crypt[.]zip | Triage

Resubmissions

24/05/2023, 11:34

230524-nps8lacc39 3

24/05/2023, 11:31

230524-nmx4rscc36 7

Sharing

Copy URL

Twitter E-mail

General

Target

crypt.zip
Size

5.0MB
MD5

465dad694f494d7f9c12fbb899990627
SHA1

0d571c1e47c2e3069aef6e4b3e43c5af28c3c48f
SHA256

e355a97d406c594bee0dd5321e35728ba65419597ce95e5cd141e2ee145fc46f
SHA512

1407c8c403577374e7d623a4d1a0c3641d956f645e5b096c35c4c1f449341441ee2c976733cb725a246e0bc832ef4fb770e6ce8902ae425754dfda412566d5bc
SSDEEP

98304:I5P7S8ZBHwDVuohcHhO08uMiNOF3dqbl4Sa8/0rmVzFSkj3xj32ZSM2NA3IC:EP7xYj2OsMBFtW/0iVzFSkpGZ12q/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/crypt/etoken_3_66.dll

Files

crypt.zip
.zip
crypt/Language/langfile_default.txt
crypt/bcfmgr.exe
.exe windows x86

4f707672db2023779faacf0078fa3b74

Code Sign

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/07/2018, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:16:b0:87:ca:84:fc:ed:72:c4:2f:a3:03:65:49:7b:f0:31:e2:5b
Signer

Actual PE Digest

4b:16:b0:87:ca:84:fc:ed:72:c4:2f:a3:03:65:49:7b:f0:31:e2:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

secur32

GetUserNameExW

hid

HidD_GetFeature
HidD_SetFeature
HidD_GetAttributes

kernel32

GetFileAttributesExW
DeleteFileW
CopyFileW
CreateDirectoryW
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
GetCurrentProcess
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThread
ReleaseMutex
LoadResource
SizeofResource
GetFileSizeEx
FlushFileBuffers
DeviceIoControl
GetLocalTime
CreateMutexW
LoadLibraryA
LoadLibraryExW
GetModuleFileNameA
CreateProcessW
FindResourceW
GetDriveTypeW
GetComputerNameW
InterlockedIncrement
InterlockedDecrement
SetFileAttributesW
InterlockedExchange
GlobalFree
WaitForSingleObject
GetExitCodeThread
DeleteFileA
CreateDirectoryA
RemoveDirectoryW
GetSystemDirectoryA
GetExitCodeProcess
GetLogicalDrives
GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableW
GetDiskFreeSpaceW
MoveFileExW
GetCurrentThreadId
ReleaseSemaphore
GetTickCount
FormatMessageW
lstrcpynW
lstrcpyW
CreateSemaphoreW
GetFullPathNameW
GetVolumeInformationW
CreateSemaphoreA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetFileAttributesExA
CopyFileA
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryExA
SetLastError
SetThreadPriority
GetThreadPriority
GetPriorityClass
SetVolumeLabelW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeNameForVolumeMountPointW
WaitNamedPipeW
GetTempPathW
GetNativeSystemInfo
GetWindowsDirectoryW
SetCurrentDirectoryW
OutputDebugStringW
lstrlenW
GetSystemDirectoryW
VirtualAlloc
VirtualFree
GetVersionExW
GetFileAttributesW
FindFirstVolumeMountPointW
FindNextVolumeMountPointW
FindVolumeMountPointClose
TerminateThread
OutputDebugStringA
EncodePointer
FreeResource
GetModuleHandleA
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
GlobalSize
MulDiv
SetEvent
CreateEventW
SuspendThread
ResumeThread
GetPrivateProfileIntW
GetPrivateProfileStringW
FileTimeToSystemTime
lstrcmpA
CompareStringA
GetFileTime
GetTempFileNameW
SetFileTime
ReplaceFileW
GetUserDefaultLCID
GlobalGetAtomNameW
GlobalReAlloc
GetAtomNameW
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalHandle
LocalReAlloc
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
GetThreadLocale
GetCurrentDirectoryW
VerSetConditionMask
VerifyVersionInfoW
LockFile
SetEndOfFile
UnlockFile
DuplicateHandle
lstrcmpiW
MoveFileW
GetStringTypeExW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
FindResourceExW
SearchPathW
GetProfileIntW
SetErrorMode
LocalLock
LocalUnlock
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetFileType
GetStdHandle
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
ExpandEnvironmentStringsA
GetSystemInfo
WaitForMultipleObjects
FormatMessageA
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetStringTypeW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
CreateFileW
GetShortPathNameW
GetShortPathNameA
GetVersion
CreateFileA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
SetFilePointer
ReadFile
WriteFile
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
GetModuleHandleW
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
LCMapStringW
HeapAlloc
HeapDestroy
DecodePointer
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTime
GetDateFormatW
GetDateFormatA
WideCharToMultiByte
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
WritePrivateProfileStringW
MultiByteToWideChar
QueryDosDeviceW
FindFirstFileExA
GetFullPathNameA
SetFilePointerEx
ReadConsoleW
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetTimeZoneInformation
WriteConsoleW
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetConsoleMode
SetConsoleCtrlHandler
GetACP
SetStdHandle
HeapQueryInformation
VirtualQuery
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
PeekNamedPipe
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCPInfo

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter
GetJobW

advapi32

RegEnumKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetFileSecurityW
GetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegSetValueW
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
InitializeSid
GetSidLengthRequired
EqualSid
IsValidSid
QueryServiceStatus
RegFlushKey
RegDeleteKeyA
RegEnumValueW
RegSetValueExA
ConvertSidToStringSidW
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
InitiateSystemShutdownW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

uxtheme

IsAppThemed
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeText
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
OpenThemeData

ole32

ReleaseStgMedium
OleInitialize
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetMenuDescriptor
OleLockRunning
StgCreateDocfile
StgOpenStorage
StgOpenStorageOnILockBytes
StgIsStorageFile
CreateFileMoniker
CreateILockBytesOnHGlobal
OleRegGetMiscStatus
OleRegEnumVerbs
OleCreateMenuDescriptor
OleSetClipboard
CLSIDFromString
StringFromGUID2
CoDisconnectObject
OleDestroyMenuDescriptor
OleTranslateAccelerator
CreateStreamOnHGlobal
PropVariantCopy
CoCreateGuid
SetConvertStg
IsAccelerator
StgCreateDocfileOnILockBytes
CreateGenericComposite
CreateItemMoniker
WriteClassStm
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleRegGetUserType
CoFreeUnusedLibraries
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
StringFromCLSID
IIDFromString
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
GetHGlobalFromILockBytes
OleRun
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize

oleaut32

GetErrorInfo
CreateErrorInfo
SetErrorInfo
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysReAllocStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
SysAllocString

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics

netapi32

NetApiBufferFree
NetUserModalsGet

ws2_32

gethostbyname
socket
shutdown
send
recv
htons
connect
closesocket
WSACleanup
WSAStartup

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

winmm

PlaySoundW

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW
UuidCreateSequential

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 853KB - Virtual size: 853KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
crypt/bcfmgr.exe.manifest
.xml
crypt/etoken_3_66.dll
.dll windows x86

7f669542aa4386ac8d39e71f3f5fe4b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
FreeLibrary
FormatMessageA
FormatMessageW
CloseHandle
CreateFileA
DeviceIoControl
MapViewOfFile
CreateFileMappingA
GetVersionExA
UnmapViewOfFile
OpenFileMappingA
OpenMutexA
CreateThread
WaitForMultipleObjects
OpenEventA
ReleaseSemaphore
lstrcpynA
CreateProcessA
GetSystemDirectoryA
Sleep
GetModuleFileNameA
QueryPerformanceFrequency
LocalAlloc
GetCurrentProcessId
SystemTimeToFileTime
GetLocalTime
QueryPerformanceCounter
CreateDirectoryA
WideCharToMultiByte
SetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
MultiByteToWideChar
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
SetEvent
LoadLibraryA
GetLastError
GetProcAddress
ResetEvent
WaitForSingleObject
ReleaseMutex
CreateEventA
CreateMutexA
GetVersion
GetCurrentThreadId
SetEnvironmentVariableA
GetLocaleInfoW
SetEndOfFile
IsValidLocale
GetOEMCP
GetACP
ReadFile
SetStdHandle
IsBadCodePtr
IsBadReadPtr
TerminateProcess
GetCurrentProcess
OpenProcess
ExitProcess
WriteFile
GetTempPathA
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
RtlUnwind
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTime
HeapReAlloc
RaiseException
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
HeapSize
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetFilePointer
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW

user32

GetSystemMetrics
RegisterWindowMessageA
PostThreadMessageA
PostMessageA
MessageBoxA

advapi32

CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

WSAStartup
htons
connect
recv
send
gethostbyname
socket

Exports

Exports

etCacheDelDataA
etCacheDelDataW
etCacheGetDataA
etCacheGetDataW
etCacheSetClientDataA
etCacheSetClientDataW
etCacheSetDynamicDataA
etCacheSetDynamicDataW
etCacheSetReaderStateA
etCacheSetReaderStateW
etCancelTrackListener
etCreateTalkerA
etCreateTalkerW
etDestroyTalker
etErrorMessageA
etErrorMessageW
etFinalize
etGeneralIOCTL
etGetConfigBlock
etGetFirmwareInfo
etGetLastChangePasswordDays
etGetReaderChangedA
etGetReaderChangedW
etGetReaderInfoA
etGetReaderInfoW
etGetReaderNameA
etGetReaderNameW
etGetTokenUnique
etInitialize
etListReadersA
etListReadersW
etLockReader
etParseConfigBlock
etResetCard
etSetRing0CacheMode
etSetTokenStateA
etSetTokenStateW
etSetTransmitCallback
etStartListen
etStopListen
etTransmit
etTransmitVsr
etUnlockReader
etlogEnterFunction
etlogInitFunction
etlogLeaveFunction
etlogOutput
etlogParameter
os4AddPasswordHistory
os4ApduAdminFile
os4ApduAppendRecord
os4ApduAppendTLV
os4ApduCSESet
os4ApduChangeKey
os4ApduChangeKeyData
os4ApduChangeRefData
os4ApduCreateBS
os4ApduCreateFile
os4ApduCreateSE
os4ApduDecreaseRecord
os4ApduDeleteFile
os4ApduDirectory
os4ApduEraseFile
os4ApduExtAuthenticate
os4ApduFileActivation
os4ApduFormat
os4ApduGenKeyPair
os4ApduGenKeyPairEx
os4ApduGetChallenge
os4ApduGetData
os4ApduGetDataEx
os4ApduGiveChallenge
os4ApduHmacComputeChecksum
os4ApduHmacVerifyChecksum
os4ApduIncreaseRecord
os4ApduMSERestore
os4ApduPSOComputeChecksum
os4ApduPSODec
os4ApduPSODecEx
os4ApduPSOEnc
os4ApduPSOEncEx
os4ApduPSOHash
os4ApduPSOSign
os4ApduPSOVerify
os4ApduPSOVerifyChecksum
os4ApduPSOVerifyHash
os4ApduPhaseControl
os4ApduReadBinary
os4ApduReadBinaryEx
os4ApduReadBinarySM
os4ApduReadRecord
os4ApduReadTLV
os4ApduResetSecState
os4ApduSelectFile
os4ApduSend
os4ApduVerify
os4ApduVerifySM
os4ApduWriteBinary
os4ApduWriteBinaryEx
os4ApduWriteBinarySM
os4ApduWriteRecord
os4ApduWriteTLV
os4AppendTLVFileA
os4AppendTLVFileW
os4CalculateLoginResponse
os4CertCreate
os4CertCreateSystem
os4CertDelete
os4CertGetInfo
os4CertList
os4CertRead
os4CertReadEx
os4CertWrite
os4ChangePassword
os4ChangePasswordAdmin
os4CheckPasswordHistory
os4CreateDirectoryA
os4CreateDirectoryW
os4CreateFileA
os4CreateFileW
os4CreatePassword
os4CreatePasswordAdmin
os4CreateTokenInfo
os4DESCreateSystem
os4DESDelete
os4DESGetKeyInfo
os4DESImport
os4DESList
os4DESOperation
os4DeleteA
os4DeleteW
os4DirectoryA
os4DirectoryW
os4GetFileInfoA
os4GetFileInfoW
os4GetPasswordHistory
os4GetProperty
os4Login
os4LoginAdmin
os4LoginAdminEx
os4LoginAdminGetChallenge
os4LoginAdminSetResponse
os4Logout
os4RSAChange2ndAuth
os4RSACreateSystem
os4RSADelete
os4RSAExport
os4RSAGenKeyPair
os4RSAGetKeyInfo
os4RSAImport
os4RSAImportEx
os4RSAList
os4RSALogin2ndAuth
os4RSALogout2ndAuth
os4RSARaise
os4ReadBinaryFileA
os4ReadBinaryFileW
os4ReadTLVFileA
os4ReadTLVFileW
os4SetFileAccessA
os4SetFileAccessW
os4SetProperty
os4SetPropertyAC
os4VsrGetConf
os4VsrReset
os4WriteBinaryFileA
os4WriteBinaryFileW
os4WriteTLVFileA
os4WriteTLVFileW
r2AddPasswordHistory
r2ApduChangeCode
r2ApduCreateFile
r2ApduDeleteFile
r2ApduDesxOperation
r2ApduDirectory
r2ApduGetConfig
r2ApduGetConfig2
r2ApduReadBinaryFile
r2ApduResetSecState
r2ApduSelectFile
r2ApduVerify
r2ApduWriteBinaryFile
r2ApduWriteKey
r2AppDelete
r2AppGetPathA
r2AppGetPathW
r2BlobCreate
r2BlobDelete
r2BlobGetInfo
r2BlobList
r2BlobRead
r2BlobReadEx
r2BlobWrite
r2ChangePassword
r2CheckPasswordHistory
r2CreateDirectoryA
r2CreateDirectoryW
r2CreateFileA
r2CreateFileW
r2CreateKeyA
r2CreateKeyW
r2DeleteA
r2DeleteW
r2DesxA
r2DesxW
r2DirectoryA
r2DirectoryW
r2EncDeleteA
r2EncDeleteW
r2EncGetFileInfoA
r2EncGetFileInfoW
r2EncLoadA
r2EncLoadW
r2EncStoreA
r2EncStoreW
r2GetFileInfoA
r2GetFileInfoW
r2GetPasswordHistory
r2GetRing0PrvCachePolicy
r2GetTokenInfo
r2GetTokenNameA
r2GetTokenNameW
r2Login
r2Logout
r2ReadFileA
r2ReadFileW
r2SetRing0PrvCachePolicy
r2SetTokenInfo
r2SetTokenNameA
r2SetTokenNameW
r2WriteFileA
r2WriteFileW
r2WriteKeyA
r2WriteKeyW

Sections

.text
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/langfile.dll
.dll windows x86

b748744d3585271aad598dc46aa6beb8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/07/2018, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:2d:0f:35:95:46:94:7f:09:06:db:fc:b3:15:61:3f:08:e8:89:32
Signer

Actual PE Digest

48:2d:0f:35:95:46:94:7f:09:06:db:fc:b3:15:61:3f:08:e8:89:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileSize
ReadFile
CloseHandle
CreateFileW
MultiByteToWideChar
lstrcmpiA
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
HeapSize
HeapReAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA

Exports

Exports

lfLoadLang
lfReset
lfSetDialogLayout
lfSetMode
lfSetTextDirection
lfTranslateDialogW
lfTranslateMenuW
lfTranslateStrW
lfTryTranslateStrW

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/langinfo.txt
crypt/license.txt
crypt/x32/bcfnt.sys
.exe windows x86

1f43c5b34b8925c1748d05d1592fc1c7

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:d0:ba:d6:ca:37:42:9a:fa:ff:e3:4c:db:83:5b:c6:2e:c8:ec:97
Signer

Actual PE Digest

61:d0:ba:d6:ca:37:42:9a:fa:ff:e3:4c:db:83:5b:c6:2e:c8:ec:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
RtlInitUnicodeString
ZwUnmapViewOfSection
memset
RtlCompareMemory
MmGetSystemRoutineAddress
memcpy
KeQuerySystemTime
MmBuildMdlForNonPagedPool
MmFreeContiguousMemory
IoAllocateMdl
MmAllocateContiguousMemory
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
PsCreateSystemThread
RtlCompareUnicodeString
KeSetEvent
IofCompleteRequest
ZwDeleteValueKey
ZwOpenKey
ZwDeleteKey
PsGetCurrentProcessId
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
_alldiv
KeReleaseSemaphore
ExfInterlockedInsertTailList
IoAllocateIrp
IoFreeMdl
IoFreeIrp
IoReuseIrp
_allmul
_alldvrm
_allrem
IoUnregisterPlugPlayNotification
RtlCopyUnicodeString
_aulldiv
ZwEnumerateValueKey
RtlAppendUnicodeToString
IoRegisterPlugPlayNotification
ZwQueryValueKey
ZwSetValueKey
RtlPrefixUnicodeString
memmove
KeBugCheck
IoDeleteDevice
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
PoStartNextPowerIrp
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
ObfDereferenceObject
ZwCreateKey
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ExRaiseStatus
ExfInterlockedRemoveHeadList
KeSetPriorityThread
KeGetCurrentThread
KeQueryActiveProcessors
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeReadStateSemaphore
PoCallDriver
IoAcquireRemoveLockEx
IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
IoCreateDevice
IoGetConfigurationInformation
IoRegisterShutdownNotification
PsSetLoadImageNotifyRoutine
KeInitializeSemaphore
IoCreateSymbolicLink
ZwQueryVolumeInformationFile
NtDeviceIoControlFile
KeDelayExecutionThread
ZwOpenFile
RtlAppendUnicodeStringToString
ZwReadFile
ZwWriteFile
ZwFsControlFile
_allshr
KeRestoreFloatingPointState
KeSaveFloatingPointState
RtlUpperChar
RtlValidSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlEqualSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
READ_REGISTER_UCHAR
WRITE_REGISTER_UCHAR
READ_REGISTER_ULONG
IoGetDeviceProperty
_purecall
vDbgPrintEx
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeTickCount
KeBugCheckEx
ZwClose
ZwQuerySystemInformation
ExFreePoolWithTag
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
IoBuildSynchronousFsdRequest
_vsnwprintf
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetSaclSecurityDescriptor
_snwprintf
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlFreeUnicodeString

hal

KfLowerIrql
KeQueryPerformanceCounter
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql

Sections

.text
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x32/fsh.sys
.exe windows x86

6ed8822e6ed2ffe43d40cc57aae1dcc2

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:d9:ed:47:61:6f:07:ed:d7:3b:82:ef:59:c4:79:6b:90:98:b3:57
Signer

Actual PE Digest

c4:d9:ed:47:61:6f:07:ed:d7:3b:82:ef:59:c4:79:6b:90:98:b3:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
RtlInitUnicodeString
MmGetSystemRoutineAddress
ZwSetValueKey
ZwClose
ZwQueryValueKey
ZwOpenKey
IoDeleteDevice
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IofCompleteRequest
IoDetachDevice
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
PoCallDriver
PoStartNextPowerIrp
KeReleaseSemaphore
ExfInterlockedInsertTailList
RtlCompareMemory
ZwQueryInformationFile
ZwCreateFile
ExSemaphoreObjectType
KeReadStateSemaphore
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
towlower
IoAllocateIrp
ZwWriteFile
ExFreePoolWithTag
memcpy
memset
KeQuerySystemTime
_alldiv
towupper
RtlCompareUnicodeString
IoGetRelatedDeviceObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoAttachDeviceToDeviceStack
ObQueryNameString
MmIsAddressValid
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeSemaphore
IoRegisterShutdownNotification
IoRegisterFsRegistrationChange
IoCreateSymbolicLink
PsGetCurrentProcessId
ZwOpenProcess
ZwQueryDirectoryFile
ObReferenceObjectByHandle
IoFileObjectType
memmove
ZwDeleteValueKey
RtlTimeToTimeFields
ExSystemTimeToLocalTime
PsSetCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeTickCount
KeBugCheckEx
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
ZwSetInformationFile
KeGetCurrentThread
RtlUnwind
RtlAnsiCharToUnicodeChar

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x32_win10/bcfnt.sys
.exe windows x86

c83d93c693319311a29f8dd845e11aed

Code Sign

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/07/2018, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:4c:dd:74:c4:b2:8a:6e:ab:88:06:b0:99:bd:ff:48:c9:f9:c9:1f:2a:1d:73:c8:1a:c5:f6:09:a4:76:81:b1
Signer

Actual PE Digest

b0:4c:dd:74:c4:b2:8a:6e:ab:88:06:b0:99:bd:ff:48:c9:f9:c9:1f:2a:1d:73:c8:1a:c5:f6:09:a4:76:81:b1

Digest Algorithm

sha256

PE Digest Matches

true

32:e0:d5:7f:65:57:ab:7e:35:1a:64:49:a8:97:60:9d:9d:50:09:b0
Signer

Actual PE Digest

32:e0:d5:7f:65:57:ab:7e:35:1a:64:49:a8:97:60:9d:9d:50:09:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memset
memmove
KeGetCurrentThread
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlTimeToTimeFields
RtlIsNtDdiVersionAvailable
RtlCompareMemory
KeInitializeEvent
KeSetEvent
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeSetPriorityThread
KeWaitForSingleObject
KeQuerySystemTime
KeQueryActiveProcessors
ExAllocatePoolWithTag
ExFreePoolWithTag
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
ExRaiseStatus
ExSystemTimeToLocalTime
MmBuildMdlForNonPagedPool
MmGetSystemRoutineAddress
MmMapLockedPagesSpecifyCache
MmAllocateContiguousMemory
MmFreeContiguousMemory
PsCreateSystemThread
IoAllocateIrp
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDetachDevice
IoFreeIrp
IoFreeMdl
IoGetDeviceObjectPointer
IoReuseIrp
IoRegisterShutdownNotification
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
PoCallDriver
memcpy
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlPrefixUnicodeString
KeBugCheck
PsSetLoadImageNotifyRoutine
PsGetCurrentProcessId
IoGetConfigurationInformation
_vsnwprintf
ZwQuerySystemInformation
_alldiv
_alldvrm
_allmul
_allrem
_aulldiv
RtlAppendUnicodeStringToString
KeDelayExecutionThread
ZwOpenFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
NtDeviceIoControlFile
ZwFsControlFile
_purecall
vDbgPrintEx
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlCreateSecurityDescriptor
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlEqualSid
DbgPrint
READ_REGISTER_UCHAR
READ_REGISTER_ULONG
WRITE_REGISTER_UCHAR
IoGetDeviceProperty
KeBugCheckEx
RtlUpperChar
RtlGetEnabledExtendedFeatures
KeRestoreFloatingPointState
PoStartNextPowerIrp
KeSaveFloatingPointState
ZwSetSecurityObject
IoDeviceObjectType
ObOpenObjectByPointer
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
SeExports
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlFreeUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
KeQueryPerformanceCounter

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x32_win10/fsh.sys
.exe windows x86

b755eca6b2b04c5a426876873293d83c

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:0d:f5:1a:5e:98:d3:4e:e6:ec:7d:5f:26:72:35:93:f6:e9:4d:22:8e:54:70:7b:10:4d:81:e3:11:18:65:19
Signer

Actual PE Digest

65:0d:f5:1a:5e:98:d3:4e:e6:ec:7d:5f:26:72:35:93:f6:e9:4d:22:8e:54:70:7b:10:4d:81:e3:11:18:65:19

Digest Algorithm

sha256

PE Digest Matches

true

5c:2e:99:15:20:bd:de:17:0a:bd:31:25:19:11:fd:82:b4:40:ec:ae
Signer

Actual PE Digest

5c:2e:99:15:20:bd:de:17:0a:bd:31:25:19:11:fd:82:b4:40:ec:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeReadStateSemaphore
KeReleaseSemaphore
KeWaitForSingleObject
KeQuerySystemTime
ExfInterlockedInsertTailList
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsGetCurrentProcessId
ZwOpenProcess
ZwQueryDirectoryFile
memcpy
memset
IoFileObjectType
towlower
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeSetEvent
KeInitializeSemaphore
KeEnterCriticalRegion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateIrp
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDetachDevice
IoGetDeviceObjectPointer
IoGetRelatedDeviceObject
IoRegisterShutdownNotification
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
PoCallDriver
PoStartNextPowerIrp
ZwQueryInformationFile
ZwSetInformationFile
MmIsAddressValid
IoRegisterFsRegistrationChange
ObQueryNameString
ObReferenceObjectByName
ExSemaphoreObjectType
IoDriverObjectType
KeBugCheckEx
RtlUnwind
RtlTimeToTimeFields
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString
RtlAnsiCharToUnicodeChar
KeGetCurrentThread
memmove
towupper
KeLeaveCriticalRegion

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x64/bcfnt.sys
.exe windows x64

0756f20442f75529dc1fb2303bebf145

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:b1:a9:3d:70:0d:a1:31:21:ac:39:6c:85:70:dc:30:a3:43:e8:16
Signer

Actual PE Digest

b6:b1:a9:3d:70:0d:a1:31:21:ac:39:6c:85:70:dc:30:a3:43:e8:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoReuseIrp
KeQueryActiveProcessors
IoGetConfigurationInformation
ExRaiseStatus
IoBuildDeviceIoControlRequest
ZwCreateKey
ExFreePoolWithTag
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
RtlAnsiStringToUnicodeString
PsSetLoadImageNotifyRoutine
IoBuildSynchronousFsdRequest
ZwQuerySymbolicLinkObject
KeSetPriorityThread
ZwMapViewOfSection
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
IoFreeWorkItem
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeEvent
RtlInitAnsiString
ZwDeleteValueKey
ZwSetValueKey
IoReleaseRemoveLockEx
ZwQuerySystemInformation
KeReleaseSpinLock
MmFreeContiguousMemory
IoDetachDevice
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
ExSystemTimeToLocalTime
ZwQueryValueKey
ZwUnmapViewOfSection
ExInterlockedInsertTailList
IoAllocateWorkItem
_vsnwprintf
PoStartNextPowerIrp
RtlPrefixUnicodeString
ZwEnumerateValueKey
ZwClose
KeBugCheck
IoUnregisterPlugPlayNotification
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
KeInitializeSemaphore
ObReferenceObjectByHandle
IoAcquireRemoveLockEx
IoFreeIrp
RtlTimeToTimeFields
IoAttachDeviceToDeviceStack
PoCallDriver
KeReleaseSemaphore
RtlCompareUnicodeString
KeReadStateSemaphore
IoAllocateIrp
ExInterlockedRemoveHeadList
RtlCompareMemory
IoCreateSymbolicLink
PsGetCurrentProcessId
RtlCopyUnicodeString
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
IoQueueWorkItem
ZwDeleteKey
ZwOpenSection
IoAllocateMdl
MmAllocateContiguousMemory
IofCallDriver
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
ZwFsControlFile
NtDeviceIoControlFile
ZwReadFile
KeDelayExecutionThread
RtlAppendUnicodeStringToString
ZwQueryVolumeInformationFile
ZwOpenFile
ZwWriteFile
RtlUpperChar
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlValidSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlEqualSid
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlInitializeSid
RtlGetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
IoGetDeviceProperty
IoWriteErrorLogEntry
vDbgPrintEx
IoAllocateErrorLogEntry
_purecall
KeBugCheckEx
KeWaitForSingleObject
ExAllocatePoolWithTag
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlFreeUnicodeString

hal

KeQueryPerformanceCounter

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x64/fsh.sys
.exe windows x64

005dcac41f78db32d658910d1c2daa3d

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:0d:36:9f:ff:25:c9:6b:aa:ee:e7:4b:b7:b6:07:de:2f:16:3d:5b
Signer

Actual PE Digest

1b:0d:36:9f:ff:25:c9:6b:aa:ee:e7:4b:b7:b6:07:de:2f:16:3d:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

towlower
ExAllocatePoolWithTag
IoAcquireRemoveLockEx
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
IoRegisterShutdownNotification
KeLeaveCriticalRegion
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
MmGetSystemRoutineAddress
KeInitializeEvent
ZwSetValueKey
IoReleaseRemoveLockEx
KeReleaseSpinLock
IoDetachDevice
RtlEqualUnicodeString
KeEnterCriticalRegion
ExSemaphoreObjectType
ZwSetInformationFile
ObQueryNameString
IoDriverObjectType
ZwCreateFile
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
ZwQueryValueKey
ExInterlockedInsertTailList
PoStartNextPowerIrp
ZwClose
RtlAppendUnicodeStringToString
IofCompleteRequest
KeInitializeSemaphore
KeWaitForSingleObject
PoCallDriver
KeReleaseSemaphore
RtlCompareUnicodeString
KeReadStateSemaphore
IoAllocateIrp
RtlCompareMemory
IoCreateSymbolicLink
RtlCopyUnicodeString
MmIsAddressValid
ObfDereferenceObject
IoInitializeRemoveLockEx
ObReferenceObjectByName
IoCreateDevice
towupper
ZwQueryInformationFile
ZwWriteFile
IoRegisterFsRegistrationChange
IofCallDriver
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
PsSetCreateThreadNotifyRoutine
ZwDeleteValueKey
PsSetCreateProcessNotifyRoutine
IoFileObjectType
ExSystemTimeToLocalTime
ZwQueryDirectoryFile
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwOpenProcess
PsGetCurrentProcessId
KeBugCheckEx
RtlAnsiCharToUnicodeChar
__C_specific_handler

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x64_win10/bcfnt.sys
.exe windows x64

8661c842c67eb24f6ee44f1f513396e6

Code Sign

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/07/2018, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:97:87:10:d0:98:1b:55:eb:18:2a:9f:53:c0:d7:dc:17:88:08:0e:9c:10:ee:78:f0:8e:e7:0d:61:c2:3c:36
Signer

Actual PE Digest

49:97:87:10:d0:98:1b:55:eb:18:2a:9f:53:c0:d7:dc:17:88:08:0e:9c:10:ee:78:f0:8e:e7:0d:61:c2:3c:36

Digest Algorithm

sha256

PE Digest Matches

true

82:dd:2f:af:2e:50:49:00:34:92:f7:35:94:d7:83:13:8d:ee:c5:32
Signer

Actual PE Digest

82:dd:2f:af:2e:50:49:00:34:92:f7:35:94:d7:83:13:8d:ee:c5:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlGetEnabledExtendedFeatures
RtlUpperChar
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlTimeToTimeFields
RtlIsNtDdiVersionAvailable
RtlCompareMemory
KeInitializeEvent
KeSetEvent
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeSetPriorityThread
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeQueryActiveProcessors
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
ExRaiseStatus
ExSystemTimeToLocalTime
MmBuildMdlForNonPagedPool
MmGetSystemRoutineAddress
MmMapLockedPagesSpecifyCache
MmAllocateContiguousMemory
MmFreeContiguousMemory
PsCreateSystemThread
IoAllocateIrp
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDetachDevice
IoFreeIrp
IoFreeMdl
IoGetDeviceObjectPointer
IoReuseIrp
IoRegisterShutdownNotification
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoAllocateWorkItem
IoFreeWorkItem
KeRestoreExtendedProcessorState
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
PoCallDriver
PoStartNextPowerIrp
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlPrefixUnicodeString
KeBugCheck
PsSetLoadImageNotifyRoutine
PsGetCurrentProcessId
IoGetConfigurationInformation
_vsnwprintf
ZwQuerySystemInformation
RtlAppendUnicodeStringToString
KeDelayExecutionThread
ZwOpenFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
NtDeviceIoControlFile
ZwFsControlFile
_purecall
vDbgPrintEx
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlCreateSecurityDescriptor
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlEqualSid
DbgPrint
IoGetDeviceProperty
KeBugCheckEx
IoQueueWorkItem
KeSaveExtendedProcessorState
ZwSetSecurityObject
IoDeviceObjectType
ObOpenObjectByPointer
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
SeExports
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlFreeUnicodeString
strcmp

hal

KeQueryPerformanceCounter

Sections

.text
Size: 433KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypt/x64_win10/fsh.sys
.exe windows x64

e6da37dbb82b220cdb5c3cec0c28b0e3

Code Sign

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/01/2020, 00:00

Not After

16/10/2021, 12:00

Subject

CN=Jetico Inc. Oy,O=Jetico Inc. Oy,L=Espoo,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:48:31:0a:5b:41:75:66:93:98:65:5a:3b:f6:8e:ac:c1:0f:36:a3:da:a3:b5:44:4c:63:e0:1e:4d:35:59:be
Signer

Actual PE Digest

68:48:31:0a:5b:41:75:66:93:98:65:5a:3b:f6:8e:ac:c1:0f:36:a3:da:a3:b5:44:4c:63:e0:1e:4d:35:59:be

Digest Algorithm

sha256

PE Digest Matches

true

d7:ac:82:11:7d:f0:62:02:6b:68:b1:c5:4f:06:9a:8a:4a:9e:81:aa
Signer

Actual PE Digest

d7:ac:82:11:7d:f0:62:02:6b:68:b1:c5:4f:06:9a:8a:4a:9e:81:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlTimeToTimeFields
RtlCompareMemory
KeReadStateSemaphore
KeReleaseSemaphore
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExInterlockedInsertTailList
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsGetCurrentProcessId
ZwOpenProcess
ZwQueryDirectoryFile
__C_specific_handler
wcscmp
IoFileObjectType
towlower
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeSetEvent
RtlAppendUnicodeStringToString
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateIrp
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDetachDevice
IoGetDeviceObjectPointer
IoGetRelatedDeviceObject
IoRegisterShutdownNotification
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
PoCallDriver
PoStartNextPowerIrp
ZwQueryInformationFile
ZwSetInformationFile
MmIsAddressValid
IoRegisterFsRegistrationChange
ObQueryNameString
ObReferenceObjectByName
ExSemaphoreObjectType
IoDriverObjectType
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlCopyUnicodeString
RtlInitUnicodeString
towupper
KeInitializeSemaphore

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

4f707672db2023779faacf0078fa3b74

Code Sign

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0dCertificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

4b:16:b0:87:ca:84:fc:ed:72:c4:2f:a3:03:65:49:7b:f0:31:e2:5bSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

secur32

hid

kernel32

msimg32

winspool.drv

advapi32

uxtheme

ole32

oleaut32

oledlg

gdiplus

netapi32

ws2_32

oleacc

winmm

imm32

setupapi

rpcrt4

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 120KB - Virtual size: 499KB

.gfids Size: 139KB - Virtual size: 139KB

.giats Size: 512B - Virtual size: 28B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 853KB - Virtual size: 853KB

7f669542aa4386ac8d39e71f3f5fe4b0

Headers

File Characteristics

Imports

kernel32

user32

advapi32

version

wsock32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 301KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 36KB - Virtual size: 42KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 21KB

b748744d3585271aad598dc46aa6beb8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0dCertificate

Extended Key Usages

Key Usages

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

4b:16:b0:87:ca:84:fc:ed:72:c4:2f:a3:03:65:49:7b:f0:31:e2:5b
Signer

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 120KB - Virtual size: 499KB

.gfids
Size: 139KB - Virtual size: 139KB

.giats
Size: 512B - Virtual size: 28B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 853KB - Virtual size: 853KB

.text
Size: 304KB - Virtual size: 301KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 36KB - Virtual size: 42KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 21KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

48:2d:0f:35:95:46:94:7f:09:06:db:fc:b3:15:61:3f:08:e8:89:32
Signer

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 236B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

61:d0:ba:d6:ca:37:42:9a:fa:ff:e3:4c:db:83:5b:c6:2e:c8:ec:97
Signer

.text
Size: 200KB - Virtual size: 200KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 247KB - Virtual size: 247KB

PAGE
Size: 5KB - Virtual size: 4KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB

0c:3b:17:55:4c:95:10:44:0c:97:cd:6e:66:e9:26:58
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

c4:d9:ed:47:61:6f:07:ed:d7:3b:82:ef:59:c4:79:6b:90:98:b3:57
Signer