65014c8701682dce2eada6872a5210eddd547ea78a290728d613d6c90a69a2f83
- TLSH T1E4A02403017CDC03D0371D03D5151110553CC7D5110C000414D754F03000110414503C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvmsg.ini
- SHA256 ab104d16fcb223c3fff2af1880490f879e940561732d66571f69a15d498321d8
- MD5 0ac70c35787ea579baefc56e36ea9c47
- SHA1 84125c310359ebe120c680d30ca09273db5bcedc
- SHA512 3de749098b8a3db4d7fe444f19bddb31dd33666ca209c7b216d48bc63be4a1ea4b4bc01dc6c1d5d109c5fe868e9e46b4604c79881842bf96e80ccfae975a323a
- TLSH T101A022830BECFC03C03B3E02EAB323208A3CCFC2200C020C00EFB2F02080220828A02C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvsem.ini
- SHA256 2f7f5db8fddca372e034f3c7bb34f5abd861621fa5282bd0808bd320e2867e85
- MD5 a4c2616a57351dc93cb36e1f41c63926
- SHA1 b679a69c3f01bed6e66854844859ad70597bd88a
- SHA512 5fe91d9dc0b46d73eb26e3dcd7cca2962eaed09a0436afcd9e843d386ddd26269c8f883a1045eb05c5b43533d0046ee1c36373d1319bc99e2fd757b6d5102d0e
- TLSH T1D0A0220303BCEC03803B3E02EAA222208A3CCFE2200C000802EFA2F0200222083CA03C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Asysvshm.ini
- SHA256 4218981bb40ed218b01846cbdc85b436133859b2b051f740f992db14a702b2fc
- MD5 46bf0b73759bfdd7fcf431ea42d03c2f
- SHA1 8c91dfa289d74a78f55708fcb112c1247b384672
- SHA512 222deb5f9a46ba757088377a1ea46978ec99ec8c8ccc6ead22630edffce5b46ca6c87c96b9d5ff484fcec78921db345d2b0426d51af789117d968050fbeaaef9
- TLSH T1ECA0024303ACED43903B7E16EAA66661CA7DCFD2211E114959EFB6F560542A186CA13C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.3#003Amods-available#003Atokenizer.ini
- SHA256 5915e8a8256d4ba7b8b021ce1bcb9456ae86cd98e1100b6b57e098ccf169e6a9
- MD5 cb36a25e9c9d2c975cb49bbb56f16465
- SHA1 f16e3989efcead1a5879ba8081e64bddea63337d
- SHA512 0face1fede39b50366e8c55a1606ec2900be77e4a9bd94fc32dcd39e0a7442b98bed20b056e8a7d90810ce3aed92b8ddddbe8fe9792960fa8aa5b417cf17e71c
- TLSH T1EEA02443415CDC0340373F01F5311140453CC7C1300C004410F7D0F1D401110414F01C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Acalendar.ini
- SHA256 0fbe835f25a303eb942760930f734275c2a5e60049835b0d9bd9f97c9b996d7d
- MD5 0877786daf8479dd91be0f89f223a102
- SHA1 1e3acdf918937140ac67ede66b6fee989994a736
- SHA512 4b2a9623eae483e0ec7d18e104a3369db6397c2fa34636f7ae5999586fcb1028751b605f2a170a28ef7661ce07cdde7d6e529846eb03227378e07f272c9701ce
- TLSH T1CAA024030154DC03403F1D01D513310045FDCFC3100D740440FF75F0104003041C503C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Actype.ini
- SHA256 05e736f9509116eec00fe4fa1b4e0fea51a2fb311262cd46a35ea1f177eb9ff9
- MD5 72def1d4663c5350713006af725f21ae
- SHA1 3a82beeef9f73c46ab6c51c43cea7299354d5ca9
- SHA512 92f3104e1db42216c19921cc45c3d9bef59ebbcd6b436ceea5dbf7734a1c16e911657e1c0d24d9f8040e17fbda726105a6122e6646576c12ae5c61123fe75a1a
- TLSH T19BA0024302B8EC07913B6F42EB6662549ABDCBC6210D504D56EFA5F66150662868A62C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aexif.ini
- SHA256 e7bbc905937019e082d5ad1dd6482b3bb9eaebc47c3939066e5099c1b7b5e9f5
- MD5 7b3bf6064e6bd1749e5f1a3dd56592b3
- SHA1 f0db1da24e4a61aa1851509504a1ad92423ff549
- SHA512 62235b9d8c76241b6d97c1a9291096837a25fa67024c987d8d07b42ef3041ffce1594bc53da8056258e925087e13e206c7918bb97c934380a36788719e9d21fd
- TLSH T1E6A0024302A8ED53D07B6E02EA6762508A7EDFC3610D105959EBA5F570901619A8B23C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Affi.ini
- SHA256 005d8a46015f79bc5e03e393e7c455eeb675e456515740537317235fa12458f9
- MD5 40c77aebbb04a3e8891ea3575eda55a5
- SHA1 7105f312782eeb38f77f7c6c22c3c3c92b2d5bc5
- SHA512 41170fc966464a9ad982144c75e1f738cd6793a4faa780f938a48483ca04f8a33c64c5ee9fa2390bd49a8a1aebe8f1032969cc6bf9d69f71f8fca2598704f7b7
- TLSH T1A5A0024303ACEC03D03B6E02EEA672508A7DCFD2210D104955EBA5F56050161868E13C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Afileinfo.ini
- SHA256 c8a2d1dd0161a50e0ddd031f0abc7a5acfe8559f5ec18423e567f519c456dfcc
- MD5 3eb68bf4e22faed68c673430081b1a08
- SHA1 81dff42af5a3bea0d81ea31ced7ec83afde8d797
- SHA512 e1ec5439a9cb59ead6b737d7364039b02bd03cc46d449c4901eef97687837935d84b76340e3854d255cc27f562817c3965c7adc455f2124da6f9081d8f4d79d7
- TLSH T118A0024302ACEC53D03BAE02EAAF62518A7DDFC3211D755965FBE5FA605016196CA12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aftp.ini
- SHA256 464d61d9d251d63efb02af8698c21125962a18992470080bf8929770292302f9
- MD5 b245857286d2cff077355dd82086c950
- SHA1 cfdec6e72f9ae77d81fce48e0ac25f8e6c96ce50
- SHA512 d2997b2c779ad1bf2b946180a2f2883e4ce7a1a94b2c67cfcc922d4f52a7b9bc5f8c45cd7b3e97f73287981f7cf73ab65cf9e9c6d89761cfc96f0b885724e8a9
- TLSH T1FCA0024302ACEC13D03B6E03EB6662508B7ECFD2211D114995EBA5F6A0502639A9E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Agettext.ini
- SHA256 f502d4781c78fff2b7db83e1f37db6c8bb4648ec0d2ce00decdc079a9b551738
- MD5 7dfbed71c04bbd15100e719b20b7c764
- SHA1 3a69469914ff8b57d35e7c18ee3671896011de36
- SHA512 2c023b34cd8d66982fb685f5ba09704f65569cc7e07320c6bd31df889993d85e9de2e561eb37c15df7886c35d4f1b1c523f4b929a110ba19a0a176f23ae32739
- TLSH T131A004434155DC4350377F01F5555150D77DC7C1110D514555FFD5F55051151554557C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aiconv.ini
- SHA256 922d70e6a207418f4bf87c4dda8685cd19c278c50cf1332b0a11a33e7c32d893
- MD5 f875ac0ca30dea610b2adc421b9e997e
- SHA1 d3460acc4309eca91d5a0d58a91112064693083c
- SHA512 da7e6168bb9556d21b087c4874328e7ad12fb154a117ae5fcc574bf0c479e9f8529d51d502ead261023508686645f2c37486c6fdbffc35ebc71a19871b86f96f
- TLSH T1F8A0024302E8EC03D53B6E02EA6662609A7DDBC2250D104955EBA6F66260265868A52C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Ajson.ini
- SHA256 ea4bace2bae8c8a7cd575d52fcec09db55201bc110123c123e82961ea57577ef
- MD5 0732bc961c57a55cd03a3294554d7a70
- SHA1 b09c9281ca585ed2692e9835f0e77fe857b26a2a
- SHA512 3f4a6608e819953db9a7042fa380613553c92bc95d41d76cbfc441ea1e3216400a9ea60b3d85b67cc5b392bd66cd0a385c90b69f621f55db66b884c95fc8b91f
- TLSH T15BA0024206ADEC03E03F6F03EB5B55509A798FC1315D184999EF90D56540261468A13C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aopcache.ini
- SHA256 eadb95d7c508f3cf42c2dc2ed035be3d0da20136b14e02422476ac0b535a4ce5
- MD5 11686c89e38e05a6c1ef41c186588b21
- SHA1 3764f5d223c96cc03989047dd9f47ecf12acceec
- SHA512 b8d0a6842ab025892b7488bb9c7864d3a17ecf51c4ae94bb33eee1276ab0166ba96b1612fa87e2b6b431e8582a28559e3dcdd10a6230239c69b577ec9b7b4e02
- TLSH T193A012131304DC0342362B02EA455054843C43C01118000460AAD4A480001510DC5010
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Apdo.ini
- SHA256 b072d1e70a5173af7e968b4abf908e017f5f8675d30dda36ea7443dc410d2e5d
- MD5 2bcf2cd02149a7b3118f9a8ed7cfe1b3
- SHA1 cf5354039e953188d5e4a77078ca95777def5d03
- SHA512 2d97da53a09789b87792bfedac54a4c08da8e50ca4bd9706d6192c30c26ea0eeaa13333b3b48500a876ac6b86d851fc5aff802a2dce286d86abdc37e9da548a9
- TLSH T173A0024303A8EC43903B6E02FAA7A250897DCBC2601DA16951DFF6F59050161668E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aphar.ini
- SHA256 fd62472e0bf8b260ed712068086a2a55b9dd71bf13b1f0e07897eeea3bf723e2
- MD5 9dafa1a822dd003107e1686818a191fd
- SHA1 37fa75ad98c661e11ef2c29312e74cf70ba10591
- SHA512 fb96656e2010aabde843513dbc68581a04246e8c071695d7384a8d7f84e589869598e1615d1f7bcd4129991e0383f829cf671a1a7b7f72a35d906cfd7b62c8a6
- TLSH T1EDA0024302E8EC03917FAE02EA677A548A7DCFD2211D505965FFA5F560511A1868E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Aposix.ini
- SHA256 e1a5a7c827fc17ff94cf87beed916be62d6b025346b4a274adb8d835785109b0
- MD5 0f55f144c06b074b7c0a498928001452
- SHA1 b6842cf2bd95ebbba788d4c95af3154d4f61223c
- SHA512 d92bd3c182a467802a0419d2d40eae8e836a6995561b8038bac6fdb430e181a7c9aa08aadb4932da4104d8431c1f749e71c135cb92a8bb7c7a2d255b8ff43210
- TLSH T164A0028303A8FC43903B6F02EA666254CA7DCFC2610D905969EBAAF56590161868B12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Areadline.ini
- SHA256 fa6d93d1de1704dd7b40708204dec039308bd867d549c4cf4aef597d40d4394f
- MD5 04d2378963688a881deb69b0441f2a80
- SHA1 abc4b93b0a882f335f25d742308215fcf33d2801
- SHA512 cfcf2ab2dfed5def1d6c81d0aad137aa2ca54fcd8c20a5d569a1484a0c89a882b0c47cd9dae2356c465c44fc8a8d2ae65f35bf56434e8f171ec3140f8e88539c
- TLSH T135A002420EBCEC0BD83B6F83FA975551BA7CC7C3210A2149D6FFE0C671481A18A9612C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Ashmop.ini
- SHA256 134aafee92de1f650b7eb500cd6336bd33149bdd3fab4fba939894fc7ffc8193
- MD5 894f4d6c5c36f658499b941a02bbc9a7
- SHA1 99f88a477327d4fb8891ef92dd24884d452a8301
- SHA512 89d046d2300cef1a2ac5eae539dc37236d1937144c103137f98a4fcf983fccc10646b231afb02ad601a8396a979e93bbf42736230897ab52180b474d7c89a796
- TLSH T1B9A0024302ACEC53A03BEF02EB6662508B7DCBD2610E104969EBA6F6A494161869E12C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asockets.ini
- SHA256 eb31eeb6aeb34f31c1c695dbac0c9a69f909874f01341679382da0646641318c
- MD5 5c9f4598aa9e02021783e540fc023c66
- SHA1 d65f65cbec25f7752b0e7dd862c9e8f7d01b1155
- SHA512 1653bc7ffc5a17ab2bc2114bd1bbb177d60c04c4f57418d671d98b915fe023a65014c8701682dce2eada6872a5210eddd547ea78a290728d613d6c90a69a2f83
- TLSH T1E4A02403017CDC03D0371D03D5151110553CC7D5110C000414D754F03000110414503C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvmsg.ini
- SHA256 ab104d16fcb223c3fff2af1880490f879e940561732d66571f69a15d498321d8
- MD5 0ac70c35787ea579baefc56e36ea9c47
- SHA1 84125c310359ebe120c680d30ca09273db5bcedc
- SHA512 3de749098b8a3db4d7fe444f19bddb31dd33666ca209c7b216d48bc63be4a1ea4b4bc01dc6c1d5d109c5fe868e9e46b4604c79881842bf96e80ccfae975a323a
- TLSH T101A022830BECFC03C03B3E02EAB323208A3CCFC2200C020C00EFB2F02080220828A02C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvsem.ini
- SHA256 2f7f5db8fddca372e034f3c7bb34f5abd861621fa5282bd0808bd320e2867e85
- MD5 a4c2616a57351dc93cb36e1f41c63926
- SHA1 b679a69c3f01bed6e66854844859ad70597bd88a
- SHA512 5fe91d9dc0b46d73eb26e3dcd7cca2962eaed09a0436afcd9e843d386ddd26269c8f883a1045eb05c5b43533d0046ee1c36373d1319bc99e2fd757b6d5102d0e
- TLSH T1D0A0220303BCEC03803B3E02EAA222208A3CCFE2200C000802EFA2F0200222083CA03C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Asysvshm.ini
- SHA256 4218981bb40ed218b01846cbdc85b436133859b2b051f740f992db14a702b2fc
- MD5 46bf0b73759bfdd7fcf431ea42d03c2f
- SHA1 8c91dfa289d74a78f55708fcb112c1247b384672
- SHA512 222deb5f9a46ba757088377a1ea46978ec99ec8c8ccc6ead22630edffce5b46ca6c87c96b9d5ff484fcec78921db345d2b0426d51af789117d968050fbeaaef9
- TLSH T1ECA0024303ACED43903B7E16EAA66661CA7DCFD2211E114959EFB6F560542A186CA13C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Aphp#003A7.4#003Amods-available#003Atokenizer.ini
- SHA256 5915e8a8256d4ba7b8b021ce1bcb9456ae86cd98e1100b6b57e098ccf169e6a9
- MD5 cb36a25e9c9d2c975cb49bbb56f16465
- SHA1 f16e3989efcead1a5879ba8081e64bddea63337d
- SHA512 0face1fede39b50366e8c55a1606ec2900be77e4a9bd94fc32dcd39e0a7442b98bed20b056e8a7d90810ce3aed92b8ddddbe8fe9792960fa8aa5b417cf17e71c
- TLSH T1EEA02443415CDC0340373F01F5311140453CC7C1300C004410F7D0F1D401110414F01C
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Apostgresql-common#003Acreatecluster.conf
- SHA256 9b3107a922cad7dec8a3023c0e68d0f47a2b8c3bea964326f75dc9be1726ace7
- MD5 91fdf04a0fc0b2cd321c8c7d83312c14
- SHA1 732407520ca8cdb420a1e37f0b6073125f2518fd
- SHA512 4234665dcb31ad1c66296d3629b54637fe47f6ecfb89d1355170ab01bfb1a33869075c471e489c562cfc90cfede05b447978849ef51b81642d2d86549ef23f51
- TLSH T1A6215614F12E65250EC3F92334EA707067D8A2EF223F3575925BA10CAF47400A26FE15
- MD5 SHA1 SHA512 TLSH
ucf/cache/#003Aetc#003Assh#003Asshd_config
- SHA256 180b7aff7eaf3d3223972dfdaef748f1e0c269b5b244628d711f2f981224f3cb
- MD5 6dbdc3a27e1953d209f929df7aff0c57
- SHA1 e211a4f96247fb484f517525fb1b857e11d5d247
- SHA512 5c567a534bb073560a505a19ab6e421cb46e840c281f742cffecbe0f7b2985a1e289fcbad02c3df9a0f6539e98bda4dd3a207c289f6a808252d7f7a960e3bced
- TLSH T17461959367A9BC238FC1938ED3C155E27772D2BE2DA97C2445A6BC48030F41F4362667
- MD5 SHA1 SHA512 TLSH
ucf/hashfile
- SHA256 e45b388815d6db21c2b846eaf71b9e8f5c09333721c3cc2eff2b21673a372cd3
- MD5 6b250f2ee4a1a4036f5cf1f13b26ff2b
- SHA1 62eb5798485fce82501e96cf8df9614ee8b7319a
- SHA512 f5239910a8ddfd792eac3e770eaf307d9ad7584b539289f552edf472254c99f6077144810984a74e568f52d0f1dd31c2263e0e70cf952934b0d1e348869066f8
- TLSH T163614FE3CE17EB67A837CDAFCB58EA48275AB0D06005982DC40D5E7023CEDB51C6A808
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.0
- SHA256 f765f3c39daa5b3ed2ef1ea5414146b570c41eebfe0717e29d68cfd4725c1cca
- MD5 aa33b516ce194a30c5e4d69cf2d588f6
- SHA1 4bcc778c5d7e8101269e7f5da52c4f564b204b03
- SHA512 0fbf46912deda51a6f5ed71e8bb7b77a2b5c30e2fbff90b5a0a370e9d83fb6980648f234faeb57a563a885f584544c6cace9c58c84ce942e56de9ecc87d75e02
- TLSH T140612EE3CE17FB67A837DDAFCB58EA48275BB4D06005982DC40D5E6123CEDB52D6A408
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.1
- SHA256 cbd401b35d6e9a5e521f2e207e354444f16f8c09750e52c50fc426f50d19269b
- MD5 4dff368c02d41db8d35a7267642c4cdb
- SHA1 d8e29c8737bb3a189751b8191f355d2c6aee8a22
- SHA512 63fa81c4723d4dd18ced51a965d8bf7d6c7f9e4033102ff0729ca2bf62f612938d08bec5699b2e5b244cecfd9d5904d3259e80933b6a8012d7d0050fc5c13fe5
- TLSH T1A3511EE3CE17EB67A837DDAFCB58EA48275AB0D16045982DC40D5E7123CFDB52C6A408
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.2
- SHA256 cbd401b35d6e9a5e521f2e207e354444f16f8c09750e52c50fc426f50d19269b
- MD5 4dff368c02d41db8d35a7267642c4cdb
- SHA1 d8e29c8737bb3a189751b8191f355d2c6aee8a22
- SHA512 63fa81c4723d4dd18ced51a965d8bf7d6c7f9e4033102ff0729ca2bf62f612938d08bec5699b2e5b244cecfd9d5904d3259e80933b6a8012d7d0050fc5c13fe5
- TLSH T1A3511EE3CE17EB67A837DDAFCB58EA48275AB0D16045982DC40D5E7123CFDB52C6A408
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.3
- SHA256 5351636edd927870377e9c4b9903d783414545bcb8599b28f74ed7dc35cb0a1f
- MD5 ac69bba169e49c7ecbd0d3c4b0b8596d
- SHA1 80b1a0c06b8da77cf6323cc95849ed3ef29728a2
- SHA512 6713539ef0044b79aec2398522421316bbaaecd07a91801eb169f8a1815d85919f04d603f0de6646652a028bb53920632083a810dc1577bdb952406197cfc4ce
- TLSH T1BA51FEE3CE17EB67A837CDAFCB58EA48275AB0D16045982DC4095E6123CEDB51D66408
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.4
- SHA256 dd39bfce47fd29ffa0660b83d887606089aa42619552bc585639d73f0d9ad097
- MD5 3a4aaaef527a44277bcff34bb02164c9
- SHA1 782ba917bd4ec9aaf21f8114d096c6fdc267e6bd
- SHA512 419dc8c59b95294035810fd6f5c584ab7fd7baf796a2ce2d37731ba21605ccb0a406b6b5103a63b1aa46f1b94aa783d68c9dd238243343832a54f5d8c2cadf5d
- TLSH T195510BE3CE17FB67E837CDAFCB58EA48275AB0D06045982DC4095E6023CFDB52C66808
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.5
- SHA256 67abd153a80b7d89b45c1a8d0420f4cd74f742e9465f9ffd9df59a4a52b4ced4
- MD5 a1fdbf40bd9e02f28fe1f7152a42c230
- SHA1 c4e114dd7c46ec4ca76a31c90b4612462413d477
- SHA512 c48b7b38175f34a19eaef561fdfecc0d2a7a05707fbb440bf7a1b76c5047e8b9fddde303119166b3c615cdb315dd0a81b6d9036330aa6009446fb70f3fc777f9
- TLSH T1AE51FCE3CE17FB67E837DDAFCB59EA48275AB0D16045982DC4095E6033CEDB52C66808
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.6
- SHA256 d703e8c646552654c3f643603d12a2a5d2d520c6c6830e85b7e39ed382b51ed1
- MD5 6dd4a5b5c3128495cc9265d2d4703e19
- SHA1 a4d591b56e6fe9c6d73c5a51bb5c848abb23431b
- SHA512 52165b466835c553390efa2e3897eca382022cf9771176836f2a4d40d8af1a0b37a0285c9827e5c06369906e47251267d5847e011128c8303bbbd33df64e70b3
- TLSH T16D510BE3CE17FB67E837DDAFCB59EA48275AB0D16045982DC4095E6033CEDB52C66808
- MD5 SHA1 SHA512 TLSH
ucf/hashfile.7
- SHA256 90d07549edda8f399a50cee56a6183a36f6e28c5bb031bfbaff2ce6ae06bc926
- MD5 ef30164ab8d191e94ac42076b1a1fc7a
- SHA1 63842b9961ed0882553cc694d14bccec6a22b6dd
- SHA512 3837b71e11faf4ec4ffef0209951368577bad896709cf037bf4b76b1487bc5af8bfb37c93daf0968cfa6b8f8afabb13bae24ce444c75a9e7e2f0629059d02ec3
- TLSH T114510CE7CE17FB77E837DDAFCB49EA48271AB0D06045982DC4095E6023CEDB52C66808
- MD5 SHA1 SHA512 TLSH
ucf/registry
- SHA256 8e7b0f54d405e35dac02f6f99c21078937a5788a07fdbf05348d9a1fb8831e0a
- MD5 e586a69c7bd731ad6ecc8a895de819cf
- SHA1 c73ceebad6b985c7a5da44561898bd2dc25bad2d
- SHA512 6a06761f992fa681831294e85646b507a278d3b78a7f7d9ed4f31f66636bfbf4d26bc5673a69c901bfb57290d9502fa7e59aa3f2bcc70cb5133c8e8545f9a1a6
- TLSH T1B35151EFD953BBA7AC298CAE87985A3C177EF1D430238819935D1E3213CD8F05815667
- MD5 SHA1 SHA512 TLSH
ucf/registry.0
- SHA256 eceff212e48125ee17f085b646ad72e2c11765958d18f870ed9f99316d0e42cc
- MD5 4eac794437a520d8563c6e16fec5c40d
- SHA1 b32c5b7679642acefa37c68f742310628e802b4c
- SHA512 1e12d437879037c2480f05385e0e2df81812d9c2e31f521a5aff765303605ba0a430b15bbcb3c0ec60549714196f08ab20b0f411674d527548f6d8dcefd9a50d
- TLSH T1854140EFD953BBA7AC298CAE87985A3C177EF1D430238819939D1E3113CD8F05815667
- MD5 SHA1 SHA512 TLSH
ucf/registry.1
- SHA256 775c183dc947c010f9439e21ab276031980651823ae7f8c899ae51ed550d098c
- MD5 8a7dc9a639a622b8bd9f8f5ab3d84da9
- SHA1 6037995dbee22fe0c47c700a98c927771c12739c
- SHA512 06196f4624647b9a8ef370397eb63cdfb446afe95b97deac688e92627fad8597d9f3eaf60e9d5b2713ddb7eda93ae13c8c4a4735c9aeafa4267b846841749693
- TLSH T1A64100EFD9537BA7AC298CAE87985A3C177EF1D430238819935D1E3113CD8F05815667
- MD5 SHA1 SHA512 TLSH
ucf/registry.2
- SHA256 649fd642ab252ba5099e46e9858207cf0f8f8f6017ea481a3b998df803e82ac3
- MD5 16e5da83238aa61ff73dc03f122e47de
- SHA1 ef0f97b16b1c213f3459295cb3cbd12163ba6110
- SHA512 dedc6943f3f39afb171d832a33da3a023150dbbda212f340c152393ad655b6e3e1b1d799d17574cfcbfe2633f73b6a82339d7049351038469583abaed3cc6bb2
- TLSH T1F1411EEFD953BBA7AC298CAE87985A2C177EF1D430238819935D1E3113CD8F05826667
- MD5 SHA1 SHA512 TLSH
ucf/registry.3
- SHA256 4b9b33f5f3f4b071cb580592280143e46bfd9a234d21d89194714abc95d67fd4
- MD5 2adad0ec367d206e9969fff87f7e33e9
- SHA1 59d0fad24c63a148cac6719e27ed70dbc0a62b2f
- SHA512 7d9d0eaf68a391e7b29f2164be6c7d797a869da4214160537da6488ae8332d971e6881e7f6ad8ce60db2b3c4dc6678933b67cab431e43daecb1a3d560e05c580
- TLSH T1E7411EEFD9537BA7AC298CAE87985A3C137AF1D430238819935D1E3113CD8F05826667
- MD5 SHA1 SHA512 TLSH
ucf/registry.4
- SHA256 397dd9f3b45d13a5c08c6c9db78ed1e13879854cea733526be84d932e04ab619
- MD5 efebc7918a968f74ede5a89d644aa437
- SHA1 73393e94abfe95c03349af410c727bcef65ac41a
- SHA512 5f831e620e98e32fded417f653fadbfa7494efa4d821c97f87ae8a120ab86522141b03bbaef52417ab0849532cf2970f4a143dd7a62f4b3ff954c29827368f2e
- TLSH T1D1411EEFDD537BA7AC2A8CAE87985A2C137EF1D430238819935D1E3113CD9F05826667
- MD5 SHA1 SHA512 TLSH
ucf/registry.5
- SHA256 6a16be43fc24272842fe1323888adbd7a76bf0da8aa043da3a46fec8383722f8
- MD5 58bba1e7627251fc55d0705d6e179b8b
- SHA1 0a4ce9ba05351a6249a610c8c8265048e608da98
- SHA512 a97c9f378ab6ab0410f6b2b258af3616f988638c830d9f1c05c2ee87a4bd5e3bad55979da53d4f6a46690b9da1b13e2de35b9b859c821dce79ffdad9dafe3195
- TLSH T11A41FDEFDD53BBA7AC298CAE87985A2C137AF1D430238819935D1E3113CD9F05826667
- MD5 SHA1 SHA512 TLSH
ucf/registry.6
- SHA256 e579b92acd780b1182918723536cff08cc440ac3559a14cd5cb2925d9c182a8a
- MD5 698f1bd55818e1d7ef74ecd37d980245
- SHA1 795c80282d25652b774ada50b53946a5f0bdf52a
- SHA512 8d49f834ebee8f741a2cfb03bced67a9c2086c07455aba4c24d5c3cef95d38dd488191521582eb63ab4c05f1d7018d00b521829469a82a8c99b57295dbd300cf
- TLSH T1D341EDEFDD53BBA7AC298CAE87985A2C137AF1D430238819935D1E3113CD9F05826667
- MD5 SHA1 SHA512 TLSH
ucf/registry.7
- SHA256 c0962b3fbdc4b7c7574d3e81d1956f8c74f35424675a5115c3f876d279c0f29f
- MD5 dc285755d9d614b730ee4df5f67a8ce4
- SHA1 fc40cc9db48635005b32dfe107ed2fa53066ffdf
- SHA512 68b289b91cef6e75afcd895ded9f93922d1e6f54873599ce16facbc914515605ae80d4b0223f7e15a27aeead568f8f429ce58735801360410799861424206725
- TLSH T1AD41DCEFD953BBA7AC298CAE47985A2C137AF1D430238819935D1E3113CD9F05816667
- MD5 SHA1 SHA512 TLSH
ucf/update_check/80/COM/sqlvdi.dll
- IMPHASH 6499b940213d268aa405068355eafe37
- SHA256 19e4a2a8676a9f4a488d67f1f7e44bf8a013f0ab5c51d7a0d4911e4b2300e2d6
- MD5 5fca59a96ad276ee95bc6ab297c3b374
- SHA1 08cf8d5ddf77fb7b51e210a316b5f89b81acb514
- SHA512 83dffee067f9b6e5349e3b3f4db469ff9e44028e1ccfbcea8b89d2ee3946b75c31aff4a2f04058e22cbf7afe663f650a105c14e1dd9ee096d4d026da0023ff56
- SSDEEP 3072:bXA0f7V8M5uGcdTbdfQC2mCpCJ4bvu76gAOD05hoTl1wrcGBxG2fOXEOGS8:bXA0fBrcdTb03WhJYkGxGaJlS8
- TLSH T124147B717AC180B6E8F315B816FCA676153DB9A10B6088DF13A81BEDA9307D09734B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:23:bf:49:03:40:17:f0:1d:e7:36:77:b6:0b:e6:13:40:93:6c:4a:2a:1f:ed:2b:81:18:52:17:77:e1:c2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
42965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\18\obj\x86retail\sql\ntdbms\storeng\dmu\dmpld\vdi\sql\sqlvdi.vcxproj\sqlvdi.pdb
kernel32
OpenSemaphoreW
CreateFileW
WaitForMultipleObjectsEx
WriteFile
ReleaseSemaphore
ReadFile
GetTickCount
ResetEvent
WaitForSingleObjectEx
SetEvent
ProcessIdToSessionId
CreateEventW
GetComputerNameW
GetCurrentThread
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetModuleFileNameW
GetModuleFileNameA
GetCurrentProcessId
LocalFree
FormatMessageW
GetCurrentThreadId
MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
CloseHandle
GetLastError
OpenProcess
UnmapViewOfFile
OpenFileMappingW
GetEnvironmentVariableW
SetLastError
HeapFree
GetFileAttributesW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
WideCharToMultiByte
VirtualQuery
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
WriteConsoleW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetSystemInfo
GetVersionExW
CompareStringW
InitializeCriticalSection
advapi32
SetSecurityDescriptorDacl
CloseServiceHandle
OpenSCManagerW
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSidToSidW
RegEnumKeyExW
IsValidSid
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityInfo
QueryServiceConfigW
OpenServiceW
BuildTrusteeWithSidW
OpenThreadToken
MakeSelfRelativeSD
LookupAccountNameW
GetSecurityInfo
GetTokenInformation
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
GetLengthSid
CopySid
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
RegEnumKeyExA
ole32
StringFromGUID2
CoCreateGuid
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25203,
count=138, id=261, version=25203,
count=18, id=260, version=25203,
count=34, id=261, version=26706,
count=15, id=260, version=26706,
count=19, id=259, version=26706,
count=1, id=262, version=25203,
count=7, id=257, version=25203,
count=165, id=1, productName=Unmarked objects,
count=10, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=3, id=151,
count=1, id=258, version=27034,
ucf/update_check/80/Tools/Binn/sqlvdi.dll
- IMPHASH 6499b940213d268aa405068355eafe37
- SHA256 19e4a2a8676a9f4a488d67f1f7e44bf8a013f0ab5c51d7a0d4911e4b2300e2d6
- MD5 5fca59a96ad276ee95bc6ab297c3b374
- SHA1 08cf8d5ddf77fb7b51e210a316b5f89b81acb514
- SHA512 83dffee067f9b6e5349e3b3f4db469ff9e44028e1ccfbcea8b89d2ee3946b75c31aff4a2f04058e22cbf7afe663f650a105c14e1dd9ee096d4d026da0023ff56
- SSDEEP 3072:bXA0f7V8M5uGcdTbdfQC2mCpCJ4bvu76gAOD05hoTl1wrcGBxG2fOXEOGS8:bXA0fBrcdTb03WhJYkGxGaJlS8
- TLSH T124147B717AC180B6E8F315B816FCA676153DB9A10B6088DF13A81BEDA9307D09734B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:23:bf:49:03:40:17:f0:1d:e7:36:77:b6:0b:e6:13:40:93:6c:4a:2a:1f:ed:2b:81:18:52:17:77:e1:c2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
42965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\18\obj\x86retail\sql\ntdbms\storeng\dmu\dmpld\vdi\sql\sqlvdi.vcxproj\sqlvdi.pdb
kernel32
OpenSemaphoreW
CreateFileW
WaitForMultipleObjectsEx
WriteFile
ReleaseSemaphore
ReadFile
GetTickCount
ResetEvent
WaitForSingleObjectEx
SetEvent
ProcessIdToSessionId
CreateEventW
GetComputerNameW
GetCurrentThread
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetModuleFileNameW
GetModuleFileNameA
GetCurrentProcessId
LocalFree
FormatMessageW
GetCurrentThreadId
MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
CloseHandle
GetLastError
OpenProcess
UnmapViewOfFile
OpenFileMappingW
GetEnvironmentVariableW
SetLastError
HeapFree
GetFileAttributesW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
WideCharToMultiByte
VirtualQuery
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
WriteConsoleW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetSystemInfo
GetVersionExW
CompareStringW
InitializeCriticalSection
advapi32
SetSecurityDescriptorDacl
CloseServiceHandle
OpenSCManagerW
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSidToSidW
RegEnumKeyExW
IsValidSid
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityInfo
QueryServiceConfigW
OpenServiceW
BuildTrusteeWithSidW
OpenThreadToken
MakeSelfRelativeSD
LookupAccountNameW
GetSecurityInfo
GetTokenInformation
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
GetLengthSid
CopySid
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
RegEnumKeyExA
ole32
StringFromGUID2
CoCreateGuid
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25203,
count=138, id=261, version=25203,
count=18, id=260, version=25203,
count=34, id=261, version=26706,
count=15, id=260, version=26706,
count=19, id=259, version=26706,
count=1, id=262, version=25203,
count=7, id=257, version=25203,
count=165, id=1, productName=Unmarked objects,
count=10, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=3, id=151,
count=1, id=258, version=27034,
ucf/update_check/90/Shared/Resources/1028/License_SysClrTypes.rtf
- SHA256 0cb71395534f598d40d12d80d0b1818b2715434a93cc2e4e63bb070aa20c0377
- MD5 af75df6971c1d09d31549698c1917eb2
- SHA1 737b7c496498eb83cd13433861425b3c58c14f4c
- SHA512 ebcd8004fed3277769e559d5cfd61cda4909f7c4a78c092959432f6435d094300ab3fd422e1453cdcc8f0b0446b52b65bf8520b0dbb185aaf4d996979ebb3837
- SSDEEP 3072:1w4J95k2o5XG0iRyXDlaO2ikE0Nud7T3LZqrJjrJoK2Z8e1UG:hJ9K2o5XRiRyTlaO2ik9Nud7T3LZqrJ6
- TLSH T1D2C340A84C119BD4C2A1AB6D9D1CF0DCAC36F112F87181A6E17FD1BB583EC79C9A8D41
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1031/License_SysClrTypes.rtf
- SHA256 08cd68d8f45c4666f45766b228234a0f79aba1f0a7831fa1a57a68aa8e38109d
- MD5 7bb97c6c5b3fa858710b17b0d75a28b4
- SHA1 b29627a4340a757df129f4098f9c31cbefb521a5
- SHA512 968042727ab9e94f79a63093376e98c15e46ef45f38e148cf9ea7dba3980fa8a2cdc682697a274b2ec8b7f7d698fb8ce589b2426336deef85d0a54e4759184c7
- SSDEEP 768:lc4YqWmrDcJiILpro6Qg/rHot6qB/nkQWvY7Ggsb3W3CB8yYGTBOrrw9Cgsb32P4:lcwiIqJ5gZd/
- TLSH T1519353B44402B7D6C26297785E16F49CAC37F21470BD6094A2AFC2BEA57FB78C925D02
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1033/License_SysClrTypes.rtf
- SHA256 d45b2eb44417e9bdd800bf0db90c88725540723140a448fb89742a62ca264266
- MD5 f6f55d4cf917c04a43f9bea86576df63
- SHA1 d735f5fce0fc69fbb823854c1d7e32d06b4f45d8
- SHA512 f9a8e64a08e1590842484348be8706d65e2af32af600529fc34768f76b0ff9b22a41a694dd861f96cfbbb6cf300bb3607025a63e1787eb382431fc26a10f1c99
- SSDEEP 768:lLvkQNejs/ZsZfwiiQmskXPl+JksDj1uzIFQjEo3G7KfPsO6f4rNqel8Ssnv0NVm:lLMFWfLoN9JTw8OmOWQj635dL
- TLSH T1659362B84001A7D5C26297799E5AF08DAD37F51070F9A4D4E2BFC2BE913FE78D624902
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1036/License_SysClrTypes.rtf
- SHA256 fa92a28407f529b6223912524e576f4e9a150fbb5e9edb8b69333af8ba29819d
- MD5 dea508f34e9bf89b057baf32210ba022
- SHA1 79c02749b69d0d20c156003687aca0d3de7e164b
- SHA512 5204aed92dc4995db83f523dd7f0556b99b9a8322e85d9f4ccbb827776ed5e3422425bdd4836ce9984bc1788788b22fcc4809dfb8aa3b1a95956fcb4273ba8fc
- SSDEEP 768:lEvITfvFTK9YC1PnGamsdtCBNzHQah0zmvY7Ggsb383CB8yYGTBH9vY7Ggsb32FB:lEwPwFnpGNP9yUpczSHzhs5FdD
- TLSH T1F3A352784441A6C7C261D7785E16F04CAD3BF10070BCA4A4E2BFC2BEA63FA78E575902
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1040/License_SysClrTypes.rtf
- SHA256 7a6abd6464105179622ec76d9d20ab892d35c14866cf23dec3175ed6427504d9
- MD5 d1b4838eacce113758c2b62c239ba8a6
- SHA1 a3f961de8a40fc4ba065bf4afc8d3845b2f6b9ef
- SHA512 1810d30571012ba9411e983d65904653fdf49fd14cfebffb7a4cffa6b07547f449887ab1df4b0341e7d2102ea1ded77b272ed2012241e870ba8c6144ab2bb54f
- SSDEEP 768:lgYsOeqbj0duoDN3AmQoHTjUhmqFDPq2WvY7Ggsb3k3CB8yYGTBOrrw9Cgsb325u:lgM2ocN2yydtlc5ds
- TLSH T10B9350748041A7D5D2A29B789E66F448FC3BF50470F96095E2BBC3BE583FE78C529902
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1041/License_SysClrTypes.rtf
- SHA256 a0d6afe63e1000a16e9851e56e8280b314c438059c34024908f63a1c4c2f25ed
- MD5 b434e82c320fb18cfd61e6bae77538ac
- SHA1 f4f0010960f743679b6d05b045ea6719aa6f4300
- SHA512 e4674c44f3ae3cdee238a4fdc33650db08eb8119346d8236ea9130d53ba4da28701499a3610c03a3918d83bac18c5872f28c8c8818a4f877c1097e3b1f196dd3
- SSDEEP 768:1oaLTZQhcJpkp7qpElp5PAzl+bP6NAAsw+3HC74CbE0/s0w7yRBgf/piyjZCoQb/:1o6GL4E1qLmGTgq6XxUisxwo
- TLSH T1ECE3603B5C517698D6E8879D9F92F0CC6CEBF00268768016B06FE17B483E5798297DC2
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1042/License_SysClrTypes.rtf
- SHA256 dfac806cec5029a47b2012857c2a685904d9b983ce61b0ea6db8b12dace3a442
- MD5 edd85e0543d4d7e0bc700cf5160f0820
- SHA1 c9fa3b524006b899321068b260ececeb66a72d95
- SHA512 9e1bc849dcb324af0e8cac92c79e8f9cbdf5a642ab5c93f409fe69575d3fb188b61706a7dafd0ff6563eff1d009ac591a22058b73c173c64972f4b9af7b8644a
- SSDEEP 1536:dnXzJsZl4j6+6mAlmhgNyqSrzwPBKuKEZdp:dXzwj
- TLSH T1868422F481830ED4C2A1AFBDAC6AF0FDEC62921574794F46C13641AE993FE358969C43
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1046/License_SysClrTypes.rtf
- SHA256 4dd36cefc1fb62c1813ca457a8b9d1d92d8fb773af088b38cdbb8b015b751841
- MD5 31788ccd56b1774ca3c442cda344cf71
- SHA1 c4218b65f763bc72055711ddf5e078448fd1eb6f
- SHA512 4e56b5c6effe62ecfc4db9486515af6feca4bd3f660ddb3149b2d1fa6195620ac05cdf4dc172bcdfe2787369b917ae7c3b22c690f2f3c54ef6f759d8dbeca75c
- SSDEEP 768:lXfmBwpqzMfpMV/g+KAS803P1aFUMXBb60WvY7Ggsb3g3CB8yYGTBOrrw9Cgsb3F:lX4VuLUArzUTwoTLdv
- TLSH T19F9333784401B7D6C252D7786E96F44CAC37F514B0BCA094E2AFC2BEA63FA78D535902
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/1049/License_SysClrTypes.rtf
- SHA256 8f34e86e025a378883a2327f89a767d2ba5e6d0b84a6d8a3fdb15b821b0393f5
- MD5 5bc6753191bcdcc38ad825b304d40a5c
- SHA1 9d275d60ffe0f462f960badae90554d81c9b1806
- SHA512 c387083417956da2bb46da8da8adb8c06076e13b41fdbd91ce2e88e92916217ee3c604b9227c3f02812f11a833b8bf42509ef97bf5257ba5481c85541360a333
- SSDEEP 768:lcvE4tWcsxB2xz5yUaai6YZJ0Dx5xq09ifbvY7Ggsb333CB8yYGTBOrrw9Cgsb3u:lcD2GPEE81VYZaE6dY
- TLSH T16DD36A7848206586C151DE6E4F6FF4495E6AE01DB8F8204F92EBC3B758FED348A63427
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/2052/License_SysClrTypes.rtf
- SHA256 6e3ab98064cc8c03882b7f1d926cd06731507fa45fb9da113acf47dade26f935
- MD5 dc9510c853b34a3dcd5df79edab00d40
- SHA1 6820cca319e1d348b5101408948290e4e23d13f6
- SHA512 7870b6a4cd450e658a1651c29eaee5bfe4fbd7b2ff627355e554cb9287de6e4f167fd558c5dd79e1d03a602d2758750494b19250dd775864123faebfc3b32b89
- SSDEEP 1536:1X8GdwSDoDP+WBR5xRHxCeFvh6l1nVak55SF3DzK3xizysb:1HyP+W9xRHxCeFvYl1nks5SF3DzKhizD
- TLSH T1AFC3326C5D212B9DC16296FECE18F08CAD36F102A4B54499E57FD27F583EE3CC5A9802
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/90/Shared/Resources/3082/License_SysClrTypes.rtf
- SHA256 8b22bf1ae6eff48a0db233b3ba578e33fdf5ffb0970fdd4fda5c34b18bd1da12
- MD5 1457bc2916c92669ac1423a4f667bc5c
- SHA1 1b25c6ea070b20e958a640e9a9f44e47aee0eb39
- SHA512 eeb33b102b75d8dc2a3c0b6aa27b8493874ccb120b20df7ec4a880751cd4b993331acb11c0f36cbf136f0bf64aafe3ac4b927fdcddee14edc833db9c79611ca6
- SSDEEP 768:lUlZL0fLAhWvY7Ggsb3t3CB8yYGTBOrrw9Cgsb32dXsIpsAvikCMiiKECM3RECiU:lUbLcANBpsqiiKECM3RECiZSdj
- TLSH T138A342B84441A7D6C2529379DE56F08DAC37F60070FDA494A36BC2FEA93ED38C539902
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/Client SDK/ODBC/170/License Terms/License_msodbcsql_ENU.txt
- SHA256 c80b4a4bcc21fe489e877d8cc7b3f3cfe4943801c4bc899a0f3c82244fa0f28a
- MD5 07cf3e505b9c844de73d54d0159e55ec
- SHA1 3db89b017a4ca9ed90ae1297dc25ffd7dde5df63
- SHA512 2b954d025a2278a459445fe809d3ff425797220ed500dfac120991bc1130fbafc4d5025b790aa4d1e84d8d1897f50608b3b3d9e9c111f95bface79d8791bbd3b
- SSDEEP 192:MS8fRlsLqbBDLonGehWyeusZithrBTNH5xc1eKB5wcp6aFWgHSs:MS8fRljbBnoHFeus+rpNH5+1PDDp6aFZ
- TLSH T1784294AE734543624AD203D66E0AD5D5F72F82BA361BAA5078A8C10C1757B2DC37F2DC
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/Client SDK/ODBC/170/SDK/Include/msodbcsql.h
- SHA256 3dfa4ac8ba992e3c2751688d192b382911702cc1565c27604b7548a97a5f0fc0
- MD5 bb869705cc8069a5811eeac7457622f9
- SHA1 7ba894271e8a3f57c6bd8cbb6b480ec468cbba03
- SHA512 019a1e3b8988b5b4f2b331a35790b31079a126ec4a92e5fbe1a36937c6a3dc407740804e935cb56480a35a65a045c66e89927ef322546a167f1a18d123a63b2a
- SSDEEP 3072:hu37c3X5ybUH8HiHgGBvCWLK4S4YFIrioyAYtAOfV:vyGBvCWLK4S4YFIrioyAeAC
- TLSH T100B3949C6FC25676063FA105A77E7451EA1AF83F9AA092D43D8C4E0A1F2488513FF4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/Client SDK/ODBC/170/SDK/Lib/x64/msodbcsql17.lib
- SHA256 5f303761f4c0cdea25535dc52d4cd310308733443df2887103dd488a9f92d5d6
- MD5 73f16ea2744aac5f7d940e270a15d96b
- SHA1 7e1f685fe901aba5f055571e3712c3b96dd27372
- SHA512 b86d1d45e3d140be227595db43566ff5f83d99cba052d9e207d5337ae73c411efb61c760b9a34a37cc37094e96b5638a67545c36e23cd2a982ee185c73ead487
- SSDEEP 192:GpWH0QpsyzbjX0EKW8JX0vt+RxBxJorDBxqxv5ya7KxmpqxfxJg7oxhxcx1Lx1CA:v9oEoJX0V+RxBxJorDBxqxBya7Kxmpqg
- TLSH T13CD18D356C70580AE2E6C735B53994BCA5BE88C38F07503BB24C85615F392A7DD97D88
- MD5 SHA1 SHA512 SSDEEP TLSH
ucf/update_check/Client SDK/ODBC/170/SDK/Lib/x86/msodbcsql17.lib
- SHA256 0ca1e69a010f5c4a8cea193d5144f277c7370157d68fcf45f2e09d7a8c9871e3
- MD5 992fd89649da9582d7f62ea0953943e8
- SHA1 4fbb7e122f086ef27668eb3046786ab562c46123
- SHA512 e0572abc717dff3891a8d16f9f6a8355a79a9cda97976c1efd45b12cd644077ea10de767b4e33eed77b0f95a70ce1bff141cc84b921e740ad11ea3d40ebadcf2
- SSDEEP 192:3ZaqjLw/BzVj+SasJf2BZ4wfMXm6Dxrx3CWD5quxyfxOx6xaxdxx1xxCxTBxCxVz:kqjLMzVj+SasJFwfMXm6Dxrx3CWD5qu1
- TLSH T100E1473558608DCAD7DEA231F53C817EE14C98874F02D923395CC5A1AFE9197ECD3588
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/README
- SHA256 a94eec4138b3d826b4c6fb4b14aeb3594dc7cdee138bab1c3400cd27f80c4b0d
- MD5 a4a101317463a0f64cbf9163b65ff994
- SHA1 9da7a7a234395034ed93df9fa73f33d0e77544a9
- SHA512 fe77713f26902d7164d95557fe3917a679edf6fe59248c5afe9c8cb917c91b0f845d461addaa56c39bca676d2cf77eb2c5a5788a4de100170829bf0fcfa20583
- TLSH T129A022A20ACE002228008BC0AAA20330323EC3AC833C00800E08320820A300C08FB020
- MD5 SHA1 SHA512 TLSH
usbutils/aspell/en-common.rws
- SHA256 b92e1233a11acc4bccfb8df5ce90eada0f5fa72a122b962bd4a8c1d5238dd76e
- MD5 3df6a1cd59bdb6d6041df59a6a4bd23d
- SHA1 4a72b76f781d651efb205e17cfce2e9c0b614fbd
- SHA512 0090848b0743f61d0ef03794d06882d3d65e9c6757aec42fd0ca2ca5e3f2e5621b0411ecf1473ffa86f39ad147742954bc34b177867f0ba21e4f515cb2c24c64
- SSDEEP 49152:aQv2PR7slXPpEy5h4bW5Oq+6RD8Sf9jM1+i+5Dq70+JbCmu9/xmaTl4v0nRPY4Sc:H5Cip7/J
- TLSH T139B54B9BD88141E4695F1AB6A82416D037258F834DFA8DD77368328C11FF9C562CEBBC
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en-variant_0.rws
- SHA256 e14b1e0063397526592aef6b3c36a49203d21f9bd2f47e01b24697701439a2c8
- MD5 1c9dc8743e0a1e949635d037b0f35287
- SHA1 eea19a90c33069ae57bf78dd64fad2db6bbf554c
- SHA512 dc488674bc56fc865aeda4cf54314a0a06bdd8dfae4765500b0230b7606c48b81675b35f298af11709bfc6e31040bc427f195fe17819e859c53a94beced9817f
- SSDEEP 768:fheSFWZaK1VLSNrkzG5RjqT7ifFcTrxcMTHJTEa38N+1uKliTK3nN2FmCNwUI:fkmeaK1VLSNQoMIcT1cuYN+RliscFLM
- TLSH T1F2035A06F40211F2D57F6AF4944092CA3744FF4A6EAB6FEB7314378C21BA54612CD6B9
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en-variant_1.rws
- SHA256 b543578d0667018f6afe9e78ef96b5f58ebe98ffb1fe8c4484c45a3cdc456200
- MD5 352d7e90612da1c51a9e3a332e4d452d
- SHA1 d8ddfa8181fafd7284ac382a7ad084ad2efa732a
- SHA512 5ea7c3046b69cc402ac09b72c1eff9825fa6140e2fb1d3b280ebaa98240c2b80a71ea38bcaa41b89021102419be10ce846b8a3b54f3531379dddda0c52338aff
- SSDEEP 1536:42uKG1ES1I1K1xf88bGhyWnpapmQG7p85SD8fxwSMdMDIdou4TJngp3lThnPKLgr:oJ1El82y6pa6p2SD8fxedM8z1lnPKLOh
- TLSH T129937C0BF49111F2E26F2AB1A48096C57741AF854EBBBED373283B4D11FA28521CD5F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en-variant_2.rws
- SHA256 e6db15f161233083e170928a8e76f4a8e336cc5b3930b23563e315f413b19841
- MD5 35f1dbb7f1982d6c06842b445582741b
- SHA1 15c079d0d96de701b23aca27e84b7c276b7f3cfc
- SHA512 6a95ee9a1af2e644155c27bde5f3c6a089f4e7bc511e76698cecfa45796a836bdd4aa88927999f8e553351c50992233380de2fcf6e5dafe1d75462b5ed3a574c
- SSDEEP 3072:wJktY5DyO4aQprSDCdjzxMMj0jdfb2wzBcQ:wJktY5l7QNSDCldXQ5iwj
- TLSH T1ECA36C0BF48211F6A16F2AB05480A6C57751AF815EBFAFD37329378D10FA68925CC5F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en-w_accents-only.rws
- SHA256 969ea2e1068ada4634ef704dfda3b76cf13b21e917fc89a846c76531f3a2b675
- MD5 2431c0a4eed675aaf4ec91dd66db28a7
- SHA1 e287548f289f31aa92fd714ee45185301bce8df6
- SHA512 6e9c77b6d66d0f3c1e30f08ff6050ada23a2962d69042b97d4e94ee15660c6a4801fb0df5a882e86c7834d2bfa394bc6a762ba14bb23ab7940673fd9c9055200
- SSDEEP 3072:lhYdmIhuc9Yhxql/0I3FQz4zdvlVMLbmyUovMugwQvSlr:lmmCoxql8aQzsIEoEugwiYr
- TLSH T18BF3B586F8440092E90B7A76552066C13335EEC14E3FAFD77179369C50B75881F8ABF9
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en-wo_accents-only.rws
- SHA256 b7772a2dce40eaecd3b8851e748c0eab82259bc2799b0266f777f204b855b9e4
- MD5 8601df70fb255c5f44cb37959fd559fa
- SHA1 a2fc74673e8758b1d46eccc27e60425009c97e44
- SHA512 d5507b24bb60a01a301e583835090376da2ffa58be58b354ddeb6b7df217de67e284169ff0199a72bf69e9c8bd8505c27536f458fef11520a83be33a7e7ded54
- SSDEEP 3072:lhwBMIVuk75hxbVdNoA/Q6SzNnlMMLlNiOoNMugwQvSlr:liMY/xbVbFQ6KbnoeugwiYr
- TLSH T15AF3B58AF84000A2E50B7A76552066C13335EEC14E3FAFD771B9369D50B75881F8ABF9
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en.compat
- SHA256 9849bb5f02b512e0fd9f5bdf04ca1e402ea75fff348db3e4c8b7552162890656
- MD5 6af88b407a655031d8bc5ad8d2a2f73d
- SHA1 7ead58835e98c4aa43d3e2ab95cf172c55f36b4f
- SHA512 39d9cc30bfe3cb8001fc3f1ff775a3b168e1c6d2d5320922c2fd76745c0f8f54cf6daf1e26ec1a54c452737625e0ba53852a3fde745864e26d4927490adffdf2
- MD5 SHA1 SHA512
usbutils/aspell/en.remove
- SHA256 f1c4573cd2e845efb06f36d85102d81391ed2b8787a8e90b59a7889e46436169
- MD5 af5ddd28b94b20c89373920deeb54cce
- SHA1 fd57ffc06148ee20737838b29ad4fa4e4f683d3a
- SHA512 22f316d62215253cb9f9fac91f4156d47087c3117aa4494f45eb541c05c27ea5458401b80af05b15a5427795bb9b17f0b2e3d3f11079fedfcd7ac2acce692a72
- TLSH T1E431A547F3BD6962F3CCBFB049ABA69E5CF46134660678285C8522FED5894C2C212D27
- MD5 SHA1 SHA512 TLSH
usbutils/aspell/en_AU-variant_0.rws
- SHA256 0f32d66b4dc36720f2418c8bab2b587a8d4ab31e1c6925bddae176b9fad6e9c1
- MD5 262b63cb4b203f2953c18db0d93c2215
- SHA1 3da8a3dbbacf01640700c9e8266d0fa55a4eb05e
- SHA512 7b0a3227f337b6706039d3833f1f7f373396d7d6a5478ac270873629c522c749b87cdbadfc9a94ae86bf4fa0488c995821dc73653d8b391737e339039ba0de28
- SSDEEP 768:xJn046FI4o+Bgde2eqfVfVbNjAzNEtd+4+vrQhlyJamWvk:b048I4o+GdetmbNjCU+4+TayJa4
- TLSH T180D24B47F10650F4E17F1AB59040E0CA3345EF8E6D9F6EEB76243B9C20B2646528DA7E
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_AU-variant_1.rws
- SHA256 fd0df6fc50932edafa8577efce65b35a7b80f0116563bfa1c0995d593945d3fb
- MD5 c84247abddfbe4bfed893ff48a11dff6
- SHA1 743bbb7d4b38f7a03271218bdb3b7036b07c29dd
- SHA512 f4a4118040c240a334d94f862837486e373e011b0d545e23f2a1a295f31e6c6d4f67100799c814e7466f16e4488584e4636fdb5a015db6c00104d5277edf56b5
- SSDEEP 1536:EWyoCl2ORo+Db1bIyChfVTnMbSD3WAnMMCxNlJ6TVd04/:EWyhr1TChfybSD3FM3NTkT0a
- TLSH T10C636C07F48111F6A57F27B15040A6CA7304EF855E6BADE77328379C21F278662CDAB8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_AU-w_accents-only.rws
- SHA256 140ac8e81f116421040608bcd5a6362c0db36265e5f7db3373679d1acac531c6
- MD5 5434ebe8a6e59046b95099f526287b8f
- SHA1 4c4fa6a3671d1601713ee14a6cb39cfaa2fa1cd3
- SHA512 90f7994f357ee698ce3dcf4b27fd64e7d10682d1f6bbb4f43ad5e60e8361337d85670145cb8ccaebb523a63f2ffc94e686df52a5c3a9fcf9542c38d2e0e6a206
- SSDEEP 3072:/sOByKIWgWXOdNHR/GmXO9iJNo2rH3ceqHnj9:/75Y5x/zB4rnx
- TLSH T199A31886F1420152AA5F97765050BB813736EEC24F7F8EE772293BCD407218D1A9A7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_AU-wo_accents-only.rws
- SHA256 7b95912e83da2e0af3b5ff31cd7556d27e7a56f6b9ef6396a8eeb465efd6f8c2
- MD5 31efcdac01ed2ecdaca5b4e1e0310605
- SHA1 82e6bee87ef18afe111163349d20aebcf174c267
- SHA512 f7f0951ff456bab53a44e082f49475e8d4ed3b8b5845322f88c1363f37b8ce445eb0f6dcd331082db97ef881dbb4f3fe2d4c86e37c66baae3ee7f11fb6c0d060
- SSDEEP 3072:/sOxq+eWAes+pH3C/ImGkZi6HQ2rH3ceqHnj9:/jtG2S/RJ4rnx
- TLSH T168A30886F1420152A65FA7765054BB813336EEC24F7F8EE772293BCE407218D265A7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_CA-variant_0.rws
- SHA256 f7b9e61bf8c79eb9b5b0a48aa1a5a384e8cb9e76832088501b8bfebc8a636b7d
- MD5 81886dd7d1b96f33549f5c317e3f7562
- SHA1 36d323986cf90a215788d5be891098ed96a1d9cf
- SHA512 de57d52e3a039897f3231ff2aede6bf285c43f99495e4020f7cfe44b60de382661ebac2562218b9ac9ba99e8b9bcea6d8588ffea19e4b9170b30a0e803c186f5
- SSDEEP 768:F+Y486y1rdtBMxiPo+bzpSBd5tDl1YKJOMLrZqcdCQ+4EBzaPL+JKwKPUd6C9ce7:f6+rdtB5Po+vpSF8MLFquCmL+APUd997
- TLSH T130036C0AF44221B5D57F66B08440E6CA3700FF499D7BBEE772243B9C22B754652CD2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_CA-variant_1.rws
- SHA256 83d34cb0774c08cf8f0d38d2373a8ba49a8b62aaa2261b934d6c5685d6a0cdf3
- MD5 0e0fba8b21aa8bd16811be658f1e870f
- SHA1 b82c86e606c40404fe3cc8f7233df06c8248dd07
- SHA512 178d47462f2e8d6e86b90f3c79b8cd813a033dc8e058fc936fdebf0349fbafd3421b23f2b958c8ee819a8a09bea84f40b056b5f6a476b7e50f0d7b826008c45b
- SSDEEP 1536:M84Ms1eksPuThOUo+IYbfjxHS9PzcvSDHX4O7O6zQfCQ7DS9ni0H6r:M9YkK4WYfxHCuSDHXt/zo7DgnicK
- TLSH T1C8736B07F48211B6E57F16B19480A7C97704EF865E6FADE37228379C10F628A62CD5F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_CA-w_accents-only.rws
- SHA256 5c74a181367009ab660a1d67eaa520794b3623c9f360d30599873f324adf1a4e
- MD5 47c0441c41054c05371098b3207e5bb0
- SHA1 9d9dbed6883d689585f29de752a23d9fbe95ca34
- SHA512 7de767a9ea9506e94142d24bc109a4b7ac965704affbc83faed3b2bb28232993edd6852d86fd14ab2487ae7c945a8fada5dab612c47237af1b1ef32362b5e570
- SSDEEP 1536:ZozP6t4XgsmWKZ7SKLK7TSxuBWzQlPZWTNaZti4NYX6IF9DNSBNWNc3x:ZyIhPcozaWTIZM4NYDNSBNWa3x
- TLSH T163930589F1420061F81FAAB65860A2C4373AAF464E7FACE7B239375C10735D5165AFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_CA-wo_accents-only.rws
- SHA256 c77177a53fc9769d57d3e8f123208e95463ab32a781beccc6dae9fc53d458581
- MD5 c5a6d66cd60141168f3a1e9380cd752d
- SHA1 618c56b5e0d446b5a44fc81db68478e0d88ba73d
- SHA512 170d55e346cbde000c5908dfebc220aa037b020a2b354d4c2f7f132a49b4fe471a06a26f57fbf515fe746f4510dbcedf37fea377ed2a1cd5391a47f69634d4cc
- SSDEEP 1536:ZozPidwXEKymihSKU6cTqxugeQQSsZ4DDLFi48wd6zp9hNSBNWNc3x:Zy4bH4jQw4DvFi48w8NSBNWa3x
- TLSH T19C93F589F1420061F81FAAB65864A2C43336AF564E7FACE7B239375C10B35D5125AFF4
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-ise-w_accents-only.rws
- SHA256 7f5eed299c272faea781417438b329fb0e26fc2db772bd034ac99a3046605d9c
- MD5 cba7623e107b9c3b985714161e8f621f
- SHA1 78a903cc7c2268d735b8ac1cecadb5c65e999f70
- SHA512 4b1763f28fb64a740cbbacaaf467b5183e31591e6027899d899e0d385afc186254d4100fd1c10d57375c912f9d5ad8a85dbfee65a6051bbef4aa54a082cda441
- SSDEEP 1536:CX4Fy7HZY+jkJi5SL7tW9exuJykQT9RdXJSXvUDmbKoWiWOLtSKz2Wd3Zj4VJeDM:CoFyN1+HWqkeXJS/ImbpWib6KZj4jOM
- TLSH T1A393E586F1420152AA5F9B765160BB803736EEC24F7F8DE772293BCD407218C565ABF8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-ise-wo_accents-only.rws
- SHA256 01fba97670a2a47b26b73882522e50f113f686873c2fd6b90b1bf1ffd618090b
- MD5 160c635473dd4bda48a471db04d32d41
- SHA1 129bff08d839e5b1fdaa3d07ba5bbf44bde1a0f0
- SHA512 b18ae53c841da811a3a5b410c1cc023d414a18e2bb265d4a4a2678a467cc3cc4f4b8dbf4e395338476c86ed1459a056905c6c8c65064b19fbb161c3bd344692b
- SSDEEP 1536:CX4Fq7jZwonUxsNzIteNGxuK68QW9KFFZlXvqmA4wCi+bbX4Uz2Wd3Zj4VJeDM:CoFqJjeFef8EFZl/qmA3CieQKZj4jOM
- TLSH T16893D586F1420152AA5F9B765064BB803736EEC25F7F8DE772293BCE407218C165A7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-ize-w_accents-only.rws
- SHA256 9e4d478cadb0c22d034a83dffaadc6d14f2d600edf8cf44190d03d0c28b0f76d
- MD5 52444e73770ffba2a5f0657c465f404d
- SHA1 d4036ce495393ec29fbe8c0b3eae022e7705aa51
- SHA512 61b41a996a77f84c1e804c53057dbc9af2ebccaebe5b16d8d4867638b77b21301720d43f9e04cc0a86b7f096cc7e382dd7fd5ebd3a133757007a371dd7d2cd8d
- SSDEEP 1536:7sXLRPWOIJRAKKJjkSKO8vTd4qxu0W2Qr7x+Ok4Tg4pmALGB/SQ8+9sPBrcgQ53:7495dbgd02tOk484phas5re53
- TLSH T144931589F5420051F81FAAB25864A2C03736AF524E3FACE7B239375C10B35D5265AFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-ize-wo_accents-only.rws
- SHA256 33edcf7ded91eb9bb8e34300f8ea7db1cea01f4a2201b37ac1a1ed78b84dedd3
- MD5 490be604b3c75b8f8781ef3425e59429
- SHA1 457bdb77568272e624c1bcf9c7132bef8ae9da70
- SHA512 dab8217d7a313c340bc6071fd0e4144d10cf50da399a96af11c6692f59a3ee9f051e5e0efcd5586de00f1626ac34d3d79ebe05d533a50460be6805b4a503dd90
- SSDEEP 1536:7sXLRPWWAFX06iPmSKFUkTloSxu7eeQSjawe7864uEgq8nZSQ8+9sPBrcgQ53:749p7TaldeRe7864usas5re53
- TLSH T1A293F489F5420051F85FAAB65864A2C0333AAF524E7FACE77239375C10B35D5225AFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-variant_0.rws
- SHA256 cc3ff8e4d1da358f1f5c6e3672d55f97b4608989e4ab6928e45bf18525e737c3
- MD5 2b1e250abff72de68bb0555a075b2424
- SHA1 edf8fddec08ddecb21100bc88e6843338411a026
- SHA512 d4f5cbeb86a93974e420cdb7af6d0b8f48c3c933c193289072f9245efa3ca94bc517f4d2be1b45b6af2296b6c1e47623ad6bbc4f401d9eaa72736f8dd9e08548
- SSDEEP 768:2e684S6FIzo+Qij5y2pBXXqezMj5IbE/6H+Gg8pqVSPx:oY8Izo+Rj5L3zMjqPH+L8pbp
- TLSH T1B9C23C07F00251F4D27F15B19050A5CA3345DFC9BEAB6EEB35243B9D31B264A238E67A
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_GB-variant_1.rws
- SHA256 09990bd7f48f8196e3bf033c1beb4f5be72a62a9d490c59e1753ad27160dcf57
- MD5 f8bba49c7583c0b49eb4f1c9f7f44db7
- SHA1 fdb820a420d65096a89edea7fcd484f7b1a34bc6
- SHA512 d9e741186557e501689cca0c2149d59d6b5a5f9b8038c4c19fc3a1099d6b0633383e80eea42aef80ea88454f6fc1a6724b71886072121b45b1cb62e46ba8bf41
- SSDEEP 1536:liG0vojcCl2Ooo+4Y7bHmZ/NnEdSSD31QXONCRNZ73tUejwv:liG0ad9Y7CZ/sSSD31Qe2NFuejwv
- TLSH T13A535B07F48251F5A27F16B15440AACA7705EF855EABADE37328379C20F138A218E5F9
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_US-w_accents-only.rws
- SHA256 cd77fd6f1fdd53ee75def889d632f335d058223bc0a19d40ee79ebf2b23b9fc0
- MD5 d34887b0e3057bd2ba9c145f1aa36fa1
- SHA1 e75005cb92ab949342aa9c1423813cb8a1750bdf
- SHA512 7b79f37e56acbeaf4532f6bcb1a05e64a64a8464fab34d9db27cb7894947b7a853a360e64767e0249c12ac3eb172b59cb32e6631788ed1a8d32890b1e5f1acb1
- SSDEEP 1536:N5PD4ldBpbzwSKf5JmiTmYZ47wBtSt44qCZiZdjCscX:8bmfmiKE2wBK44GHcX
- TLSH T1C19305C9F5460062F86FAAF64860A1C43735AE524E3FA9E7B278335C10B3599125EFF4
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/aspell/en_US-wo_accents-only.rws
- SHA256 1b4649c11e2a765499b522cef5f4853a63e4abd11ac15363b1ddd0dbab56cdb7
- MD5 5e990f8b2e631348f19f782841f17992
- SHA1 868968dfdc0b0efb3a0cc4518d8768b89785c9c0
- SHA512 e23dbbaee36d52381f117c7bbb8922acb185c8354edf9c1777bd9af8d53eafea38fd74450a276cb729ba6abcee873e0dd054cb41e86b7a9da441ad97adf6bd38
- SSDEEP 1536:N5XzwldLlbUSKy5QWvIVYxJ7SxFqGu4NWZcsfdjCscX:SbjSWvQUVSxxu4NeHcX
- TLSH T1AA93068AF5420061F86FAAB65860A1C43335AE524E3FADE7B27C379C10B3595125EFF4
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/systemd/catalog/database
- SHA256 f4c0b05e86cdaedf99895c55ac39477fa422e77624f8f6493a6693ab9be8b9de
- MD5 0ca66a696b3c505c681a9596d70f7d25
- SHA1 b95022693a28a4f54d7f1091e81ee83aca86f128
- SHA512 abd21a8a85325eb4e2679dfc38fbd82f2e4f16b53cd3d0fd6591aebc80f57152d51853b13551b7aa17bc97446f5df825b144c21fcccbfa548df3667a4d49dbf1
- SSDEEP 3072:SBcNiPQPkiIW0VWNO8mg1v7awWe9L4fSlaJ99hTyxaTw5jiQ1yinA:NN8QPkihckO8mSawTifSlaD9hTyxaTwc
- TLSH T1A1E3D5B54359746ADB17D1F2BA00658EAEEB68FF7FD8936046CD0B385981870C33D826
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/systemd/deb-systemd-helper-enabled/apache-htcacheclean.service.dsh-also
- SHA256 796c34cf0d9f8daf6434d0a1a6d906610a91aeba39f45a9b5ae8d570945d84e4
- MD5 973358b9c966d992987587c6be05900b
- SHA1 281e88064427d60d7cb993cf85e1cbf2708a8e86
- SHA512 72893cb4d3ff4da7f116ee761171291d6d440a27d6c09272ba456f8c4c4d578a4c3cbec44a611ae1d3ef52bae2f0160ff455747d9213129c107d7c0e4cc7eabd
- TLSH T1D1A00219E7F51CE1260459B4893126406A7B70D46F4225254FF900CAD1C08DC737CD36
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/apache2.service.dsh-also
- SHA256 47c8f757ec236c0afd20ec6d01828a0f8f0f033d3fa67ad5469a8bbea8d6a82f
- MD5 79b67122dd819c03350c3ec4183f2b19
- SHA1 e2081fef4924f843df72f812d4b34d5276ec22fe
- SHA512 485d52a24159662d9688872ca805cd7aecb0e458436127f7c578306aae28bec6e2e38be242463cc7903e3d1fba71c11799b99b851cbf477c1a63f0a291109e11
- TLSH T194A00250D7D118A1140415B485357640597A30D46E4221244FF900C5D0C08CC67BCD21
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/apparmor.service.dsh-also
- SHA256 55fd055a2b70ecf8d6b11474f3356ed801a08f7f09cc25a5e8c5884b9330a881
- MD5 faae6b24f17f47621e4b0af0dd1d4ac9
- SHA1 8b9adf87a1fdccc69ea5b0c85134343edc6c3fb8
- SHA512 8432c00b183b4d27769aa85063cd223f3c15cefee0a68da8aa58bc6f7756b2018b90428aa6304820d774a6e86344344ac81c6f55f0560d5051a5bbf645e4c1ed
- TLSH T1B3A0022493531EA31110163846511594577A30A2235161580FE040E1D1C09497368D31
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/apt-daily-upgrade.timer.dsh-also
- SHA256 05e0a72e601e00feaeff5d237f892b5f891cbb9c156fc5da667ac56c25f20fdf
- MD5 04fd8c2b0e172a16a7d829898482d0d3
- SHA1 ba8835db3c4430ebb7b44e1882b880fb01c31395
- SHA512 6f40bc630c00c519b50164137555986bfedfa15c0b2bb8dd9788aad1e6e759d42350ba9832f268cafcf8fd2e86c050ecbd5873c7fc3ccb581827485d1a941e5e
- TLSH T1B2A002186B1249D1C4C92635A5295BC52B7B75D6721A001C0D9C21C2FDF584C32E5D2C
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/apt-daily.timer.dsh-also
- SHA256 71649d5e78c0ba864daf3778e8d90a3707b88c587a4634cba67aa9094def7750
- MD5 6992f1d0d496b3fb03873442383528f6
- SHA1 400ac63e53870966e35ed6cce893c2921b10eccb
- SHA512 7069299f070fdaa8e19df7780cf1e8d9a5479e807b05be1d0d6aa3b2aca132c60a454135348f29b2e12383da27c087088d483d3ea347c5ae1e287d8617cbb5b4
- TLSH T16A9002185F1249D194C9257165191BC417773496B21A001D0DC821C1FCB588832E4D2C
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/binfmt-support.service.dsh-also
- SHA256 93ad5c806fe40c560f85a47a4064e09fec51b5510c9ed3220d07392b612c7274
- MD5 fdde577761dc0173de1b1d7e87164b18
- SHA1 1e7ac2d52078d3464808e8ead6c89a01ea267f2c
- SHA512 ff358c5dde40d82c400ece9ae0b389ce046a0fb77206d11360a4e798e98f4a4175b012a2e6390f944c731d3427b473c6cc1bc97f784aba9692f01d78cc28991a
- TLSH T108A00230D7F164A316041CB0D5F11A4A5A7930D42E81E1275FF50AC5E0C0D8CD778D65
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/containerd.service.dsh-also
- SHA256 7045f062744770b7240ec67333b27e7b0d657860ed577acf31683cd0d086c9d5
- MD5 5611e4bc963d9073e8df141af26d1a7b
- SHA1 3d78e8f394658d0f53b060da4760dec8fdd3ec39
- SHA512 5f12f8889fcc65f2c92ce6e2dc852168c1fa26549d0366e7da711d09380ae5eb1253a3631ead957415987be24c099bf2e512099fb984efe0507b071927d3e0a3
- TLSH T150A00220DBD114B16404147C95311A486A7970D97E4126255FF240C5D0C080D6338E65
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/cron.service.dsh-also
- SHA256 21eb4d4fadaca75913b3cfcb1513cc1e5d7d1753dcccdbe770a05011d661fddd
- MD5 28cfd2070799c1bc3a9ae529be638ffe
- SHA1 a6a60f9a3ff89c6e7a5a8d6b7c5a2b35d0691377
- SHA512 dc3b12acbbcab9b18b3f2139a71e65a431e339af377db0093974f2226d0caceae2d9fc7642865be2b349e057048079454b5972c7e505c43eeb93d94773c69f9e
- TLSH T1AC900210D7E114A11504547895311645557930D52E4121254FF100C9D1C080C5338D21
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/docker.service.dsh-also
- SHA256 ec53169078642864c1d63585e54f69e19e9da8fc035edb67f8fe6c0096fc59e0
- MD5 be0cd151df1e0f19579bff5372c604d1
- SHA1 f89309cc8c4768e5ffc3ae8ac8bc60ddfc588334
- SHA512 f5068ddb0482d4e12c5315dbb5ca33792a719a038c9e086e8b21f013cba88b345c2b85ed0a5f0f5d4d20820229688535788509d85dc7cd8c01d956486d897ea8
- TLSH T18BA00224D7E114B12524587085711650557970E96E5121244FF500C5E0C580C5378D21
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/docker.socket.dsh-also
- SHA256 b775266c9f9f2c650f61c3bfd007d5b59eaa2412aca6ea435255d1d8ee782689
- MD5 546523711bb614071b145c24d793c2be
- SHA1 48e27026adf6b6bb92b7f597d059fb1023422a1b
- SHA512 1c4ab517d576c1530d8f94bb53d4a2c451f18e404f1e207dc6d9f4773e8a84a39c403af24bd8870cd3afedca754dd845b37fb60b598af76416a2a44471afcc87
- TLSH T1FB90022DD33309F171305D31819015A1357A70B5375100140D8408C1E4974041225E24
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/e2scrub_all.timer.dsh-also
- SHA256 02a92626ce1053b563ecdf2724c5150257fc36219caf0d728dc849f541b1da2a
- MD5 a613f87ebef3e03696367f300487ef84
- SHA1 3b2cfc22b778be58e9741f1019d2d6405510f8ac
- SHA512 ca31614294710537c49e3cccd1702f9f2b0ae68e116940a065db2f75acbfc013be99cffdc20b99fd74f684aa3457c66f217c04ad4949e64607521244051cc644
- TLSH T19BA002196B72A6D1C0C62B3145A02BC457BA34983211001C0E8445C1F8B495D1269D2C
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/e2scrub_reap.service.dsh-also
- SHA256 da0c9e1aeb7608a0321231aea0394620ee3eeee301c646fcc1623dfd9b546349
- MD5 9e3f0c1e39c1c89427a39a666b88fe7f
- SHA1 1c09a2296830ec7a50a71b798e42de0612a4a7e5
- SHA512 671f2df3f197db88622b8540030d61227b7ae7a2a9e4f10dd30e5ae564c74fb5d4eda4fe7b463a69ef071cb9a0f9030af335887b72e2ea1df643b9682c4886e0
- TLSH T17FA00211BB6264B1500318304A912740A37A38996242306C1EE0C1C1E08091C5238E74
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/fstrim.timer.dsh-also
- SHA256 6a9438efc04c93e981d38ad13aadb92e4207e12a6cf9bca683460be1a06257b2
- MD5 75c41858df4c3f1ef24deca4efaa36b7
- SHA1 09aa078e85de1f05ed0a3a1295053fb359a539f7
- SHA512 e60d7428b52ff8ebddbd462453320e557a1cc9f2c1f7bf42415f30ab48b4a3a3726425c86622ba3bade0d76af79d3e695fc24b1e91662a6ee6957322858cc618
- TLSH T1E6900228D71248D541C5383185201BC41B7730943301102C1DC501C1F9B490C1274D28
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/hostapd.service.dsh-also
- SHA256 c8608930267783c7acd8e2486974357b58c5863a2d4a59cd2a2cb38e29398c8c
- MD5 74f084059b3cd50263412547a120b95b
- SHA1 1621099690d775602ce52bd7875ca668d7ce2118
- SHA512 e415ad4f45212751ad418b4250b99356520aac2c2c025fcec0859b47f15813ea412506f5004c4d8fe3978d6dfe6c625cd47c2c3c0da626f6567291e70a061a29
- TLSH T1B3A00210D7D154A5540414B085321B4459B931D83E8126284FF100C5DDC080E5338E21
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/ifupdown-wait-online.service.dsh-also
- SHA256 72385035bfbeb53732b23a6e2ee5402c23766c6228094473e4f9651fa90fc3b5
- MD5 519138a84cc1bc724b84465c9653d5cc
- SHA1 bbcbef863219babfccf0c545532415daec49b73b
- SHA512 12976aa4f0cc8e6b6c945ae85f31571e12d6c71905c146a07180a343229dfbc6dab1c33b510ba8ca8692165482834fe751b1917adccca7b1d41c986b79e4303e
- TLSH T189A02200F3F320A200088C300002A38020BA30833A0AACFCEFC200CAF2C0B0E323CC32
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/logrotate.timer.dsh-also
- SHA256 2da04e5ba24a048c9fbe8ef861302f9649d5c3832824d7d388a2aaef4de0d40e
- MD5 420f3370e24126dc73ec22fea188fe0e
- SHA1 75e67fcd7a13f445addda33442998316e8b18483
- SHA512 fd0074882a054c6a4506523c376d8e73ae67ce961e2994f99e168a8636f306ca705f38a17fd9c3171f844cd3598ee6badabb9f0a5e9350cf72273e464b4fe4c3
- TLSH T1F6900218971684D154C9253989141BC417F6329C3A1640180EC501C1F9F491812ADE28
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/mlocate.timer.dsh-also
- SHA256 14b06898b3fc9c0e488529e4f14f14a4dd32ad4a8f3d81b26f25328cb2ffb442
- MD5 954ef50b7611324c86740156161dc16b
- SHA1 6abf95e5fe40c2e81cc7cbcd551a6157363b1150
- SHA512 645ee6afaad84f755e7f85ab2ab47e8dbbd63dc4248ae16e743c5d4f275f50eb57e28a62c409e04994e650e6879e8f50708bedae10a6e503c49cb8e8e8003e8e
- TLSH T14C900218571244D144C5353589101BC427763094360204184D8541C2F8B495C126CE28
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/networking.service.dsh-also
- SHA256 ccc4e9465b43e33944aa0d2626d5ecb47e17f8989d1e5e7c68f66f308ecc2f0a
- MD5 09767c24fd40e27d69f84ce7f81e74c5
- SHA1 de2c77db86bee45449b2bc2ea2542f03a68c5a23
- SHA512 cf41a35aed4962c2e1e45cb189aa4cc94fc7e39273fb88107109e15cc29acb082cad79d509855a91a581766873ee293e97bb026c037b9a9c3d059d491ce14b1f
- TLSH T1D6C04816A7A224B6400458308A262F4056B930912A02BCFC5EE062D5E0C8A0C667CD30
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/phpsessionclean.timer.dsh-also
- SHA256 877b623cf8b0e39c8ce96d2e2e04e87616e58b9a8ecf72414528b06574da57c6
- MD5 f0037a7215e0ca8b600585d1df4ad0f9
- SHA1 60b7e6f2199103a54ddf50ef20e52a8463dc88e0
- SHA512 711c8ac51160d4bb5d6afada0233c62f01e426e679cfbebce74f37d1ca9d18d75fbfb57a7e49df728cae299c5ead6239c754d763daf1d4fb9ebf9cfbe5a4b18c
- TLSH T19CA00228672244E244C6AD3185202BC42B7630E43341001C1D9506C1FDB4C2822A4D35
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/postgresql.service.dsh-also
- SHA256 6385cd4b019497a12a0b500a52c359b97ec04eb232b257ebdde98b385bfc1bf8
- MD5 9744c591c68bf14033297596565134ee
- SHA1 2f826e73180eac4fc30c287554095621c1ff4b5f
- SHA512 e29ab202e8da55343c1b120660e8f024fbba58da7ae0f46feceb2865192b2064bc17da4fb5ecf7d39e03bbc7ad216d72ada7a515c15f8551cfa565ac7666c2ed
- TLSH T109A00211D7E114B5584419B09531164059B931D82F8621248FF104C6D9C080C633CD61
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/rsyslog.service.dsh-also
- SHA256 eefca8f0a2fc4415cba1bccc01df8ef1fd1f3ac7542dd0ba6117babb90354d9d
- MD5 9a298ba049f96d951bf0651657e2feed
- SHA1 8c9e5c285fb8e3fd64cec4c805bfd54ee5d2fda8
- SHA512 9b8f0c348b982c3eab1f704dc291d281b85db61e9704d6b6b26f2fe26a6e06f5445678740a1d00b36e05b08d963ae6107a6e12790b9bdd09c43e9e1072bf4e53
- TLSH T1CDB00124D7DA29B6940468B49A262A8066BE70F83B91A1245FF130F5E1C4E0C5378E71
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/ssh.service.dsh-also
- SHA256 9222e31f82559baacd021cebe472eefe99c4ca2aa15afd3b2f7735454ecf73bd
- MD5 5ba2785023abd9758ab8d9b9d20df3f0
- SHA1 4caf5ed31dbb4f98ad34e5d7bd3b3626cd47e8c8
- SHA512 4802d1a999efe027fe617674bf2e9d12edc313f2ab599e54aac18ec3e0c23472f2c14b14868feeb26e825471c80e54358d883add2f8a1a35c2a770fd9b421208
- TLSH T108B00124E7D229B29404A8708A322A88ABBE70E43B9126258FF109C5E1C8C0D9738E31
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/ssh.socket.dsh-also
- SHA256 04d0e502df2a9cdbb41e710018d1e278dc3079bd9f2b9e287bd37b0ad7e25b6d
- MD5 f21484d71fb6b98865a99741d89bde5a
- SHA1 2f7c6e2560ea3f46864b7189f6772bdcce40c042
- SHA512 808697d9d88d74b7d2d3d8e1f9935cc010fcaa450cb356e22aab6e7d75ce5a9ed18bf3e4c9c6e88c43565bc6ae4fb8998a5c8e6de61e8f75dec88c189b9bb9e7
- TLSH T1E5900269633319B1B0301831815015D1367A30E0334140190D800CC1D5934041625E24
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/sysstat-collect.timer.dsh-also
- SHA256 93ca3479ddc1be4a20d867bbd7ee7b1d83dff0d92a084b26f3bf5b4dd3cc573d
- MD5 5fe7234c559e1638af1a9fa8a0c27559
- SHA1 76af6b426d5500286955b963f90b44e16a762c91
- SHA512 46cb91f69ce441c7b741145c1a7bb36dfab17dd487a805621d4b3cf84b7a2e298e25adb0ca7e2ed400e12f7cd44938ab176fb5a826a6bc587bf6b85647c6210f
- TLSH T183A0022A6351813A1CA424300E0528F0733A30702FC050505DD10FC4E7B0C4C576CE35
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/sysstat-summary.timer.dsh-also
- SHA256 757ea08aa028af3919fe2ca84b65a53bb03607e9f1b91b2d442b6623f316ed55
- MD5 68c1df368dfb7179f0ce7567e76a396d
- SHA1 13273c9177cfb8ebaf68ac46ea33fbfca310b19f
- SHA512 190f7a3c9b59e2a5730643a407b82692d3233b660c973247ac29ba03f8df30f3fba026eecb2d0376a6cb1f553f3080fc1b0f06de934828a2315cd2bb4c0a2368
- TLSH T19CA002256251812A2D6014600A0118E0233930713BD050571DD50AD5EAB1C8C076CD3C
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/sysstat.service.dsh-also
- SHA256 ea675423ebfb13aac24c036f9100f9458c9e47eb3ed0386ca092a45c3054389d
- MD5 5ee6a5b08ed3d4a16bd22b093bc6067f
- SHA1 d69c347b2fb38f3540f44a66de427276acf091dc
- SHA512 b9fb84ef9615569d2b5b3cd67d2176886c30e540bbb098cc53e8c184ae258392d098b3d20adf4f2cf0c7070ca7afb5bac159abdb621e7d4c4cbb3ed50f38b611
- TLSH T156C00225A391817A6C6424704B1129E0737A70B03FC060655EE20EC5E6F4C8C577CE39
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/systemd-timesyncd.service.dsh-also
- SHA256 5698201a765f2ec8a0e24ef46fd246ede0a0861b020e8dc5d35079b402215fd4
- MD5 03deb5598b59e1f123186c02e404568e
- SHA1 1edb9b1235e7d4dc7902420d5cd0ae91ad351d16
- SHA512 7bd796f16a7c1cff82d9f4c9349324a403baae0cc3a573d187f5722671eded4059259671c692c8d908f59dfc0b89b4ea4e0dac798414c5d38c052ba1aa27d038
- TLSH T143B092609363157280502D3459263CC56B7E34A1738166248EF858C6E0C4C0D4339F30
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-helper-enabled/tor.service.dsh-also
- SHA256 6b76eb9416fb034dcf7b040828c9741561d6bd4c525048fd07088d9779fdfefb
- MD5 de50ce9ea17c0e973e3d5a435404f2d5
- SHA1 937e7a291da6a1b792f971debc34d2634f79b1f5
- SHA512 7add8ad6345f026f8ff58bb2c242d36852bdce19adf6cbd8e87557ab7123153d8192cc2d8ef5a8c46c773597d655c54ec53b6ed823c7218a63ab544528986246
- TLSH T1BC900214D7D114A11524147085311641557A30D86ED125244FF101C9D4C080C5338D21
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/dirmngr.socket.dsh-also
- SHA256 ae08d5e2d31ea96af0da2b3c13d985b6dd9394bbfedf0a539cdbcecf8c07b1f5
- MD5 65f81211af638d6344239317ba9935f0
- SHA1 79a3c35572d22827c40aae873c865775597e6bc0
- SHA512 9816fe6148854552bef04c52839ac8518bb7809f97f68941b4138d1b779fe21d700b5bbbcd8923ffa209706230f820b216b466c819717a3b17ec7d9ca567aed3
- TLSH T14B90021A52B30CE569704DB19554159A33576080675151144A54088154934001125A15
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-browser.socket.dsh-also
- SHA256 c3c810c96f47023562f218a952f6653a048d5ba3da30325439afa47ccc6fdae2
- MD5 695711ab57e3c4284d5fa4cfeb58d916
- SHA1 347fcf3a47115eca4039378ffdf3ae0f3afb23bd
- SHA512 331667fbb956d4a6ce5ae5370959165279f589fa82dbfd1141245f7f548b274a430ab625deb50175a1520b1c3b6d88c487ed4b25ee658d3cf94554e3fe1f151c
- TLSH T1BFA0026A92770CF56E304BB1955511923197B1D06FD350181B6549C1D8934426A99A18
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-extra.socket.dsh-also
- SHA256 07c4f19dc42a81a6c8f52c5299aec170671dd042d47fc20b25c5e39e6ffa9b2e
- MD5 39059c3a19b6341c048f3c0ca76c56cc
- SHA1 65c560b917b44cb46e0ac5350c2975d3b5c886fe
- SHA512 1f2735cdb705e0e01928f75f5e45ee6681176726c779040b70c7b749d103b72c1ef26333f9a02895a10bd72a01cbb39f3ad5d45d268c84049c7792c875da54fb
- TLSH T17DA0222A82B30CF0A0300BB0800800A0328FB0C02B8200082F0808C0A8830002200A00
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent-ssh.socket.dsh-also
- SHA256 a9ed773af567141349624f78d2f851863c0c176fa6e71149bcc81c3eeaf269a0
- MD5 a53fce9e942063ee9ad474a75c474b05
- SHA1 1a15094c360217d18b8501e3a0f56a5a9b1d8aad
- SHA512 021e12be69058b6991d73885c11b1c04ca1fcd62bb1b6afbbc91a298c4a443724721249057de7315f06a462537d0b453496350a654e9d7fa8048d6df9cdafd85
- TLSH T151A002AA52730CF575304AB1D55511F13297A2C06B42901D1A544EC199934412755A14
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/gpg-agent.socket.dsh-also
- SHA256 d207b29b4332717cb13cf55da2a18c942ddd977356a2f1d3e51ebcdf77544451
- MD5 04568f5815b09e507d95b49b7ff25ade
- SHA1 0167595b0cbba1659fcdd2909b2daa021db20b8a
- SHA512 9576c90bb5ec824f0c241555f2162ceaaebeb9f5b4100dcf7e7602f99af48bf61eae4e2c0962b2475b8eebe493124f2640b53e9babb07682288e7ec3a4cb3a02
- TLSH T14A90026A52734CF5A5304AB1955515E131A7A2C02B4150185A5449C198A34412655A14
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/pipewire.service.dsh-also
- SHA256 823528ea30ace08513ffae5fcfba4d4b3f85dc056760d5700d7ae5505d63b2a3
- MD5 26ba186a4b95531fe29137f3ff638be6
- SHA1 04a20a977f875af73f06614833869a3866b21d29
- SHA512 050f9ec4f016ed199114725722ace36cdd3c2f08813c6e3efb840f2572ccc4c4268b98c5e1ecff442b27ddcbf08c27864cae42246702590faccee773d19d6e91
- TLSH T112B0022AA2F258F558240A728A5612A262DBB5C5678230281BA8CCD659939541219F26
- MD5 SHA1 SHA512 TLSH
usbutils/systemd/deb-systemd-user-helper-enabled/pipewire.socket.dsh-also
- SHA256 ca0593a13093df54ee7fd5f0779cf171064f1558808c98062296cb5ee3aace40
- MD5 ead3e46933f84eb1d19a2237d0c0b0d1
- SHA1 56ec321bbd1a6d9389677a4a65a64c0f74ab98c0
- SHA512 f7982effe07480205b789fb418bf17d58813f031ff32f61efcf887b06b59b1bc247912ed148da7ef307a26d156df47f650bc3df4e9bb8b0c15ed22961d49a7a6
- TLSH T12B90022E52B318E968300B72855511A2319760C0278210140A58CC9259535501115B15
- MD5 SHA1 SHA512 TLSH
usbutils/tor/cached-certs
- SHA256 dd3cdf06ecdde3118d3c3d4bb4754ec00adabe826023bdee9f21aa09cb1aba61
- MD5 6b401f5f9acf27dc440f7481ae1bd667
- SHA1 248597fd609fb9ef6d2402aa2fcfa862ba571e46
- SHA512 c4e06e67acb16180ab7bd58d5afccf961457ea2c2cd6628bed098bbd8635aecff663b0317f30ee3bff1b7d6cf40fcc1a6c360a8c1d6dcf14bc2d69cab7b2f636
- SSDEEP 384:B7IyYZohVRsnd8crOhL9FoIyy9SyhwCoPIo7iGVHhpB8FytAh1Hgmt4hlspeK7Cr:VZMusdmjX4CYVvC9YDEzp2X
- TLSH T14D927D621C953EC446A6C76DDCAB53CEEB3483BB1A33354001D1306BFA6585AA35F839
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/tor/cached-microdesc-consensus
- SHA256 dea7091d8101a01844da1215f6be5889b087d9cfe7acf289b8880ba774ed297a
- MD5 59b487accd0de08438c801fb4364c048
- SHA1 1446fb127d665e730961b06b1e318af697d17f47
- SHA512 b4acd1885cf9ea333187ee5567c5d567c5d3d6588f0d1ed1e82c437330f229f77317d1f3a60707a0509198eebe36c326e6f98fc8113f358a89ad27fd01795bb8
- SSDEEP 12288:FXpYOZB+pgddLg1AqWjjqCiINelwLT108wGVVRfYzI7QO+9hDEyTg36X:FXGOjLaWjoIN6MTyGVV9vQZU3w
- TLSH T1EDB557EEB7131E7EE3B409EB6910566BF77F625C02045F50253B89EA37160423B78B29
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/tor/cached-microdescs
- SHA256 c98f750c8ee3c0bb841a053598bef076d183f9f6899d5ea61cb7d6a881ba93d0
- MD5 f8aadfd8af936ba8b510d33517bf2ba0
- SHA1 f66f622f8dea3667f2d6437a9d18ed1f0580d38b
- SHA512 43df4336a2158a9ab429d89488840b4f0c50b13ca5bce8fbd4f4db9bc2c76db44e579bf2bec8b1d0488a29b641e800540f283cc9876edc0d933882aa6bdceb60
- SSDEEP 24576:ot/OrKtJN84KySmtJM9LB2UK4mfx0MduZn+pc3sA0H4nq4VEWXqqDNRFwMgUsjbW:kcx3I++DUb88sQ
- TLSH T1ED667CEA4D2625C18684C188EC5703C7EB39D73F567818E076DB750B26327CB9B6EA34
- MD5 SHA1 SHA512 SSDEEP TLSH
usbutils/tor/state
- SHA256 d62ed59a9d858548c1bf8fbece6b2fee41797361e1ad97adb67c4d2e359a1e24
- MD5 1b885e4f619389af49a6cc5879cff76d
- SHA1 e5841df6a25f05b12f68a3ad8243e038460fdefd
- SHA512 f67e87b0d84ef0ee69c0b55ec06c38d5a77cc7ce966da3ad7905e791683ad67f77d2c5e2c586bdbcddb0dc757c9201fc3c58eee86aec3f183eb6c25c4e63598e
- TLSH T128818A7AF1B8A84385E258B9C14537C9D9C4BADE23F0B9626C9A47595360843BBF433C
- MD5 SHA1 SHA512 TLSH
usbutils/usb.ids
- SHA256 f269a8cf068bc3ea4c492268f8b70ace39e1d04b521d193f94541e4af0373b80
- MD5 b4097e5467552098232a67da3a326528
- SHA1 7f65230638c1169ddc68e76fd1ad8e69f06c7285
- SHA512 431cfb15da4497df5a863debf3733c374b89cfc6617f73404ab9dc0422c4e845f8fa2c0758094f950988e734ac4b05f1532d787c7cf15784a8e26893277f66d7
- SSDEEP 12288:2JsEukhJLrN1Rcy3naWEH3Wrx0OsN384CEjxC31riyAtIyoAoL2NgidrIjQPO0xB:YukHLrN1Rcy3naWEH3Wrx0584CYNfdrx
- TLSH T108E45B156EDE3813236B928FAB825CBF591E3885261B156B112CDDDC62C70C99FDBF08
- MD5 SHA1 SHA512 SSDEEP TLSH