2.bin

info
MZ
PE
imports
foremost
signature
hexdump
disasm
log
discuss
donate

filename	2.bin
size	12416 (0x3080)
md5	63ccf2aeb72b072e529e82b72c424cb6

type	PE32+ executable (native) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
260	25711	7
259	25711	4
257	25711	5
1	0	34
260	26730	3
258	26730	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5c80ecc1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.15
SizeOfCode	0x1a00
SizeOfInitializedData	0xc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x6000
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0xd823
Subsystem	1
DllCharacteristics	0x4160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1207	0x1400	R-X CODE
.rdata	0x3000	0x5d4	0x600	R-- IDATA
.data	0x4000	0x80	0x200	RW- IDATA
.pdata	0x5000	0x138	0x200	R-- IDATA
INIT	0x6000	0x480	0x600	R-X CODE DISCARDABLE
.reloc	0x7000	0x14	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x605c	0x3c
RESOURCE	0	0
EXCEPTION	0x5000	0x138
SECURITY	0x2a00	0x680
BASERELOC	0x7000	0x14
DEBUG	0x3160	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x31a0	0x100
Bound_IAT	0	0
IAT	0x3000	0x120
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
NETIO.SYS	511	WskCaptureProviderNPI
NETIO.SYS	515	WskReleaseProviderNPI
NETIO.SYS	512	WskDeregister
NETIO.SYS	514	WskRegister
ntoskrnl.exe	2025	RtlInitAnsiString
ntoskrnl.exe	1823	RtlAnsiStringToUnicodeString
ntoskrnl.exe	1975	RtlFreeUnicodeString
ntoskrnl.exe	1060	KeInitializeSemaphore
ntoskrnl.exe	1148	KeReleaseSemaphore
ntoskrnl.exe	1063	KeInitializeTimer
ntoskrnl.exe	1196	KeSetTimer
ntoskrnl.exe	1221	KeWaitForSingleObject
ntoskrnl.exe	1061	KeInitializeSpinLock
ntoskrnl.exe	153	ExAllocatePool
ntoskrnl.exe	221	ExInterlockedInsertTailList
ntoskrnl.exe	224	ExInterlockedRemoveHeadList
ntoskrnl.exe	1630	PsCreateSystemThread
ntoskrnl.exe	1796	PsTerminateSystemThread
ntoskrnl.exe	629	IoAttachDevice
ntoskrnl.exe	940	IofCallDriver
ntoskrnl.exe	662	IoCreateDevice
ntoskrnl.exe	685	IoDeleteDevice
ntoskrnl.exe	688	IoDetachDevice
ntoskrnl.exe	1507	ObReferenceObjectByHandle
ntoskrnl.exe	2511	ZwClose
ntoskrnl.exe	1053	KeInitializeEvent
ntoskrnl.exe	1180	KeSetEvent
ntoskrnl.exe	1337	MmProbeAndLockPages
ntoskrnl.exe	1355	MmUnlockPages
ntoskrnl.exe	621	IoAllocateIrp
ntoskrnl.exe	623	IoAllocateMdl
ntoskrnl.exe	705	IoFreeIrp
ntoskrnl.exe	706	IoFreeMdl
ntoskrnl.exe	2727	__C_specific_handler

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /CN=WDKTestCert Ivan,131781907128522032

serial: 62A9EB759AC98CBA41FDF183137863F1

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:a9:eb:75:9a:c9:8c:ba:41:fd:f1:83:13:78:63:f1
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=WDKTestCert Ivan,131781907128522032
        Validity
            Not Before: Aug  8 08:31:53 2018 GMT
            Not After : Aug  8 00:00:00 2028 GMT
        Subject: CN=WDKTestCert Ivan,131781907128522032
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a8:3d:f6:db:58:ab:4b:b2:9d:0a:e4:1e:5f:a5:
                    8a:11:eb:2f:26:cc:58:35:d7:28:d0:b0:ab:d6:9f:
                    a4:ac:67:c7:aa:f4:c2:97:61:eb:ba:44:d6:0d:06:
                    98:b2:63:6c:e0:37:ad:7e:4a:44:2f:d1:47:e6:2d:
                    c4:e4:1c:b3:fd:5f:cd:3f:39:84:dc:33:4a:1f:a9:
                    63:f3:c7:51:ef:95:e9:a2:10:fb:03:6b:a6:79:a4:
                    4c:b8:2c:ef:62:9b:6a:3d:07:8c:3b:b3:8f:8d:e3:
                    df:9d:2f:90:ea:6f:39:3e:85:21:82:90:b7:5d:2f:
                    2f:23:62:76:1a:64:bf:cc:68:f7:3f:ff:0e:20:d1:
                    f1:7d:60:54:d5:22:33:8d:4c:6a:a5:ba:e0:d0:f1:
                    b0:f1:ab:67:b4:53:f8:8c:d4:05:7d:8b:e1:3e:82:
                    99:02:11:35:41:f9:bb:33:42:4f:43:23:4c:a1:0d:
                    de:cb:f6:dd:fd:df:f0:6e:e5:9e:36:8c:97:8d:e3:
                    ae:d5:e5:0f:bc:5b:f7:34:c6:bc:0b:c2:76:bb:c9:
                    d9:7a:c0:2b:12:6b:29:a1:1c:3e:7f:7d:a7:f3:2d:
                    68:b0:75:a2:e6:47:bd:30:62:27:d5:bb:94:0f:74:
                    d4:7e:6f:66:17:1f:57:96:e9:83:58:69:1e:86:d2:
                    0c:31
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage: 
                Code Signing
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        6f:1c:01:ec:10:1a:08:bc:de:39:e1:2c:5d:36:80:7e:bc:3c:
        14:bf:3a:86:12:32:ed:86:b1:a9:d4:49:55:3a:77:0f:88:33:
        3c:0f:57:84:c5:b3:3b:30:4d:ee:83:b0:4e:f4:21:94:c9:4a:
        c5:08:3f:32:b4:6d:e0:be:2d:6a:4d:d6:08:a5:8d:78:63:38:
        75:2c:d4:17:9c:21:30:1a:00:c5:f2:a9:cc:fc:53:fe:4f:f8:
        2b:3b:f0:79:7b:97:47:2a:db:19:37:ff:f0:1c:eb:60:1b:1e:
        c9:f1:36:f4:f0:3d:92:54:7e:c8:54:ea:b8:c9:8f:fc:fe:0c:
        4d:cc:fc:c2:88:79:ba:a2:41:5c:74:4b:2d:7f:62:4c:0d:05:
        ea:3e:aa:b3:6c:34:43:78:75:ec:e5:23:fb:4b:40:d5:7e:7a:
        59:09:54:e1:73:8d:1e:e0:dc:63:65:e0:62:3b:2d:84:a4:f7:
        b5:ed:d2:ce:0a:6d:78:bf:ba:d9:9e:e9:1e:f4:1d:49:a0:6b:
        de:4f:30:1d:bb:f9:a2:e8:51:19:4b:1b:49:ec:05:dd:3e:11:
        af:15:df:b1:6e:7d:10:56:a4:cc:5b:bf:68:91:e0:0b:7d:5d:
        85:00:53:49:3e:e8:e7:37:fa:db:cf:d5:d3:f0:9e:f9:43:92:
        3b:d1:b2:59

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

a6 b5 86 d5 b4 a1 24 66 ae 05 a2 17 da 8e 60 d6 |......$f......`.|

1.3.6.1.4.1.311.2.3.1:

00 00 00 00 b9 18 09 7c  e6 42 5e d6 51 22 e7 5d  |.......|.B^.Q".]|
10 0c a9 db a8 f4 fa 2f  00 04 00 00 0e 4f d6 8a  |......./.....O..|
27 de 65 79 fa d7 80 6f  60 50 59 03 fc 27 2d c6  |'.ey...o`PY..'-.|
00 14 00 00 4d 6d 08 eb  18 f2 1d d5 a9 3f 64 46  |....Mm.......?dF|
80 08 af eb 2b e2 b1 f5  00 18 00 00 91 7b 8f d9  |....+........{..|
5b 2d d0 6f 00 7b 18 2f  f3 af 9b 2f c1 95 6b 20  |[-.o.{./.../..k |
00 1e 00 00 b6 93 80 f4  3b ff 9d ed 03 4b 62 98  |........;....Kb.|
1c 5a 5c 7f 80 15 fd 1b  00 20 00 00 52 24 6d 71  |.Z\...... ..R$mq|
71 1b 92 09 57 9b f8 af  d8 dc b8 80 bd 3d 8a 5c  |q...W........=.\|
00 22 00 00 c2 dd d9 15  0d 9b 69 fb cb 27 d5 50  |."........i..'.P|
1f dc 84 85 90 de c7 6e  00 28 00 00 35 cf db cb  |.......n.(..5...|
52 73 e9 a5 7d 73 ec c7  12 12 e5 bc 35 8a 3b 4f  |Rs..}s......5.;O|
00 2a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |.*..............|
00 00 00 00 00 00 00 00                           |........        |

SHA1

f7 92 bf c0 a1 01 42 31 15 9f a3 e6 ff d0 c1 fa |......B1........| 81 4a 61 19 |.Ja. |

2
- 62:A9:EB:75:9A:C9:8C:BA:41:FD:F1:83:13:78:63:F1
- RSA-SHA1: nil
- CN: WDKTestCert Ivan,131781907128522032
- 2018-08-08 08:31:53 UTC: 2028-08-08 00:00:00 UTC
- CN: WDKTestCert Ivan,131781907128522032
- #5
  - rsaEncryption: nil
  - A8:3D:F6:DB:58:AB:4B:B2:9D:0A:E4:1E:5F:A5:8A:11:
    EB:2F:26:CC:58:35:D7:28:D0:B0:AB:D6:9F:A4:AC:67:
    C7:AA:F4:C2:97:61:EB:BA:44:D6:0D:06:98:B2:63:6C:
    E0:37:AD:7E:4A:44:2F:D1:47:E6:2D:C4:E4:1C:B3:FD:
    5F:CD:3F:39:84:DC:33:4A:1F:A9:63:F3:C7:51:EF:95:
    E9:A2:10:FB:03:6B:A6:79:A4:4C:B8:2C:EF:62:9B:6A:
    3D:07:8C:3B:B3:8F:8D:E3:DF:9D:2F:90:EA:6F:39:3E:
    85:21:82:90:B7:5D:2F:2F:23:62:76:1A:64:BF:CC:68:
    F7:3F:FF:0E:20:D1:F1:7D:60:54:D5:22:33:8D:4C:6A:
    A5:BA:E0:D0:F1:B0:F1:AB:67:B4:53:F8:8C:D4:05:7D:
    8B:E1:3E:82:99:02:11:35:41:F9:BB:33:42:4F:43:23:
    4C:A1:0D:DE:CB:F6:DD:FD:DF:F0:6E:E5:9E:36:8C:97:
    8D:E3:AE:D5:E5:0F:BC:5B:F7:34:C6:BC:0B:C2:76:BB:
    C9:D9:7A:C0:2B:12:6B:29:A1:1C:3E:7F:7D:A7:F3:2D:
    68:B0:75:A2:E6:47:BD:30:62:27:D5:BB:94:0F:74:D4:
    7E:6F:66:17:1F:57:96:E9:83:58:69:1E:86:D2:0C:31: 0x010001
- #6
  - keyUsage: 0
  - extendedKeyUsage: codeSigning

RSA-SHA1:

6f 1c 01 ec 10 1a 08 bc  de 39 e1 2c 5d 36 80 7e  |o........9.,]6.~|
bc 3c 14 bf 3a 86 12 32  ed 86 b1 a9 d4 49 55 3a  |.<..:..2.....IU:|
77 0f 88 33 3c 0f 57 84  c5 b3 3b 30 4d ee 83 b0  |w..3<.W...;0M...|
4e f4 21 94 c9 4a c5 08  3f 32 b4 6d e0 be 2d 6a  |N.!..J..?2.m..-j|
4d d6 08 a5 8d 78 63 38  75 2c d4 17 9c 21 30 1a  |M....xc8u,...!0.|
00 c5 f2 a9 cc fc 53 fe  4f f8 2b 3b f0 79 7b 97  |......S.O.+;.y{.|
47 2a db 19 37 ff f0 1c  eb 60 1b 1e c9 f1 36 f4  |G*..7....`....6.|
f0 3d 92 54 7e c8 54 ea  b8 c9 8f fc fe 0c 4d cc  |.=.T~.T.......M.|
fc c2 88 79 ba a2 41 5c  74 4b 2d 7f 62 4c 0d 05  |...y..A\tK-.bL..|
ea 3e aa b3 6c 34 43 78  75 ec e5 23 fb 4b 40 d5  |.>..l4Cxu..#.K@.|
7e 7a 59 09 54 e1 73 8d  1e e0 dc 63 65 e0 62 3b  |~zY.T.s....ce.b;|
2d 84 a4 f7 b5 ed d2 ce  0a 6d 78 bf ba d9 9e e9  |-........mx.....|
1e f4 1d 49 a0 6b de 4f  30 1d bb f9 a2 e8 51 19  |...I.k.O0.....Q.|
4b 1b 49 ec 05 dd 3e 11  af 15 df b1 6e 7d 10 56  |K.I...>.....n}.V|
a4 cc 5b bf 68 91 e0 0b  7d 5d 85 00 53 49 3e e8  |..[.h...}]..SI>.|
e7 37 fa db cf d5 d3 f0  9e f9 43 92 3b d1 b2 59  |.7........C.;..Y|

#0
- CN: WDKTestCert Ivan,131781907128522032
- 62:A9:EB:75:9A:C9:8C:BA:41:FD:F1:83:13:78:63:F1
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

4e f4 ad 91 31 96 9a 1a  66 da 3f c7 1b 09 d9 fb  |N...1...f.?.....|
41 00 a5 d9                                       |A...            |

rsaEncryption:

2f 03 9f af d1 95 e5 30  62 83 b9 3e 3d 6d 36 3a  |/......0b..>=m6:|
d1 6e ab 65 c9 0a 56 ca  75 c5 60 33 e5 fe 39 a0  |.n.e..V.u.`3..9.|
4c 5f 44 ef fc 8d 21 3e  b9 63 3e 56 99 a7 1f 3a  |L_D...!>.c>V...:|
00 76 fd a5 85 f8 89 0a  2d 6d da a8 d2 5a 33 5f  |.v......-m...Z3_|
45 5a b0 37 19 79 9d de  62 15 f4 b6 b6 ba d5 11  |EZ.7.y..b.......|
60 9a 9b 80 cc ee 8c f9  7f 9e 3f 9d be e9 cb 8a  |`.........?.....|
fd af 6f c6 b4 b0 0e d7  0b ea da a1 2e 0f 2d ae  |..o...........-.|
fe 5f 71 02 87 0e d9 f7  27 cd 38 ee 56 5a a6 2d  |._q.....'.8.VZ.-|
16 36 3d 16 3c 0f 87 8f  ef 83 56 84 71 69 b3 86  |.6=.<.....V.qi..|
64 f8 9f 0f fb f9 38 38  3e 19 00 57 d0 0e 5b cc  |d.....88>..W..[.|
bf 60 a2 42 1e e3 03 2f  04 65 e1 3f 33 e1 82 c5  |.`.B.../.e.?3...|
b2 52 67 f0 9e 94 46 48  6a 49 78 8e 93 d0 ff 0d  |.Rg...FHjIx.....|
68 ad 24 ef a4 82 51 eb  69 9f 1c c9 c3 57 f1 5b  |h.$...Q.i....W.[|
b7 34 5d bf bb 3c 36 db  8e 66 a8 08 a4 a0 af b0  |.4]..<6..f......|
56 07 37 fd 6f b8 a7 24  95 e7 b3 fc b5 0d f7 ea  |V.7.o..$........|
e3 50 23 05 d6 59 9a 1d  04 68 6a e2 23 30 d9 f0  |.P#..Y...hj.#0..|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	6832	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK