mb_driver_bigfoot_bt_w7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

mb_driver_bigfoot_bt_w7.zip
Size

183.1MB
MD5

9ff41deab1025a6ac0fcdf24a43f188f
SHA1

7b7b1dbec2a0dd2489b95de4fabd2c319470a75a
SHA256

782445f2ef6406b14aa3c97fdf191d5063be27aac800b3c1b9939414fe9837a3
SHA512

51fca1435874c5f9beaf80996b165476f4abaa9ea3828c53404e23112b1421bb3010a9efb5dff32825416b71c3098967c388390acd3df119d6f26288b89fbdc1
SSDEEP

3145728:aRZHor6KxIJWFTTC6TZU7IOJRzErliMOx5b1PpExZNmucsRsWowlRPt:aRZHoGvM9xGcOJRArlKfw+PWoA

Score

N/A

Malware Config

Signatures

Files

mb_driver_bigfoot_bt_w7.zip
.zip
Win7/Bluetooth_Install.EXE
.exe windows x86

b7ed8c660e4ca1446e9ef00b1e8f91c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
GetTokenInformation
RegSetValueExA
EqualSid
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
RegCloseKey

kernel32

GetPrivateProfileIntA
GetFileAttributesA
IsDBCSLeadByte
GetSystemDirectoryA
GlobalUnlock
GetShortPathNameA
CreateDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
CompareStringA
_lopen
CloseHandle
LocalFree
DeleteFileA
ExitProcess
DosDateTimeToFileTime
CreateFileA
FindResourceA
GlobalAlloc
ExpandEnvironmentStringsA
LoadResource
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
SetFileTime
WriteFile
GetDriveTypeA
GetVolumeInformationA
TerminateThread
SizeofResource
CreateEventA
GetExitCodeProcess
CreateProcessA
ReadFile
_llseek
GetTempFileNameA
ResetEvent
LockResource
GetSystemInfo
LoadLibraryExA
CreateMutexA
GetCurrentDirectoryA
GetVersionExA
GetVersion
GetTempPathA
CreateThread
LocalFileTimeToFileTime
SetFilePointer
GetWindowsDirectoryA
lstrcmpA
_lclose
GlobalLock
GetCurrentProcess
FreeResource
FreeLibrary
Sleep
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
SetCurrentDirectoryA

gdi32

GetDeviceCaps

user32

SetForegroundWindow
MsgWaitForMultipleObjects
SendDlgItemMessageA
GetWindowRect
GetDC
SetWindowLongA
MessageBoxA
GetWindowLongA
PeekMessageA
ReleaseDC
GetDlgItem
SetWindowPos
ShowWindow
DispatchMessageA
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
GetDlgItemTextA
LoadStringA
MessageBeep
CharUpperA
CharNextA
ExitWindowsEx
CharPrevA
EndDialog
GetDesktopWindow
SetDlgItemTextA
SendMessageA
GetSystemMetrics

msvcrt

?terminate@@YAXXZ
_controlfp
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
memset
memcpy
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_errno
_vsnprintf
_acmdln

comctl32

ord17

cabinet

ord22
ord23
ord21
ord20

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 177.1MB - Virtual size: 177.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/DIFxAPI.dll
.dll windows x64

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08
Signer

Actual PE Digest

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
memmove
memcpy
??1type_info@@UEAA@XZ
_amsg_exit
_initterm
_XcptFilter
__C_specific_handler
__dllonexit
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
_unlock
iswdigit
iswalpha
_isatty
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vscwprintf
??3@YAXPEAX@Z
_onexit
_lock
_wcsnicmp
wcsrchr
wcspbrk
wcschr
??2@YAPEAX_K@Z
_CxxThrowException
wcsstr
_wcsicmp
??_U@YAPEAX_K@Z
_vsnwprintf
_resetstkoflw
malloc
free
??_V@YAXPEAX@Z
memset
memcmp

ntdll

RtlNtStatusToDosError
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

WaitForMultipleObjects
GetThreadLocale
SetEndOfFile
SetFilePointer
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
GetVersionExA
RaiseException
VirtualProtect
Sleep
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetProcessHeap
GetSystemTimeAsFileTime
DeviceIoControl
GetSystemDirectoryW
LocalReAlloc
LocalAlloc
GetEnvironmentVariableW
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CloseHandle
CreateFileW
MoveFileExW
GetSystemWindowsDirectoryW
EnterCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
DeleteCriticalSection
OutputDebugStringA
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
GetLastError
FindResourceW
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
VerifyVersionInfoW
lstrlenW
SetFileAttributesW
DeleteFileW
SetLastError
LoadLibraryW
GetVersionExW
GetProcAddress
FreeLibrary
GetFileSize
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
WideCharToMultiByte
CompareStringW
LocalFree
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
CopyFileW
GetTempFileNameW
SetEvent

user32

CharLowerW
UnregisterClassA
CharPrevW

setupapi

pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupDiClassNameFromGuidW
SetupDiGetDeviceInstallParamsW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiSetClassInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
CM_Get_Device_IDW
SetupDiSetDeviceRegistryPropertyW
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Enumerate_Classes
SetupDiOpenClassRegKey
SetupGetTargetPathW
SetupInstallFromInfSectionW
SetupDiGetClassDevsW
SetupPromptReboot
SetupDiDestroyDeviceInfoList
SetupInstallFilesFromInfSectionW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupCommitFileQueueW
SetupQueueCopyW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupCopyOEMInfW
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetIntField
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenFileQueue
SetupGetLineCountW
SetupCloseFileQueue
SetupOpenAppendInfFileW

advapi32

FreeSid
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
ControlService
StartServiceW
DeleteService
CloseServiceHandle

ole32

CoInitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

crypt32

CertFreeCertificateContext
CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 457KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/NvmMerge.exe
.exe windows x64

c6fba0d542797a8cb68bcb6ae37d84b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
HeapAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
GetCommandLineA
RtlUnwindEx
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
TerminateProcess
GetCurrentProcess
Sleep
CloseHandle
MultiByteToWideChar
ReadFile
SetStdHandle
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
SetFilePointer
WriteFile
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
FlushFileBuffers
GetTimeZoneInformation
CreateFileA
HeapSize
WriteConsoleW
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap
CreateFileW
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/WdfCoInstaller01009.dll
.dll windows x64

70497fec79daa5f71de3b34faee686a5

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e
Signer

Actual PE Digest

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/07/2009, 21:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_ultow
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_stricmp
_vsnwprintf

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupOpenLog
SetupDiGetActualSectionToInstallW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupDiGetDriverInfoDetailW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
ExpandEnvironmentStringsW
GetFileInformationByHandle
DeleteFileW
CloseHandle
FindNextFileW
RemoveDirectoryW
LockResource
GetLocalTime
FindClose
SetLastError
CreateFileW
FileTimeToSystemTime
TerminateProcess
GetExitCodeProcess
FormatMessageW
SizeofResource
WriteFile
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
LocalFree
GetWindowsDirectoryW
LocalAlloc
GlobalFree
GetProcAddress
GetLastError
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask

advapi32

DeleteService
OpenSCManagerW
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

shell32

CommandLineToArgvW

user32

LoadStringW
IsCharAlphaNumericW
IsCharAlphaW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/atheros_bth.cat
Win7/drivers/Production/Windows7-x64/atheros_bth.inf
Win7/drivers/Production/Windows7-x64/audio/btath_a2dp.cat
Win7/drivers/Production/Windows7-x64/audio/btath_a2dp.inf
Win7/drivers/Production/Windows7-x64/audio/btath_a2dp.sys
.exe windows x64

db2c455988c364829bf22d70d3fe136e

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bd:75:e4:dd:14:53:fc:a0:dd:da:8f:45:21:19:8a:5f:c5:c4:31:47
Signer

Actual PE Digest

bd:75:e4:dd:14:53:fc:a0:dd:da:8f:45:21:19:8a:5f:c5:c4:31:47

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExFreePool
KeWaitForSingleObject
IoGetAttachedDeviceReference
ObfDereferenceObject
DbgPrint
IofCallDriver
ExAllocatePoolWithTag
KeClearEvent
ExReleaseFastMutex
KeInitializeMutex
KeInitializeGuardedMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
IoFreeWorkItem
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseMutex
IoAllocateWorkItem
ExQueryDepthSList
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
KeInitializeEvent
KeAcquireSpinLockRaiseToDpc
IoGetLowerDeviceObject
ExFreePoolWithTag
RtlInitUnicodeString
RtlQueryRegistryValues
KeDelayExecutionThread
PsCreateSystemThread
ZwClose
ObReferenceObjectByHandle
RtlCompareUnicodeString
ObfReferenceObject
IoGetDeviceProperty
KeResetEvent
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
RtlCompareMemory
KeCancelTimer
ExSetTimerResolution
KeInitializeDpc
_purecall
KeInitializeTimerEx
KeBugCheckEx
ExDeleteNPagedLookasideList
IoBuildSynchronousFsdRequest
ZwCreateKey
RtlUnicodeToMultiByteN
RtlWriteRegistryValue
IoCancelIrp
ExAllocatePool
IoBuildDeviceIoControlRequest
IoGetDeviceInterfaces
RtlFreeAnsiString
IoGetDeviceObjectPointer
MmGetSystemRoutineAddress
ZwQueryValueKey
PsGetVersion
KeInitializeTimer
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlDeleteRegistryValue

hal

KeStallExecutionProcessor

portcls.sys

PcNewServiceGroup
PcNewMiniport
PcInitializeAdapterDriver
PcRegisterPhysicalConnection
PcRegisterAdapterPowerManagement
PcRegisterSubdevice
PcAddAdapterDevice
PcNewPort
PcDispatchIrp

Sections

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/audio/btath_audio_flt.cat
Win7/drivers/Production/Windows7-x64/audio/btath_audio_flt.inf
Win7/drivers/Production/Windows7-x64/audio/btath_avdt.sys
.exe windows x64

35c70972abed15c2f84e5f8833edab5a

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

81:d9:40:ab:da:d5:64:c7:4e:32:7d:32:b6:1e:9e:64:d8:01:92:da
Signer

Actual PE Digest

81:d9:40:ab:da:d5:64:c7:4e:32:7d:32:b6:1e:9e:64:d8:01:92:da

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
KeReleaseMutex
ExFreePool
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
RtlCompareUnicodeString
ObfDereferenceObject
IoCreateDevice
IoGetDeviceProperty
DbgPrint
IofCallDriver
KeBugCheckEx
ExFreePoolWithTag
KeSetPriorityThread
KeInitializeDpc
KeReleaseSpinLock
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
KeAcquireSpinLockRaiseToDpc
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
KeResetEvent
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ExAllocatePool
RtlWriteRegistryValue
RtlUnicodeToMultiByteN

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 289B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/audio/btath_flt.sys
.exe windows x64

2b6e4568fdae2b8d59b697dd6e8f6512

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:8a:e2:ef:3a:58:5f:b0:40:d8:d9:80:35:fa:69:96:8d:89:09:dc
Signer

Actual PE Digest

5d:8a:e2:ef:3a:58:5f:b0:40:d8:d9:80:35:fa:69:96:8d:89:09:dc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
KeReleaseMutex
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoFreeIrp
IoAttachDeviceToDeviceStack
PoCallDriver
IoAllocateIrp
IoCreateDevice
DbgPrint
IofCallDriver
KeBugCheckEx
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
ObfDereferenceObject
KeSetPriorityThread
KeInitializeDpc
KeReleaseSpinLock
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
KeAcquireSpinLockRaiseToDpc
KeResetEvent
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoQueueWorkItem
RtlUnicodeToMultiByteN

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/audio/btath_rcp.cat
Win7/drivers/Production/Windows7-x64/audio/btath_rcp.inf
Win7/drivers/Production/Windows7-x64/audio/btath_rcp.sys
.exe windows x64

4938030bbc147aa88ace7f3c208dde11

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:aa:96:39:82:ce:5d:60:b0:54:fe:fc:2c:a1:60:41:6a:c2:c2:45
Signer

Actual PE Digest

79:aa:96:39:82:ce:5d:60:b0:54:fe:fc:2c:a1:60:41:6a:c2:c2:45

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeSetEvent
KeInitializeEvent
RtlQueryRegistryValues
KeReleaseSpinLock
KeReleaseMutex
IoCancelIrp
ExSystemTimeToLocalTime
ExAllocatePool
ExFreePool
PoStartNextPowerIrp
KeInitializeMutex
IofCompleteRequest
KeWaitForSingleObject
RtlTimeToTimeFields
PoCallDriver
IoReleaseCancelSpinLock
DbgPrint
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeClearEvent
KeBugCheckEx
_vsnprintf
ExAllocatePoolWithTag
ExFreePoolWithTag
KeResetEvent
IoFreeWorkItem
IoAllocateWorkItem
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
IoGetDeviceObjectPointer
RtlWriteRegistryValue
ObfDereferenceObject
RtlCompareMemory
KeSetPriorityThread
KeInitializeDpc
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_a2dp.cat
Win7/drivers/Production/Windows7-x64/btath_a2dp.inf
Win7/drivers/Production/Windows7-x64/btath_a2dp.sys
.exe windows x64

db2c455988c364829bf22d70d3fe136e

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bd:75:e4:dd:14:53:fc:a0:dd:da:8f:45:21:19:8a:5f:c5:c4:31:47
Signer

Actual PE Digest

bd:75:e4:dd:14:53:fc:a0:dd:da:8f:45:21:19:8a:5f:c5:c4:31:47

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExFreePool
KeWaitForSingleObject
IoGetAttachedDeviceReference
ObfDereferenceObject
DbgPrint
IofCallDriver
ExAllocatePoolWithTag
KeClearEvent
ExReleaseFastMutex
KeInitializeMutex
KeInitializeGuardedMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
IoFreeWorkItem
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeReleaseMutex
IoAllocateWorkItem
ExQueryDepthSList
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
KeInitializeEvent
KeAcquireSpinLockRaiseToDpc
IoGetLowerDeviceObject
ExFreePoolWithTag
RtlInitUnicodeString
RtlQueryRegistryValues
KeDelayExecutionThread
PsCreateSystemThread
ZwClose
ObReferenceObjectByHandle
RtlCompareUnicodeString
ObfReferenceObject
IoGetDeviceProperty
KeResetEvent
KeSetPriorityThread
KeSetTimerEx
PsTerminateSystemThread
RtlCompareMemory
KeCancelTimer
ExSetTimerResolution
KeInitializeDpc
_purecall
KeInitializeTimerEx
KeBugCheckEx
ExDeleteNPagedLookasideList
IoBuildSynchronousFsdRequest
ZwCreateKey
RtlUnicodeToMultiByteN
RtlWriteRegistryValue
IoCancelIrp
ExAllocatePool
IoBuildDeviceIoControlRequest
IoGetDeviceInterfaces
RtlFreeAnsiString
IoGetDeviceObjectPointer
MmGetSystemRoutineAddress
ZwQueryValueKey
PsGetVersion
KeInitializeTimer
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlDeleteRegistryValue

hal

KeStallExecutionProcessor

portcls.sys

PcNewServiceGroup
PcNewMiniport
PcInitializeAdapterDriver
PcRegisterPhysicalConnection
PcRegisterAdapterPowerManagement
PcRegisterSubdevice
PcAddAdapterDevice
PcNewPort
PcDispatchIrp

Sections

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_audio_flt.cat
Win7/drivers/Production/Windows7-x64/btath_audio_flt.inf
Win7/drivers/Production/Windows7-x64/btath_avdt.sys
.exe windows x64

35c70972abed15c2f84e5f8833edab5a

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

81:d9:40:ab:da:d5:64:c7:4e:32:7d:32:b6:1e:9e:64:d8:01:92:da
Signer

Actual PE Digest

81:d9:40:ab:da:d5:64:c7:4e:32:7d:32:b6:1e:9e:64:d8:01:92:da

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
KeReleaseMutex
ExFreePool
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
RtlCompareUnicodeString
ObfDereferenceObject
IoCreateDevice
IoGetDeviceProperty
DbgPrint
IofCallDriver
KeBugCheckEx
ExFreePoolWithTag
KeSetPriorityThread
KeInitializeDpc
KeReleaseSpinLock
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
KeAcquireSpinLockRaiseToDpc
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
KeResetEvent
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ExAllocatePool
RtlWriteRegistryValue
RtlUnicodeToMultiByteN

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 289B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_bus.cat
Win7/drivers/Production/Windows7-x64/btath_bus.inf
Win7/drivers/Production/Windows7-x64/btath_bus.sys
.exe windows x64

6103ae58355997c3e38f567f2bbe9c0c

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:9d:fd:21:d9:97:b5:3e:cd:94:b8:c2:04:ce:30:65:cb:ee:9b:e1
Signer

Actual PE Digest

aa:9d:fd:21:d9:97:b5:3e:cd:94:b8:c2:04:ce:30:65:cb:ee:9b:e1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeResetEvent
ExReleaseFastMutex
ExAcquireFastMutex
KeSetEvent
KeInitializeEvent
ExEventObjectType
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlCopyUnicodeString
ObfDereferenceObject
DbgPrint
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDeleteDevice
IoFreeWorkItem
ExFreePoolWithTag
IoDetachDevice
PoSetPowerState
KeDelayExecutionThread
IoAllocateWorkItem
IoAttachDeviceToDeviceStack
ObfReferenceObject
IoCreateDevice
IoQueueWorkItem
IofCallDriver
PoStartNextPowerIrp
PoCallDriver
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
IoWMIRegistrationControl
RtlInitUnicodeString
KeBugCheckEx
KeClearEvent
ExAllocatePoolWithTag
RtlAnsiCharToUnicodeChar

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_flt.cat
Win7/drivers/Production/Windows7-x64/btath_flt.inf
Win7/drivers/Production/Windows7-x64/btath_flt.sys
.exe windows x64

2b6e4568fdae2b8d59b697dd6e8f6512

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:8a:e2:ef:3a:58:5f:b0:40:d8:d9:80:35:fa:69:96:8d:89:09:dc
Signer

Actual PE Digest

5d:8a:e2:ef:3a:58:5f:b0:40:d8:d9:80:35:fa:69:96:8d:89:09:dc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
KeReleaseMutex
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoFreeIrp
IoAttachDeviceToDeviceStack
PoCallDriver
IoAllocateIrp
IoCreateDevice
DbgPrint
IofCallDriver
KeBugCheckEx
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
ObfDereferenceObject
KeSetPriorityThread
KeInitializeDpc
KeReleaseSpinLock
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
KeAcquireSpinLockRaiseToDpc
KeResetEvent
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoQueueWorkItem
RtlUnicodeToMultiByteN

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_hcrp.cat
Win7/drivers/Production/Windows7-x64/btath_hcrp.inf
Win7/drivers/Production/Windows7-x64/btath_hcrp.sys
.exe windows x64

71c95c0372ce9b79c87d23d5655c7cf4

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:44:53:a5:17:c7:49:73:9b:94:86:6c:a2:d9:ad:0c:e2:39:7e:22
Signer

Actual PE Digest

ae:44:53:a5:17:c7:49:73:9b:94:86:6c:a2:d9:ad:0c:e2:39:7e:22

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeResetEvent
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
ZwWriteFile
ZwCreateFile
ZwClose
KeInitializeMutex
RtlCompareMemory
KeReleaseMutex
IoOpenDeviceInterfaceRegistryKey
ZwSetValueKey
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCopyUnicodeString
KeBugCheckEx
RtlUnicodeToMultiByteN
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
ObfReferenceObject
ObfDereferenceObject
IofCallDriver
KeSetPriorityThread
KeInitializeDpc
KeReleaseSpinLock
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
KeCancelTimer
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
IoFreeIrp
RtlWriteRegistryValue
IoAllocateIrp
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoQueueWorkItem
RtlInitAnsiString
RtlInitUnicodeString
IoGetDeviceInterfaces
DbgPrint
ZwCreateKey
ZwQueryValueKey
RtlDeleteRegistryValue

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESER
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESRP0
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_hid.cat
Win7/drivers/Production/Windows7-x64/btath_hid.inf
Win7/drivers/Production/Windows7-x64/btath_hid.sys
.exe windows x64

966ad6cba4d7f6c48c06777a18b00c60

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:4e:c2:11:3b:c2:a7:5a:c5:e5:a1:09:8c:9f:45:04:34:c9:5a:0d
Signer

Actual PE Digest

bc:4e:c2:11:3b:c2:a7:5a:c5:e5:a1:09:8c:9f:45:04:34:c9:5a:0d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeMutex
IoDeleteDevice
KeSetEvent
KeInitializeEvent
RtlQueryRegistryValues
KeReleaseSpinLock
IoDetachDevice
KeReleaseMutex
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateDevice
DbgPrint
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeClearEvent
KeBugCheckEx
ExAllocatePoolWithTag
ExFreePoolWithTag
KeResetEvent
IoFreeWorkItem
IoCancelIrp
IoAllocateWorkItem
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
IoGetDeviceObjectPointer
RtlWriteRegistryValue
ObfDereferenceObject
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
KeSetPriorityThread
KeInitializeDpc
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
ZwCreateKey
ZwQueryValueKey
RtlDeleteRegistryValue
RtlUnicodeToMultiByteN

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_lwflt.cat
Win7/drivers/Production/Windows7-x64/btath_lwflt.inf
Win7/drivers/Production/Windows7-x64/btath_lwflt.sys
.exe windows x64

5ca79ed323be32a44e29964ae2c69904

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

86:07:be:f3:03:dd:ef:d7:74:87:23:4a:8c:d6:d1:77:46:b4:47:fe
Signer

Actual PE Digest

86:07:be:f3:03:dd:ef:d7:74:87:23:4a:8c:d6:d1:77:46:b4:47:fe

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeMutex
RtlInitUnicodeString
IoDeleteDevice
RtlQueryRegistryValues
IoDetachDevice
KeReleaseMutex
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
IoInitializeRemoveLockEx
IoCreateDevice
DbgPrint
IofCallDriver
ExAllocatePoolWithTag
IoAcquireRemoveLockEx
KeClearEvent
IoBuildDeviceIoControlRequest
KeSetEvent
KeInitializeEvent
KeInitializeDpc
KeReleaseSpinLock
KeSetTimerEx
KeDelayExecutionThread
IoGetDeviceObjectPointer
ExAllocatePool
ExFreePool
IoReleaseRemoveLockAndWaitEx
IoFreeIrp
IoAllocateIrp
ObfDereferenceObject
KeCancelTimer
IoReleaseCancelSpinLock
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
ExFreePoolWithTag
KeSetPriorityThread
KeInitializeTimer
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
IoFreeWorkItem
IoReleaseRemoveLockEx
IoCancelIrp
IoAllocateWorkItem
RtlUnicodeToMultiByteN

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 317B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btath_rcp.cat
Win7/drivers/Production/Windows7-x64/btath_rcp.inf
Win7/drivers/Production/Windows7-x64/btath_rcp.sys
.exe windows x64

4938030bbc147aa88ace7f3c208dde11

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:aa:96:39:82:ce:5d:60:b0:54:fe:fc:2c:a1:60:41:6a:c2:c2:45
Signer

Actual PE Digest

79:aa:96:39:82:ce:5d:60:b0:54:fe:fc:2c:a1:60:41:6a:c2:c2:45

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeSetEvent
KeInitializeEvent
RtlQueryRegistryValues
KeReleaseSpinLock
KeReleaseMutex
IoCancelIrp
ExSystemTimeToLocalTime
ExAllocatePool
ExFreePool
PoStartNextPowerIrp
KeInitializeMutex
IofCompleteRequest
KeWaitForSingleObject
RtlTimeToTimeFields
PoCallDriver
IoReleaseCancelSpinLock
DbgPrint
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeClearEvent
KeBugCheckEx
_vsnprintf
ExAllocatePoolWithTag
ExFreePoolWithTag
KeResetEvent
IoFreeWorkItem
IoAllocateWorkItem
IoFreeIrp
IoAllocateIrp
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
IoGetDeviceObjectPointer
RtlWriteRegistryValue
ObfDereferenceObject
RtlCompareMemory
KeSetPriorityThread
KeInitializeDpc
KeInitializeTimer
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeCancelTimer
ExReleaseFastMutex
ExAcquireFastMutex
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoGetDeviceInterfaces
ObfReferenceObject

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btatherosInstall.exe
.exe windows x64

bdcaf0d55d3864f9485429da6af1a055

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:38:b2:23:fb:5a:2c:2f:44:95:1c:9e:42:3a:12:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/03/2015, 00:00

Not After

27/03/2018, 23:59

Subject

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:22:8a:bd:29:ca:28:44:40:92:2f:4a:28:86:2b:ff:15:29:08:49
Signer

Actual PE Digest

54:22:8a:bd:29:ca:28:44:40:92:2f:4a:28:86:2b:ff:15:29:08:49

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

28/04/2015, 00:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiOpenDeviceInfoW
SetupDiGetClassDevsExW
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoListExW
SetupDiGetINFClassW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW
CM_Get_DevNode_Status_Ex
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInfoListDetailW

kernel32

LCMapStringEx
GetStringTypeW
LoadLibraryW
GetFullPathNameW
GetCommandLineW
FindFirstFileW
OutputDebugStringW
WaitNamedPipeW
WriteFile
CreateFileW
lstrlenW
FlushFileBuffers
GetLastError
SetNamedPipeHandleState
FindNextFileW
CloseHandle
LocalFree
LoadLibraryExW
Sleep
GetModuleHandleW
TerminateProcess
GetCurrentProcess
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapSize
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
HeapReAlloc
SetStdHandle
FindClose
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
EncodePointer
DecodePointer
WriteConsoleW
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter

user32

IsWindow
SendMessageW
MessageBoxW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW

newdev

DiUninstallDevice
UpdateDriverForPlugAndPlayDevicesW

difxapi

DriverPackagePreinstallW
DriverPackageUninstallW
DriverPackageInstallW

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/btfilter.sys
.exe windows x64

18c82ef2497ed845dec36b2a382cf0ae

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:38:b2:23:fb:5a:2c:2f:44:95:1c:9e:42:3a:12:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/03/2015, 00:00

Not After

27/03/2018, 23:59

Subject

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:ab:91:d9:8e:ac:f6:ed:df:49:c3:55:39:12:cd:86:39:72:cd:35
Signer

Actual PE Digest

54:ab:91:d9:8e:ac:f6:ed:df:49:c3:55:39:12:cd:86:39:72:cd:35

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

21/04/2015, 11:32
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeSetEvent
IoFreeWorkItem
KeInitializeEvent
RtlQueryRegistryValues
IoIs32bitProcess
RtlGetVersion
KeInitializeDpc
IoReleaseRemoveLockEx
KeReleaseSpinLock
IoDetachDevice
KeSetTimerEx
IoCancelIrp
PoSetPowerState
KeDelayExecutionThread
IoAllocateWorkItem
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoFreeIrp
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoAllocateIrp
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
IoQueueWorkItem
KeInitializeTimerEx
KeCancelTimer
IoReleaseCancelSpinLock
IoGetDeviceProperty
DbgPrint
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeClearEvent
IoWriteErrorLogEntry
IoBuildDeviceIoControlRequest
IoAllocateErrorLogEntry
KeFlushQueuedDpcs
IoDeleteDevice
ZwClose
RtlWriteRegistryValue
ExInterlockedRemoveHeadList
RtlDeleteRegistryValue
ZwQueryKey
ZwOpenKey
KeReadStateEvent
KeReleaseSpinLockFromDpcLevel
PoRequestPowerIrp
KeAcquireSpinLockAtDpcLevel
IoWMIRegistrationControl
IoAcquireRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoIsWdmVersionAvailable
IoInitializeRemoveLockEx
ObfReferenceObject
ZwEnumerateKey
ZwCreateKey
ZwReadFile
RtlAppendUnicodeToString
ZwCreateFile
RtlCopyUnicodeString
ZwQueryInformationFile
IoBuildSynchronousFsdRequest
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoGetDeviceObjectPointer
RtlFreeAnsiString
IoGetDeviceInterfaces
KeResetEvent
ExEventObjectType
ObReferenceObjectByHandle
KeBugCheckEx
RtlInitUnicodeString
IoDeleteSymbolicLink
ExFreePoolWithTag
IoGetLowerDeviceObject
ZwQueryValueKey
IoReuseIrp
MmGetSystemRoutineAddress
PsGetVersion
KeSetPriorityThread
KeInitializeTimer
PsCreateSystemThread
PsTerminateSystemThread
_vsnprintf
DbgPrintEx
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
ZwWriteFile
_vsnwprintf
ZwEnumerateValueKey
RtlRandomEx
sprintf
isupper
islower
RtlCompareMemory
ZwDeleteValueKey
wcsncat
RtlAppendUnicodeStringToString
ZwDeleteKey
ExFreePool
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ExAllocatePoolWithTag
__chkstk

wmilib.sys

WmiSystemControl
WmiCompleteRequest

hal

KeStallExecutionProcessor

Sections

.text
Size: 522KB - Virtual size: 521KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/bthci.dll
.dll windows x86

bbfc61016159b1f7118b96e7be017053

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
_vsnwprintf

ntdll

VerSetConditionMask

setupapi

SetupCloseLog
SetupLogErrorW
SetupDiInstallDevice
SetupDiCreateDevRegKeyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupOpenLog

user32

EndDialog
GetDlgItem
GetWindowTextW
IsWindowEnabled
SetWindowTextW
LoadStringW
SendMessageW
EnableWindow
ShowWindow
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetParent

advapi32

StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegCloseKey
RegQueryValueExW
RegSetValueExW
CreateServiceW

kernel32

GetTickCount
QueryPerformanceCounter
LoadLibraryExA
CompareStringW
GetCurrentThreadId
CreateFileW
CloseHandle
GetLastError
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
lstrcpynW
GetModuleFileNameW
LoadLibraryW
MultiByteToWideChar
DeviceIoControl
lstrlenW
DisableThreadLibraryCalls
LocalFree
GetComputerNameW
VerifyVersionInfoW
SetLastError
OutputDebugStringW
WideCharToMultiByte
lstrcmpiW
GetWindowsDirectoryW
LocalAlloc

Exports

Exports

BluetoothClassInstaller
DllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x64/leath_hid.cat
Win7/drivers/Production/Windows7-x64/leath_hid.inf
Win7/drivers/Production/Windows7-x64/leath_hid.sys
.exe windows x64

da89c9ee7906a76f64a213756392bc8f

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

81:f1:a6:2b:2c:6a:d9:fc:01:0f:6c:e0:c9:15:7e:69:7b:56:ff:ea
Signer

Actual PE Digest

81:f1:a6:2b:2c:6a:d9:fc:01:0f:6c:e0:c9:15:7e:69:7b:56:ff:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeInitializeMutex
IoBuildSynchronousFsdRequest
RtlInitUnicodeString
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
IoCancelIrp
PsCreateSystemThread
IoGetDeviceObjectPointer
ZwQueryValueKey
ExFreePool
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
ExFreePoolWithTag
IoFreeIrp
PoCallDriver
IoAllocateIrp
RtlCompareMemory
ObfDereferenceObject
IoReleaseCancelSpinLock
DbgPrint
IofCallDriver
ZwQueryKey
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
KeReleaseMutex
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
KeBugCheckEx
KeWaitForSingleObject
ExAllocatePoolWithTag
ZwCreateKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
wcsncat
RtlFreeUnicodeString
RtlAppendUnicodeStringToString
RtlWriteRegistryValue
RtlCopyUnicodeString
_vsnprintf

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 768B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/DIFxAPI.dll
.dll windows x86

c8bb176aa316a8a34b7e7e1439c67e13

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

26:98:6b:1f:23:b8:07:df:c1:05:57:1b:9c:b8:b1:59:1a:1f:7c:a1
Signer

Actual PE Digest

26:98:6b:1f:23:b8:07:df:c1:05:57:1b:9c:b8:b1:59:1a:1f:7c:a1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
RtlNtStatusToDosError
VerSetConditionMask

kernel32

VerifyVersionInfoW
GetVersionExW
lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
SetFileAttributesW
GetEnvironmentVariableW
CompareStringW
GetFileAttributesW
MoveFileExW
GetTempFileNameW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetSystemWindowsDirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
CopyFileW
LocalFree
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CreateDirectoryW
LocalReAlloc
LocalAlloc
GetProcessHeap
ReleaseMutex
GetSystemDirectoryW
DeviceIoControl
WaitForSingleObject
CreateMutexW
GetSystemTimeAsFileTime
Sleep
RaiseException
GetVersionExA
HeapSize
GetCommandLineA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
GetThreadLocale
WaitForMultipleObjects
InterlockedCompareExchange
SetEvent
CreateEventW
SetEndOfFile
SetLastError
InterlockedExchange
lstrcmpiW
InterlockedDecrement
GetLastError
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
HeapReAlloc
EnterCriticalSection
HeapAlloc
LeaveCriticalSection
HeapDestroy
GetModuleHandleW
DeleteCriticalSection
GetModuleFileNameA
OutputDebugStringA
HeapCreate
InitializeCriticalSection
TlsGetValue

user32

UnregisterClassA
CharLowerW
CharPrevW

setupapi

CM_Query_And_Remove_SubTreeW
SetupDiSetDeviceRegistryPropertyW
SetupQueueCopyIndirectW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoList
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Setup_DevNode
SetupDiGetDeviceRegistryPropertyW
SetupGetTargetPathW
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupOpenFileQueue
SetupCommitFileQueueW
SetupQueueCopyW
SetupCloseFileQueue
SetupGetLineCountW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetFieldCount
SetupGetIntField
CM_Enumerate_Classes
SetupDiEnumDeviceInfo
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupDiGetClassDevsW
SetupDiOpenClassRegKey
CM_Get_Device_IDW
SetupDiDestroyDeviceInfoList
SetupGetStringFieldW
pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupOpenAppendInfFileW
SetupCopyOEMInfW
SetupTermDefaultQueueCallback

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetEntriesInAclW
QueryServiceStatus
DeleteService
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
RegCloseKey

ole32

StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

crypt32

CertFreeCertificateContext
CertGetCTLContextProperty
CryptQueryObject
CertFreeCTLContext

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/Dell/atheros_bth.cat
Win7/drivers/Production/Windows7-x86/Dell/atheros_bth.inf
Win7/drivers/Production/Windows7-x86/Dell/btfilter.sys
.exe windows x86

094bd4cc7a09a9953b2ac7d9596fe451

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:38:b2:23:fb:5a:2c:2f:44:95:1c:9e:42:3a:12:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/03/2015, 00:00

Not After

27/03/2018, 23:59

Subject

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ff:5f:f4:e7:5e:b9:19:04:27:a3:aa:2e:c3:44:35:be:b6:e9:e9:9c
Signer

Actual PE Digest

ff:5f:f4:e7:5e:b9:19:04:27:a3:aa:2e:c3:44:35:be:b6:e9:e9:9c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

21/04/2015, 11:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAllocateWorkItem
IofCallDriver
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
RtlQueryRegistryValues
memmove
memset
RtlInitUnicodeString
PoStartNextPowerIrp
KeWaitForSingleObject
PoCallDriver
IoGetLowerDeviceObject
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
PoSetPowerState
KeInitializeTimerEx
KeInitializeDpc
KeInitializeEvent
KeInitializeSpinLock
IoGetDeviceProperty
IoCreateSymbolicLink
IoCreateDevice
KeSetEvent
RtlGetVersion
ExfInterlockedRemoveHeadList
RtlWriteRegistryValue
ZwClose
ZwQueryValueKey
ZwQueryKey
ZwOpenKey
RtlDeleteRegistryValue
KeClearEvent
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoBuildDeviceIoControlRequest
IoQueueWorkItem
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoRequestPowerIrp
KeReadStateEvent
IoWMIRegistrationControl
IoInitializeRemoveLockEx
IoIsWdmVersionAvailable
IoReleaseRemoveLockAndWaitEx
ObfReferenceObject
InterlockedCompareExchange
memcpy
ZwEnumerateKey
RtlCopyUnicodeString
ZwCreateKey
RtlAppendUnicodeToString
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObReferenceObjectByHandle
ExEventObjectType
KeResetEvent
KeTickCount
KeBugCheckEx
IoReuseIrp
ExFreePoolWithTag
IoFreeIrp
ExAllocatePoolWithTag
IoAllocateIrp
IoFreeWorkItem
KeSetTimerEx
KeCancelTimer
IoCancelIrp
KeFlushQueuedDpcs
KeDelayExecutionThread
PsGetVersion
MmGetSystemRoutineAddress
_vsnprintf
KeQueryInterruptTime
_aulldiv
KeInitializeTimer
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
DbgPrintEx
PsCreateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwWriteFile
_vsnwprintf
ZwEnumerateValueKey
RtlRandomEx
sprintf
islower
isupper
InterlockedExchange
RtlCompareMemory
KeQuerySystemTime
wcsncat
RtlAppendUnicodeStringToString
ZwDeleteKey
ZwDeleteValueKey
ExFreePool
_allshl
ExSystemTimeToLocalTime
RtlTimeToTimeFields
IoReleaseCancelSpinLock
IofCompleteRequest
InterlockedExchangeAdd
DbgPrint

hal

KfRaiseIrql
KeStallExecutionProcessor
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql

wmilib.sys

WmiCompleteRequest
WmiSystemControl

Sections

.text
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/NvmMerge.exe
.exe windows x86

95035709be3b90e7c275a209f6f768f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
HeapAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
EncodePointer
Sleep
SetStdHandle
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
MultiByteToWideChar
ReadFile
CloseHandle
WriteFile
GetModuleFileNameW
HeapCreate
SetFilePointer
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
FlushFileBuffers
GetTimeZoneInformation
IsProcessorFeaturePresent
CreateFileA
HeapSize
WriteConsoleW
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap
CreateFileW
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/WdfCoInstaller01009.dll
.dll windows x86

a17af54bf9d379152b9c377204b35eb9

Code Sign

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0
Signer

Actual PE Digest

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/07/2009, 19:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf

setupapi

SetupCloseInfFile
SetupOpenInfFileW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetWindowsDirectoryW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree

advapi32

OpenSCManagerW
ChangeServiceConfigW
QueryServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
DeleteService
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

shell32

CommandLineToArgvW

user32

IsCharAlphaW
IsCharAlphaNumericW
LoadStringW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/atheros_bth.cat
Win7/drivers/Production/Windows7-x86/atheros_bth.inf
Win7/drivers/Production/Windows7-x86/audio/btath_a2dp.cat
Win7/drivers/Production/Windows7-x86/audio/btath_a2dp.inf
Win7/drivers/Production/Windows7-x86/audio/btath_a2dp.sys
.exe windows x86

23a2884e0cd109da9c3ec7c0dd1bbe32

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ce:0e:d2:6d:ab:52:b9:f7:0f:80:14:e5:55:8e:09:f4:cd:f7:de
Signer

Actual PE Digest

2b:ce:0e:d2:6d:ab:52:b9:f7:0f:80:14:e5:55:8e:09:f4:cd:f7:de

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
IoFreeIrp
IoAllocateIrp
KeInitializeSpinLock
ExInitializeNPagedLookasideList
KeInitializeMutex
KeInitializeGuardedMutex
memset
IoAllocateWorkItem
InterlockedExchangeAdd
_aulldiv
InterlockedIncrement
KeSetEvent
InterlockedDecrement
KeClearEvent
memcpy
KeReleaseMutex
ExDeleteNPagedLookasideList
IoFreeWorkItem
ExAllocatePoolWithTag
IoQueueWorkItem
InterlockedExchange
ExFreePoolWithTag
KeDelayExecutionThread
RtlQueryRegistryValues
KeInitializeEvent
ObfReferenceObject
IoGetLowerDeviceObject
RtlCompareUnicodeString
RtlInitUnicodeString
IoGetDeviceProperty
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeQueryInterruptTime
_allmul
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
KeResetEvent
ExSetTimerResolution
KeSetTimerEx
KeCancelTimer
RtlCompareMemory
_purecall
_alldiv
KeInitializeTimerEx
KeInitializeDpc
InterlockedCompareExchange
KeTickCount
KeBugCheckEx
IoGetAttachedDeviceReference
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
ObfDereferenceObject
memmove
ExFreePool
ZwCreateKey
RtlUnicodeToMultiByteN
RtlWriteRegistryValue
IoCancelIrp
ExAllocatePool
IoBuildDeviceIoControlRequest
KeInitializeTimer
PsGetVersion
MmGetSystemRoutineAddress
ZwQueryValueKey
RtlFreeAnsiString
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
RtlDeleteRegistryValue

hal

KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeStallExecutionProcessor

portcls.sys

PcNewServiceGroup
PcInitializeAdapterDriver
PcAddAdapterDevice
PcRegisterAdapterPowerManagement
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterSubdevice
PcDispatchIrp

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/audio/btath_audio_flt.cat
Win7/drivers/Production/Windows7-x86/audio/btath_audio_flt.inf
Win7/drivers/Production/Windows7-x86/audio/btath_avdt.sys
.exe windows x86

80bfa4369747399f06c0555e1d1e28ed

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:f0:02:ed:cd:e4:d9:59:f3:cb:99:bf:e7:ec:15:26:c1:ac:ef:19
Signer

Actual PE Digest

7f:f0:02:ed:cd:e4:d9:59:f3:cb:99:bf:e7:ec:15:26:c1:ac:ef:19

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeEvent
KeReleaseMutex
KeWaitForSingleObject
RtlCompareUnicodeString
RtlInitUnicodeString
IoGetDeviceProperty
InterlockedCompareExchange
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoGetAttachedDeviceReference
IoCreateDevice
IoDeleteDevice
IoDetachDevice
DbgPrint
KeInitializeMutex
ExAllocatePoolWithTag
memset
KeTickCount
KeBugCheckEx
InterlockedExchangeAdd
KeInitializeSpinLock
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
memcpy
KeSetEvent
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
InterlockedExchange
_allmul
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoFreeWorkItem
IoFreeIrp
IoCancelIrp
IoQueueWorkItem
IoAllocateWorkItem
IoAllocateIrp
KeResetEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
memmove
ExAllocatePool
RtlWriteRegistryValue
PoStartNextPowerIrp
PoCallDriver
IofCallDriver
ExFreePool
ExFreePoolWithTag
IofCompleteRequest
RtlUnicodeToMultiByteN

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 235B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/audio/btath_flt.sys
.exe windows x86

0cec4d5fc323dcefd8d861eb020a1c12

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:00:43:e9:8a:87:d5:ed:7e:4d:2d:a2:64:61:35:30:47:ef:3d:cb
Signer

Actual PE Digest

2e:00:43:e9:8a:87:d5:ed:7e:4d:2d:a2:64:61:35:30:47:ef:3d:cb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
KeSetEvent
IoFreeIrp
ExAllocatePoolWithTag
IoAllocateIrp
ExFreePoolWithTag
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
RtlInitUnicodeString
KeReleaseMutex
KeInitializeMutex
KeTickCount
KeBugCheckEx
InterlockedExchangeAdd
KeInitializeSpinLock
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
memset
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
ObfDereferenceObject
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
InterlockedExchange
_allmul
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoFreeWorkItem
IoCancelIrp
IoQueueWorkItem
IoAllocateWorkItem
KeResetEvent
memcpy
KeInitializeEvent
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject
RtlUnicodeToMultiByteN

hal

ExReleaseFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/audio/btath_rcp.cat
Win7/drivers/Production/Windows7-x86/audio/btath_rcp.inf
Win7/drivers/Production/Windows7-x86/audio/btath_rcp.sys
.exe windows x86

f100a5ca85d2fb356cebc4cb32056fb1

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:e2:ea:b2:2a:2e:a4:ee:97:1d:f2:d0:b8:51:63:70:fa:e2:2e:28
Signer

Actual PE Digest

c9:e2:ea:b2:2a:2e:a4:ee:97:1d:f2:d0:b8:51:63:70:fa:e2:2e:28

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeSpinLock
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
KeReleaseMutex
InterlockedExchange
KeWaitForSingleObject
IofCompleteRequest
memcpy
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
ExFreePool
IoReleaseCancelSpinLock
ExAllocatePoolWithTag
KeInitializeEvent
KeInitializeMutex
KeClearEvent
KeTickCount
KeBugCheckEx
IoCancelIrp
memset
DbgPrint
memmove
IofCallDriver
ExAllocatePool
ExFreePoolWithTag
IoFreeWorkItem
IoFreeIrp
RtlQueryRegistryValues
IoAllocateWorkItem
IoAllocateIrp
KeResetEvent
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
ObfDereferenceObject
IoGetDeviceObjectPointer
_allmul
RtlWriteRegistryValue
RtlCompareMemory
InterlockedExchangeAdd
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoQueueWorkItem
_vsnprintf

hal

ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_a2dp.cat
Win7/drivers/Production/Windows7-x86/btath_a2dp.inf
Win7/drivers/Production/Windows7-x86/btath_a2dp.sys
.exe windows x86

23a2884e0cd109da9c3ec7c0dd1bbe32

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ce:0e:d2:6d:ab:52:b9:f7:0f:80:14:e5:55:8e:09:f4:cd:f7:de
Signer

Actual PE Digest

2b:ce:0e:d2:6d:ab:52:b9:f7:0f:80:14:e5:55:8e:09:f4:cd:f7:de

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
IoFreeIrp
IoAllocateIrp
KeInitializeSpinLock
ExInitializeNPagedLookasideList
KeInitializeMutex
KeInitializeGuardedMutex
memset
IoAllocateWorkItem
InterlockedExchangeAdd
_aulldiv
InterlockedIncrement
KeSetEvent
InterlockedDecrement
KeClearEvent
memcpy
KeReleaseMutex
ExDeleteNPagedLookasideList
IoFreeWorkItem
ExAllocatePoolWithTag
IoQueueWorkItem
InterlockedExchange
ExFreePoolWithTag
KeDelayExecutionThread
RtlQueryRegistryValues
KeInitializeEvent
ObfReferenceObject
IoGetLowerDeviceObject
RtlCompareUnicodeString
RtlInitUnicodeString
IoGetDeviceProperty
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeQueryInterruptTime
_allmul
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
KeResetEvent
ExSetTimerResolution
KeSetTimerEx
KeCancelTimer
RtlCompareMemory
_purecall
_alldiv
KeInitializeTimerEx
KeInitializeDpc
InterlockedCompareExchange
KeTickCount
KeBugCheckEx
IoGetAttachedDeviceReference
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
ObfDereferenceObject
memmove
ExFreePool
ZwCreateKey
RtlUnicodeToMultiByteN
RtlWriteRegistryValue
IoCancelIrp
ExAllocatePool
IoBuildDeviceIoControlRequest
KeInitializeTimer
PsGetVersion
MmGetSystemRoutineAddress
ZwQueryValueKey
RtlFreeAnsiString
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
RtlDeleteRegistryValue

hal

KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeStallExecutionProcessor

portcls.sys

PcNewServiceGroup
PcInitializeAdapterDriver
PcAddAdapterDevice
PcRegisterAdapterPowerManagement
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterSubdevice
PcDispatchIrp

Sections

.text
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_audio_flt.cat
Win7/drivers/Production/Windows7-x86/btath_audio_flt.inf
Win7/drivers/Production/Windows7-x86/btath_avdt.sys
.exe windows x86

80bfa4369747399f06c0555e1d1e28ed

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:f0:02:ed:cd:e4:d9:59:f3:cb:99:bf:e7:ec:15:26:c1:ac:ef:19
Signer

Actual PE Digest

7f:f0:02:ed:cd:e4:d9:59:f3:cb:99:bf:e7:ec:15:26:c1:ac:ef:19

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeEvent
KeReleaseMutex
KeWaitForSingleObject
RtlCompareUnicodeString
RtlInitUnicodeString
IoGetDeviceProperty
InterlockedCompareExchange
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoGetAttachedDeviceReference
IoCreateDevice
IoDeleteDevice
IoDetachDevice
DbgPrint
KeInitializeMutex
ExAllocatePoolWithTag
memset
KeTickCount
KeBugCheckEx
InterlockedExchangeAdd
KeInitializeSpinLock
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
memcpy
KeSetEvent
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
InterlockedExchange
_allmul
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoFreeWorkItem
IoFreeIrp
IoCancelIrp
IoQueueWorkItem
IoAllocateWorkItem
IoAllocateIrp
KeResetEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
memmove
ExAllocatePool
RtlWriteRegistryValue
PoStartNextPowerIrp
PoCallDriver
IofCallDriver
ExFreePool
ExFreePoolWithTag
IofCompleteRequest
RtlUnicodeToMultiByteN

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 235B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_bus.cat
Win7/drivers/Production/Windows7-x86/btath_bus.inf
Win7/drivers/Production/Windows7-x86/btath_bus.sys
.exe windows x86

af346a78d460009d7dc011a75526b019

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:9d:07:c1:64:0b:11:ce:34:72:65:3f:8f:e6:f7:1c:5b:f4:e6:f4
Signer

Actual PE Digest

40:9d:07:c1:64:0b:11:ce:34:72:65:3f:8f:e6:f7:1c:5b:f4:e6:f4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ObfDereferenceObject
KeWaitForSingleObject
memcpy
memset
ExFreePoolWithTag
KeClearEvent
KeInitializeEvent
RtlCopyUnicodeString
ExAllocatePoolWithTag
PoSetPowerState
IoSetDeviceInterfaceState
IoDeleteDevice
KeDelayExecutionThread
DbgPrint
IoQueueWorkItem
IoAllocateWorkItem
IoDetachDevice
IoAttachDeviceToDeviceStack
IoRegisterDeviceInterface
IoCreateDevice
IofCallDriver
ObfReferenceObject
PoCallDriver
PoStartNextPowerIrp
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
IoWMIRegistrationControl
RtlInitUnicodeString
KeTickCount
KeResetEvent
KeSetEvent
ExEventObjectType
ObReferenceObjectByHandle
IoFreeWorkItem
IofCompleteRequest
RtlAnsiCharToUnicodeChar
KeBugCheckEx

hal

ExAcquireFastMutex
ExReleaseFastMutex

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_flt.cat
Win7/drivers/Production/Windows7-x86/btath_flt.inf
Win7/drivers/Production/Windows7-x86/btath_flt.sys
.exe windows x86

0cec4d5fc323dcefd8d861eb020a1c12

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:00:43:e9:8a:87:d5:ed:7e:4d:2d:a2:64:61:35:30:47:ef:3d:cb
Signer

Actual PE Digest

2e:00:43:e9:8a:87:d5:ed:7e:4d:2d:a2:64:61:35:30:47:ef:3d:cb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
KeSetEvent
IoFreeIrp
ExAllocatePoolWithTag
IoAllocateIrp
ExFreePoolWithTag
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
RtlInitUnicodeString
KeReleaseMutex
KeInitializeMutex
KeTickCount
KeBugCheckEx
InterlockedExchangeAdd
KeInitializeSpinLock
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
memset
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
ObfDereferenceObject
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
InterlockedExchange
_allmul
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoFreeWorkItem
IoCancelIrp
IoQueueWorkItem
IoAllocateWorkItem
KeResetEvent
memcpy
KeInitializeEvent
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject
RtlUnicodeToMultiByteN

hal

ExReleaseFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_hcrp.cat
Win7/drivers/Production/Windows7-x86/btath_hcrp.inf
Win7/drivers/Production/Windows7-x86/btath_hcrp.sys
.exe windows x86

2c777a42e0e9d538c003bf671fcef84c

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:cd:0a:86:48:af:7b:ce:c5:da:75:38:58:a1:2b:78:29:1c:de:e8
Signer

Actual PE Digest

de:cd:0a:86:48:af:7b:ce:c5:da:75:38:58:a1:2b:78:29:1c:de:e8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwWriteFile
memcpy
KeInitializeMutex
memset
RtlCompareMemory
KeReleaseMutex
ZwSetValueKey
IoOpenDeviceInterfaceRegistryKey
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlCopyUnicodeString
KeTickCount
KeBugCheckEx
RtlUnicodeToMultiByteN
_allmul
RtlFreeAnsiString
ObfDereferenceObject
IofCallDriver
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
ObfReferenceObject
ZwCreateFile
KeInitializeSpinLock
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ObReferenceObjectByHandle
PsCreateSystemThread
InterlockedExchange
IoFreeWorkItem
IoFreeIrp
IoCancelIrp
IoQueueWorkItem
IoAllocateWorkItem
IoAllocateIrp
IoBuildDeviceIoControlRequest
RtlWriteRegistryValue
ZwClose
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
KeResetEvent
RtlInitUnicodeString
RtlInitAnsiString
InterlockedExchangeAdd
DbgPrint
ZwQueryValueKey
ZwCreateKey
RtlDeleteRegistryValue

hal

KfReleaseSpinLock
ExAcquireFastMutex
KeGetCurrentIrql
KfAcquireSpinLock
ExReleaseFastMutex

wdfldr.sys

WdfVersionBind
WdfVersionBindClass
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESER
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESRP0
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_hid.cat
Win7/drivers/Production/Windows7-x86/btath_hid.inf
Win7/drivers/Production/Windows7-x86/btath_hid.sys
.exe windows x86

5d37ed6a7e645e1a702a336a5eb617ff

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c6:24:89:41:b7:8a:53:67:95:99:9f:e8:95:82:8b:00:6d:81:07:85
Signer

Actual PE Digest

c6:24:89:41:b7:8a:53:67:95:99:9f:e8:95:82:8b:00:6d:81:07:85

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteDevice
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
IofCallDriver
memcpy
IofCompleteRequest
InterlockedExchange
KeInitializeEvent
IoDetachDevice
KeInitializeMutex
KeClearEvent
KeTickCount
KeBugCheckEx
KeWaitForSingleObject
KeReleaseMutex
memset
DbgPrint
ExFreePoolWithTag
IoFreeWorkItem
ExAllocatePoolWithTag
IoFreeIrp
IoCancelIrp
IoQueueWorkItem
memmove
IoAllocateIrp
KeResetEvent
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
ObfDereferenceObject
IoGetDeviceObjectPointer
_allmul
RtlWriteRegistryValue
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
InterlockedExchangeAdd
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
ZwQueryValueKey
ZwCreateKey
RtlDeleteRegistryValue
IoAllocateWorkItem
RtlQueryRegistryValues
RtlUnicodeToMultiByteN

hal

ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_lwflt.cat
Win7/drivers/Production/Windows7-x86/btath_lwflt.inf
Win7/drivers/Production/Windows7-x86/btath_lwflt.sys
.exe windows x86

b8ce2a59cf6911ebae42f96abfd2594e

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:f1:8f:a5:41:05:42:ef:5e:39:f6:0b:54:ef:94:0b:ce:5a:af:55
Signer

Actual PE Digest

4c:f1:8f:a5:41:05:42:ef:5e:39:f6:0b:54:ef:94:0b:ce:5a:af:55

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
IoCreateDevice
RtlInitUnicodeString
KeReleaseMutex
KeWaitForSingleObject
IofCompleteRequest
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
KeInitializeMutex
KeSetTimerEx
KeCancelTimer
InterlockedExchangeAdd
_allmul
InterlockedExchange
KeSetEvent
ObfDereferenceObject
IoFreeIrp
KeInitializeEvent
IoAllocateIrp
IoGetDeviceObjectPointer
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePool
IoReleaseRemoveLockAndWaitEx
IoAcquireRemoveLockEx
ExAllocatePool
KeDelayExecutionThread
memcpy
IoReleaseCancelSpinLock
IoDetachDevice
InterlockedDecrement
InterlockedIncrement
IoBuildDeviceIoControlRequest
KeInitializeDpc
KeTickCount
KeBugCheckEx
IoDeleteDevice
memset
memmove
KeInitializeTimer
KeQueryInterruptTime
_aulldiv
ExFreePoolWithTag
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoFreeWorkItem
IoReleaseRemoveLockEx
IoCancelIrp
IoAllocateWorkItem
RtlQueryRegistryValues
KeClearEvent
DbgPrint
RtlUnicodeToMultiByteN

hal

ExAcquireFastMutex
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 257B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btath_rcp.cat
Win7/drivers/Production/Windows7-x86/btath_rcp.inf
Win7/drivers/Production/Windows7-x86/btath_rcp.sys
.exe windows x86

f100a5ca85d2fb356cebc4cb32056fb1

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:e2:ea:b2:2a:2e:a4:ee:97:1d:f2:d0:b8:51:63:70:fa:e2:2e:28
Signer

Actual PE Digest

c9:e2:ea:b2:2a:2e:a4:ee:97:1d:f2:d0:b8:51:63:70:fa:e2:2e:28

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeSpinLock
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
KeReleaseMutex
InterlockedExchange
KeWaitForSingleObject
IofCompleteRequest
memcpy
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
ExFreePool
IoReleaseCancelSpinLock
ExAllocatePoolWithTag
KeInitializeEvent
KeInitializeMutex
KeClearEvent
KeTickCount
KeBugCheckEx
IoCancelIrp
memset
DbgPrint
memmove
IofCallDriver
ExAllocatePool
ExFreePoolWithTag
IoFreeWorkItem
IoFreeIrp
RtlQueryRegistryValues
IoAllocateWorkItem
IoAllocateIrp
KeResetEvent
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
ObfDereferenceObject
IoGetDeviceObjectPointer
_allmul
RtlWriteRegistryValue
RtlCompareMemory
InterlockedExchangeAdd
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeInitializeTimer
KeCancelTimer
KeQueryInterruptTime
_aulldiv
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
KeSetTimerEx
KeInitializeDpc
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObfReferenceObject
IoQueueWorkItem
_vsnprintf

hal

ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btatherosInstall.exe
.exe windows x86

d2b30199cb0d827502d0d10e926577a0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:38:b2:23:fb:5a:2c:2f:44:95:1c:9e:42:3a:12:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/03/2015, 00:00

Not After

27/03/2018, 23:59

Subject

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:d7:1c:dc:a5:a0:5a:8e:0d:3b:71:38:fe:5a:73:6f:07:2b:88:c4
Signer

Actual PE Digest

79:d7:1c:dc:a5:a0:5a:8e:0d:3b:71:38:fe:5a:73:6f:07:2b:88:c4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

28/04/2015, 00:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiOpenDeviceInfoW
SetupDiGetClassDevsExW
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoListExW
SetupDiGetINFClassW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW
CM_Get_DevNode_Status_Ex
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInfoListDetailW

kernel32

LCMapStringEx
GetStringTypeW
RtlUnwind
GetFullPathNameW
GetCommandLineW
FindFirstFileW
OutputDebugStringW
WaitNamedPipeW
WriteFile
CreateFileW
lstrlenW
FlushFileBuffers
GetLastError
SetNamedPipeHandleState
FindNextFileW
CloseHandle
LocalFree
LoadLibraryW
LoadLibraryExW
Sleep
GetModuleHandleW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapSize
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
HeapReAlloc
SetStdHandle
FindClose
InterlockedDecrement
HeapFree
HeapAlloc
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
EncodePointer
DecodePointer
WriteConsoleW
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc

user32

IsWindow
SendMessageW
MessageBoxW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW

newdev

DiUninstallDevice
UpdateDriverForPlugAndPlayDevicesW

difxapi

DriverPackagePreinstallW
DriverPackageUninstallW
DriverPackageInstallW

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/btfilter.sys
.exe windows x86

094bd4cc7a09a9953b2ac7d9596fe451

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:38:b2:23:fb:5a:2c:2f:44:95:1c:9e:42:3a:12:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/03/2015, 00:00

Not After

27/03/2018, 23:59

Subject

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ff:5f:f4:e7:5e:b9:19:04:27:a3:aa:2e:c3:44:35:be:b6:e9:e9:9c
Signer

Actual PE Digest

ff:5f:f4:e7:5e:b9:19:04:27:a3:aa:2e:c3:44:35:be:b6:e9:e9:9c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

21/04/2015, 11:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAllocateWorkItem
IofCallDriver
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
RtlQueryRegistryValues
memmove
memset
RtlInitUnicodeString
PoStartNextPowerIrp
KeWaitForSingleObject
PoCallDriver
IoGetLowerDeviceObject
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
PoSetPowerState
KeInitializeTimerEx
KeInitializeDpc
KeInitializeEvent
KeInitializeSpinLock
IoGetDeviceProperty
IoCreateSymbolicLink
IoCreateDevice
KeSetEvent
RtlGetVersion
ExfInterlockedRemoveHeadList
RtlWriteRegistryValue
ZwClose
ZwQueryValueKey
ZwQueryKey
ZwOpenKey
RtlDeleteRegistryValue
KeClearEvent
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoBuildDeviceIoControlRequest
IoQueueWorkItem
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoRequestPowerIrp
KeReadStateEvent
IoWMIRegistrationControl
IoInitializeRemoveLockEx
IoIsWdmVersionAvailable
IoReleaseRemoveLockAndWaitEx
ObfReferenceObject
InterlockedCompareExchange
memcpy
ZwEnumerateKey
RtlCopyUnicodeString
ZwCreateKey
RtlAppendUnicodeToString
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlFreeAnsiString
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
IoGetDeviceInterfaces
RtlInitAnsiString
ObReferenceObjectByHandle
ExEventObjectType
KeResetEvent
KeTickCount
KeBugCheckEx
IoReuseIrp
ExFreePoolWithTag
IoFreeIrp
ExAllocatePoolWithTag
IoAllocateIrp
IoFreeWorkItem
KeSetTimerEx
KeCancelTimer
IoCancelIrp
KeFlushQueuedDpcs
KeDelayExecutionThread
PsGetVersion
MmGetSystemRoutineAddress
_vsnprintf
KeQueryInterruptTime
_aulldiv
KeInitializeTimer
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
DbgPrintEx
PsCreateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwWriteFile
_vsnwprintf
ZwEnumerateValueKey
RtlRandomEx
sprintf
islower
isupper
InterlockedExchange
RtlCompareMemory
KeQuerySystemTime
wcsncat
RtlAppendUnicodeStringToString
ZwDeleteKey
ZwDeleteValueKey
ExFreePool
_allshl
ExSystemTimeToLocalTime
RtlTimeToTimeFields
IoReleaseCancelSpinLock
IofCompleteRequest
InterlockedExchangeAdd
DbgPrint

hal

KfRaiseIrql
KeStallExecutionProcessor
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql

wmilib.sys

WmiCompleteRequest
WmiSystemControl

Sections

.text
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/bthci.dll
.dll windows x86

bbfc61016159b1f7118b96e7be017053

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
_vsnwprintf

ntdll

VerSetConditionMask

setupapi

SetupCloseLog
SetupLogErrorW
SetupDiInstallDevice
SetupDiCreateDevRegKeyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupOpenLog

user32

EndDialog
GetDlgItem
GetWindowTextW
IsWindowEnabled
SetWindowTextW
LoadStringW
SendMessageW
EnableWindow
ShowWindow
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetParent

advapi32

StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegCloseKey
RegQueryValueExW
RegSetValueExW
CreateServiceW

kernel32

GetTickCount
QueryPerformanceCounter
LoadLibraryExA
CompareStringW
GetCurrentThreadId
CreateFileW
CloseHandle
GetLastError
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
lstrcpynW
GetModuleFileNameW
LoadLibraryW
MultiByteToWideChar
DeviceIoControl
lstrlenW
DisableThreadLibraryCalls
LocalFree
GetComputerNameW
VerifyVersionInfoW
SetLastError
OutputDebugStringW
WideCharToMultiByte
lstrcmpiW
GetWindowsDirectoryW
LocalAlloc

Exports

Exports

BluetoothClassInstaller
DllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win7/drivers/Production/Windows7-x86/leath_hid.cat
Win7/drivers/Production/Windows7-x86/leath_hid.inf
Win7/drivers/Production/Windows7-x86/leath_hid.sys
.exe windows x86

3f837fd3bfdbfd8b8c40390c3e7aa1e5

Code Sign

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2012, 00:00

Not After

23/02/2015, 23:59

Subject

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:de:e5:5b:e9:60:98:b9:ed:b9:47:e3:b2:c6:21:47:32:70:19:2a
Signer

Actual PE Digest

cb:de:e5:5b:e9:60:98:b9:ed:b9:47:e3:b2:c6:21:47:32:70:19:2a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qualcomm Atheros,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qualcomm Atheros,L=San Jose,ST=California,C=US

15/12/2022, 13:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeSetEvent
ObfDereferenceObject
IoFreeIrp
IoAllocateIrp
IoGetDeviceObjectPointer
RtlInitUnicodeString
ZwClose
ZwQueryValueKey
ExAllocatePoolWithTag
ZwQueryKey
ZwOpenKey
memcpy
IofCompleteRequest
IoBuildSynchronousFsdRequest
InterlockedExchange
IofCallDriver
RtlCompareMemory
KeInitializeSpinLock
DbgPrint
memset
PoCallDriver
PoStartNextPowerIrp
IoReleaseCancelSpinLock
ExFreePoolWithTag
IoCancelIrp
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeMutex
KeReleaseMutex
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeTickCount
KeBugCheckEx
KeWaitForSingleObject
KeInitializeEvent
ExFreePool
wcsncat
RtlCopyUnicodeString
ZwCreateKey
RtlFreeUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlWriteRegistryValue
_vsnprintf

hal

KfReleaseSpinLock
KfAcquireSpinLock

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7ed8c660e4ca1446e9ef00b1e8f91c3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

Sections

.text Size: 25KB - Virtual size: 25KB

.data Size: 1KB - Virtual size: 7KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 177.1MB - Virtual size: 177.1MB

.reloc Size: 4KB - Virtual size: 3KB

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

61:10:c3:52:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08Signer

Signature Validations

Verification

15/12/2022, 13:59 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

setupapi

advapi32

ole32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 457KB - Virtual size: 456KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 42KB - Virtual size: 42KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

c6fba0d542797a8cb68bcb6ae37d84b0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 1024B - Virtual size: 796B

70497fec79daa5f71de3b34faee686a5

Code Sign

61:47:52:ba:00:00:00:00:00:04Certificate

.text
Size: 25KB - Virtual size: 25KB

.data
Size: 1KB - Virtual size: 7KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 177.1MB - Virtual size: 177.1MB

.reloc
Size: 4KB - Virtual size: 3KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

61:10:c3:52:00:00:00:00:00:03
Certificate

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08
Signer

15/12/2022, 13:59
Valid: false

.text
Size: 457KB - Virtual size: 456KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 1024B - Virtual size: 796B

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

61:02:a4:e9:00:00:00:00:00:09
Certificate

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e
Signer

14/07/2009, 21:21
Valid: false

.text
Size: 62KB - Virtual size: 61KB

.data
Size: 1KB - Virtual size: 18KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 280B

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

bd:75:e4:dd:14:53:fc:a0:dd:da:8f:45:21:19:8a:5f:c5:c4:31:47
Signer

15/12/2022, 13:59
Valid: false

.text
Size: 198KB - Virtual size: 197KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 3KB - Virtual size: 79KB

.pdata
Size: 6KB - Virtual size: 6KB

PAGE
Size: 71KB - Virtual size: 70KB

INIT
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 3KB - Virtual size: 3KB

46:7c:40:2c:26:fa:b7:42:48:4f:70:e0:a0:e6:6c:cd
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate