ScpServer[.]rar

Resubmissions

21/11/2023, 03:42

231121-d9r6xsca34 3

21/11/2023, 03:38

231121-d68z9sca28 8

21/11/2023, 03:33

231121-d379kaca22 3

Sharing

Copy URL

Twitter E-mail

General

Target

ScpServer.rar
Size

20.1MB
MD5

e6387146bbc3b2ae90414f76905428c3
SHA1

18a34d9e4b867bd1e42cbdaef87ea74057323282
SHA256

a77d5ded488c7413d1954fa092d67c4b960e1c933a3783ed08868eee5a92abb6
SHA512

94bed4c48346bb5d027837faa7f611d52bcaa5c4b3280b23652c70e2118a3d65b10dece2717ceabc593dc311e054ac2888d43d4b240dffe1a1460c13290b50bc
SSDEEP

393216:0NRhLKgxlWxZHPgcKiV8dAA5cGP34x/lWxZBPggV8drACLhb9JvrlTYRGpQmXPY7:0dGgxl69gli+cGQ5l6Tgg4LhzJxQm/Y7

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ScpServer/bin/ScpControl.dll
unpack001/ScpServer/bin/ScpDriver.exe
unpack001/ScpServer/bin/ScpMonitor.exe
unpack001/ScpServer/bin/ScpPair.exe
unpack001/ScpServer/bin/ScpServer.exe
unpack001/ScpServer/bin/ScpService.exe
unpack001/ScpServer/bin/Win32/LilyPad-Scp-r5875.dll
unpack001/ScpServer/bin/Win32/SCPUser.exe
unpack001/ScpServer/bin/Win32/XInput1_3.dll
unpack001/ScpServer/bin/Win64/SCPUser.exe
unpack001/ScpServer/bin/Win64/XInput1_3.dll
unpack001/ScpServer/bin/Zadig/Driver/installer_x64.exe
unpack001/ScpServer/bin/Zadig/Driver/installer_x86.exe
unpack001/ScpServer/bin/Zadig/zadig.exe

Files

ScpServer.rar
.rar
ScpServer/Source/Clean.cmd
ScpServer/Source/Common/Properties/Info.cs
ScpServer/Source/Common/Resources/Scp.ico
ScpServer/Source/DDK/inc/hidclass.h
ScpServer/Source/DDK/inc/hidpi.h
ScpServer/Source/DDK/inc/hidsdi.h
.vbs
ScpServer/Source/DDK/inc/hidusage.h
ScpServer/Source/DDK/inc/lusb0_usb.h
ScpServer/Source/DDK/lib/x64/hid.lib
ScpServer/Source/DDK/lib/x64/hidclass.lib
ScpServer/Source/DDK/lib/x64/hidparse.lib
ScpServer/Source/DDK/lib/x86/hid.lib
ScpServer/Source/DDK/lib/x86/hidclass.lib
ScpServer/Source/DDK/lib/x86/hidparse.lib
ScpServer/Source/Lilypad/Config.cpp
ScpServer/Source/Lilypad/DualShock3.cpp
ScpServer/Source/Lilypad/LilyPad.rc
ScpServer/Source/ScpBus/bus/ScpVBus.inf
ScpServer/Source/ScpBus/bus/busenum.c
ScpServer/Source/ScpBus/bus/busenum.h
ScpServer/Source/ScpBus/bus/busenum.rc
ScpServer/Source/ScpBus/bus/buspdo.c
ScpServer/Source/ScpBus/bus/makefile
ScpServer/Source/ScpBus/bus/pnp.c
ScpServer/Source/ScpBus/bus/power.c
ScpServer/Source/ScpBus/bus/sources
ScpServer/Source/ScpBus/inc/ScpVBus.h
ScpServer/Source/ScpControl/BthConnection.Designer.cs
ScpServer/Source/ScpControl/BthConnection.cs
ScpServer/Source/ScpControl/BthDevice.Designer.cs
ScpServer/Source/ScpControl/BthDevice.cs
ScpServer/Source/ScpControl/BthDongle.Designer.cs
ScpServer/Source/ScpControl/BthDongle.cs
.js
ScpServer/Source/ScpControl/BthDongle.resx
.vbs
ScpServer/Source/ScpControl/BthDs3.Designer.cs
ScpServer/Source/ScpControl/BthDs3.cs
ScpServer/Source/ScpControl/BthDs4.Designer.cs
ScpServer/Source/ScpControl/BthDs4.cs
ScpServer/Source/ScpControl/BthHub.Designer.cs
ScpServer/Source/ScpControl/BthHub.cs
ScpServer/Source/ScpControl/BusDevice.Designer.cs
ScpServer/Source/ScpControl/BusDevice.cs
ScpServer/Source/ScpControl/Properties/AssemblyInfo.cs
ScpServer/Source/ScpControl/RootHub.Designer.cs
ScpServer/Source/ScpControl/RootHub.cs
ScpServer/Source/ScpControl/RootHub.resx
.vbs
ScpServer/Source/ScpControl/ScpControl.csproj
ScpServer/Source/ScpControl/ScpControl_2010.csproj
ScpServer/Source/ScpControl/ScpDevice.Designer.cs
ScpServer/Source/ScpControl/ScpDevice.cs
.js
ScpServer/Source/ScpControl/ScpHub.Designer.cs
ScpServer/Source/ScpControl/ScpHub.cs
ScpServer/Source/ScpControl/ScpMapper.Designer.cs
ScpServer/Source/ScpControl/ScpMapper.cs
.js
ScpServer/Source/ScpControl/ScpMapper.resx
.vbs
ScpServer/Source/ScpControl/ScpMapper.xml
ScpServer/Source/ScpControl/ScpProxy.Designer.cs
ScpServer/Source/ScpControl/ScpProxy.cs
ScpServer/Source/ScpControl/ScpProxy.resx
.vbs
ScpServer/Source/ScpControl/ScpUtil.cs
.vbs
ScpServer/Source/ScpControl/UsbDevice.Designer.cs
ScpServer/Source/ScpControl/UsbDevice.cs
ScpServer/Source/ScpControl/UsbDevice.resx
.vbs
ScpServer/Source/ScpControl/UsbDs3.Designer.cs
ScpServer/Source/ScpControl/UsbDs3.cs
ScpServer/Source/ScpControl/UsbDs3.resx
.vbs
ScpServer/Source/ScpControl/UsbDs4.Designer.cs
ScpServer/Source/ScpControl/UsbDs4.cs
ScpServer/Source/ScpControl/UsbDs4.resx
.vbs
ScpServer/Source/ScpControl/UsbHub.Designer.cs
ScpServer/Source/ScpControl/UsbHub.cs
ScpServer/Source/ScpControl/XmlMapper.Designer.cs
ScpServer/Source/ScpControl/XmlMapper.cs
ScpServer/Source/ScpInstaller/Devcon.cs
.js
ScpServer/Source/ScpInstaller/Difx.cs
ScpServer/Source/ScpInstaller/Program.cs
ScpServer/Source/ScpInstaller/Properties/AssemblyInfo.cs
ScpServer/Source/ScpInstaller/Properties/Resources.Designer.cs
.vbs
ScpServer/Source/ScpInstaller/Properties/Resources.resx
.vbs
ScpServer/Source/ScpInstaller/Properties/ScpInstaller.manifest
ScpServer/Source/ScpInstaller/Properties/Settings.Designer.cs
ScpServer/Source/ScpInstaller/Properties/Settings.settings
ScpServer/Source/ScpInstaller/ScpDriver.xml
ScpServer/Source/ScpInstaller/ScpForm.Designer.cs
ScpServer/Source/ScpInstaller/ScpForm.cs
ScpServer/Source/ScpInstaller/ScpForm.resx
.vbs
ScpServer/Source/ScpInstaller/ScpInstaller.csproj
ScpServer/Source/ScpInstaller/ScpInstaller_2010.csproj
ScpServer/Source/ScpMonitor/AxisBar.Designer.cs
ScpServer/Source/ScpMonitor/AxisBar.cs
ScpServer/Source/ScpMonitor/AxisBar.resx
.vbs
ScpServer/Source/ScpMonitor/AxisControl.Designer.cs
ScpServer/Source/ScpMonitor/AxisControl.cs
ScpServer/Source/ScpMonitor/AxisControl.resx
.vbs
ScpServer/Source/ScpMonitor/ProfileProperties.Designer.cs
ScpServer/Source/ScpMonitor/ProfileProperties.cs
ScpServer/Source/ScpMonitor/ProfileProperties.resx
.vbs
ScpServer/Source/ScpMonitor/ProfilesForm.Designer.cs
ScpServer/Source/ScpMonitor/ProfilesForm.cs
ScpServer/Source/ScpMonitor/ProfilesForm.resx
.vbs
ScpServer/Source/ScpMonitor/Program.cs
ScpServer/Source/ScpMonitor/Properties/AssemblyInfo.cs
ScpServer/Source/ScpMonitor/Properties/Resources.Designer.cs
.vbs
ScpServer/Source/ScpMonitor/Properties/Resources.resx
.vbs
ScpServer/Source/ScpMonitor/Properties/Settings.Designer.cs
ScpServer/Source/ScpMonitor/Properties/Settings.settings
ScpServer/Source/ScpMonitor/ScpButton.Designer.cs
ScpServer/Source/ScpMonitor/ScpButton.cs
ScpServer/Source/ScpMonitor/ScpForm.Designer.cs
ScpServer/Source/ScpMonitor/ScpForm.cs
ScpServer/Source/ScpMonitor/ScpForm.resx
.vbs
ScpServer/Source/ScpMonitor/ScpMonitor.csproj
ScpServer/Source/ScpMonitor/ScpMonitor_2010.csproj
ScpServer/Source/ScpMonitor/SettingsForm.Designer.cs
ScpServer/Source/ScpMonitor/SettingsForm.cs
ScpServer/Source/ScpMonitor/SettingsForm.resx
.vbs
ScpServer/Source/ScpPair/Program.cs
ScpServer/Source/ScpPair/Properties/AssemblyInfo.cs
ScpServer/Source/ScpPair/Properties/Resources.Designer.cs
.vbs
ScpServer/Source/ScpPair/Properties/Resources.resx
.vbs
ScpServer/Source/ScpPair/Properties/Settings.Designer.cs
ScpServer/Source/ScpPair/Properties/Settings.settings
ScpServer/Source/ScpPair/ScpForm.Designer.cs
ScpServer/Source/ScpPair/ScpForm.cs
ScpServer/Source/ScpPair/ScpForm.resx
.vbs
ScpServer/Source/ScpPair/ScpPair.csproj
ScpServer/Source/ScpPair/ScpPair_2010.csproj
ScpServer/Source/ScpServer.sln
ScpServer/Source/ScpServer/Program.cs
ScpServer/Source/ScpServer/Properties/AssemblyInfo.cs
ScpServer/Source/ScpServer/Properties/Resources.Designer.cs
.vbs
ScpServer/Source/ScpServer/Properties/Resources.resx
.vbs
ScpServer/Source/ScpServer/Properties/Settings.Designer.cs
ScpServer/Source/ScpServer/Properties/Settings.settings
ScpServer/Source/ScpServer/ScpForm.Designer.cs
ScpServer/Source/ScpServer/ScpForm.cs
ScpServer/Source/ScpServer/ScpForm.resx
.vbs
ScpServer/Source/ScpServer/ScpServer.csproj
ScpServer/Source/ScpServer/ScpServer_2010.csproj
ScpServer/Source/ScpServer_2010.sln
ScpServer/Source/ScpService/Ds3Service.Designer.cs
ScpServer/Source/ScpService/Ds3Service.cs
ScpServer/Source/ScpService/Ds3Service.resx
.vbs
ScpServer/Source/ScpService/Program.cs
ScpServer/Source/ScpService/ProjectInstaller.Designer.cs
ScpServer/Source/ScpService/ProjectInstaller.cs
ScpServer/Source/ScpService/ProjectInstaller.resx
.vbs
ScpServer/Source/ScpService/Properties/AssemblyInfo.cs
ScpServer/Source/ScpService/ScpService.csproj
ScpServer/Source/ScpService/ScpService_2010.csproj
ScpServer/Source/ScpUser.sln
ScpServer/Source/ScpUser/ARPIcon.ico
ScpServer/Source/ScpUser/AssemblyInfo.cpp
ScpServer/Source/ScpUser/Resources/Controller.png
.png
ScpServer/Source/ScpUser/Resources/Game.ico
ScpServer/Source/ScpUser/ScpExtended.cpp
ScpServer/Source/ScpUser/ScpExtended.h
ScpServer/Source/ScpUser/ScpExtended.resx
.vbs
ScpServer/Source/ScpUser/ScpExtensions.cpp
ScpServer/Source/ScpUser/ScpExtensions.h
ScpServer/Source/ScpUser/ScpPad.h
ScpServer/Source/ScpUser/ScpPad.resX
.vbs
ScpServer/Source/ScpUser/ScpUser.cpp
ScpServer/Source/ScpUser/ScpUser.rc
ScpServer/Source/ScpUser/ScpUser.vcxproj
ScpServer/Source/ScpUser/ScpUser.vcxproj.filters
ScpServer/Source/ScpUser/ScpUser_2010.vcxproj
ScpServer/Source/ScpUser/ScpUser_2010.vcxproj.filters
ScpServer/Source/ScpUser/resource.h
ScpServer/Source/ScpUser/stdafx.cpp
ScpServer/Source/ScpUser/stdafx.h
ScpServer/Source/ScpUser_2010.sln
ScpServer/Source/XInput_Scp/BTConnection.cpp
.js
ScpServer/Source/XInput_Scp/BTConnection.h
ScpServer/Source/XInput_Scp/DS2Controller.cpp
ScpServer/Source/XInput_Scp/DS2Controller.h
ScpServer/Source/XInput_Scp/DS3Controller.cpp
ScpServer/Source/XInput_Scp/DS3Controller.h
ScpServer/Source/XInput_Scp/LibUsbApi.cpp
ScpServer/Source/XInput_Scp/LibUsbApi.h
ScpServer/Source/XInput_Scp/SCPController.cpp
ScpServer/Source/XInput_Scp/SCPController.h
ScpServer/Source/XInput_Scp/SL3Controller.cpp
ScpServer/Source/XInput_Scp/SL3Controller.h
ScpServer/Source/XInput_Scp/X360Controller.cpp
ScpServer/Source/XInput_Scp/X360Controller.h
ScpServer/Source/XInput_Scp/XInput_SCP.cpp
ScpServer/Source/XInput_Scp/XInput_SCP.def
ScpServer/Source/XInput_Scp/XInput_SCP.h
ScpServer/Source/XInput_Scp/XInput_SCP.rc
ScpServer/Source/XInput_Scp/XInput_SCP.vcxproj
ScpServer/Source/XInput_Scp/XInput_SCP.vcxproj.filters
ScpServer/Source/XInput_Scp/XInput_SCP_2010.vcxproj
ScpServer/Source/XInput_Scp/XInput_SCP_2010.vcxproj.filters
ScpServer/Source/XInput_Scp/XInput_Wrap.cpp
ScpServer/Source/XInput_Scp/XInput_Wrap.h
ScpServer/Source/XInput_Scp/dllmain.cpp
ScpServer/Source/XInput_Scp/hid.h
ScpServer/Source/XInput_Scp/pnp.cpp
ScpServer/Source/XInput_Scp/report.cpp
ScpServer/Source/XInput_Scp/resource.h
ScpServer/Source/XInput_Scp/stdafx.cpp
ScpServer/Source/XInput_Scp/stdafx.h
ScpServer/Source/XInput_Scp/targetver.h
ScpServer/bin/DIFxAPI/amd64/DIFxAPI.dll
.dll windows:6 windows x64 arch:x64

fa7bbfc375651121b7223cafa40dc7b8

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:55:60:61:36:ea:2b:db:06:1f:e0:d9:92:1a:27:14:39:e5:af:db
Signer

Actual PE Digest

6b:55:60:61:36:ea:2b:db:06:1f:e0:d9:92:1a:27:14:39:e5:af:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_unlock
__dllonexit
_lock
_onexit
??3@YAXPEAX@Z
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
memcpy
??1type_info@@UEAA@XZ
_amsg_exit
_XcptFilter
__C_specific_handler
memset
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
iswdigit
_vscwprintf
wcsrchr
wcspbrk
_wcsnicmp
iswalpha
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_fileno
_lseeki64
wcsstr
wcschr
_write
_isatty
_CxxThrowException
??2@YAPEAX_K@Z
_wcsicmp
??_U@YAPEAX_K@Z
memmove
_initterm
_vsnwprintf
_resetstkoflw
malloc
free
??_V@YAXPEAX@Z
memcmp

ntdll

RtlNtStatusToDosError
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

WaitForSingleObjectEx
SetEndOfFile
WaitForMultipleObjectsEx
GetThreadLocale
LCMapStringW
SetFilePointer
CreateEventW
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersionExA
RaiseException
HeapSize
VirtualProtect
Sleep
GetProcessHeap
GetSystemTimeAsFileTime
DeviceIoControl
ReleaseMutex
WaitForSingleObject
CreateMutexW
LocalReAlloc
LocalAlloc
GetSystemDirectoryW
LocalFree
CompareStringW
WideCharToMultiByte
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
CopyFileW
HeapReAlloc
HeapAlloc
HeapFree
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
OutputDebugStringA
GetLastError
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenW
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
VerifyVersionInfoW
SetFileAttributesW
DeleteFileW
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
GetTempFileNameW
MoveFileExW
CreateFileW
CloseHandle
FindFirstFileW
lstrcmpW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile

user32

UnregisterClassA
CharLowerW

setupapi

pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupDiClassNameFromGuidW
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiSetClassInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
CM_Get_Device_IDW
SetupDiSetDeviceRegistryPropertyW
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Enumerate_Classes
SetupDiOpenClassRegKey
SetupGetTargetPathW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupQueueCopyW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupCloseFileQueue
SetupOpenFileQueue
SetupCopyOEMInfW
SetupOpenInfFileW
SetupCloseInfFile
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupOpenAppendInfFileW
SetupFindFirstLineW
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupFindNextLine
SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetIntField
SetupGetFieldCount

advapi32

DeleteService
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
ControlService
StartServiceW
RegCloseKey
CloseServiceHandle

ole32

CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

crypt32

CertGetCTLContextProperty
CertFreeCertificateContext
CertFreeCTLContext
CryptQueryObject

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/DIFxAPI/x86/DIFxAPI.dll
.dll windows:6 windows x86 arch:x86

bced6390751f7df672767c6c60fd16dc

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

b4:3a:2e:c6:32:74:1f:7f:5a:ac:1d:1e:5f:70:f7:d0:71:69:58:ba
Signer

Actual PE Digest

b4:3a:2e:c6:32:74:1f:7f:5a:ac:1d:1e:5f:70:f7:d0:71:69:58:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlNtStatusToDosError
VerSetConditionMask
RtlUnwind

kernel32

VerifyVersionInfoW
GetVersionExW
lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
SetFileAttributesW
GetEnvironmentVariableW
CompareStringW
GetFileAttributesW
MoveFileExW
GetTempFileNameW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetSystemWindowsDirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryW
GetFullPathNameW
CopyFileW
LocalFree
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CreateDirectoryW
LocalReAlloc
LocalAlloc
GetProcessHeap
ReleaseMutex
DeviceIoControl
WaitForSingleObject
CreateMutexW
GetSystemTimeAsFileTime
Sleep
RaiseException
GetVersionExA
HeapSize
GetCommandLineA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
TlsGetValue
SetLastError
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
LoadLibraryExA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetThreadLocale
WaitForMultipleObjectsEx
InterlockedCompareExchange
WaitForSingleObjectEx
SetEvent
CreateEventW
SetEndOfFile
InterlockedExchange
lstrcmpiW
GetLastError
InterlockedIncrement
InterlockedDecrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
HeapReAlloc
EnterCriticalSection
HeapAlloc
LeaveCriticalSection
HeapDestroy
GetModuleHandleW
DeleteCriticalSection
GetModuleFileNameA
OutputDebugStringA
HeapCreate
InitializeCriticalSection
TlsAlloc
CreateFileA

user32

UnregisterClassA
CharLowerW

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupQueueCopyIndirectW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoList
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Query_And_Remove_SubTreeW
SetupDiOpenClassRegKey
SetupGetTargetPathW
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupOpenFileQueue
SetupCommitFileQueueW
SetupQueueCopyW
SetupCloseFileQueue
SetupFindFirstLineW
SetupCopyOEMInfW
SetupCloseInfFile
SetupGetLineCountW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupOpenAppendInfFileW
CM_Enumerate_Classes
CM_Setup_DevNode
SetupGetIntField
SetupGetFieldCount
pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupGetStringFieldW

advapi32

RegCloseKey
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetEntriesInAclW
QueryServiceStatus
DeleteService
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
FreeSid

ole32

StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

crypt32

CertFreeCertificateContext
CertGetCTLContextProperty
CryptQueryObject
CertFreeCTLContext

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpControl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpControl.xml
ScpServer/bin/ScpDriver.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpDriver.log
ScpServer/bin/ScpDriver.xml
ScpServer/bin/ScpMapper.xml
ScpServer/bin/ScpMonitor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpPair.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpServer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/ScpServer.log
ScpServer/bin/ScpService.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/BthWinUsb.cat
ScpServer/bin/System/BthWinUsb.inf
ScpServer/bin/System/Ds3WinUsb.cat
ScpServer/bin/System/Ds3WinUsb.inf
ScpServer/bin/System/ScpVBus.cat
ScpServer/bin/System/ScpVBus.inf
ScpServer/bin/System/amd64/ScpVBus.sys
.sys windows:6 windows x64 arch:x64

1dc18f76ce8e2c3ae8078b4c9c805a07

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:f6:11:ba:e8:35:2e:92:01:c6:50:95:87:9d:7b:da:b1
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

20/08/2012, 14:27

Not After

21/08/2013, 14:27

Subject

CN=Bruce James,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:a8:7d:83:96:c3:a7:cd:5d:4b:0d:8c:e1:77:87:7d:57:91:04:9f
Signer

Actual PE Digest

fd:a8:7d:83:96:c3:a7:cd:5d:4b:0d:8c:e1:77:87:7d:57:91:04:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeClearEvent
ExFreePoolWithTag
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExAcquireFastMutex
KeSetEvent
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
IofCompleteRequest
ExQueryDepthSList
RtlCopyUnicodeString
IoReleaseCancelSpinLock
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDeleteDevice
KeInitializeEvent
IoInvalidateDeviceRelations
IoRequestDeviceEject
IoDetachDevice
PoSetPowerState
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
ObfReferenceObject
IoCreateDevice
IofCallDriver
PoStartNextPowerIrp
PoCallDriver
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
ZwClose
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
RtlAnsiCharToUnicodeChar

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/amd64/WUDFUpdate_01009.dll
.dll windows:6 windows x64 arch:x64

2d556b4fd0343868b288619b2a5c9d8b

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:2a:9a:86:18:f8:8b:86:0e:af:9d:f7:37:27:0a:cb:c8:ac:a8:a9
Signer

Actual PE Digest

38:2a:9a:86:18:f8:8b:86:0e:af:9d:f7:37:27:0a:cb:c8:ac:a8:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
DecodePointer
GetEnvironmentVariableW
GetTempFileNameW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
WriteFile
LoadLibraryW
SizeofResource
GetExitCodeProcess
CreateFileW
LockResource
CloseHandle
GetWindowsDirectoryW
DeleteFileW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
FlsSetValue
GetCommandLineA
ExitProcess
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetProcAddress
GetSystemTimeAsFileTime
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
FlushFileBuffers
SetStdHandle
WriteConsoleW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetLastError
GetVersionExW
GetModuleHandleW
OutputDebugStringW
GetSystemWindowsDirectoryW
LoadLibraryExW
FreeLibrary
GetCurrentProcessId
EncodePointer
LocalFree
FormatMessageW

advapi32

OpenSCManagerW
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
OpenServiceW

setupapi

SetupDiGetDeviceRegistryPropertyW
CM_Set_DevNode_Problem_Ex
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDeviceInstanceIdW

Exports

Exports

CoDeviceInstall
InstallStandaloneUmdfW
UpdateUmdf

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/amd64/WdfCoInstaller01009.dll
.dll windows:6 windows x64 arch:x64

70497fec79daa5f71de3b34faee686a5

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e
Signer

Actual PE Digest

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_ultow
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_stricmp
_vsnwprintf

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupOpenLog
SetupDiGetActualSectionToInstallW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupDiGetDriverInfoDetailW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
ExpandEnvironmentStringsW
GetFileInformationByHandle
DeleteFileW
CloseHandle
FindNextFileW
RemoveDirectoryW
LockResource
GetLocalTime
FindClose
SetLastError
CreateFileW
FileTimeToSystemTime
TerminateProcess
GetExitCodeProcess
FormatMessageW
SizeofResource
WriteFile
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
LocalFree
GetWindowsDirectoryW
LocalAlloc
GlobalFree
GetProcAddress
GetLastError
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask

advapi32

DeleteService
OpenSCManagerW
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

shell32

CommandLineToArgvW

user32

LoadStringW
IsCharAlphaNumericW
IsCharAlphaW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/amd64/WinUsbCoInstaller2.dll
.dll windows:6 windows x64 arch:x64

8248dad30db39242289209dc3ff9aa66

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:2a:c5:7d:4c:ef:c2:66:3a:03:51:b1:c2:b5:78:8b:96:d0:2c:74
Signer

Actual PE Digest

c8:2a:c5:7d:4c:ef:c2:66:3a:03:51:b1:c2:b5:78:8b:96:d0:2c:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupDiGetDeviceRegistryPropertyW
CM_Set_DevNode_Problem_Ex
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupOpenLog
SetupLogErrorW
SetupDiGetDeviceInstallParamsW

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask

kernel32

LocalFree
FormatMessageW
GetModuleHandleExW
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
FreeLibrary
LoadLibraryExW
OutputDebugStringW
GetLastError
GetProcAddress
GetLocalTime
GetEnvironmentVariableW
GetTempFileNameW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
WriteFile
LoadLibraryW
CopyFileW
SizeofResource
GetExitCodeProcess
CreateFileW
LockResource
CloseHandle
GetWindowsDirectoryW
DeleteFileW
ExpandEnvironmentStringsW
VerifyVersionInfoW
FlsSetValue
GetCommandLineA
GetVersionExW
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
FlushFileBuffers
SetStdHandle
WriteConsoleW
VirtualProtect

Exports

Exports

ApplyUpdate
CoDeviceInstall
InstallUpdateW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 897KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/x86/ScpVBus.sys
.sys windows:6 windows x86 arch:x86

2f4c5952e83fdac0f066be77fc2a98f6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:f6:11:ba:e8:35:2e:92:01:c6:50:95:87:9d:7b:da:b1
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

20/08/2012, 14:27

Not After

21/08/2013, 14:27

Subject

CN=Bruce James,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:fe:88:4e:ad:43:fa:4b:36:16:56:9b:ee:f6:1c:8f:e4:71:77:a4
Signer

Actual PE Digest

b3:fe:88:4e:ad:43:fa:4b:36:16:56:9b:ee:f6:1c:8f:e4:71:77:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeSetEvent
memcpy
RtlCopyUnicodeString
ExAllocatePoolWithTag
ExInitializeNPagedLookasideList
KeInitializeEvent
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
IoRegisterDeviceInterface
IoCreateDevice
memset
PoSetPowerState
KeClearEvent
IoInvalidateDeviceRelations
IoRequestDeviceEject
KeWaitForSingleObject
IofCallDriver
ObfReferenceObject
PoCallDriver
PoStartNextPowerIrp
ObfDereferenceObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
KeTickCount
KeBugCheckEx
IoReleaseCancelSpinLock
InterlockedPopEntrySList
IofCompleteRequest
ExDeleteNPagedLookasideList
ExFreePoolWithTag
InterlockedPushEntrySList
IoSetDeviceInterfaceState
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
RtlAnsiCharToUnicodeChar

hal

KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
KfLowerIrql
KfReleaseSpinLock

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/x86/WUDFUpdate_01009.dll
.dll windows:6 windows x86 arch:x86

30448524ab936448298b5c1294b1bbbc

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bc:41:b5:c2:9b:3b:17:90:1c:5b:20:fd:33:f0:00:ac:db:46:7c:f8
Signer

Actual PE Digest

bc:41:b5:c2:9b:3b:17:90:1c:5b:20:fd:33:f0:00:ac:db:46:7c:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringW
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
LockResource
SizeofResource
LoadResource
FindResourceW
CloseHandle
WriteFile
CreateFileW
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetWindowsDirectoryW
LoadLibraryW
GetEnvironmentVariableW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
VerifyVersionInfoW
VerSetConditionMask
GetCommandLineA
GetVersionExA
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetLocalTime
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA
DecodePointer
EncodePointer
LoadLibraryExW
GetLastError
FreeLibrary
GetVersionExW
GetModuleHandleW
GetTickCount
GetProcAddress
FormatMessageW
LocalFree

advapi32

OpenServiceW
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
OpenSCManagerW

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupOpenLog
SetupLogErrorW
SetupCloseLog
SetupDiGetDeviceInstanceIdW

Exports

Exports

CoDeviceInstall
InstallStandaloneUmdfW
UpdateUmdf

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/x86/WdfCoInstaller01009.dll
.dll windows:6 windows x86 arch:x86

a17af54bf9d379152b9c377204b35eb9

Code Sign

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0
Signer

Actual PE Digest

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf

setupapi

SetupCloseInfFile
SetupOpenInfFileW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetWindowsDirectoryW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree

advapi32

OpenSCManagerW
ChangeServiceConfigW
QueryServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
DeleteService
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

shell32

CommandLineToArgvW

user32

IsCharAlphaW
IsCharAlphaNumericW
LoadStringW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/System/x86/WinUsbCoInstaller2.dll
.dll windows:6 windows x86 arch:x86

8346f3fd2848988fb391cc309c0dbe66

Code Sign

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:66:5d:64:a9:23:fd:5c:1c:c7:a2:a8:b4:8e:4a:63:c0:6d:ae:fa
Signer

Actual PE Digest

7d:66:5d:64:a9:23:fd:5c:1c:c7:a2:a8:b4:8e:4a:63:c0:6d:ae:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiSetDeviceRegistryPropertyW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW

ntdll

RtlUnwind
VerSetConditionMask

kernel32

GetModuleHandleExW
FormatMessageW
LocalFree
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetLocalTime
OutputDebugStringW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
LockResource
SizeofResource
LoadResource
FindResourceW
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetWindowsDirectoryW
LoadLibraryW
CloseHandle
WriteFile
CreateFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
VerifyVersionInfoW
GetCommandLineA
GetVersionExA
GetModuleHandleA
ExitProcess
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA

Exports

Exports

ApplyUpdate
CoDeviceInstall
InstallUpdateW

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 750KB - Virtual size: 750KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Win32/LilyPad-Scp-r5875.dll
.dll windows:5 windows x86 arch:x86

f031ef025f7774ec0b4bf1a92ba3349d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime
waveOutSetVolume
waveOutGetNumDevs

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

user32

SetCapture
ClipCursor
SetCursorPos
GetAsyncKeyState
CallNextHookEx
SetWindowsHookExW
ReleaseCapture
GetKeyNameTextW
RemovePropW
UnhookWindowsHookEx
GetWindowThreadProcessId
GetParent
GetWindowLongW
IsWindow
MapVirtualKeyW
keybd_event
ShowCursor
IsWindowUnicode
PostMessageW
GetMonitorInfoW
MonitorFromPoint
GetWindowRect
CallWindowProcW
EndDialog
GetActiveWindow
DestroyMenu
TrackPopupMenuEx
GetCursorPos
InsertMenuItemW
GetMenuItemCount
CreatePopupMenu
MessageBoxW
CheckRadioButton
SetTimer
GetDlgCtrlID
SetWindowLongW
KillTimer
MessageBoxA
SetDlgItemTextW
ShowWindow
GetWindowTextW
SetWindowTextW
wsprintfW
CheckDlgButton
EnableWindow
IsDlgButtonChecked
GetDlgItem
SendMessageW
DefWindowProcW
GetPropW
SetPropW
DialogBoxParamW

kernel32

GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
CreateThread
IsBadReadPtr
LoadLibraryW
DecodePointer
EncodePointer
EnterCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetProcAddress
WriteFile
GetSystemTimeAsFileTime
Sleep
GetVersionExW
GetPrivateProfileStringW
CreateDirectoryW
GetPrivateProfileIntW
DeleteFileW
WritePrivateProfileStringW
MultiByteToWideChar
CreateMutexW
ReleaseMutex
WaitForSingleObject
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
CreateFileA
GetCurrentThreadId
FreeLibrary
CloseHandle
InitializeCriticalSection

comdlg32

GetSaveFileNameW
GetOpenFileNameW

dinput8

DirectInput8Create

comctl32

PropertySheetW
CreatePropertySheetPageW

msvcr120

sscanf
??2@YAPAXI@Z
iswspace
wcsrchr
_itow
wcschr
free
malloc
strchr
memmove
realloc
calloc
??3@YAXPAX@Z
wcscat_s
sprintf
wcsstr
printf
fprintf
__iob_func
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
__clean_type_info_names_internal
memset
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_wcsicmp
_wcsdup
_libm_sse2_cos_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
floor
memcpy
atoi

Exports

Exports

PADabout
PADclose
PADconfigure
PADfreeze
PADinit
PADkeyEvent
PADopen
PADpoll
PADquery
PADqueryMtap
PADreadPort1
PADreadPort2
PADsetSettingsDir
PADsetSlot
PADshutdown
PADstartPoll
PADtest
PADupdate
PS2EgetLibName
PS2EgetLibType
PS2EgetLibVersion2
PSEgetLibName
PSEgetLibType
PSEgetLibVersion

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Win32/SCPUser.exe
.exe windows:6 windows x86 arch:x86

7d5a61c38335feeb39285712d78a0aab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

xinput1_3

ord2
ord5
ord3

msvcr120

__FrameUnwindFilter
_amsg_exit
swprintf_s
_cexit
wcscpy_s

kernel32

LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetProcAddress

mscoree

_CorExeMain

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Win32/XInput1_3.dll
.dll windows:6 windows x86 arch:x86

ad858122bcd3d31242e1b521473d5792

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hid

HidD_GetHidGuid
HidD_GetPreparsedData
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxUsageListLength
HidP_GetUsages
HidP_GetUsageValue
HidP_GetScaledUsageValue

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

ws2_32

WSACleanup
socket
connect
htons
inet_addr
closesocket
bind
send
recv
WSAStartup

msvcp120

?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z

msvcr120

??2@YAPAXI@Z
_wcsdup
realloc
free
calloc
malloc
vswprintf_s
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
??1type_info@@UAE@XZ
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
_purecall
memmove
_beginthread
??3@YAXPAX@Z
_lock
_CxxThrowException
__CxxFrameHandler3
memcpy
_endthread
memset

kernel32

SetEvent
ReadFile
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
FreeLibrary
GetSystemDirectoryW
WriteFile
WaitForSingleObject
CreateFileW
GetLastError
Sleep
GetProcAddress
LoadLibraryW
CreateEventW

Exports

Exports

DllMain
XInputCancelGuideButtonWait
XInputEnable
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetDSoundAudioDeviceGuids
XInputGetExtended
XInputGetKeystroke
XInputGetState
XInputGetStateEx
XInputPowerOffController
XInputSetState
XInputWaitForGuideButton

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Win64/SCPUser.exe
.exe windows:6 windows x64 arch:x64

7d5a61c38335feeb39285712d78a0aab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

xinput1_3

ord2
ord5
ord3

msvcr120

__FrameUnwindFilter
_amsg_exit
swprintf_s
_cexit
wcscpy_s

kernel32

LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetProcAddress

mscoree

_CorExeMain

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Win64/XInput1_3.dll
.dll windows:6 windows x64 arch:x64

fdd28338f76323e40bbf641b5853ed04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

hid

HidD_GetHidGuid
HidD_GetPreparsedData
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxUsageListLength
HidP_GetUsages
HidP_GetUsageValue
HidP_GetScaledUsageValue

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

ws2_32

WSACleanup
socket
connect
htons
inet_addr
closesocket
bind
send
recv
WSAStartup

msvcp120

?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z

msvcr120

??2@YAPEAX_K@Z
_wcsdup
realloc
free
calloc
malloc
vswprintf_s
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
_purecall
_endthread
_beginthread
??3@YAXPEAX@Z
_lock
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset

kernel32

SetEvent
ReadFile
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
FreeLibrary
GetSystemDirectoryW
WriteFile
WaitForSingleObject
CreateFileW
GetLastError
Sleep
GetProcAddress
LoadLibraryW
CreateEventW

Exports

Exports

DllMain
XInputCancelGuideButtonWait
XInputEnable
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetDSoundAudioDeviceGuids
XInputGetExtended
XInputGetKeystroke
XInputGetState
XInputGetStateEx
XInputPowerOffController
XInputSetState
XInputWaitForGuideButton

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Bluetooth.cfg
ScpServer/bin/Zadig/Driver/WinUSB_Generic_Device.cat
ScpServer/bin/Zadig/Driver/WinUSB_Generic_Device.inf
ScpServer/bin/Zadig/Driver/amd64/WdfCoInstaller01009.dll
.dll windows:6 windows x64 arch:x64

70497fec79daa5f71de3b34faee686a5

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e
Signer

Actual PE Digest

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_ultow
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_stricmp
_vsnwprintf

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupOpenLog
SetupDiGetActualSectionToInstallW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupDiGetDriverInfoDetailW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
ExpandEnvironmentStringsW
GetFileInformationByHandle
DeleteFileW
CloseHandle
FindNextFileW
RemoveDirectoryW
LockResource
GetLocalTime
FindClose
SetLastError
CreateFileW
FileTimeToSystemTime
TerminateProcess
GetExitCodeProcess
FormatMessageW
SizeofResource
WriteFile
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
LocalFree
GetWindowsDirectoryW
LocalAlloc
GlobalFree
GetProcAddress
GetLastError
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask

advapi32

DeleteService
OpenSCManagerW
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

shell32

CommandLineToArgvW

user32

LoadStringW
IsCharAlphaNumericW
IsCharAlphaW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Driver/amd64/winusbcoinstaller2.dll
.dll windows:6 windows x64 arch:x64

8248dad30db39242289209dc3ff9aa66

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:2a:c5:7d:4c:ef:c2:66:3a:03:51:b1:c2:b5:78:8b:96:d0:2c:74
Signer

Actual PE Digest

c8:2a:c5:7d:4c:ef:c2:66:3a:03:51:b1:c2:b5:78:8b:96:d0:2c:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupDiGetDeviceRegistryPropertyW
CM_Set_DevNode_Problem_Ex
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupOpenLog
SetupLogErrorW
SetupDiGetDeviceInstallParamsW

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask

kernel32

LocalFree
FormatMessageW
GetModuleHandleExW
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
FreeLibrary
LoadLibraryExW
OutputDebugStringW
GetLastError
GetProcAddress
GetLocalTime
GetEnvironmentVariableW
GetTempFileNameW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
WriteFile
LoadLibraryW
CopyFileW
SizeofResource
GetExitCodeProcess
CreateFileW
LockResource
CloseHandle
GetWindowsDirectoryW
DeleteFileW
ExpandEnvironmentStringsW
VerifyVersionInfoW
FlsSetValue
GetCommandLineA
GetVersionExW
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
FlushFileBuffers
SetStdHandle
WriteConsoleW
VirtualProtect

Exports

Exports

ApplyUpdate
CoDeviceInstall
InstallUpdateW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 897KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Driver/installer_x64.exe
.exe windows:5 windows x64 arch:x64

8cf68d1a6c9baea8dbbac2f640e569bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiSetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupCopyOEMInfW

kernel32

RtlLookupFunctionEntry
GetFullPathNameW
CreateFileA
GetFileSize
SetFilePointer
WaitForSingleObject
SetEvent
WriteFile
WideCharToMultiByte
Sleep
RtlCaptureContext
ReadFile
GetOverlappedResult
MultiByteToWideChar
GetLastError
SetLastError
GetProcAddress
LoadLibraryA
CreateEventW
GetModuleHandleA
CloseHandle
DecodePointer
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetVersionExW
GetSystemTimeAsFileTime
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer

advapi32

RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ConvertStringSidToSidA
RegCloseKey

ole32

CoInitializeEx
CoCreateInstance

msvcr100

_vsnprintf_s
free
calloc
malloc
strlen
_beginthread
printf
memset
strcmp
getenv
_amsg_exit
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_endthread
strncmp
strncat
memcpy

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Driver/installer_x86.exe
.exe windows:5 windows x86 arch:x86

0627a534c266eea9dfefb51ab424c9a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiSetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupCopyOEMInfW

kernel32

SetUnhandledExceptionFilter
GetFullPathNameW
CreateFileA
GetFileSize
SetFilePointer
WaitForSingleObject
SetEvent
WriteFile
WideCharToMultiByte
Sleep
IsDebuggerPresent
ReadFile
GetOverlappedResult
MultiByteToWideChar
GetLastError
SetLastError
GetProcAddress
LoadLibraryA
CreateEventW
GetModuleHandleA
CloseHandle
DecodePointer
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetVersionExW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSetInformation
EncodePointer
InterlockedCompareExchange
InterlockedExchange

advapi32

RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ConvertStringSidToSidA
RegCloseKey

ole32

CoInitializeEx
CoCreateInstance

msvcr100

_vsnprintf_s
free
calloc
malloc
strlen
_beginthread
printf
memset
strcmp
getenv
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_endthread
strncmp
memcpy
strncat

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Driver/license/WinUSB/license.rtf
.rtf
ScpServer/bin/Zadig/Driver/x86/WdfCoInstaller01009.dll
.dll windows:6 windows x86 arch:x86

a17af54bf9d379152b9c377204b35eb9

Code Sign

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0
Signer

Actual PE Digest

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf

setupapi

SetupCloseInfFile
SetupOpenInfFileW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetWindowsDirectoryW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree

advapi32

OpenSCManagerW
ChangeServiceConfigW
QueryServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
DeleteService
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

shell32

CommandLineToArgvW

user32

IsCharAlphaW
IsCharAlphaNumericW
LoadStringW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/Driver/x86/winusbcoinstaller2.dll
.dll windows:6 windows x86 arch:x86

8346f3fd2848988fb391cc309c0dbe66

Code Sign

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:66:5d:64:a9:23:fd:5c:1c:c7:a2:a8:b4:8e:4a:63:c0:6d:ae:fa
Signer

Actual PE Digest

7d:66:5d:64:a9:23:fd:5c:1c:c7:a2:a8:b4:8e:4a:63:c0:6d:ae:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiSetDeviceRegistryPropertyW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW

ntdll

RtlUnwind
VerSetConditionMask

kernel32

GetModuleHandleExW
FormatMessageW
LocalFree
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetLocalTime
OutputDebugStringW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
LockResource
SizeofResource
LoadResource
FindResourceW
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetWindowsDirectoryW
LoadLibraryW
CloseHandle
WriteFile
CreateFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
VerifyVersionInfoW
GetCommandLineA
GetVersionExA
GetModuleHandleA
ExitProcess
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA

Exports

Exports

ApplyUpdate
CoDeviceInstall
InstallUpdateW

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 750KB - Virtual size: 750KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/DualShock3.cfg
ScpServer/bin/Zadig/DualShock4.cfg
ScpServer/bin/Zadig/README
ScpServer/bin/Zadig/zadig.exe
.exe windows:5 windows x86 arch:x86

526b8a35020462bf36c095e1fab83cff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageW
GetVersionExW
ReadFile
CreateFileW
LocalFree
GetCommandLineA
GetCurrentDirectoryW
GetLastError
MultiByteToWideChar
GetModuleFileNameW
MulDiv
GetProcessHeap
SetEndOfFile
HeapSize
WriteConsoleW
SetFilePointer
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
GetStringTypeW
LCMapStringW
GetConsoleMode
GetFileAttributesW
IsProcessorFeaturePresent
WriteFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
RtlUnwind
DeleteCriticalSection
SetHandleCount
ExitProcess
HeapCreate
GetCurrentThreadId
TlsFree
DecodePointer
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
GetFileType
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
DeleteFileA
GetVersion
CloseHandle
OutputDebugStringA
CreateMutexA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetSystemTimeAsFileTime
SetLastError
GetFileAttributesA
Sleep
LoadLibraryW
WideCharToMultiByte
GetModuleHandleW
GetConsoleCP
CreateProcessW
CreateThread
ResumeThread
ExitThread
HeapAlloc
EnterCriticalSection
HeapFree
SetStdHandle
GetStartupInfoW
OpenThread
TerminateThread
CreateMutexW
CreateFileA
WaitForSingleObject
FormatMessageA
GetExitCodeProcess
TerminateProcess
FileTimeToSystemTime
GetOverlappedResult
GetStdHandle
CreateNamedPipeA
GetLocalTime
CreateEventW
WaitForMultipleObjects
FileTimeToLocalFileTime
DeleteFileW
GetFullPathNameA
FindFirstFileW
FindClose
FindNextFileW
HeapSetInformation

user32

InvalidateRect
MoveWindow
CheckMenuItem
DialogBoxParamW
FindWindowExA
LoadIconW
CreateWindowExW
SetWindowTextW
DefWindowProcW
ClientToScreen
DestroyWindow
SetCursor
GetWindowTextLengthW
ScreenToClient
GetWindowRect
CreateDialogParamA
InsertMenuItemA
GetMessageW
PostQuitMessage
SendDlgItemMessageA
LoadImageW
PostMessageW
GetSubMenu
DeleteMenu
LoadMenuA
LoadCursorW
GetClientRect
SetFocus
SendMessageA
DrawTextExA
GetDC
TranslateMessage
GetMenu
TrackPopupMenuEx
SetRect
MessageBoxA
DispatchMessageW
GetWindowTextW
CreateWindowExA
ReleaseDC
EnableMenuItem
GetMenuState
GetDlgItem
SetWindowLongW
EndDialog
GetSysColor
GetCursorPos
CheckDlgButton
ShowWindow
IsDlgButtonChecked
GetSystemMetrics
SetWindowTextA
GetDlgItemTextW
SetDlgItemTextW
SendMessageW
UpdateWindow
EnableWindow
GetDlgItemTextA
GetSysColorBrush
EnumChildWindows
GetDesktopWindow
GetWindowLongW
GetWindowTextA
RegisterClassExW
GetClassInfoExW
GetParent
SetTimer
DialogBoxParamA
SetDlgItemTextA
CallWindowProcW

gdi32

SetTextColor
CreateFontIndirectW
CreateFontA
GetDeviceCaps
SetBkMode
SelectObject
GetTextExtentPointW
GetTextFaceW
GetStockObject
CreateSolidBrush
GetTextMetricsW

advapi32

InitializeSecurityDescriptor
GetTokenInformation
ConvertStringSidToSidA
ConvertSidToStringSidA
OpenProcessToken
SetSecurityDescriptorOwner
RegQueryValueExA
CryptAcquireContextW
CryptReleaseContext
CryptGenKey
CryptDestroyKey

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteA
SHCreateDirectoryExW
ShellExecuteExW

ole32

CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoCreateGuid

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsA

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScpServer/bin/Zadig/zadig.ini

Resubmissions

Sharing

General

Malware Config

Signatures

Files

fa7bbfc375651121b7223cafa40dc7b8

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

6b:55:60:61:36:ea:2b:db:06:1f:e0:d9:92:1a:27:14:39:e5:af:dbSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

setupapi

advapi32

ole32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 452KB - Virtual size: 451KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 41KB - Virtual size: 40KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

bced6390751f7df672767c6c60fd16dc

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

b4:3a:2e:c6:32:74:1f:7f:5a:ac:1d:1e:5f:70:f7:d0:71:69:58:baSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

setupapi

advapi32

ole32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 283KB - Virtual size: 282KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

6b:55:60:61:36:ea:2b:db:06:1f:e0:d9:92:1a:27:14:39:e5:af:db
Signer

.text
Size: 452KB - Virtual size: 451KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 41KB - Virtual size: 40KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

b4:3a:2e:c6:32:74:1f:7f:5a:ac:1d:1e:5f:70:f7:d0:71:69:58:ba
Signer

.text
Size: 283KB - Virtual size: 282KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB

.text
Size: 108KB - Virtual size: 108KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 385KB - Virtual size: 384KB

.rsrc
Size: 364KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 629KB - Virtual size: 629KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 371KB - Virtual size: 370KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 377KB - Virtual size: 377KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 12B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:f6:11:ba:e8:35:2e:92:01:c6:50:95:87:9d:7b:da:b1
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate