filenameeTCrtMng.exe
size98304 (0x18000)
md5ac1316daef732ab93e3b8db9b10d15ee
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
14729923
10978297
1080471
1180478
484474
10142
2592109
11978215
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x46c2e3eb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0xf000
SizeOfInitializedData0xa000
SizeOfUninitializedData0
AddressOfEntryPoint0x85f1
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1a000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xed450xf000R-X CODE
.rdata0x100000x22ae0x3000R-- IDATA
.data0x130000x50280x4000RW- IDATA
.rsrc0x190000x4700x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x119680x8c
RESOURCE0x190000x470
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x100000x198
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#110360
module_namehintordfunction_name
CRYPT32.dll80CertOpenStore
CRYPT32.dll50CertFindCertificateInStore
CRYPT32.dll4CertAddCertificateContextToStore
CRYPT32.dll15CertCloseStore
CRYPT32.dll17CertCompareCertificateName
CRYPT32.dll70CertGetNameStringW
KERNEL32.dll414GetStdHandle
KERNEL32.dll346GetLastError
KERNEL32.dll229FreeLibrary
KERNEL32.dll393GetProcAddress
KERNEL32.dll558LoadLibraryA
KERNEL32.dll469GlobalAddAtomA
KERNEL32.dll474GlobalFindAtomA
KERNEL32.dll306GetCurrentThreadId
KERNEL32.dll44CloseHandle
KERNEL32.dll139EnterCriticalSection
KERNEL32.dll809Sleep
KERNEL32.dll514InitializeCriticalSection
KERNEL32.dll519InterlockedExchange
KERNEL32.dll118DeleteCriticalSection
KERNEL32.dll557LeaveCriticalSection
KERNEL32.dll518InterlockedDecrement
KERNEL32.dll522InterlockedIncrement
KERNEL32.dll593MultiByteToWideChar
KERNEL32.dll689RtlUnwind
KERNEL32.dll359GetModuleHandleA
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll253GetCommandLineA
KERNEL32.dll455GetVersion
KERNEL32.dll171ExitProcess
KERNEL32.dll501HeapFree
KERNEL32.dll505HeapReAlloc
KERNEL32.dll495HeapAlloc
KERNEL32.dll643RaiseException
KERNEL32.dll817TerminateProcess
KERNEL32.dll303GetCurrentProcess
KERNEL32.dll507HeapSize
KERNEL32.dll825TlsSetValue
KERNEL32.dll545LCMapStringW
KERNEL32.dll766SetLastError
KERNEL32.dll824TlsGetValue
KERNEL32.dll834UnhandledExceptionFilter
KERNEL32.dll357GetModuleFileNameA
KERNEL32.dll227FreeEnvironmentStringsA
KERNEL32.dll228FreeEnvironmentStringsW
KERNEL32.dll873WideCharToMultiByte
KERNEL32.dll319GetEnvironmentStrings
KERNEL32.dll321GetEnvironmentStringsW
KERNEL32.dll762SetHandleCount
KERNEL32.dll822TlsAlloc
KERNEL32.dll336GetFileType
KERNEL32.dll322GetEnvironmentVariableA
KERNEL32.dll456GetVersionExA
KERNEL32.dll499HeapDestroy
KERNEL32.dll497HeapCreate
KERNEL32.dll856VirtualFree
KERNEL32.dll886WriteFile
KERNEL32.dll853VirtualAlloc
KERNEL32.dll532IsBadWritePtr
KERNEL32.dll797SetUnhandledExceptionFilter
KERNEL32.dll753SetFilePointer
KERNEL32.dll219FlushFileBuffers
KERNEL32.dll241GetCPInfo
KERNEL32.dll529IsBadReadPtr
KERNEL32.dll526IsBadCodePtr
KERNEL32.dll235GetACP
KERNEL32.dll380GetOEMCP
KERNEL32.dll780SetStdHandle
KERNEL32.dll656ReadFile
KERNEL32.dll415GetStringTypeA
KERNEL32.dll418GetStringTypeW
KERNEL32.dll544LCMapStringA
USER32.dll142DefWindowProcA
USER32.dll691UnregisterClassA
USER32.dll68CloseWindow
USER32.dll161DispatchMessageA
USER32.dll682TranslateMessage
USER32.dll551RegisterWindowMessageA
USER32.dll227FindWindowA
USER32.dll571SendMessageA
USER32.dll513PostQuitMessage
USER32.dll314GetMessageA
USER32.dll96CreateWindowExA
USER32.dll534RegisterClassA
eToken.dll38etStartListen
eToken.dll21etGetReaderChangedA
eToken.dll16etFinalize
eToken.dll28etInitialize
eTCAPI.dll27GetCACertificates
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll481RegOpenKeyExA
ADVAPI32.dll504RegSetValueExA
ADVAPI32.dll469RegEnumKeyExA
ADVAPI32.dll460RegCreateKeyExA
ADVAPI32.dll463RegDeleteKeyA
ADVAPI32.dll491RegQueryValueExA

StringTable 040904b0

Comments
CompanyNameAladdin Knowledge Systems, Ltd.
FileDescriptionCertificate Store Initialization
FileVersion3.66.115.0
InternalNameCertStoreInit
LegalCopyrightCopyright © 2005 Aladdin Knowledge Systems, Ltd. All rights reserved.
LegalTrademarks
OriginalFilenameCertStoreInit.exe
PrivateBuild
ProductNameeToken RTE
ProductVersion3.66.115.0
SpecialBuild

VS_FIXEDFILEINFO

FileVersion3.66.115.0
ProductVersion3.66.115.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
098304EXE08/15/2007 11:30:51#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK