DriversCloudx64_11_2_8_0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

DriversCloudx64_11_2_8_0.zip
Size

11.1MB
MD5

665a44aa2b930fc2dd4e77affe9e3f73
SHA1

0b38e8e4f5abf916cf25926eac206c5a81eb4111
SHA256

f388da320a39306b171509dea05bdae682e31170753e91c87d46f780d1b96c82
SHA512

ffeb3d08e8d844cd95b5e0cc9d2899e1f5b6ed8ad0aed49411f39f14023c1139014259a7ddeefd356d53fa4be22a1e7812c0d9b59c3c8c25be0d3470edba513d
SSDEEP

196608:73LZ7qGJPTZ90ewfG3XFhvB8y3ceRAno6RO6xYM8LCFUIpzvM4zxTA2sCc03q173:73LZ7qGJPTZ9VwfG3V5r3dt6Rn78LIUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DriversCloud/sqlite3x64.dll

Files

DriversCloudx64_11_2_8_0.zip
.zip
DriversCloud/CPUID/cpuidsdk64.dll
.dll windows x64

30f927266ae1ab7192e73b777d9c7786

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

10/09/2021, 09:33

Not After

09/09/2024, 09:33

Subject

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,POSTALCODE=59240,STREET=39 rue Joseph Marie Jacquard,L=Dunkerque,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130944756e6b6572717565,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

10/09/2021, 09:33

Not After

09/09/2024, 09:33

Subject

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,POSTALCODE=59240,STREET=39 rue Joseph Marie Jacquard,L=Dunkerque,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130944756e6b6572717565,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cf:ae:74:cc:a3:4e:83:a5:3d:9c:f6:99:8f:9d:15:a1:0f:a2:92:6b:2c:9d:9d:bc:70:bc:ac:c6:eb:b6:87:4b
Signer

Actual PE Digest

cf:ae:74:cc:a3:4e:83:a5:3d:9c:f6:99:8f:9d:15:a1:0f:a2:92:6b:2c:9d:9d:bc:70:bc:ac:c6:eb:b6:87:4b

Digest Algorithm

sha256

PE Digest Matches

true

02:91:18:c2:94:b6:4b:ed:33:28:0e:06:d8:c3:fe:c3:3a:bf:7a:84
Signer

Actual PE Digest

02:91:18:c2:94:b6:4b:ed:33:28:0e:06:d8:c3:fe:c3:3a:bf:7a:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

timeGetTime

advapi32

OpenSCManagerA
StartServiceA
OpenServiceA
DeleteService
CreateServiceW
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
LookupPrivilegeValueA
AdjustTokenPrivileges
ControlService

kernel32

GetModuleHandleA
GetCurrentDirectoryA
GetTempPathA
GetCurrentProcess
QueryPerformanceCounter
LocalAlloc
QueryPerformanceFrequency
LocalFree
SetEnvironmentVariableA
CreateFileA
DeviceIoControl
GetSystemInfo
ExitThread
GetCurrentThread
SetThreadPriority
SetThreadAffinityMask
ResumeThread
CreateThread
VirtualFree
VirtualAlloc
GetTickCount
GetDiskFreeSpaceA
WriteFile
CreateEventA
ReadFile
ResetEvent
CancelIo
WriteConsoleA
GetSystemDirectoryA
lstrcmpiA
GetComputerNameA
GetModuleFileNameA
DeleteFileA
GetWindowsDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateDirectoryA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetEndOfFile
GetStringTypeW
GetStringTypeA
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetFileAttributesA
GetSystemWindowsDirectoryA
GlobalMemoryStatus
CloseHandle
GetVersionExA
ReleaseMutex
CreateMutexA
OpenMutexA
LoadLibraryA
GetProcAddress
SetLastError
GetLastError
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
FreeLibrary
SetFilePointer
Sleep
lstrlenA
GetLocaleInfoA
RemoveDirectoryA
WriteConsoleW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
RaiseException
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
GetModuleHandleW
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

GetSystemMetrics
wsprintfA

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoInitialize

oleaut32

SafeArrayGetElemsize
SafeArrayGetElement
VariantInit
VariantClear
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringLen
SafeArrayGetVartype

Exports

Exports

QueryInterface

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/Drivers/DriversCloud_amd64.sys
.exe windows x64

609a0efe14b66b1a341d1856df00b9fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:d4:e3:73:be:2e:79:0f:64:5c:e3:4d:be:a6:8e:3e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/09/2016, 00:00

Not After

24/04/2017, 23:59

Subject

CN=Cybelsoft,O=Cybelsoft,L=Saint Benoit,ST=Vienne,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/02/2016, 00:59

Not After

12/05/2017, 00:59

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:dd:5c:b7:c2:ed:6c:3b:94:16:81:1f:a9:a2:6f:e7:a2:0e:25:c8:ed:8c:95:01:30:c5:32:b3:0c:43:1d:ec
Signer

Actual PE Digest

52:dd:5c:b7:c2:ed:6c:3b:94:16:81:1f:a9:a2:6f:e7:a2:0e:25:c8:ed:8c:95:01:30:c5:32:b3:0c:43:1d:ec

Digest Algorithm

sha256

PE Digest Matches

true

b4:f6:bd:67:bb:d4:f8:98:09:95:9f:40:bd:60:66:a1:01:d0:80:b6
Signer

Actual PE Digest

b4:f6:bd:67:bb:d4:f8:98:09:95:9f:40:bd:60:66:a1:01:d0:80:b6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
MmMapIoSpace
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmUnmapIoSpace
__C_specific_handler

hal

HalSetBusDataByOffset
HalGetBusDataByOffset

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/Drivers/DriversCloud_x86.sys
.exe windows x86

8648b34f84c2e0a7da462243188f4816

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:d4:e3:73:be:2e:79:0f:64:5c:e3:4d:be:a6:8e:3e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/09/2016, 00:00

Not After

24/04/2017, 23:59

Subject

CN=Cybelsoft,O=Cybelsoft,L=Saint Benoit,ST=Vienne,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/02/2016, 00:59

Not After

12/05/2017, 00:59

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:9a:95:9c:1d:48:8b:2c:95:b1:d2:91:54:76:9a:f2:a7:6d:79:7f:56:aa:bf:e0:69:c6:0e:96:24:3a:c3:ab
Signer

Actual PE Digest

de:9a:95:9c:1d:48:8b:2c:95:b1:d2:91:54:76:9a:f2:a7:6d:79:7f:56:aa:bf:e0:69:c6:0e:96:24:3a:c3:ab

Digest Algorithm

sha256

PE Digest Matches

true

25:4b:de:ab:e9:c5:39:72:ad:1e:76:ae:43:90:10:d8:19:60:80:95
Signer

Actual PE Digest

25:4b:de:ab:e9:c5:39:72:ad:1e:76:ae:43:90:10:d8:19:60:80:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeTickCount
IoCreateSymbolicLink
RtlUnwind
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateDevice
memcpy
MmUnmapIoSpace
MmMapIoSpace
KeBugCheckEx

hal

WRITE_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
READ_PORT_UCHAR
HalSetBusDataByOffset
HalGetBusDataByOffset
WRITE_PORT_ULONG

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 630B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/Drivers/driverscloud_amd64.cat
DriversCloud/Drivers/driverscloud_x86.cat
DriversCloud/dccrypt.dll
.dll windows x64

aeaa9620dc2df17331af97190c9f1376

Code Sign

b6:47:44:b9:53:fe:b1:7c:67:5f:05:64:85:fc:fd:01
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/04/2021, 00:00

Not After

12/04/2024, 23:59

Subject

SERIALNUMBER=792 782 203 00022,CN=CYBELSOFT,O=CYBELSOFT,L=CANNES,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:e8:20:bd:7a:fa:4a:d5:ac:61:cc:c0:8c:71:a1:60:22:63:55:7e:77:89:ac:9d:09:a5:a3:89:9e:57:a8:9c
Signer

Actual PE Digest

2d:e8:20:bd:7a:fa:4a:d5:ac:61:cc:c0:8c:71:a1:60:22:63:55:7e:77:89:ac:9d:09:a5:a3:89:9e:57:a8:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThread
GetThreadTimes
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
EncodePointer
DecodePointer
LCMapStringW
GetStringTypeW
GetCPInfo
InitializeSListHead
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitProcess
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
HeapFree
HeapAlloc
GetStdHandle
GetFileType
HeapReAlloc
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW
WriteConsoleW

Exports

Exports

CreateCrypt3
Test

Sections

.text
Size: 590KB - Virtual size: 589KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/dcengine.dll
.dll windows x64

6addcdd1d3863522ea3bfdc6a2a8c1e1

Code Sign

b6:47:44:b9:53:fe:b1:7c:67:5f:05:64:85:fc:fd:01
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/04/2021, 00:00

Not After

12/04/2024, 23:59

Subject

SERIALNUMBER=792 782 203 00022,CN=CYBELSOFT,O=CYBELSOFT,L=CANNES,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:a8:00:08:54:c7:2e:54:82:87:d4:ec:c8:38:ae:f2:6b:3d:da:77:33:16:a0:b7:43:13:d8:c9:c3:77:dc:75
Signer

Actual PE Digest

eb:a8:00:08:54:c7:2e:54:82:87:d4:ec:c8:38:ae:f2:6b:3d:da:77:33:16:a0:b7:43:13:d8:c9:c3:77:dc:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

freeaddrinfo
getaddrinfo
ntohl
inet_addr
WSAPoll
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSAGetLastError
socket
shutdown
setsockopt
sendto
send
recvfrom
recv
listen
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
ntohs
htons
WSASetLastError
WSACleanup
WSAStartup
gethostname
WSAAddressToStringA

newdev

UpdateDriverForPlugAndPlayDevicesW
DiRollbackDriver

dccrypt

CreateCrypt3

sqlite3x64

sqlite3_open_v2
sqlite3_exec
sqlite3_close
sqlite3_vfs_register
sqlite3_vfs_find
sqlite3_vfs_unregister
sqlite3_libversion_number

kernel32

GetProcessHeap
HeapFree
GetSystemInfo
OpenProcess
CancelIo
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
SetFilePointer
SetEndOfFile
CreateProcessW
InitializeCriticalSectionEx
RaiseException
DecodePointer
CreateEventW
ResetEvent
WaitForSingleObject
SetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
CreateFileMappingW
MapViewOfFile
GetLogicalDriveStringsW
QueryDosDeviceW
VirtualAlloc
VirtualFree
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetFileAttributesExW
GetFileAttributesW
GetLongPathNameW
ExpandEnvironmentStringsW
GetOEMCP
GetACP
GetTickCount
GlobalMemoryStatus
MultiByteToWideChar
GetStringTypeW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ExitProcess
GetModuleHandleExW
ExitThread
GetFileType
SetStdHandle
RtlPcToFileHeader
RtlUnwindEx
CreateTimerQueue
HeapAlloc
QueryPerformanceFrequency
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
FileTimeToSystemTime
FileTimeToLocalFileTime
GetWindowsDirectoryW
SetLastError
GetTempPathW
GetModuleFileNameW
LoadLibraryExW
LocalAlloc
FormatMessageW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
CloseHandle
GetModuleHandleW
SetUnhandledExceptionFilter
GetVersionExW
GetUserDefaultLCID
GetLastError
FreeLibrary
LoadLibraryW
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
FreeLibraryAndExitThread
SetEvent
QueryPerformanceCounter
GetThreadTimes
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
RtlUnwind
SystemTimeToFileTime
GetSystemTime
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
CreateThread
SignalObjectAndWait
CreateWaitableTimerA
GetModuleHandleA
GetLogicalProcessorInformation
EnumSystemLocalesW
ResumeThread
ReadConsoleA
SetConsoleMode
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
WaitForMultipleObjects
CreateMutexW
UnregisterWaitEx
WaitForSingleObjectEx
GetSystemTimeAsFileTime
ReleaseSemaphore
DuplicateHandle
CreateEventA
CreateSemaphoreA
FormatMessageA
LocalFree
QueryDepthSList
ReleaseMutex
GetComputerNameW
WideCharToMultiByte
GetVersionExA
SetEnvironmentVariableW
LoadLibraryExA
VirtualQuery
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
IsValidCodePage
FindFirstFileExW
HeapSize
SetConsoleCtrlHandler
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetFilePointerEx
CopyFileW
MoveFileExW
AreFileApisANSI
GetStdHandle
TerminateProcess
GetStartupInfoW
GetConsoleWindow
SetThreadPriority
GetExitCodeThread
ReadFile
WriteFile
GetTimeZoneInformation
FlushFileBuffers

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
CharLowerBuffW
SwapMouseButton
GetDoubleClickTime
GetSystemMetrics
GetKeyboardType
SystemParametersInfoW
wsprintfW
DialogBoxParamW
SetDlgItemTextW
SetFocus
GetDlgItem
MoveWindow
ClientToScreen
GetDesktopWindow
GetClientRect
GetWindowRect
EndDialog

advapi32

CryptEnumProvidersW
CryptAcquireContextW
CryptReleaseContext
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptGenRandom
EnumDependentServicesW
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptAcquireContextA
QueryServiceStatusEx
QueryServiceConfigW
EnumServicesStatusW
CloseEventLog
ReadEventLogW
OpenEventLogW
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
ControlService
StartServiceW
DeleteService
CloseServiceHandle
OpenServiceW
CreateServiceW
OpenSCManagerW
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoCreateInstance
OleRun
CoTaskMemFree
CLSIDFromProgID
CoSetProxyBlanket

shell32

SHGetFolderPathW
ShellExecuteA
ShellExecuteExA

oleaut32

SysFreeString
GetErrorInfo
VariantClear
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantInit

shlwapi

AssocQueryStringW

pdh

PdhOpenQueryW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhMakeCounterPathW
PdhRemoveCounter
PdhCloseQuery
PdhLookupPerfNameByIndexW
PdhAddCounterW

setupapi

SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW

iphlpapi

GetAdaptersInfo

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

Exports

Exports

GetKernel
GetNewKernel
ReleaseKernel

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 313KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/driverscloud.exe
.exe windows x64

90538f24f55957a1fe63ad24bc37b273

Code Sign

b6:47:44:b9:53:fe:b1:7c:67:5f:05:64:85:fc:fd:01
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/04/2021, 00:00

Not After

12/04/2024, 23:59

Subject

SERIALNUMBER=792 782 203 00022,CN=CYBELSOFT,O=CYBELSOFT,L=CANNES,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:8a:ca:6c:61:e3:be:b8:33:c9:58:81:8e:42:72:58:c2:ae:76:53:0b:5c:78:4d:90:a0:1d:9a:5b:f0:65:1c
Signer

Actual PE Digest

5e:8a:ca:6c:61:e3:be:b8:33:c9:58:81:8e:42:72:58:c2:ae:76:53:0b:5c:78:4d:90:a0:1d:9a:5b:f0:65:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSARecv
WSASend
ntohs
WSACleanup
WSAStartup
ioctlsocket
closesocket
WSASetLastError
inet_addr
recv
recvfrom
send
sendto
shutdown
socket
WSARecvFrom
WSASendTo
WSAPoll
listen
setsockopt
getsockname
getpeername
getsockopt
connect
bind
accept
htons
ntohl
freeaddrinfo
getaddrinfo
WSAGetLastError
gethostname

gdi32

RemoveFontResourceExW
AddFontResourceExW
CreateRoundRectRgn
BitBlt
CreateBitmap
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
SetBkColor
GetObjectW
CreateRectRgn
ExcludeClipRect
RealizePalette
SelectPalette
GetTextMetricsW
SetBrushOrgEx
GdiFlush
CreateFontIndirectW
GetOutlineTextMetricsW
CreatePen
GetStockObject
ExtCreatePen
CreateHatchBrush
CreatePatternBrush
CreateSolidBrush
Arc
Ellipse
ExtFloodFill
GetClipBox
GetGraphicsMode
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
MaskBlt
Pie
PolyPolygon
Rectangle
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPixel
SetPolyFillMode
StretchBlt
StretchDIBits
SetROP2
SetStretchBltMode
SetTextColor
ExtTextOutW
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
ExtCreateRegion
GetRegionData
OffsetRgn
GetTextExtentPoint32W
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
CreateDIBitmap
GetDIBits
CreateDIBSection
GetDIBColorTable
SetDIBColorTable
GetBkColor
LineTo
MoveToEx
CombineRgn
EqualRgn
GetRgnBox
PtInRegion
RectInRegion
CreateRectRgnIndirect
GetCharABCWidthsW
GetTextExtentExPointW
CreateICW
GetSystemPaletteEntries
CreateDCW
EnumFontFamiliesExW
PatBlt
GetDeviceCaps

dcengine

ReleaseKernel
GetNewKernel

dccrypt

CreateCrypt3

uxtheme

CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
IsThemeBackgroundPartiallyTransparent
GetThemeColor
DrawThemeParentBackground
GetThemeMargins
IsThemeActive
GetThemeFont
GetThemeBackgroundExtent
SetWindowTheme
GetCurrentThemeName
GetThemePartSize
GetThemeInt
GetThemeSysColor
GetThemeSysFont
IsThemePartDefined
IsAppThemed
OpenThemeData

kernel32

GetUserDefaultUILanguage
FindClose
FindFirstFileW
GetFileAttributesW
GetFileTime
GetLongPathNameW
GetTempFileNameW
SetCurrentDirectoryW
GetFileType
CopyFileW
ExpandEnvironmentStringsW
ReadFile
WriteFile
PeekNamedPipe
CreateThread
CreateProcessW
QueryPerformanceCounter
QueryPerformanceFrequency
GetDriveTypeW
GetLogicalDriveStringsW
RtlCaptureContext
GetCurrentThread
FindNextFileW
IsBadReadPtr
IsBadStringPtrA
GetStringTypeW
SwitchToThread
RtlPcToFileHeader
EncodePointer
FindFirstFileExW
LCMapStringW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
GetLocaleInfoW
MoveFileExW
AreFileApisANSI
GetStartupInfoW
GetConsoleWindow
GetSystemDirectoryW
GetTimeZoneInformation
FlushFileBuffers
SetFilePointer
SetEnvironmentVariableW
GetVersionExA
ResetEvent
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
LoadLibraryA
GetModuleHandleExW
GetACP
OutputDebugStringW
GetCPInfo
IsValidCodePage
GetComputerNameW
GetNativeSystemInfo
TerminateProcess
GetEnvironmentVariableW
ResumeThread
GetExitCodeThread
SetThreadPriority
ReleaseMutex
CreateMutexW
SetErrorMode
InitializeCriticalSection
GetCommandLineW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
ReadConsoleOutputCharacterA
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
WriteConsoleW
WriteConsoleA
AttachConsole
FreeConsole
GetStdHandle
ExitProcess
GetVersion
LoadResource
LockResource
SizeofResource
FindResourceW
GetTickCount
MultiByteToWideChar
TlsSetValue
TlsGetValue
WaitForSingleObjectEx
DuplicateHandle
SetLastError
GetSystemTimeAsFileTime
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
TlsFree
QueueUserAPC
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
FormatMessageA
LocalFree
WideCharToMultiByte
GetTempPathW
GetModuleFileNameW
LoadLibraryExW
ReadConsoleW
LocalAlloc
FormatMessageW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
CloseHandle
GetModuleHandleW
SetUnhandledExceptionFilter
MulDiv
GetVersionExW
IsDebuggerPresent
GetUserDefaultLCID
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
LoadLibraryW
DecodePointer
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
RtlUnwindEx
SetConsoleCtrlHandler
ExitThread
SetStdHandle
GetConsoleOutputCP
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlsAlloc
FlsGetValue
GetSystemTime
SystemTimeToFileTime
HeapAlloc
HeapFree
GetProcessHeap
OpenEventA
GetThreadTimes
FreeLibraryAndExitThread
InterlockedPushEntrySList
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
EnumSystemLocalesW
GetFileSizeEx
IsValidLocale
HeapReAlloc
GetOEMCP
GetEnvironmentStringsW
GetCommandLineA
HeapSize
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
FreeEnvironmentStringsW
CompareStringW
RtlUnwind

user32

DestroyMenu
CreatePopupMenu
CreateMenu
GetMenuState
ChildWindowFromPoint
EndPaint
BeginPaint
GetWindowDC
ValidateRect
PostThreadMessageW
GetMessageW
TranslateAcceleratorW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetClassNameW
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
SetMenuInfo
InsertMenuItemW
SetMenuItemInfoW
GetClassInfoW
IsRectEmpty
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
DrawEdge
DrawFrameControl
CheckMenuItem
GetMenuItemID
GetSysColorBrush
CheckMenuRadioItem
DdeFreeStringHandle
DdeQueryStringW
DdeCreateStringHandleW
DdeGetLastError
DdeFreeDataHandle
GetSubMenu
DdeGetData
DdeCreateDataHandle
DdeClientTransaction
MessageBeep
GetWindowTextW
GetDoubleClickTime
SetCaretPos
DestroyCaret
GetCaretBlinkTime
CreateCaret
ShowCaret
HideCaret
GetWindowTextLengthW
keybd_event
OffsetRect
CopyRect
SetRectEmpty
SetRect
DdeNameService
DdePostAdvise
DdeDisconnect
DdeConnect
DdeUninitialize
DrawStateW
FindWindowExW
SetMenu
RegisterWindowMessageW
DestroyIcon
GetProcessDefaultLayout
GetComboBoxInfo
DrawFocusRect
DrawTextW
DestroyCursor
DdeInitializeW
LoadCursorW
SetForegroundWindow
EnableMenuItem
GetSystemMenu
DrawMenuBar
GetDialogBaseUnits
CreateDialogIndirectParamW
IsZoomed
IsIconic
FlashWindowEx
SetLayeredWindowAttributes
RegisterClassW
GetWindowPlacement
DrawIconEx
CreateDialogParamW
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
InflateRect
FillRect
GetSysColor
ChildWindowFromPointEx
WindowFromPoint
MapWindowPoints
ScreenToClient
GetCursorPos
SetCursor
SetCursorPos
SetWindowTextW
EnableScrollBar
ScrollWindow
RedrawWindow
InvalidateRect
GetUpdateRgn
UpdateWindow
GetMenuItemInfoW
TrackPopupMenu
GetMenuItemCount
GetSystemMetrics
IsWindowEnabled
EnableWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetKeyState
GetFocus
GetActiveWindow
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
AnimateWindow
DestroyWindow
IsWindow
CreateWindowExW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
UnregisterHotKey
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
LoadImageW
LoadIconW
LoadBitmapW
GetIconInfo
CreateIconIndirect
SendMessageW
SetWindowPos
ShowWindow
BringWindowToTop
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
SendNotifyMessageW
PostQuitMessage
PostMessageW
ExitWindowsEx
SetWindowRgn
DialogBoxParamW
SetDlgItemTextW
SetFocus
GetDlgItem
MoveWindow
ClientToScreen
GetDesktopWindow
GetClientRect
GetWindowRect
EndDialog
ReleaseDC
GetDC
MessageBoxW
MessageBoxA
UnregisterClassW
GetProcessWindowStation
GetUserObjectInformationW
KillTimer
SetTimer
MsgWaitForMultipleObjects
wsprintfW
GetWindow

advapi32

RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCreateKeyW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
GetUserNameW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCloseKey

ole32

OleRun
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
OleUninitialize
CoTaskMemAlloc
CoTaskMemFree
OleInitialize

shell32

ShellExecuteExA
ord6
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
SHGetFileInfoW
ShellExecuteExW
CommandLineToArgvW
DragFinish
DragQueryPoint
DragQueryFileW
ExtractIconExW
ExtractIconW

oleaut32

SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
SysStringByteLen
VariantCopy
GetErrorInfo
VariantInit
SysAllocStringLen

shlwapi

SHAutoComplete
AssocQueryStringW

msimg32

GradientFill
AlphaBlend

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

rpcrt4

RpcStringFreeW
UuidToStringW

comctl32

ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_Remove
ImageList_Replace
ImageList_Draw
ImageList_SetBkColor
ImageList_Copy
ord17
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Add
ImageList_ReplaceIcon

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
CommDlgExtendedError

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CertCloseStore

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 642KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriversCloud/driverscloud.xrc
.xml
DriversCloud/filtres.xml
DriversCloud/fonts/RobotoCondensed.ttc
DriversCloud/langues/LangueMC.ar.resx
.xml .vbs
DriversCloud/langues/LangueMC.de.resx
.xml .vbs
DriversCloud/langues/LangueMC.en.resx
.xml .vbs
DriversCloud/langues/LangueMC.es.resx
.xml .vbs
DriversCloud/langues/LangueMC.fr.resx
.xml .vbs
DriversCloud/langues/LangueMC.pt.resx
.xml .vbs
DriversCloud/langues/LangueMC.ru.resx
.xml .vbs
DriversCloud/mcbase.db
DriversCloud/sqlite3x64.dll
.dll windows x64

86407fa80eeaaabce41f53dc0aee34db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FlushViewOfFile
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
WriteFile
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
Sleep
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CloseHandle
AreFileApisANSI
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTimeZoneInformation
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsFree
SetLastError
GetCurrentThread
FlsAlloc
RtlUnwindEx
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
RaiseException
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts5_may_be_corrupt
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30f927266ae1ab7192e73b777d9c7786

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89Certificate

Extended Key Usages

Key Usages

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89Certificate

Extended Key Usages

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

cf:ae:74:cc:a3:4e:83:a5:3d:9c:f6:99:8f:9d:15:a1:0f:a2:92:6b:2c:9d:9d:bc:70:bc:ac:c6:eb:b6:87:4bSigner

02:91:18:c2:94:b6:4b:ed:33:28:0e:06:d8:c3:fe:c3:3a:bf:7a:84Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

winmm

advapi32

kernel32

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 321KB - Virtual size: 321KB

.data Size: 165KB - Virtual size: 175KB

.pdata Size: 53KB - Virtual size: 53KB

.rsrc Size: 225KB - Virtual size: 225KB

.reloc Size: 30KB - Virtual size: 29KB

609a0efe14b66b1a341d1856df00b9fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1e:d4:e3:73:be:2e:79:0f:64:5c:e3:4d:be:a6:8e:3eCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

52:dd:5c:b7:c2:ed:6c:3b:94:16:81:1f:a9:a2:6f:e7:a2:0e:25:c8:ed:8c:95:01:30:c5:32:b3:0c:43:1d:ecSigner

b4:f6:bd:67:bb:d4:f8:98:09:95:9f:40:bd:60:66:a1:01:d0:80:b6Signer

Headers

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89
Certificate

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

50:c4:66:ee:aa:54:2f:95:b6:4e:42:26:c8:18:30:89
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

cf:ae:74:cc:a3:4e:83:a5:3d:9c:f6:99:8f:9d:15:a1:0f:a2:92:6b:2c:9d:9d:bc:70:bc:ac:c6:eb:b6:87:4b
Signer

02:91:18:c2:94:b6:4b:ed:33:28:0e:06:d8:c3:fe:c3:3a:bf:7a:84
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 321KB - Virtual size: 321KB

.data
Size: 165KB - Virtual size: 175KB

.pdata
Size: 53KB - Virtual size: 53KB

.rsrc
Size: 225KB - Virtual size: 225KB

.reloc
Size: 30KB - Virtual size: 29KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1e:d4:e3:73:be:2e:79:0f:64:5c:e3:4d:be:a6:8e:3e
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

52:dd:5c:b7:c2:ed:6c:3b:94:16:81:1f:a9:a2:6f:e7:a2:0e:25:c8:ed:8c:95:01:30:c5:32:b3:0c:43:1d:ec
Signer

b4:f6:bd:67:bb:d4:f8:98:09:95:9f:40:bd:60:66:a1:01:d0:80:b6
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 468B

.data
Size: 512B - Virtual size: 280B

.pdata
Size: 512B - Virtual size: 144B

INIT
Size: 1024B - Virtual size: 578B

.rsrc
Size: 1024B - Virtual size: 920B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1e:d4:e3:73:be:2e:79:0f:64:5c:e3:4d:be:a6:8e:3e
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

33:00:00:00:12:b0:54:93:ea:dd:ce:eb:4b:00:00:00:00:00:12
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

de:9a:95:9c:1d:48:8b:2c:95:b1:d2:91:54:76:9a:f2:a7:6d:79:7f:56:aa:bf:e0:69:c6:0e:96:24:3a:c3:ab
Signer

25:4b:de:ab:e9:c5:39:72:ad:1e:76:ae:43:90:10:d8:19:60:80:95
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 436B

.data
Size: 512B - Virtual size: 88B

INIT
Size: 1024B - Virtual size: 630B

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 512B - Virtual size: 240B

b6:47:44:b9:53:fe:b1:7c:67:5f:05:64:85:fc:fd:01
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

2d:e8:20:bd:7a:fa:4a:d5:ac:61:cc:c0:8c:71:a1:60:22:63:55:7e:77:89:ac:9d:09:a5:a3:89:9e:57:a8:9c
Signer

.text
Size: 590KB - Virtual size: 589KB

.rdata
Size: 260KB - Virtual size: 259KB