Sample details: 2d9cb4e97ecb8029c71c26da729f0b27 --

Hashes
MD5: 2d9cb4e97ecb8029c71c26da729f0b27
SHA1: bcd73a221a7140d2b5cb70b7a3b6e0bb0d4e4d27
SHA256: ef7cc405b55f8a86469e6ae32aa59f693e1d243f1207a07912cce299b66ade38
SSDEEP: 12288:ryJXUKMyaXWAC/RPySbVaEA+P7X+6K3GIkWWRCf8H7f:QUKMCnZyQA+P7X+6KW5RiYz
Details
File Type: PE32
Yara Hits
YRP/Visual_Cpp_2005_Release_Microsoft | YRP/VC8_Microsoft_Corporation | YRP/Microsoft_Visual_Cpp_8 | YRP/IsPE32 | YRP/IsConsole | YRP/HasOverlay | YRP/HasDigitalSignature | YRP/HasRichSignature | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/System_Tools | YRP/Misc_Suspicious_Strings | YRP/DebuggerCheck__QueryInfo | YRP/DebuggerException__SetConsoleCtrl | YRP/Check_OutputDebugStringA_iat | YRP/anti_dbg | YRP/inject_thread | YRP/create_service | YRP/cred_local | YRP/spreading_share | YRP/win_mutex | YRP/win_registry | YRP/win_token | YRP/win_files_operation | YRP/Big_Numbers0 | YRP/Big_Numbers1 | YRP/Advapi_Hash_API | YRP/MD5_API | YRP/Powerkatz_DLL_Generic | YRP/with_sqlite | FlorianRoth/Powerkatz_DLL_Generic |
Parent Files
6acec394718b86af1cab369f7a25f430
Strings
		!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
Vhkiwih
tSVVVh
t79~ht29~dt-9~`t(V
QSVWjdj@
PPWShP
PPWSh0
@PPWSh
PQQWSh
F$PPWSh@
@PPWSh
F,PPWSh
vLWShH
vDWSh|
v$WShH
PPVShh
QSVWjTj@
PPWSh`
PPWSh0
PQQWSh
PPWSh@
F PPWSh
@PPWSh
v4WSh|
UPPWSh
t!VWj	Y
KDBMV9Y
KSSMu^
94r=9Y
SVWj<j@
s/j j@
PPVShh
PPPVSh@
G,PPVSh
Y]^[YY
tbSVSSj
F(YPPW
F,YPPW
t7j(j@
PPWSh`
PRRWSh
PRRWSh
SVWj$j@
SPPWUh
PPWUhH
VPPSUh
G\PPSUh
G`PPSUh
LPPSUh@
GpPPSUh
GxPPSUh
tTjPj@
UPPVSh
PPVSh,
UPPWSh
PPWSh,
PRRWSh
F PPWSh
F$PPWShL
PRRWSh
F,PPWSh
F0PPWSh
9u u19E
ts9] tnP
QQSVW3
D$DPWV
QSVWjHj@
UPPWSh
PPWSh8
PPPWSh
PPWSh(
PPWShx
F PPWSh
PPPWSh
YYWShL
QSVWj@j@
SPPWUh
PPWUh8
PPPWUh(
PPWUhx
PPVSh`
PPPVSh
ItpItTIt?
tBIt&IIuO
t9Jt!JJuB
tPWWWj
98t1WWWj
9MDMPu
t$hSh8
LSVWjD_
t:Ht!HuJW
PVVSQV
PVVSVVVQVV
PVVSVVVQV
+7FVj@
f9D$Pu
L$$#L$4
8regfuE9X
8hbinu3
CL@@Pj@
pLt=;7
6SSSSS
QSWVhl
u)9](t5
PPhH	G
YY9u tUV
FVWWWW
t!PPh8(G
	t!PPh
QPh\+G
uJhh-G
PSSSSSSSSj
usSh44G
YYVVVVV
t1Shp4G
t WWVPj
t!FVj@
t VVSPj
8HEu!8HFu
 t1It3IIt#
t$(uHj
D$49\$
Y9|$4t
SSh\LG
F9t$ u3
^[_]YY
HtUHtB
r1;~@u
;VDt'9F u"9F4
;~0u	;^4
Y9t$,t>9t$8u8
</t6<\t2
9_4u79_(u
9_,v<V
;s\t2VW
 ;whY|
 C;^h|
9_,t68_
;GXwl3
_@93tf
jeX_^[
u!;{8s
~,h\eG
t ;_ w
!FP!FT
 ;FhY|
!~0	F<Yt
;PTt#V
:AEt$h]
L$ jdQ
E *E$jL
t19w@u,
Y_^][Y
u#8GBu
TVPf;P
DFPf;B
f9\NPu
FDf9\FPt
r{;w,wv9E
VW;X,v
AtYIItNItDIt#
SVWj4Yj4
J`3H`_
YC;^$|
uJ9D$$u
_d8^Cts
u`9_Pt
u(9_Pt
_d9_L|
&#F8_^[
f;FDY}$!E
HtfHt(
It|ItiItD
YPhpLG
$G<C|8
 t9Jt-Jt!Jt
sv!KP!KH=
;CDvdh:5
tl8GCt	
x@|#9}
YPhpLG
aa !"aa#$%&'()*+,-./01234567aa89:;<a=>?@AABBCDEFaGHIIJKLMNNOPQQRSSTUVWWaXaYZaa[aaa\]^_`W
tD9~(t
D$()D$
	A8	Q<
	G8	W<
t$ hhSG
t$ h,SG
t$ hPSG
D$,YY;C
u&9;~"3
D$,;D$(
YY_^[]
|$, }!
PQQQjV
D$(_^[
tnHt&H
tYHt&H
C f;F 
R f;S t
9GDu/8CEu*9
f;C"}5
@PQjbS
S"B;Pd~
f;G"}2
YFf;C"Y}l
f;F4s&
N+QPWWWS
f;C2s?
f;A"}3
PVhlXG
@2PSQjjW
f;B2s~
f;F"}0
G2FF9E
PVh|ZG
Y_^[Y]
	FhC;_
f;G2sM
98ZLu4
CLV@PWj
T$$9|$$
t&)\$ 
t$$9|$$
T$$t A<
WVhh\G
SVWj [
f;F4s[!E
CLPRjJ
Ht`HtYHtZH
f;G2s1
Q BBRPj
G"PVj`
t~;s`~-h\^G
^@8_Et
Q@Pj1S
V@Pj|S
D$$PWW3
G( urW
|$T!D$
D$,XaG
t$4h\aG
WPRjlV
uE9P$u@;E
CLPVjJ
f;A"}[
f;H"}j
wL#H(#p,
vLVWjyQ
f;G2s2
O,#CH#KL
O,#CH#KL
f;F2s73
	G$_^[
YY_^[Y
@ f;FHuO
f;C2sF
8^+v0W
#C #K$
f;8tpC@@;
f;N2s8
C0f;F(}s
IQPVRS
j@hHbG
@* jfZt
I RPWS
D$ _^[
F8#F4Y
<=t}<&ty
YPhtkG
QPh@lG
t$hplG
QPh@lG
t$hplG
PQh@lG
t'hplG
PQh@lG
t"hplG
PQh@lG
t"hplG
CD;C@t
CD;C@t
D$$PSS
 WWh(wG
t$4h<wG
D$(VWP
YY9|$$t
VWSShHxG
jLXPj@f
tVj{Yf
D$8Ph<{G
t$8h`{G
t$4SSP
#t$(VP
tkhp}G
D$\PhL~G
SSh`rG
Y9\$,tP
Y9\$<t
9\$@t	
D$4Ph<{G
YWWh(wG
u,hP;G
YY9|$$t
9|$(t!hl
D$,_^[
uoj$j@
8RSA2u
8RSA2u
E@j(P3
]xVVhh
Y9uLtJh
|J9ul|;
YY9udt3
D$(PhhrG
D$8Pht
FYY;t$<r
YY9\$8t
ti9\$lt&
T$$RQP
YYjdj@
ItIIt5It%
u%j(j@
CYYf;^
tsSSh(
jDhP~I
j h@~I
j4h ~I
QQSVW3
D$(PSS
t$ Ph(
t<WVhH
D$ Ph4
YY9t$`t
Y9t$Dt
t-WWWj
QWhD%H
t$<h,6H
ubhX6H
t#h\7H
D$@WP3
D$4PSV
t1h0<H
PWVhL<H
D$ PVV
D$$Y_^[
IItxIt
SVWj0X
SShHBH
PWh8DH
PQhhDH
PPhhEH
FPPSWj
FPPSWj
tvhdIH
ujSSh,MH
GWh4SH
*PhX^H
D$8PhTaH
D$HPh|aH
D$ Ph<{G
D$@PhTaH
D$PPh|aH
D$dWP3
D$`WP3
D$|PPW
j*hLuH
j*hxuH
D$DPSSSS
D$PAAAA
D$`BBBB
D$pCCCC
t$0Sh8
D$,+D$
D$pJJJJ
D$|DHG
VVh8|H
t$8Vh8
D$ j(P
t$Hhx|H
YY9t$(
vDVWhP
D$LAAAA
D$XlIG
D$\BBBB
Ht HuL
YYC;]$r
YYC;]dr
YYC;]dr
_[9uht
PWWWWVW3
D$0PVV
YYSSVh
HtFHt7HHu0
u"PPh0
D$HPhP
D$HPhl
WWh@+H
D$D9=h
|$89|$L
Y9|$Dt8
D$@PWW
Y9|$Dt8
Y9|$ u
D$(8;D$,
tNIt9It
SSh@+H
D$<Ph0
9\$HvP
YYC;\$Hr
9\$HvM
Y9t$Lv
FYY;t$Lr
Y;D$Hr
F;t$Hr
Y9>v$h 
t"hpTH
tpj{Yf
PPh`#I
PPh`#I
p h\)I
PPhp,I
PPhx/I
{J}uJjLXf
						
7PPh`;I
D$$@AI
D$HHAI
D$XPAI
D$hhAI
j!X+D$
WShhBI
PPhPDI
GPPhPGI
PPhXHI
PPh KI
PPh KI
t?PPh8LI
%PPhhMI
VVhpNI
VVh|NI
t`VVh,OI
VVh<OI
VVhLOI
t<hXOI
vHhdRI
v 9^4t
D$ Pj	
u'h@SI
shh\SI
|UVj hh
|nVj h(
WPh0]I
}`hP_I
D$$;D$,
D$ _^[
D$8VP3
D$TVP3
D$8VP3
D$LVP3
D$$_^[
D$DPhP
D$Xh<hI
Y9t$$u
D$TPj8
9t$0tz9t$
D$4PSj
HtMHt5Ht&Ht
t$0hP;G
QSVjdj@
u/PPPh
0W;1u!
u0SSSh
;L$4u?
;D$8u69\$Lu
9\$\t$
0WWWWW
AAFFf;
0WWWWW
AAFFf;
f92u	AAf91u
URPQQh$
v	N+D$
<xtM<XtI
YSSSSS
HHtXHHt
>If90t
HHtXHHt
jd^j-Xf;
tPjXYf;
ou1j8Xf;
UQPXY]Y[
<+t(<-t$:
+t HHt
v	N+D$
bcrypt.dll
ncrypt.dll
Invalid parameter passed to C runtime function.
(null)
```hhh
xppwpp
%04hu%02hu%02hu%02hu%02hu%02huZ
012345678.F? !!
NTPASSWORD
LMPASSWORD
NTPASSWORDHISTORY
LMPASSWORDHISTORY
!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%
0123456789012345678901234567890123456789
3.13.0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
******""""""""""""""""""""
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
&&					
	&&&&&&&&&&	
BINARY
0123456789ABCDEF0123456789abcdef
thstndrd
SQLite format 3
  !!""##$$%%&&''(())**++,,--..//00112233445566778899
0123456789ABCDEF
onoffalseyestruextrafull
naturaleftouterightfullinnercross
 !"#$%
'()*+,-./0133
 !"#$%
'()*+,-./01+,-./019
 !"#$%
'()*+,-./01f
 !"#$%P'()*+,-./01
 !"#$%j'()*+,-./01
 !"#$%
'()*+,-./01
 !"#$%
'()*+,-./01
 !"#$%B'()*+,-./01
 !"#$%
'()*+,-./01
 !"#$%
'()*+,-./01
 !"#$%n'()*+,-./01
 !"#$%3'()*+,-./01
 !"#$%
'()*+,-./01
fghijkl+,-
34s234+,
|+,2343
234"#$%&'()*+,-./01'()*+,-./01
de01h{
b3dedbhde
"#$%d'()*+,-./01
3333333333333333333333333333333333333333333333
CONSTRAINTOFFSETABLEFTHENDESCAPELSELECTRANSACTIONATURALLIKEYSAVEPOINTEMPORARYWITHOUTERELEASEXCLUSIVEXISTSBEGINDEXEDELETEBETWEENOTNULLIMITCASECOLLATECREATECURRENT_DATEGROUPDATEIGNORECURSIVEIMMEDIATEJOINNEREGEXPRIMARYMATCHECKVALUESWHENWHEREPLACEABORTANDEFAULTASCOMMITCONFLICTCROSSCURRENT_TIMESTAMPDEFERREDISTINCTDROPFAILFROMFULLGLOBYHAVINGIFINSERTISNULLORDERIGHTROLLBACKUNIQUEUSING
1.2.840.113556.1.4.27
1.2.840.113556.1.4.135
1.2.840.113556.1.4.129
1.2.840.113556.1.4.125
1.2.840.113556.1.4.160
1.2.840.113556.1.4.55
1.2.840.113556.1.4.94
1.2.840.113556.1.4.90
memory
private
shared
file is encrypted or is not a database
bind or column index out of range
auxiliary database format error
authorization denied
large file support is disabled
library routine called out of sequence
datatype mismatch
constraint failed
table contains no data
locking protocol
unable to open database file
database or disk is full
unknown operation
database disk image is malformed
disk I/O error
interrupted
attempt to write a readonly database
database table is locked
database is locked
callback requested query abort
access permission denied
SQL logic error or missing database
not an error
threads
soft_heap_limit
shrink_memory
cell_size_check
case_sensitive_like
busy_timeout
coalesce
group_concat
substr
zeroblob
replace
total_changes
changes
last_insert_rowid
sqlite_log
sqlite_source_id
sqlite_version
nullif
randomblob
random
ifnull
unicode
printf
length
typeof
likely
likelihood
unlikely
FOREIGN KEY
UNIQUE
NOT NULL
win32-longpath
FlushViewOfFile
UuidCreateSequential
UuidCreate
InterlockedCompareExchange
CreateFileMappingFromApp
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
GetNativeSystemInfo
GetTickCount64
LoadPackagedLibrary
CreateFile2
MapViewOfFileFromApp
GetFileInformationByHandleEx
SetFilePointerEx
WaitForSingleObjectEx
WaitForSingleObject
CreateEventExW
WriteFile
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddressA
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
FileTimeToSystemTime
FileTimeToLocalFileTime
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CloseHandle
CharUpperW
CharLowerW
AreFileApisANSI
current_timestamp
%Y-%m-%d %H:%M:%S
current_date
%Y-%m-%d
current_time
%H:%M:%S
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
(NULL)
922337203685477580
API call with %s database connection pointer
unopened
invalid
OsError 0x%lx (%lu)
os_win.c:%d: (%lu) %s(%s) - %s
delayed %dms for lock/sharing conflict at line %d
winSeekFile
winClose
winRead
winWrite1
winWrite2
winTruncate1
winTruncate2
winSync1
winSync2
winFileSize
winUnlockReadLock
winUnlock
winUnmapfile1
winUnmapfile2
winMapfile1
winMapfile2
etilqs_
winGetTempname1
winGetTempname2
winGetTempname3
winGetTempname4
winGetTempname5
winOpen
winDelete
winAccess
%s%c%s
winFullPathname1
winFullPathname2
winFullPathname3
winFullPathname4
recovered %d pages from %s
-journal
nolock
immutable
out of memory
%!.15g
%s-mjXXXXXX9XXz
MJ delete: %s
MJ collide: %s
-mj%06X9%02X
API called with finalized prepared statement
API called with NULL prepared statement
string or blob too big
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
%s constraint failed
%z: %s
abort at %d in [%s]: %s
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot release savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot start a transaction within a transaction
cannot rollback - no transaction is active
cannot commit - no transaction is active
database schema has changed
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
statement aborts at %d: [%s] %s
misuse of aliased aggregate %s
no such column
ambiguous column name
%s: %s.%s.%s
%s: %s.%s
%s: %s
partial index WHERE clauses
index expressions
%s prohibited in %s
the "." operator
functions
second argument to likelihood() must be a constant between 0.0 and 1.0
non-deterministic functions
misuse of aggregate function %.*s()
no such function: %.*s
wrong number of arguments to function %.*s()
subqueries
parameters
%r %s BY term out of range - should be between 1 and %d
too many terms in ORDER BY clause
%r ORDER BY term does not match any column in the result set
too many terms in %s BY clause
a GROUP BY clause is required before HAVING
aggregate functions are not allowed in the GROUP BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
_ROWID_
oversized integer: %s%s
misuse of aggregate: %s()
unknown function: %s()
%s %T cannot reference objects in database %s
no such table
corrupt database
unknown database %T
sqlite_
object name reserved for internal use: %s
table %T already exists
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
INTEGER
CREATE TABLE 
AUTOINCREMENT not allowed on WITHOUT ROWID tables
PRIMARY KEY missing on table %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
tbl_name='%q' AND type!='trigger'
sqlite_stat%d
DELETE FROM %Q.%s WHERE %s=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
table %s may not be dropped
cannot create a TEMP index on non-TEMP table "%s"
altertab_
table %s may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
expressions prohibited in PRIMARY KEY and UNIQUE constraints
conflicting ON CONFLICT clauses specified
 UNIQUE
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
name='%q' AND type='index'
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
index '%q'
%s.rowid
duplicate WITH table name: %s
no such collation sequence: %s
table %s may not be modified
rows deleted
integer
integer overflow
LIKE or GLOB pattern too complex
ESCAPE expression must be a single character
%!.20e
table %S has no column named %s
table %S has %d columns but %d values were supplied
%d values for %d columns
rows inserted
automatic extension loading failed: %s
malformed database schema (%s)
%z - %s
create 
invalid rootpage
CREATE TABLE x(type text,name text,tbl_name text,rootpage integer,sql text)
attached databases must use the same text encoding as main database
unsupported file format
SELECT name, rootpage, sql FROM "%w".%s ORDER BY rowid
statement too long
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
UNION ALL
INTERSECT
EXCEPT
column%d
%.*z:%u
all VALUES must have the same number of terms
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
'%s' is not a function
multiple references to recursive table: %s
circular reference: %s
table %s has %d values for %d columns
multiple recursive references: %s
recursive reference in a subquery: %s
too many references to "%s": max 65535
%s.%s.%s
no such table: %s
no tables specified
too many columns in result set
DISTINCT aggregates must have exactly one argument
no such column: %s
rows updated
BINARY
too many arguments on %s() - max %d
no query solution
at most %d tables in a join
too many terms in compound SELECT
syntax error after column name "%.*s"
parser stack overflow
unknown table option: %.*s
set list
near "%T": syntax error
too many arguments on function %T
unrecognized token: "%T"
2016-05-18 10:57:30 fc49f556e48970561d7ab6a2f24fdd7d9eb81ff2
unable to close due to unfinalized statements or unfinished backups
unknown error
abort due to ROLLBACK
unable to delete/modify user-function due to active statements
unable to delete/modify collation sequence due to active statements
localhost
invalid uri authority: %.*s
access
no such %s mode: %s
%s mode not allowed: %s
no such vfs: %s
NOCASE
%s at line %d of [%.10s]
database corruption
misuse
cannot open file
ncrypt.dll
bcrypt.dll
CPGenKey
CPDeriveKey
CPDestroyKey
CPSetKeyParam
CPGetKeyParam
CPExportKey
CPImportKey
CPEncrypt
CPDecrypt
CPDuplicateKey
logins
select signon_realm, origin_url, username_value, password_value from logins
cookies
select host_key, path, name, creation_utc, expires_utc, encrypted_value from cookies order by host_key, path, name
select count(*) from sqlite_master where type='table' and name=?
Hj1diQ6kpUx7VC4m
6jnkd5J3ZdQDtrsu
xT5rZW5qVVbrvpuA
Kerberos
t{{t{i}t{i}t{
{t{{t{i}t{
t{{t{{{t{
}}}}}}
}t{{t{i}t{o}}}t{
t{{{t{i}t{
{{t{i}t{o}}}
{t{i}t{{
{t{i}t{o}}
<root>
CardAcquireContext
mimikatz
1.3.6.1.4.1.311.20.2.3
2.5.29.17
2.5.29.15
2.5.29.37
2.5.29.14
2.5.29.35
2.5.29.31
2.5.29.19
1.2.840.113549.1.1.5
2.5.4.3
2.5.4.11
2.5.4.10
2.5.4.6
1.3.14.3.2.29
1.3.6.1.5.5.7.3.2
1.3.6.1.4.1.311.20.2.2
SamIConnect
SamrCloseHandle
SamIRetrievePrimaryCredentials
SamrOpenDomain
SamrOpenUser
SamrQueryInformationUser
SamIFree_SAMPR_USER_INFO_BUFFER
VirtualAlloc
memcpy
LocalAlloc
fwprintf
fclose
SystemParametersInfoW
NtQuerySystemInformationEx
VaultEnumerateItemTypes
VaultEnumerateVaults
VaultOpenVault
VaultGetInformation
VaultEnumerateItems
VaultCloseVault
VaultFree
VaultGetItem
1.2.840.113556.1.4.133
1.2.840.113556.1.4.609
1.2.840.113556.1.4.146
1.2.840.113556.1.4.96
1.2.840.113556.1.4.159
1.2.840.113556.1.4.8
1.2.840.113556.1.4.302
1.2.840.113556.1.4.656
1.2.840.113556.1.4.221
1.2.840.113556.1.4.1
attributeID
attributeSyntax
systemFlags
2.5.4.0
1.2.840.113556.1.2.14
1.2.840.113556.1.2.36
1.2.840.113556.1.2.115
1.2.840.113556.1.4.307
1.2.840.113556.1.4.375
1.2.840.113556.1.4.515
1.2.840.113556.1.4.1459
1.2.840.113556.1.4.1820
1.2.840.113556.1.4.1836
LsaICancelNotification
LsaIRegisterNotification
CredentialKeys
Primary
BCryptFreeBuffer
BCryptEnumRegisteredProviders
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptGetProperty
NCryptOpenStorageProvider
NCryptFreeObject
NCryptGetProperty
NCryptSetProperty
NCryptImportKey
NCryptOpenKey
NCryptFreeBuffer
NCryptEnumKeys
NCryptExportKey
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
ConvertStringSidToSidW
LsaFreeMemory
CryptSetProvParam
CryptEnumProvidersW
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
SystemFunction005
LsaQueryTrustedDomainInfoByName
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
IsValidSid
LookupPrivilegeNameW
OpenThreadToken
SetThreadToken
CredFree
CredEnumerateW
GetSidSubAuthority
GetSidSubAuthorityCount
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
ADVAPI32.dll
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptProtectData
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertGetNameStringW
CertAddCertificateContextToStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptSignAndEncodeCertificate
CertEnumSystemStore
CryptEncodeObject
CRYPT32.dll
CDLocateCheckSum
MD5Final
MD5Update
MD5Init
CDGenerateRandomBits
CDLocateCSystem
cryptdll.dll
FilterFindFirst
FilterFindNext
FLTLIB.DLL
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetServerGetInfo
NetShareEnum
NetStatisticsGet
NetWkstaUserEnum
NETAPI32.dll
CoCreateInstance
CoUninitialize
CoInitializeEx
ole32.dll
OLEAUT32.dll
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
NdrClientCall2
UuidCreate
RpcEpResolveBinding
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
RPCRT4.dll
PathIsRelativeW
PathCanonicalizeW
PathCombineW
PathIsDirectoryW
PathFindFileNameW
SHLWAPI.dll
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamSetInformationUser
SamiChangePasswordUser
SamEnumerateGroupsInDomain
SamGetGroupsForUser
SamGetMembersInGroup
SamRidToSid
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamOpenGroup
SamOpenAlias
SAMLIB.dll
QueryContextAttributesW
FreeContextBuffer
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaCallAuthenticationPackage
Secur32.dll
CommandLineToArgvW
SHELL32.dll
IsCharAlphaNumericW
GetKeyboardLayout
USER32.dll
CreateEnvironmentBlock
DestroyEnvironmentBlock
USERENV.dll
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
VERSION.dll
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
HID.DLL
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SETUPAPI.dll
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardConnectW
SCardListReadersW
SCardDisconnect
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
WinSCard.dll
WinStationCloseServer
WinStationEnumerateW
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WINSTA.dll
WLDAP32.dll
A_SHAInit
A_SHAFinal
A_SHAUpdate
advapi32.dll
ASN1_CreateModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
msasn1.dll
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlEqualString
ntdll.dll
I_NetServerReqChallenge
I_NetServerTrustPasswordsGet
I_NetServerAuthenticate2
netapi32.dll
FileTimeToSystemTime
WriteFile
TerminateThread
ReadFile
CreateFileW
GetLastError
LocalAlloc
CloseHandle
LocalFree
CreateThread
CreateFileA
SetFilePointer
FileTimeToLocalFileTime
GetTempPathA
DeleteFileA
FindFirstFileW
GetFileAttributesW
FlushFileBuffers
GetFileSizeEx
GetCurrentDirectoryW
FindClose
FindNextFileW
ExpandEnvironmentStringsW
GetCurrentProcess
OpenProcess
DuplicateHandle
DeviceIoControl
GetComputerNameExW
VirtualQuery
VirtualFree
VirtualQueryEx
VirtualFreeEx
ReadProcessMemory
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
VirtualProtect
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetConsoleOutputCP
SetConsoleOutputCP
CreateProcessW
SetLastError
WaitForSingleObject
CreateRemoteThread
lstrlenW
GetDateFormatW
SystemTimeToFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetTimeFormatW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
CreateMutexW
HeapCompact
TryEnterCriticalSection
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
InitializeCriticalSection
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
SetHandleInformation
CreatePipe
SetEvent
CreateEventW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
IsWow64Process
SetCurrentDirectoryW
GetCurrentThread
ProcessIdToSessionId
GetComputerNameW
GetProcessId
InterlockedExchange
LoadLibraryA
KERNEL32.dll
_errno
_wcsdup
strrchr
_wcsicmp
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
vwprintf
_setmode
fclose
_stricmp
wcsrchr
wcschr
strtoul
_wcsnicmp
wcsstr
gmtime
memmove
malloc
_msize
strftime
realloc
fgetws
wcstoul
wcstol
towupper
_wpgmptr
_wcstoui64
getchar
msvcrt.dll
memset
memcpy
__wgetmainargs
_cexit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
calloc
isdigit
isspace
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_snprintf
wctomb
ferror
iswctype
wcstombs
?terminate@@YAXXZ
_controlfp
__badioinfo
__pioinfo
_lseeki64
_write
_isatty
ungetc
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetCurrentThreadId
_except_handler3
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
;JWHDTc
4GZ}HYj
8L_6;Ys
5UpP9Wq
:Sh_N^m
E\n(C[n
9Tl?8Sk
&C\I&B\
 CaL Ba
'V}L&U|
,PoL,Po
!A\+!B]
;^I*Ro
;L`bFVe
;Um07Tn
@VhR<Ui
.Jbv+Jd
0%0>0e0
1)13191?1I1U1\1h1p1x1
2-262R2g2p2
474?4X4^4p4x4~4
5"5U5_5
747K7[7k7t7~7
;2;;;L;X;k;
>N?W?n?
1,1=1N1b1q1
1	2[2d2~2
2-353I3]3l3P4
5E6N6f6v6
6"7l7t7
7$8G8m8
9*9>9T9u9
9I:c:w:
;N;X;T<{<
='=-=j=
>9>C>L>V>
050G0s0
3!3T3r3
5D5Z5o5x5
626J6S6]6
8%8+8;8C8I8Z8c8i8
:*:0:@:H:N:^:o:
;=;H;R;d;|;
<=<S<q<|<
<Q=a=n=t=
>0>?>J>q>~>
0!000G0\0m0
1*1V1g1
2>2O2i2
3&323I3Z3u3
5=6r6{6
787X7x7
8(919I9U9h9z9
:-:>:O:j:{:
:O;,<5<
?&?/?>?
2N3W3`3i3|3
4L5g5~5
8#8)898W8\8t8
919B9O9]9w9
:%:2:H:f:v:
;';F;O;m;
<-<K<j<}<
>B>c>r>
>3?H?m?y?
0'0-0|0
2*2>2O2`2q2
636?6R6^6w6
727>7Q7]7w7
141_1u1
6)6?6G6L6V6^6p6v6|6
6%7N7%8_8i8
8L9T9Z9b9h9
233I3^3t3
959L9\9
;6;F;I<[<"=H=X=
243N3{3
4;4U4b4h4
7$7+7P7V7\7b7h7
8?8Z8p8
949W9j9q9
:&:,:<:R:b:x:
;';.;4;J;{;
=.=G=L=s=
>V>l>q>w>
030<0L0S0Y0d0n0v0
4S5Z5b5q5
6K6p6u6;7G7p7|7
8&858<8C8J8r8e9l9{9
>">C>P>b>j>~>
?1?6?E?N?[?l?t?
0%0*0G0L0e0j0o0
191>1[1`1}1
2#2(2-2@2E2J2]2b2g2z2
333<3Q3W3f3~3
5*5G5Y5j5
6%6-636;6A6U6b6j6y6
727G7|7
708R8|8
849U9q9
:/:?:[:k:
=$=2=C=
?%?L?h?}?
343:3T3z3
3 4/4t4~4
5)5H5}5
6.7T7d7
8)9i98:
<(<><E<d<m<s<z<
=#=,=4=B=H=W=]=h=p=w=
>2>>>E>V>i>o>y>
?!?,?5?@?S?\?d?j?t?
0"030D0R0Z0`0i0p0z0
1#1)1/1=1H1N1[1a1g1n1t1
3*3;3%8C8
=)>9>=>A>E>I>M>Q>U>Y>]>a>e>i>m>q>u>E?
3$3+313:3@3G3M3X3h3
98===b=
253@3T3d3
4%4:4A4\4s4~4
858^8i8
a0g00181G1R1
3>3H3U3
4>4K4U4b4
787D7x7
;);4;n;
>.>I>O>
0e0~073
7)7/757=7S7[7a7f7z7
8D8M8W8f8l8q8y8
9D;N;Z;d;l;~;
5+626;7
=%=2=9=[=
%3n5z5{758_9
> >$>(>,>0>
0v6"7V7
2'5=5u;
4d62:9:
246E6m6
:$;);C;X;p;
<&=-=6=
>k>o>s>w>{>
?#?'?+?/?3?7?;???C?G?K?O?S?W?[?_?c?g?k?o?s?w?{?
6<:M:T:
A2[2~2
8E9L9e:
5=5,6W6
1X2_2j2
;"<3<:<A<H<O<{<
:J;U;l;
8G9g9f=
X0s057o8
:-:T:r:}:
619H9W9
<9<@<G<N<T<
7#787A7
8 8$8(8,8
:5;<;t;
<@=G=Y=f=
;#;';+;/;3;7;;;?;C;G;K;O;S;W;[;_;c;g;k;o;s;w;{;
<#<'<+</<3<7<;<?<C<G<K<O<S<W<[<_<c<g<k<o<s<w<{<
=#='=+=/=3=7=;=?=C=G=K=O=S=W=[=_=c=g=k=o=s=w={=
?*?5?A?H?m?y?
3 3$3(3,3034383<3
5:5I5E6w6}6
7$7,797?7L7\7b7h7s7y7
8"8(8/898G8O8U8[8b8i8u8
9&909=9E9M9Z9b9j9
9::@:F:L:V:`:u:y:}:
424B4\4f4
596P6X6z6
9+:T:\:o:y:~:
;-;3;;;\;a;f;q;
<	<"<;<P<
>(>>>j>v>
? ?B?L?\?w?
1*2"3@3U3f3
4J4O4w4
5)545[5b5
5(6L6p6
737J7b7m7w7
7 8+8O8X8}8
9*:R:W:p:
:	;!;9;
;6<?<F<g<
>.>A>z>
0 0F0q0
1P1]1w1
2+2W2v2
373<3H3U3u3
3	4<4J4y4
5'6/656W6
=0=O=_=o=
>J>P>a>
141M1x1
202;2d2
4;4q4~4
4<5E5M5
6$6.6E6V6^6t6s8
9&9M9u9
:5:>:C:K:R:i:
;A;J;^;u;
<!<;<c<q<
=!=5=M=
>=>J>P>
0%0-030X0
363@3Z3{3
4+545>5D5Q5p5
6Y6p6z6
8!8(8/8;8C8I8^8g8m8z8
8'9c9x9
98:[:j:
;L;R;_;
;4<C<o<
<7=N=d=y=
>1>F>s>
>$?*?7?T?
1"1:1c1n1y1
2%2+2P2
4+555L5
6/7=7N7h7
9-9D9O9Z9
:,:4:I:Z:d:l:z:
:&;>;i;
<"<2<P<n<
< =9=R=u=
?F?\?y?
0&0\0l0
2#222B2J2P2]2m2t2{2
4#5L5o5
6H7Z7l7
;-;\;d;j;x;
>6?N?s?
0,0J0a0
2L2d2q2
30353Q3
8&8>8e8
9/:O:d:
;<;F;h;m;
;J<Q<V<\<b<h<n<t<z<
="=&=*=.=2=6=:=>=
?2?B?M?h?
#020[0f0u0
2,232=2L2b2l2
3?3I3V3s3~3
4:4Y4^4p4}4
5$5>5O5Y5l5
696T6h6s7
8 828J8Z8
949E9T9l9}9
;5;Q;`;i;
<2<F<a<
<	='=?=G=M=c=
>(>4>B>H>`>h>n>
0=0u0}0
2 3)3I3
5J5s5y5
6/6P6j6t6z6
6&7-727f7
7!8-8U8
879@9F9W9_9e9s9{9
:':-:9:J:
;7;[;n;
<><M<T<
?$?2?o?
040:0d0r0
0)191@1
2@2V2|2
3#3+353E3M3S3w3
6 616H6
7"727?7m7
8 8/8J8h8q8z8
949<9B9P9`9
99:B:j:
;.<7<}<
=!=I=U=[=
>9>?>Q>[>a>x>
0%0>0e0
1C2Q2m2
2+353M3c3t3
354V4c4
6!60676J6Q6d6k6}6
8&8F8a8m8
:2:B:J:P:g:o:u:
:	;!;*;?;];i;
=(=3=9=
>7>M>[>d>
?$?*?I?e?o?u?
0%0.060<0N0V0\0i0}0
1$1*1I1O1n1
3+3=3O3z3
3-4C4[4
5 5/5A5S5e5
7+7A7V7m7z7
9*919V9|9
:+:5:=:C:S:r:
:$;J;O;`;f;v;~;
<!<'<9<V<c<w<
=(=F=p=
=(>1>B>K>W>`>l>u>
0#0V0y0
1!1)1K1|1
1!2)2/2G2R2X2
4 5r5z5
7$8/848Q8a8f8{8
9*9I9V9
9C:J:^:}:
:I;f;y;
=J=g=n=x=
?)?1?;?Y?u?
!030E0
0%131?1f1w1~1
2+2>2W2
555E5[5w5
636F6o6
60777L7j7
888M8|8
:.:6:<:Y:b:w:
=D=`=u=
=C>_>u>
?!?)?/???G?M?]?g?}?
080X0x0
1"1>1C1
2'202_2d2
3.3>3[3
445R5l5
616Q6g6
7$7*7g7y7
8$878]8q8
9&:@:s:
:#;3;I;
<+<;<S<
2(2I2m2{2
3%3-323h3o3v3
3#4+4T4m4
5,5?5N5e5
5$656I6a6
6&7F7R7\7n7
9'9d9~9
:6;a;x;
;3<:<T<l<
000c0u0
0(1D1[1r1
3$3E3]3u3
<'=<=F=Y=m=w=
>3>[>0?@?F?T?p?
30383>3X3`3f3n3t3R5\5
5,6R6f6
9+9P9m9
:(:J:X:f:u:
: ;(;<;D;f;
<'<=<E<K<
=*===M=s=
6 777]7~7
:,:M:T:[:b:u:
<0<Y<k<
<$=J=r=z=
?(?3?F?\?
0"000Q0b0l0
3$3,323E3O3b3o3{3
4-434C4
5"5/5=5
6	7*7=7i7v7
7)8D8\8r8
9.939K9T9a9r9z9
;(;=;T;_;
<4<D<R<c<q<
=(=7=M=S=a=t=|=
?C?K?R?X?u?{?
02080?0E0R0b0l0
14191H1f1k1z1
2.232B2Q2~2
3$3B3I3U3\3i3o3u3
4$4.444;4A4I4d4|4
5%5;5A5V5p5
5	6>6H6j6|6
7.7R7\7
8"8*8<8^8m8
8!9<9M9]9
:":4:h:u:
;4;G;W;a;
<(<5<P<g<
=#=/=6===Z=a=r=
>'>->3>8>F>Q>W>`>g>
? ?J?Z?`?h?n?|?
0#0-0P0]0b0w0
2%2.2C2L2
3"3D3R3`3m3u3
414E4U4x4
5&5/5b5
626\6a6
7)8/8_8h8s8
9Q9k9q9
<)<E<P<h<m<y<
>+>I>i>
02090H0[0o0
303I3v3
4.4<4J4T4[4n4t4{4
5!5)51595A5I5Q5Y5g5p5{5
6B6S6v6
8#8-8J8e8
969o9t9
;!;6;V;f;q;
=+=9=C=Q=k=x=
>)>:>@>P>
?,?6?B?Y?s?
	070Q0g0m0z0
1S1e1o1
1	2.2J2h2w2
515D5w5
7>7N7V7n7}7
8(8a8s8
9'969@9L9U9a9l9
>'>F>T>\>
?(?G?j?
0'0G0X0x0
1+141Q1h1
2"2,2=2V2n2
4-4P4f4
5#555G5c5q5
?9?P?l?
(080S0g0
282B2V2p2
2	3!3=3l3
4(4/4>4U4_4i4
5%5/5M5z5
7&7M7b7
848;8B8I8P8W8c8z8
9,:9:A:N:`:
;/;\;a;k;r;
;&<X<o<
<"=:=@=]=l=}=
>&>,>I>
1!1b1i1n1u1|1
4@4J4[4
7#7H7^7
8&8/868r8
8%9>;W;
<-=7=F=T=f=t=C>K>S>_>w>
454?4I4S4o4z4
5$585O5r5y5
8!8>8J8q8
9%9,9I9W9`9i9u9
:$:8:I:Z:k:
;2;@;W;y;
<7<M<T<h<w<
=(=/=:=B=J=X=g=
?3?G?r?
2#212U2^2r2y2
3@3H3N3i3
4+424?4L4X4
6-62686P6U6[6m6u6z6
7,7<7L7R7W7g7w7}7
8)9D9d9
; ;&;,;2;V;\;d;
<;<F<\<i<
="=+=1=K=i=x=
>">*>>>D>K>R>Y>^>s>
0	080Y0+161E1T1o1
2 282n2w2
3+3@3E3J3
7%7`7h7
8D8^8x8
9!9>9S9j9s9~9
:5:<:M:e:
;B;_;t;
<@<O<X<e<k<|<
=-=;=P=l=x=
> >,>A>
1$2+262l2
4(454@4W4^4
535W5p5
8V9^9y9
:3:C:e:
;1<6<J<U<n<
<1=:=B=z=
>7?@?}?
M0\0e0
0 1(191B1
2)282j2
5%525;5t5
6G7h7w7
8,858G8P8e8n8
9/9;9T9]9h9q9
;";';8;J;
?#?P?d?n?u?z?
0)0;0i0y0
0G1m1}1
2)282>2D2J2P2V2\2b2h2n2t2z2
3 3+303;3@3K3P3[3b3h3n3t3z3
304=4a4|4
5S5_5g5
6 6+606;6@6K6P6[6`6k6r6x6~6
7 7&7,72787>7D7J7P7V7\7b7h7n7t7z7
8"8(8.848:8@8F8L8R8X8^8d8j8p8v8|8
9$9*90969<9B9H9N9T9Z9`9f9l9r9x9~9
: :&:,:2:8:>:D:T:
272<2B2G2L2Q2V2\2d2l2
3/353<3P3V3\3b3o3u3~3
344@4F4M4V4\4d4j4w4
5$5)5/595B5M5[5`5f5q5x5
7Y7M8d8{8
5)5b5f5j5n5r5v5z5~5
;9<?<P<
9"9o9t9
99:\:i:u:}:
1e2[3c3
596?6O6
<[?_?c?g?k?o?s?w?{?
4'555n5
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
4181<1@1D1H1L1P1T1X1`1
102L2P2T2X2\2`2d2h2l2p2t2x2|2
3(3@3X3\3p3t3
4 4$4(4,484D4H4L4P4T4X4\4`4d4h4l4p4t4x4
5$5054585<5@5D5H5L5X5d5h5t5x5|5
6@6D6L6P6X6\6d6h6p6t6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7
8 8$8(8,8084888<8@8D8H8L8P8T8X8`8d8l8p8x8|8
9 9$9(9,9094989<9@9D9H9L9X94:8:@:D:H:P:T:`:d:p:t:
; ;$;0;4;@;D;H;P;T;X;`;d;h;l;t;x;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<
<<=@=D=H=L=P=T=\=`=d=h=l=p=t=x=|=
> >$>,>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
2<3@3D3H3L3P3T3X3\3`3d3h3|3
5 5$5(5d5h5l5p5t5
0444<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 505@5P5`5p5
9 9$9(9,9094989<9H9P9
H0L0P0X0h0
4T5X5\5`5
9P:T:X:`:p:
<$<0<<<H<T<`<l<x<
<<=@=D=H=L=d>h>l>p>t>x>|>
? ?(?0?8?@?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4l4p4t4x4|4
5 6$6(6,6064686<6@6D6H6X6d6p6|6
T=X=t=x=
>$>(>4>8>D>H>T>X>d>h>t>x>
?$?(?4?8?
0,0<00343<3|3
6D6H6P6p6t6|6
:8:<:D:
<<<@<D<H<L<P<T<X<\<`<d<h<l<p<
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
3034383<3@3D3H3L3P3T3X3\3`3d3x3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
7$7P7T7X7\7`7d7
848<8p8x8
9(:0:d:l:
; ;T;\;
= >(>\>d>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?
1 1$1,10181<1D1H1P1T1\1h1t1x1
2(2,24282@2D2L2P2X2\2d2h2p2t2|2
3$3(30343<3@3H3L3T3X3`3d3l3p3x3|3
4 4,484<4D4H4P4T4\4h4l4t4
5 5$5(5,50545H5P5T5X5\5p5t5x5|5
6(606D6L6`6h6|6
7$7(7,7@7H7\7d7x7
8 8(8<8D8X8`8t8|8
9$989@9T9\9p9x9
: :4:8:<:P:T:X:l:p:t:
;8;L;T;\;d;t;|;
<d<x<|<
= =$=(=,=0=4=<=@=D=H=L=P=T=X=\=
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA0
151029113029Z
270609113029Z0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA20
http://crl.certum.pl/ctnca.crl0k
http://subca.ocsp-certum.com01
%http://repository.certum.pl/ctnca.cer09
http://www.certum.pl/CPS0
"3;vlG
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA20
171204095034Z
181204095034Z0
Open Source Developer1
Ile de France1.0,
%Open Source Developer, Benjamin Delpy1&0$
benjamin@gentilkiwi.com0
!http://crl.certum.pl/cscasha2.crl0q
http://cscasha2.ocsp-certum.com04
(http://repository.certum.pl/cscasha2.cer0
(}b?NON
cscasha2@certum.pl0
https://www.certum.pl/CPS0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA2
$http://blog.gentilkiwi.com/mimikatz 0
20180203223354Z0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1
Certum EV TSA SHA2
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA0
160308131043Z
270530131043Z0w1
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1
Certum EV TSA SHA20
http://crl.certum.pl/ctnca.crl0k
http://subca.ocsp-certum.com01
%http://repository.certum.pl/ctnca.cer0@
http://www.certum.pl/CPS0
=3+|y4N
8q={sd
<4b{gg
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA
180203223354Z0/
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA0
151029113029Z
270609113029Z0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA20
http://crl.certum.pl/ctnca.crl0k
http://subca.ocsp-certum.com01
%http://repository.certum.pl/ctnca.cer09
http://www.certum.pl/CPS0
"3;vlG
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA20
171204095034Z
181204095034Z0
Open Source Developer1
Ile de France1.0,
%Open Source Developer, Benjamin Delpy1&0$
benjamin@gentilkiwi.com0
!http://crl.certum.pl/cscasha2.crl0q
http://cscasha2.ocsp-certum.com04
(http://repository.certum.pl/cscasha2.cer0
(}b?NON
cscasha2@certum.pl0
https://www.certum.pl/CPS0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1$0"
Certum Code Signing CA SHA2
$http://blog.gentilkiwi.com/mimikatz 0
20180203223356Z0
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1
Certum EV TSA SHA2
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA0
160308131043Z
270530131043Z0w1
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1
Certum EV TSA SHA20
http://crl.certum.pl/ctnca.crl0k
http://subca.ocsp-certum.com01
%http://repository.certum.pl/ctnca.cer0@
http://www.certum.pl/CPS0
=3+|y4N
8q={sd
<4b{gg
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA
180203223356Z0/
PL1"0 
Unizeto Technologies S.A.1'0%
Certum Certification Authority1"0 
Certum Trusted Network CA
pXnM-h