e725e3e449f2c8022bdd8e4fda19d6e6

Sharing

Copy URL Twitter E-mail

General

Target

e725e3e449f2c8022bdd8e4fda19d6e6
Size

3.3MB
MD5

e725e3e449f2c8022bdd8e4fda19d6e6
SHA1

f366a30a72096ea2cb356cd070c107419fd28eb7
SHA256

2a8b0a0b5f794b012dac7073e9ae6508e83820f75b4a64d5d6419acb504a9020
SHA512

a85b3a474b2e8cdc385858ce4f54e7fd8058851672187da4cc004a52474e58cd8d41a348f5a55fc641f813fd3988deb2889ef811e2829387d26d7aecd81e96de
SSDEEP

49152:SlakKTORCBFH0GXjkdyyZyVU1RNrs3xddMV/KDBcMXY3cdOy/vYIcptoW:SYRSc0GX8J1RNaGVyl0Cf/vYI6v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LaunchManager_Dritek_v.3.0.00_Win7x86x64/CloseApp/CloseHookApp.exe

Files

e725e3e449f2c8022bdd8e4fda19d6e6
.zip
LaunchManager_Dritek_v.3.0.00_Win7x86x64/CDROMUTL.DLL
.dll windows:5 windows x86 arch:x86

d90ac94ff22c174e8c4ff0db5b137461

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:4a:1d:4f:25:3b:df:1a:4a:a2:e9:8e:67:8d:e0:9b:c4:63:25:08
Signer

Actual PE Digest

d5:4a:1d:4f:25:3b:df:1a:4a:a2:e9:8e:67:8d:e0:9b:c4:63:25:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

mciSendStringW
mciSendCommandW

kernel32

DeleteCriticalSection
CompareStringW
CompareStringA
GetPrivateProfileStringA
DeleteFileA
WritePrivateProfileStringA
CopyFileA
lstrcmpiA
SearchPathA
GetDriveTypeW
GetLogicalDrives
FindClose
FindNextFileW
lstrcmpiW
FindFirstFileW
lstrcatW
lstrcpyW
lstrlenW
GetVolumeInformationW
FlushFileBuffers
CloseHandle
CreateFileA
GetLocaleInfoW
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
GetCurrentThread
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetEnvironmentVariableA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FatalAppExitA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapAlloc
VirtualAlloc
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
HeapSize

user32

SendMessageW
PostMessageW
wsprintfW

Exports

Exports

CDRomUtl_DeInit
CDRomUtl_DeviceChange
CDRomUtl_GetCDRomDrive
CDRomUtl_GetCDTitle
CDRomUtl_GetCDTitleEx
CDRomUtl_GetTotalCDRomDrives
CDRomUtl_Init
CDRomUtl_IsCDRomDoorOpen
CDRomUtl_IsCDRomMediaPresent
CDRomUtl_OpenCDRomDoor

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/COMFNUTL.DLL
.dll windows:5 windows x86 arch:x86

395dc3652b1ff5c2221d842e50e3b6de

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:7d:1d:71:cc:df:c7:d7:1f:6e:9b:ec:3b:73:d1:b6:23:8b:26:5f
Signer

Actual PE Digest

3b:7d:1d:71:cc:df:c7:d7:1f:6e:9b:ec:3b:73:d1:b6:23:8b:26:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GlobalAlloc
lstrlenW
MultiByteToWideChar
lstrcpyA
WideCharToMultiByte
lstrcatW
ExpandEnvironmentStringsW
lstrcmpiW
GetVersionExW
LocalFree
FormatMessageW
DeleteFileW
CloseHandle
WriteFile
GetLastError
CreateFileW
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
SetSystemPowerState
CreateProcessW
GetCurrentThreadId
Sleep
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GlobalLock
GetLocaleInfoA
GetLocaleInfoW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetCurrentThread
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
lstrcpyW
GlobalUnlock
GlobalFree
GetTimeZoneInformation
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetTimeFormatA
GetStdHandle
ExitProcess
GetProcAddress
GetModuleHandleW
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapFree
HeapAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy

user32

EmptyClipboard
SetClipboardData
SetRect
OpenClipboard
GetTopWindow
GetWindow
GetSystemMenu
GetMenuState
GetFocus
SetFocus
GetParent
GetWindowLongW
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
IsIconic
ShowWindow
GetSystemMetrics
GetWindowRect
RegisterWindowMessageW
SetWindowPos
GetDesktopWindow
SendMessageTimeoutW
EnumDesktopWindows
GetCursorPos
mouse_event
SetCursorPos
OpenDesktopW
CloseDesktop
SystemParametersInfoW
EnumThreadWindows
ExitWindowsEx
FindWindowW
PostMessageW
wsprintfW
keybd_event
MessageBoxW
IsWindow
IsWindowVisible
CloseClipboard

advapi32

LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
FindExecutableW
ShellExecuteExW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Exports

Exports

BroadcastMessage
ComFnUtl_BroadcastMessage
ComFnUtl_CenterWindow
ComFnUtl_CloseScreenSaver
ComFnUtl_CopyTextToClipboard
ComFnUtl_CopyTextToClipboardA
ComFnUtl_CopyTextToClipboardW
ComFnUtl_CreateShortcut
ComFnUtl_CreateShortcutA
ComFnUtl_CreateShortcutW
ComFnUtl_CycleApplication
ComFnUtl_ExecuteCommand
ComFnUtl_ExecuteCommandA
ComFnUtl_ExecuteCommandEx
ComFnUtl_ExecuteCommandExA
ComFnUtl_ExecuteCommandExW
ComFnUtl_ExecuteCommandW
ComFnUtl_ExecuteScreenSaver
ComFnUtl_GetAssociateExecuteFileFromExtName
ComFnUtl_GetAssociateExecuteFileFromExtNameA
ComFnUtl_GetAssociateExecuteFileFromExtNameW
ComFnUtl_GetDefaultPlayerFileNameByExtName
ComFnUtl_GetDefaultPlayerFileNameByExtNameA
ComFnUtl_GetDefaultPlayerFileNameByExtNameW
ComFnUtl_GetFileVersionByFileName
ComFnUtl_GetFileVersionByFileNameA
ComFnUtl_GetFileVersionByFileNameW
ComFnUtl_GetFileVersionByFullPathFileName
ComFnUtl_GetFileVersionByFullPathFileNameA
ComFnUtl_GetFileVersionByFullPathFileNameW
ComFnUtl_GetFocusHandle
ComFnUtl_GetInternetExplorerDefaultHomePage
ComFnUtl_GetInternetExplorerDefaultHomePageA
ComFnUtl_GetInternetExplorerDefaultHomePageW
ComFnUtl_GetScreenSaverTimeOut
ComFnUtl_GetSpecialFolder
ComFnUtl_GetSpecialFolderA
ComFnUtl_GetSpecialFolderPath
ComFnUtl_GetSpecialFolderPathA
ComFnUtl_GetSpecialFolderPathW
ComFnUtl_GetSpecialFolderW
ComFnUtl_GetSystemClientsDefaultSubKey
ComFnUtl_GetSystemClientsDefaultSubKeyA
ComFnUtl_GetSystemClientsDefaultSubKeyW
ComFnUtl_GetSystemClientsFileNameBySubKey
ComFnUtl_GetSystemClientsFileNameBySubKeyA
ComFnUtl_GetSystemClientsFileNameBySubKeyW
ComFnUtl_GetSystemClientsSubKey
ComFnUtl_GetSystemClientsSubKeyA
ComFnUtl_GetSystemClientsSubKeyW
ComFnUtl_GetSystemDefaultBrowserFileName
ComFnUtl_GetSystemDefaultBrowserFileNameA
ComFnUtl_GetSystemDefaultBrowserFileNameW
ComFnUtl_GetSystemDefaultMailFileName
ComFnUtl_GetSystemDefaultMailFileNameA
ComFnUtl_GetSystemDefaultMailFileNameW
ComFnUtl_GetSystemDefaultMailSubKey
ComFnUtl_GetSystemDefaultMailSubKeyA
ComFnUtl_GetSystemDefaultMailSubKeyW
ComFnUtl_GetSystemDefaultPlayerFileName
ComFnUtl_GetSystemDefaultPlayerFileNameA
ComFnUtl_GetSystemDefaultPlayerFileNameW
ComFnUtl_GetSystemMailFileNameBySubKey
ComFnUtl_GetSystemMailFileNameBySubKeyA
ComFnUtl_GetSystemMailFileNameBySubKeyW
ComFnUtl_GetSystemMailSubKey
ComFnUtl_GetSystemMailSubKeyA
ComFnUtl_GetSystemMailSubKeyW
ComFnUtl_IsScreenSaverActive
ComFnUtl_IsScreenSaverRunning
ComFnUtl_IssueWindowsAPPCommand
ComFnUtl_MinimizeAllApplication
ComFnUtl_MinimizeWindow
ComFnUtl_OpenSpecialFolder
ComFnUtl_OpenSpecialFolderA
ComFnUtl_OpenSpecialFolderW
ComFnUtl_ResolveShortcut
ComFnUtl_ResolveShortcutA
ComFnUtl_ResolveShortcutW
ComFnUtl_RetrieveRegisterWindowMessage
ComFnUtl_RotateApplication
ComFnUtl_SendAPPCommand
ComFnUtl_SendAPPCommandEx
ComFnUtl_SetFocusHandle
ComFnUtl_SetScreenSaverActive
ComFnUtl_SetScreenSaverTimeOut
ComFnUtl_SetWindowToActive
ComFnUtl_SetWindowToForeground
ComFnUtl_ShowShutDownWindows
ComFnUtl_ShowSystemDefaultErrorMessage
ComFnUtl_ShowSystemDefaultErrorMessageA
ComFnUtl_ShowSystemDefaultErrorMessageW
ComFnUtl_ShutDownWindows
ComFnUtl_SuspendSystemByPowerDown

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/CloseApp/CloseHookApp.cfg
LaunchManager_Dritek_v.3.0.00_Win7x86x64/CloseApp/CloseHookApp.exe
.exe windows:4 windows x86 arch:x86

203b3a76dce6981b5b3f200e0ae21169

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetPrivateProfileStringA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
LoadLibraryA

user32

FindWindowA
PostMessageA
wsprintfA

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/DELPREVV.DLL
.dll windows:4 windows x86 arch:x86

cd8eb81992812b5c890011f1e6d84a1a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:5d:8f:e2:61:d2:4f:8d:a9:ba:db:89:e8:73:b3:c1:76:e3:e0:e2
Signer

Actual PE Digest

4e:5d:8f:e2:61:d2:4f:8d:a9:ba:db:89:e8:73:b3:c1:76:e3:e0:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileStringA
Sleep
CloseHandle
CreateProcessA
OutputDebugStringA
GetModuleFileNameA
VirtualFree
VirtualAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
lstrcmpA
lstrcpynA
lstrcpyA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
LoadLibraryA
lstrlenA
lstrcatA
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
lstrcmpiA
RemoveDirectoryA
IsBadWritePtr
HeapReAlloc
GetOEMCP
GetACP
SetEnvironmentVariableA
GetCPInfo
UnhandledExceptionFilter
FatalAppExitA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
WriteFile
HeapAlloc

user32

FindWindowA
SendMessageA
DdeClientTransaction
DdeCreateDataHandle
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
wsprintfA
DdeFreeStringHandle
DdeDisconnect
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeUninitialize
LoadStringA
MessageBoxA

advapi32

RegDeleteValueA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegEnumValueA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Exports

Exports

DelPrevV_DoIt

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/DELPREVV.INI
LaunchManager_Dritek_v.3.0.00_Win7x86x64/EXECBAT.DLL
.dll windows:4 windows x86 arch:x86

dcc2b31ddcf99b15d33059c1bb247c24

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:ba:5d:82:bb:9f:5d:31:56:3d:94:b0:1b:f8:56:db:23:3d:d5:21
Signer

Actual PE Digest

99:ba:5d:82:bb:9f:5d:31:56:3d:94:b0:1b:f8:56:db:23:3d:d5:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetEnvironmentVariableA
lstrcpyA
lstrcatA
lstrlenA
CreateProcessA
MultiByteToWideChar
VirtualFree
HeapDestroy
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
lstrcmpiA
GetVersionExA
HeapCreate
GetProcAddress
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
InterlockedDecrement
LoadLibraryA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedIncrement

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

Exports

Exports

ExecBat

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/INFs/Setup.Eng
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Setup.MCE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Setup.XP
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Setup.XPE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Setup.x64
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Vista/Setup.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Vista/Setup.v64
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Vista/SetupMCE.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Vista/SetupMCE.v64
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Vista/SetupStarter.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Win7/Setup.w7
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Win7/Setup.w764
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Win7/SetupMCE.w7
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Win7/SetupMCE.w764
LaunchManager_Dritek_v.3.0.00_Win7x86x64/InstSetup/Win7/SetupStarter.w7
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LGKCUTL.DLL
.dll windows:5 windows x86 arch:x86

1308d6b1e03be2bbc760a45ec504ee86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:cc:1c:9e:72:2d:f1:ac:24:16:82:e2:3c:d2:99:ca:c9:b8:8d:04
Signer

Actual PE Digest

7e:cc:1c:9e:72:2d:f1:ac:24:16:82:e2:3c:d2:99:ca:c9:b8:8d:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileIntW
CreateFileW
lstrcatW
lstrcpyW
GetPrivateProfileStringW
lstrlenW
Sleep
GetShortPathNameW
GetModuleFileNameW
lstrcpynW
GetVersionExW
GetCurrentThread
WideCharToMultiByte
HeapSize
LoadLibraryA
RtlUnwind
WaitForSingleObject
CloseHandle
GetCurrentThreadId
MultiByteToWideChar
DeviceIoControl
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount

user32

wsprintfW
KillTimer
SetTimer
MessageBoxW
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetKeyState
PostMessageW

advapi32

OpenServiceW
CloseServiceHandle
QueryServiceStatus
OpenSCManagerW

Exports

Exports

LgKCUtl_AddEraseFnKeyCodeToDriver
LgKCUtl_AddEraseKeyCodeToDriver
LgKCUtl_CheckIfWorkWell
LgKCUtl_CtrlKeyState
LgKCUtl_DeInit
LgKCUtl_DirverNotifyMessage
LgKCUtl_DoCommand
LgKCUtl_HookScanCode
LgKCUtl_IgnoreRejectKeyWhenCtrlKeysPressed
LgKCUtl_Init
LgKCUtl_InitA
LgKCUtl_InitW
LgKCUtl_InputByteValue
LgKCUtl_InputDWordValue
LgKCUtl_InputDWordValueEx
LgKCUtl_InputWordValue
LgKCUtl_LoadDriver
LgKCUtl_OutputByteValue
LgKCUtl_OutputDWordValue
LgKCUtl_OutputDWordValueEx
LgKCUtl_OutputWordValue
LgKCUtl_PrepareKeyCode
LgKCUtl_RegisterWindow
LgKCUtl_SendCommandAndGetResponse
LgKCUtl_SendCommandAndGetResponseA
LgKCUtl_SendCommandAndGetResponseW
LgKCUtl_SendECCommand
LgKCUtl_SendECCommandA
LgKCUtl_SendECCommandAndGetResponse
LgKCUtl_SendECCommandAndGetResponseA
LgKCUtl_SendECCommandAndGetResponseEx
LgKCUtl_SendECCommandAndGetResponseExA
LgKCUtl_SendECCommandAndGetResponseExW
LgKCUtl_SendECCommandAndGetResponseW
LgKCUtl_SendECCommandEx
LgKCUtl_SendECCommandExA
LgKCUtl_SendECCommandExW
LgKCUtl_SendECCommandW
LgKCUtl_SetCapsLockLEDState
LgKCUtl_SetNumLockLEDState
LgKCUtl_SetScrollLockLEDState
LgKCUtl_StartHookKeyCode
LgKCUtl_UnLoadDriver
LgKCUtl_UnRegisterWindow

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWECtrl.Cfg
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWECtrl.exe
.exe windows:4 windows x86 arch:x86

cdd55e8fd383ab6bc1aec2d39e01600f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:fa:75:49:22:d0:e5:cd:5b:fc:d6:e9:fb:a2:21:be:e0:b0:99:5e
Signer

Actual PE Digest

74:fa:75:49:22:d0:e5:cd:5b:fc:d6:e9:fb:a2:21:be:e0:b0:99:5e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
GetCurrentProcessId
CreateMutexW
GetLastError
CreateEventW
WaitForSingleObject
OpenMutexW
GetCurrentThread
GetExitCodeProcess
GetModuleFileNameW
GetPrivateProfileStringW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
GetModuleHandleW
LoadLibraryA
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
HeapSize
Sleep
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetVersionExW
GetCurrentProcess
CloseHandle
OpenProcess
lstrlenW
FreeLibrary
GetProcAddress
LCMapStringA
LoadLibraryW
GetACP
RaiseException
InterlockedDecrement
InterlockedIncrement
GetCPInfo
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA

user32

IsWindowUnicode
GetParent
GetWindowTextW
GetClassNameW
GetKeyState
WindowFromPoint
BeginPaint
DefWindowProcA
RegisterClassExA
LoadImageW
InvalidateRect
ShowWindow
IsWindow
SetWindowLongW
CreateWindowExA
RegisterWindowMessageW
DefWindowProcW
DestroyWindow
SetWindowPos
GetCursorPos
CreateWindowExW
GetWindowLongW
RegisterClassExW
LoadCursorW
IsWindowVisible
LoadIconW
DispatchMessageW
EqualRect
TranslateMessage
GetWindowRect
GetMessageW
GetWindowPlacement
SendMessageW
SetTimer
GetWindow
GetDesktopWindow
FindWindowW
KillTimer
PostQuitMessage
GetSystemMetrics
GetWindowThreadProcessId
CopyRect
PostMessageW

gdi32

StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
DeleteObject
CreateSolidBrush
DeleteDC

lmwehook

LMWEH_Deinitial
LMWEH_Initial
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWECtrl64.exe
.exe windows:4 windows x64 arch:x64

fb053fed2d1e4085413c474d7d11181f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:6b:ec:93:98:58:70:9b:29:87:9e:66:50:d5:45:cd:25:e1:30:02
Signer

Actual PE Digest

a5:6b:ec:93:98:58:70:9b:29:87:9e:66:50:d5:45:cd:25:e1:30:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcessId
CreateMutexW
GetLastError
CreateEventW
WaitForSingleObject
OpenMutexW
GetCurrentThread
GetExitCodeProcess
GetModuleFileNameW
GetPrivateProfileStringW
GetVersionExW
RaiseException
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetSystemInfo
LCMapStringA
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
RtlUnwindEx
HeapSize
Sleep
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
GetModuleHandleW
CloseHandle
OpenProcess
GetCurrentProcess
lstrlenW
GetProcAddress
LoadLibraryW
WideCharToMultiByte
FreeLibrary
UnhandledExceptionFilter
RtlPcToFileHeader
TerminateProcess
FlsAlloc
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId

user32

IsWindowUnicode
GetWindowTextW
GetClassNameW
GetParent
BeginPaint
GetWindowLongPtrW
DefWindowProcA
RegisterClassExA
LoadImageW
InvalidateRect
ShowWindow
IsWindow
SetWindowLongW
SetWindowLongPtrW
CreateWindowExA
GetKeyState
WindowFromPoint
RegisterWindowMessageW
DefWindowProcW
DestroyWindow
PostMessageW
GetCursorPos
CreateWindowExW
GetWindowLongW
RegisterClassExW
LoadCursorW
IsWindowVisible
LoadIconW
DispatchMessageW
EqualRect
TranslateMessage
GetWindowRect
GetMessageW
GetWindowPlacement
SendMessageW
SetTimer
GetWindow
GetDesktopWindow
FindWindowW
KillTimer
PostQuitMessage
GetSystemMetrics
GetWindowThreadProcessId
CopyRect
SetWindowPos

gdi32

GetObjectW
DeleteObject
CreateSolidBrush
DeleteDC
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC

lmwehook64

LMWEH_Deinitial
LMWEH_Initial
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWECtrlLH.exe
.exe windows:4 windows x86 arch:x86

8d48ac0ee2e69105bda77fea83f1a795

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:cd:98:da:a2:1d:c8:a8:6e:8b:85:c1:38:dd:11:71:a2:46:60:67
Signer

Actual PE Digest

1d:cd:98:da:a2:1d:c8:a8:6e:8b:85:c1:38:dd:11:71:a2:46:60:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
LCMapStringA
LoadLibraryA
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetVersionExW
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
HeapSize
Sleep
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetModuleFileNameA
GetStdHandle
LocalFree
LocalAlloc
WaitForSingleObject
CreateEventW
GetLastError
CreateMutexW
GetCurrentProcessId
GetSystemInfo
GetTickCount
GetModuleHandleW
GetPrivateProfileStringW
GetModuleFileNameW
GetExitCodeProcess
FreeLibrary
GetCurrentThread
OpenMutexW
CloseHandle
OpenProcess
GetCurrentProcess
lstrlenW
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
WriteFile
ExitProcess
GetModuleHandleA
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException

user32

IsWindowUnicode
GetWindowTextW
GetClassNameW
GetParent
LoadImageW
InvalidateRect
ShowWindow
IsWindow
SetWindowLongW
GetKeyState
WindowFromPoint
BeginPaint
DefWindowProcA
RegisterClassExA
wsprintfW
GetWindow
GetDesktopWindow
FindWindowW
KillTimer
CreateWindowExA
PostQuitMessage
GetSystemMetrics
ReleaseDC
DefWindowProcW
DestroyWindow
GetDC
IsProcessDPIAware
SetWindowPos
PostMessageW
SetProcessDPIAware
GetCursorPos
CreateWindowExW
GetWindowLongW
RegisterClassExW
LoadCursorW
IsWindowVisible
RegisterWindowMessageW
LoadIconW
DispatchMessageW
EqualRect
TranslateMessage
GetWindowRect
GetMessageW
GetWindowPlacement
SendMessageW
SetTimer
GetWindowThreadProcessId
CopyRect
ChangeWindowMessageFilter

gdi32

DeleteObject
CreateSolidBrush
DeleteDC
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
GetDeviceCaps
GetObjectW

advapi32

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

lmwehooklh

LMWEH_StartHook
LMWEH_Deinitial
LMWEH_Initial
LMWEH_RecheckOwnerDPI
LMWEH_StopHook

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWECtrlLH64.exe
.exe windows:4 windows x64 arch:x64

b476c98fb45a2b2aae17ced29ef890f3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:a6:db:dc:9b:2c:ef:13:44:79:9e:a7:0c:9c:e8:31:2d:1a:4e:98
Signer

Actual PE Digest

78:a6:db:dc:9b:2c:ef:13:44:79:9e:a7:0c:9c:e8:31:2d:1a:4e:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RaiseException
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
LCMapStringA
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
RtlUnwindEx
HeapSize
Sleep
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
TlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
LocalFree
LocalAlloc
GetExitCodeProcess
GetCurrentThread
OpenMutexW
WaitForSingleObject
CreateEventW
GetLastError
LeaveCriticalSection
CreateMutexW
GetSystemInfo
GetModuleHandleW
GetVersionExW
LoadLibraryW
GetPrivateProfileStringW
GetModuleFileNameW
CloseHandle
OpenProcess
GetCurrentProcess
lstrlenW
FreeLibrary
GetProcAddress
GetSystemTimeAsFileTime
GetACP
GetCPInfo
HeapCreate
HeapSetInformation
GetModuleFileNameA
GetStdHandle
WriteFile
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleA
ExitProcess
RtlPcToFileHeader

user32

IsWindowUnicode
GetWindowTextW
GetClassNameW
GetParent
BeginPaint
GetWindowLongPtrW
DefWindowProcA
RegisterClassExA
LoadImageW
InvalidateRect
IsWindow
SetWindowLongW
SetWindowLongPtrW
CreateWindowExA
GetKeyState
WindowFromPoint
wsprintfW
DispatchMessageW
EqualRect
TranslateMessage
ShowWindow
GetMessageW
GetWindowPlacement
SendMessageW
SetTimer
GetWindow
GetDesktopWindow
FindWindowW
KillTimer
ChangeWindowMessageFilter
PostQuitMessage
GetSystemMetrics
ReleaseDC
DefWindowProcW
DestroyWindow
GetDC
IsProcessDPIAware
SetWindowPos
PostMessageW
SetProcessDPIAware
GetCursorPos
CreateWindowExW
GetWindowLongW
RegisterClassExW
LoadCursorW
IsWindowVisible
RegisterWindowMessageW
LoadIconW
GetWindowThreadProcessId
CopyRect
GetWindowRect

gdi32

BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
DeleteObject
CreateSolidBrush
DeleteDC
GetDeviceCaps
StretchBlt

advapi32

GetSidSubAuthorityCount
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthority
GetTokenInformation
OpenProcessToken

lmwehooklh64

LMWEH_StopHook
LMWEH_StartHook
LMWEH_Deinitial
LMWEH_Initial
LMWEH_RecheckOwnerDPI

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWEHook.dll
.dll windows:4 windows x86 arch:x86

d0553c298490721332113baeb29de047

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:2e:1b:db:35:27:66:9d:53:8e:dd:8e:37:60:36:9f:33:af:01:81
Signer

Actual PE Digest

12:2e:1b:db:35:27:66:9d:53:8e:dd:8e:37:60:36:9f:33:af:01:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileMappingW
GetLastError
MapViewOfFile
CloseHandle
DisableThreadLibraryCalls
UnmapViewOfFile
LoadLibraryW
GetProcAddress
FreeLibrary
LCMapStringW
LCMapStringA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

CallNextHookEx
SendMessageW
GetParent
RegisterWindowMessageW

Exports

Exports

LMWEH_Deinitial
LMWEH_Initial
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWEHook64.dll
.dll windows:4 windows x64 arch:x64

d614c64626408bdb558159dcb391ad0d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:c3:de:a9:f8:8e:84:cd:56:62:94:92:92:82:da:e7:bf:db:df:7a
Signer

Actual PE Digest

99:c3:de:a9:f8:8e:84:cd:56:62:94:92:92:82:da:e7:bf:db:df:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileMappingW
GetLastError
MapViewOfFile
CloseHandle
DisableThreadLibraryCalls
UnmapViewOfFile
LoadLibraryW
GetProcAddress
FreeLibrary
LCMapStringW
LCMapStringA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
Sleep
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

CallNextHookEx
SendMessageW
GetParent
RegisterWindowMessageW

Exports

Exports

LMWEH_Deinitial
LMWEH_Initial
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWEHookLH.dll
.dll windows:4 windows x86 arch:x86

a3f0c0d93b32b519deb37899b2b2c744

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:3c:be:ea:d1:9e:e8:71:15:bd:98:a6:fd:b8:36:ec:03:e9:62:6c
Signer

Actual PE Digest

15:3c:be:ea:d1:9e:e8:71:15:bd:98:a6:fd:b8:36:ec:03:e9:62:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
LocalFree
LocalAlloc
GetCurrentProcess
CreateFileMappingW
FreeLibrary
GetProcAddress
LoadLibraryW
UnmapViewOfFile
DisableThreadLibraryCalls
GetCurrentProcessId
CloseHandle
MapViewOfFile
GetLastError
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA

user32

ChangeWindowMessageFilter
RegisterWindowMessageW
SendMessageW
ReleaseDC
GetDC
IsProcessDPIAware
GetParent
CallNextHookEx

gdi32

GetDeviceCaps

advapi32

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

LMWEH_Deinitial
LMWEH_Initial
LMWEH_RecheckOwnerDPI
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWEHookLH64.dll
.dll windows:4 windows x64 arch:x64

770f8f9be19d5efd18349b1c08738025

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:33:e5:82:8f:f4:2c:39:81:26:48:57:97:e5:77:85:fc:d6:6f:f2
Signer

Actual PE Digest

6d:33:e5:82:8f:f4:2c:39:81:26:48:57:97:e5:77:85:fc:d6:6f:f2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
LocalFree
LocalAlloc
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryW
UnmapViewOfFile
DisableThreadLibraryCalls
GetCurrentProcessId
CloseHandle
MapViewOfFile
GetLastError
CreateFileMappingW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
Sleep
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
MultiByteToWideChar
GetLocaleInfoA

user32

ChangeWindowMessageFilter
RegisterWindowMessageW
SendMessageW
ReleaseDC
GetDC
IsProcessDPIAware
GetParent
CallNextHookEx

gdi32

GetDeviceCaps

advapi32

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

LMWEH_Deinitial
LMWEH_Initial
LMWEH_RecheckOwnerDPI
LMWEH_StartHook
LMWEH_StopHook

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWndExt.dll
.dll windows:4 windows x86 arch:x86

309454772e51eb62e8dc3ced78828cd4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:10:92:48:9d:57:8a:44:d4:c6:2f:b8:ef:cd:c0:2f:c1:69:5f:c2
Signer

Actual PE Digest

7e:10:92:48:9d:57:8a:44:d4:c6:2f:b8:ef:cd:c0:2f:c1:69:5f:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
OpenMutexW
GetPrivateProfileStringW
GetModuleFileNameW
lstrlenW
SetErrorMode
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
LoadLibraryW
GetProcAddress
GetCurrentProcess
FreeLibrary
OpenProcess
GetLastError
GetVersionExW
GetModuleHandleW
GetSystemInfo
GetCurrentThread
Sleep
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
LoadLibraryA
RtlUnwind
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection

user32

KillTimer
SetTimer
GetForegroundWindow
PostMessageW
SendMessageW
RegisterWindowMessageW
GetSystemMetrics
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
TranslateMessage
PeekMessageW
wsprintfW
FindWindowW
GetWindowThreadProcessId

Exports

Exports

LMW_AddProcessPreventFromMaximizeToExtendedDisplay
LMW_AddWindowPreventFromMaximizeToExtendedDisplay
LMW_AllowLaunchNSplitterIfPresentationModeOn
LMW_Deinitial
LMW_EndPresentationMode
LMW_Initial
LMW_IsPresentationModeAllModuleReady
LMW_IsPresentationModeAnyModuleExist
LMW_IsPresentationModeOn
LMW_MakeNSplitterIgnoreExternalDisplayExtending
LMW_RemoveProcessPreventFromMaximizeToExtendedDisplay
LMW_RemoveWindowPreventFromMaximizeToExtendedDisplay
LMW_SendActivatedWindowToExtendedDisplay
LMW_SendWindowToExtendedDisplay
LMW_SetMessageLoopProc
LMW_StartPresentationMode
LMW_SupportHighIntegrityLevel
LMW_WHC_AddProcessPreventFromMonitor
LMW_WHC_AddWindowPreventFromMonitor
LMW_WHC_Close
LMW_WHC_IsControlInterfaceSupported
LMW_WHC_IsInstalled
LMW_WHC_IsRunning
LMW_WHC_RemoveProcessPreventFromMonitor
LMW_WHC_RemoveWindowPreventFromMonitor
LMW_WHC_Run

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWndExt64.dll
.dll windows:4 windows x64 arch:x64

510e04c0d17b85d95f5a153bbef4a087

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:81:75:02:9e:6b:e4:0d:e5:d0:f9:2b:30:2e:53:e0:27:3c:84:78
Signer

Actual PE Digest

43:81:75:02:9e:6b:e4:0d:e5:d0:f9:2b:30:2e:53:e0:27:3c:84:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
OpenMutexW
GetPrivateProfileStringW
GetModuleFileNameW
lstrlenW
SetErrorMode
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
LoadLibraryW
GetProcAddress
GetCurrentProcess
FreeLibrary
OpenProcess
GetVersionExW
GetModuleHandleW
GetSystemInfo
GetCurrentThread
Sleep
GetLastError
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
InitializeCriticalSection
LoadLibraryA
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
HeapSize
RtlUnwindEx
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection

user32

DestroyWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
TranslateMessage
PeekMessageW
KillTimer
SetTimer
GetForegroundWindow
PostMessageW
SendMessageW
RegisterWindowMessageW
GetSystemMetrics
DefWindowProcW
wsprintfW
FindWindowW
GetWindowThreadProcessId

Exports

Exports

LMW_AddProcessPreventFromMaximizeToExtendedDisplay
LMW_AddWindowPreventFromMaximizeToExtendedDisplay
LMW_AllowLaunchNSplitterIfPresentationModeOn
LMW_Deinitial
LMW_EndPresentationMode
LMW_Initial
LMW_IsPresentationModeAllModuleReady
LMW_IsPresentationModeAnyModuleExist
LMW_IsPresentationModeOn
LMW_MakeNSplitterIgnoreExternalDisplayExtending
LMW_RemoveProcessPreventFromMaximizeToExtendedDisplay
LMW_RemoveWindowPreventFromMaximizeToExtendedDisplay
LMW_SendActivatedWindowToExtendedDisplay
LMW_SendWindowToExtendedDisplay
LMW_SetMessageLoopProc
LMW_StartPresentationMode
LMW_SupportHighIntegrityLevel
LMW_WHC_AddProcessPreventFromMonitor
LMW_WHC_AddWindowPreventFromMonitor
LMW_WHC_Close
LMW_WHC_IsControlInterfaceSupported
LMW_WHC_IsInstalled
LMW_WHC_IsRunning
LMW_WHC_RemoveProcessPreventFromMonitor
LMW_WHC_RemoveWindowPreventFromMonitor
LMW_WHC_Run

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWndExtLH.dll
.dll windows:4 windows x86 arch:x86

e3bb9f151b352d40fe7cb5c5c2586efe

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:e4:16:a5:b7:dc:c0:a3:55:02:17:87:5a:08:d3:62:99:4f:75:8f
Signer

Actual PE Digest

53:e4:16:a5:b7:dc:c0:a3:55:02:17:87:5a:08:d3:62:99:4f:75:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
GetExitCodeProcess
GetCurrentThread
Sleep
GetLastError
GetVersionExW
GetModuleHandleW
GetSystemInfo
LocalAlloc
CreateProcessW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
LoadLibraryA
RtlUnwind
SetErrorMode
lstrlenW
GetModuleFileNameW
GetPrivateProfileStringW
OpenMutexW
CloseHandle
OpenProcess
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
LocalFree
InitializeCriticalSection
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

RegisterWindowMessageW
GetSystemMetrics
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
PeekMessageW
KillTimer
GetForegroundWindow
SetTimer
PostMessageW
SendMessageW
wsprintfW
FindWindowW
GetWindowThreadProcessId
TranslateMessage

advapi32

GetSidSubAuthority
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
CreateProcessAsUserW
GetLengthSid
SetTokenInformation
ConvertStringSidToSidW
DuplicateTokenEx
GetSidSubAuthorityCount

shell32

ShellExecuteExW

Exports

Exports

LMW_AddProcessPreventFromMaximizeToExtendedDisplay
LMW_AddWindowPreventFromMaximizeToExtendedDisplay
LMW_AllowLaunchNSplitterIfPresentationModeOn
LMW_Deinitial
LMW_EndPresentationMode
LMW_Initial
LMW_IsPresentationModeAllModuleReady
LMW_IsPresentationModeAnyModuleExist
LMW_IsPresentationModeOn
LMW_MakeNSplitterIgnoreExternalDisplayExtending
LMW_RemoveProcessPreventFromMaximizeToExtendedDisplay
LMW_RemoveWindowPreventFromMaximizeToExtendedDisplay
LMW_SendActivatedWindowToExtendedDisplay
LMW_SendWindowToExtendedDisplay
LMW_SetMessageLoopProc
LMW_StartPresentationMode
LMW_SupportHighIntegrityLevel
LMW_WHC_AddProcessPreventFromMonitor
LMW_WHC_AddWindowPreventFromMonitor
LMW_WHC_Close
LMW_WHC_IsControlInterfaceSupported
LMW_WHC_IsInstalled
LMW_WHC_IsRunning
LMW_WHC_RemoveProcessPreventFromMonitor
LMW_WHC_RemoveWindowPreventFromMonitor
LMW_WHC_Run

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LMWndExtLH64.dll
.dll windows:4 windows x64 arch:x64

21d63744c7c951293b7a3389572f1058

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:af:15:d2:28:74:02:3f:d8:f5:f3:2c:23:a0:fb:e7:73:6c:38:d2
Signer

Actual PE Digest

a4:af:15:d2:28:74:02:3f:d8:f5:f3:2c:23:a0:fb:e7:73:6c:38:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
GetExitCodeProcess
GetLastError
GetVersionExW
GetModuleHandleW
GetSystemInfo
GetCurrentThread
Sleep
LocalAlloc
CreateProcessW
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
InitializeCriticalSection
LoadLibraryA
SetErrorMode
lstrlenW
GetModuleFileNameW
GetPrivateProfileStringW
OpenMutexW
CloseHandle
OpenProcess
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
LocalFree
EnterCriticalSection
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
HeapSize
RtlUnwindEx
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection

user32

KillTimer
GetForegroundWindow
SetTimer
PostMessageW
SendMessageW
RegisterWindowMessageW
GetSystemMetrics
DefWindowProcW
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
TranslateMessage
PeekMessageW
wsprintfW
FindWindowW
GetWindowThreadProcessId
DestroyWindow

advapi32

GetSidSubAuthority
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
CreateProcessAsUserW
GetLengthSid
SetTokenInformation
ConvertStringSidToSidW
DuplicateTokenEx
GetSidSubAuthorityCount

shell32

ShellExecuteExW

Exports

Exports

LMW_AddProcessPreventFromMaximizeToExtendedDisplay
LMW_AddWindowPreventFromMaximizeToExtendedDisplay
LMW_AllowLaunchNSplitterIfPresentationModeOn
LMW_Deinitial
LMW_EndPresentationMode
LMW_Initial
LMW_IsPresentationModeAllModuleReady
LMW_IsPresentationModeAnyModuleExist
LMW_IsPresentationModeOn
LMW_MakeNSplitterIgnoreExternalDisplayExtending
LMW_RemoveProcessPreventFromMaximizeToExtendedDisplay
LMW_RemoveWindowPreventFromMaximizeToExtendedDisplay
LMW_SendActivatedWindowToExtendedDisplay
LMW_SendWindowToExtendedDisplay
LMW_SetMessageLoopProc
LMW_StartPresentationMode
LMW_SupportHighIntegrityLevel
LMW_WHC_AddProcessPreventFromMonitor
LMW_WHC_AddWindowPreventFromMonitor
LMW_WHC_Close
LMW_WHC_IsControlInterfaceSupported
LMW_WHC_IsInstalled
LMW_WHC_IsRunning
LMW_WHC_RemoveProcessPreventFromMonitor
LMW_WHC_RemoveWindowPreventFromMonitor
LMW_WHC_Run

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LManager.exe
.exe windows:5 windows x86 arch:x86

6f61f046b6f6448cad8fd0f24ed6c425

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:56:b4:79:9d:a7:8c:00:0c:31:26:7b:50:bb:7d:5e:d0:34:53:e7
Signer

Actual PE Digest

ee:56:b4:79:9d:a7:8c:00:0c:31:26:7b:50:bb:7d:5e:d0:34:53:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_GetImageCount
ImageList_GetIcon
ord17

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

CM_Get_DevNode_Registry_PropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

shlwapi

PathAddBackslashW
StrTrimW
PathFileExistsW

powrprof

SetSuspendState

netapi32

NetUserChangePassword

comfnutl

ComFnUtl_ExecuteCommandW
ComFnUtl_GetSystemDefaultBrowserFileNameW
ComFnUtl_IssueWindowsAPPCommand
ComFnUtl_GetSystemDefaultPlayerFileNameW
ComFnUtl_GetDefaultPlayerFileNameByExtNameW
ComFnUtl_RetrieveRegisterWindowMessage
ComFnUtl_BroadcastMessage
ComFnUtl_CloseScreenSaver
ComFnUtl_RotateApplication
ComFnUtl_ExecuteScreenSaver
ComFnUtl_GetSpecialFolderPathW
ComFnUtl_GetSystemDefaultMailFileNameW
ComFnUtl_ShowShutDownWindows
ComFnUtl_ShutDownWindows
ComFnUtl_OpenSpecialFolderW
ComFnUtl_GetSystemMailFileNameBySubKeyW
ComFnUtl_CopyTextToClipboardW
ComFnUtl_GetFocusHandle
ComFnUtl_IsScreenSaverRunning
ComFnUtl_SetWindowToForeground
ComFnUtl_GetSpecialFolderW
ComFnUtl_GetAssociateExecuteFileFromExtNameW

szupfutl

SzUPFUtl_OpenKeyW
SzUPFUtl_GetProfileBooleanW
SzUPFUtl_GetProfileDWordExW
SzUPFUtl_GetProfileDWordW
SzUPFUtl_GetProfileStringW
SzUPFUtl_SetUserProfileInfoW
SzUPFUtl_GetProfileStringExW
SzUPFUtl_GetProfileBooleanExW
SzUPFUtl_SetProfileStringW
SzUPFUtl_CreateKeyW
SzUPFUtl_SetRegistryValueW
SzUPFUtl_EnumKeyNameW
SzUPFUtl_QueryRegistryValueW

cdromutl

CDRomUtl_IsCDRomDoorOpen
CDRomUtl_OpenCDRomDoor
CDRomUtl_GetCDTitle
CDRomUtl_GetCDRomDrive
CDRomUtl_GetTotalCDRomDrives
CDRomUtl_Init
CDRomUtl_DeInit
CDRomUtl_DeviceChange

mixerutl

MixerUtl_GetValueExByCtrlID
MixerUtl_GetLineNameExByCtrlIDW
MixerUtl_GetValueItemCount
MixerUtl_GetMaxMinValue
MixerUtl_SetValue
MixerUtl_UnHookDevice
MixerUtl_GetValue
MixerUtl_HookDevice
MixerUtl_GetControlID
MixerUtl_FreeValueItems

wnd2file

WND2FILE_GetWindowHandleFromExecutableFileW

powerutl

PowerUtl_GetActivePowerScheme
PowerUtl_Init
PowerUtl_SetActivePowerScheme
PowerUtl_DeInit
PowerUtl_GetPowerSchemeCounts
PowerUtl_GetAllPowerScheme

osdutl2

OSDUtl_ShowStringW
OSDUtl_GetVolumePropertiesA
OSDUtl_InitW
OSDUtl_HideAll
OSDUtl_SetVolumePropertiesA
OSDUtl_SetPredefinedOSDStringW
OSDUtl_ShowVolume
OSDUtl_Show
OSDUtl_ShowConfigDialog
OSDUtl_DeInit
OSDUtl_SetProperties
OSDUtl_Hide
OSDUtl_HideAllOthers

kernel32

GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetACP
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
ExitProcess
HeapCreate
HeapReAlloc
VirtualAlloc
VirtualFree
GetStringTypeW
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
GetFileType
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
CreateProcessW
CloseHandle
WaitForSingleObject
lstrlenW
ExpandEnvironmentStringsW
lstrcpyW
lstrcatW
lstrcpynW
GetSystemDefaultLangID
lstrcmpW
lstrcmpiW
GetWindowsDirectoryW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
GetPriorityClass
SetPriorityClass
GetModuleHandleW
CreateMutexW
GetLastError
CreateEventW
GetVersionExW
GetSystemTime
GetModuleFileNameW
SetCurrentDirectoryW
Sleep
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryA
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
GetVolumeInformationW
WideCharToMultiByte
FindFirstFileW
WriteFile
FindNextFileW
FindClose
GetTempPathW
CreateFileW
SetSystemPowerState
GetCurrentThreadId
GetModuleFileNameA
GetDriveTypeW
GetLogicalDrives
FormatMessageW
LocalFree
InterlockedIncrement
InterlockedDecrement
SetThreadExecutionState
GetVersionExA
CreateThread
TerminateThread
GetExitCodeThread
GetPrivateProfileIntW
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetModuleHandleA
FlushFileBuffers
LeaveCriticalSection

user32

SendMessageTimeoutW
GetSubMenu
SetClassLongW
LoadImageW
SetWindowTextW
CreateDialogParamW
DestroyIcon
DefWindowProcW
SetForegroundWindow
IsWindowVisible
CreateWindowExW
GetForegroundWindow
RegisterClassW
LoadCursorW
LoadIconW
SendDlgItemMessageW
TranslateMessage
IsDialogMessageW
IsWindow
GetMessageW
FindWindowW
SetTimer
KillTimer
GetParent
GetWindowLongW
ShowWindow
SendMessageW
GetDlgItem
EndDialog
PostMessageW
LoadStringW
TrackPopupMenu
ReleaseDC
AppendMenuW
CreatePopupMenu
GetDC
CopyRect
DrawIcon
LockWorkStation
EnumWindows
DdeUninitialize
DdeDisconnect
DdeConnect
DialogBoxParamW
wsprintfW
DdeFreeStringHandle
DdeCreateStringHandleW
DdeInitializeW
GetWindowTextW
IsWindowEnabled
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsIconic
FindWindowExW
DdeFreeDataHandle
DdeClientTransaction
DdeCreateDataHandle
SetWindowPos
DrawTextW
DrawIconEx
DrawFocusRect
FillRect
GetSysColor
SetRect
GetSystemMetrics
DestroyWindow
keybd_event
GetClassNameW
GetDesktopWindow
GetWindowThreadProcessId
GetWindow
MapWindowPoints
GetWindowRect
GetClientRect
GetMenuItemID
GetMenuItemCount
DestroyMenu
MessageBoxW
BringWindowToTop
UpdateWindow
InvalidateRect
EndPaint
BeginPaint
GetKeyState
SystemParametersInfoW
GetMenu
GetKeyboardLayout
GetFocus
AttachThreadInput
MapVirtualKeyW
GetMenuState
GetTopWindow
GetSystemMenu
GetClassLongW
RegisterWindowMessageW
SetMenuDefaultItem
DeleteMenu
LoadMenuW
TrackPopupMenuEx
DispatchMessageW
GetCursorPos
PostQuitMessage

gdi32

Ellipse
StretchBlt
GetTextExtentPoint32W
SetBkMode
SetTextColor
CreateSolidBrush
CreateCompatibleBitmap
CreatePen
DeleteDC
BitBlt
CreateCompatibleDC
DeleteObject
LineTo
MoveToEx
SelectObject

advapi32

RegCloseKey
GetUserNameW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegNotifyChangeKeyValue
RegQueryValueExW

shell32

ShellExecuteExW
ExtractAssociatedIconW
ExtractIconW
SHGetFileInfoW
Shell_NotifyIconW
FindExecutableW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/LManager.exe.manifest
.xml
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MIXERUTL.DLL
.dll windows:5 windows x86 arch:x86

036dbeb14cb4cdcb4440988c9a8ed348

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:dd:02:4d:b5:e2:95:35:36:f6:a1:1e:8a:70:6b:2e:65:6d:2e:6a
Signer

Actual PE Digest

bd:dd:02:4d:b5:e2:95:35:36:f6:a1:1e:8a:70:6b:2e:65:6d:2e:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetDevCapsW
mixerGetNumDevs
mixerOpen
mixerSetControlDetails
mixerClose

kernel32

TlsFree
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
VirtualFree
WideCharToMultiByte
lstrcpyW
MultiByteToWideChar
VirtualAlloc
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA

Exports

Exports

MixerUtl_CanRecordMultipleSelected
MixerUtl_FindDefaultMixerNumber
MixerUtl_FreeValueItems
MixerUtl_GetControlID
MixerUtl_GetControlIDEx
MixerUtl_GetControlNameA
MixerUtl_GetControlNameExA
MixerUtl_GetControlNameExByCtrlIDA
MixerUtl_GetControlNameExByCtrlIDW
MixerUtl_GetControlNameExW
MixerUtl_GetControlNameW
MixerUtl_GetDeviceNameA
MixerUtl_GetDeviceNameW
MixerUtl_GetDevicesCount
MixerUtl_GetLineNameA
MixerUtl_GetLineNameExA
MixerUtl_GetLineNameExByCtrlIDA
MixerUtl_GetLineNameExByCtrlIDW
MixerUtl_GetLineNameExW
MixerUtl_GetLineNameW
MixerUtl_GetMaxMinValue
MixerUtl_GetMaxMinValueEx
MixerUtl_GetMaxMinValueExByCtrlID
MixerUtl_GetRecordSelectedCount
MixerUtl_GetValue
MixerUtl_GetValueEx
MixerUtl_GetValueExByCtrlID
MixerUtl_GetValueItemCount
MixerUtl_GetValueItemCountEx
MixerUtl_GetValueItemCountExByCtrlID
MixerUtl_HookDevice
MixerUtl_IsRecordSelected
MixerUtl_IsRecordSelectedEx
MixerUtl_IsRecordSelectedExByCtrlID
MixerUtl_SetRecordSelected
MixerUtl_SetRecordSelectedEx
MixerUtl_SetRecordSelectedExByCtrlID
MixerUtl_SetValue
MixerUtl_SetValueEx
MixerUtl_SetValueExByCtrlID
MixerUtl_UnHookDevice

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMDUtl.cfg
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMDUtl.dll
.dll windows:5 windows x86 arch:x86

cc2fb311f9f32a5c119d1ad24e48680f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:0f:73:fc:24:0a:78:f0:a8:08:b8:82:4f:b7:f2:f6:55:07:d9:ec
Signer

Actual PE Digest

7a:0f:73:fc:24:0a:78:f0:a8:08:b8:82:4f:b7:f2:f6:55:07:d9:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathRemoveFileSpecW
PathCombineA
PathFileExistsA

comctl32

ord17

kernel32

GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryA
lstrcpyA
lstrcpynA
GetPrivateProfileIntA
WritePrivateProfileStringA
DeleteFileA
GetTempPathA
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
OutputDebugStringA
GetModuleFileNameA
GetTempPathW
WritePrivateProfileStringW
OutputDebugStringW
ExpandEnvironmentStringsA
GetCurrentProcess
MultiByteToWideChar
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
lstrlenA
Process32Next
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
VirtualAlloc
VirtualFree
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetModuleFileNameW
Sleep
GetPrivateProfileIntW
lstrlenW
GetVersionExA
SetStdHandle
CloseHandle
WriteConsoleA
GetModuleHandleA
GetStdHandle
WriteFile
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
HeapFree
HeapReAlloc
GetCPInfo
ExitProcess
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetCommandLineA
GetCurrentThreadId
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapAlloc

user32

ChangeDisplaySettingsA
SetWindowLongA
GetWindowLongA
DestroyWindow
SetWindowPos
BringWindowToTop
GetWindowRect
GetClientRect
MapWindowPoints
GetDC
ReleaseDC
UpdateWindow
InvalidateRect
GetWindow
GetParent
MonitorFromWindow
GetMonitorInfoA
CreateDialogParamA
ChangeDisplaySettingsExA
EnumDisplaySettingsA
EnumDisplaySettingsExA
GetDesktopWindow
SetForegroundWindow
UpdateLayeredWindow
keybd_event
wsprintfA
EnumDisplaySettingsW
GetCursorPos
SetCursorPos
EnumDisplayDevicesA
GetForegroundWindow
GetWindowTextW
EnumWindows
GetClassNameW
EnumChildWindows
FindWindowW

gdi32

CreateDCA
CreateSolidBrush
DeleteDC
CreateCompatibleDC
DeleteObject
SelectObject
ExtEscape

advapi32

RegQueryValueExA
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CLSIDFromProgID
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCloneBitmapAreaI
GdipDeletePen
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipLoadImageFromFile
GdipCreateHBITMAPFromBitmap

setupapi

SetupDiOpenDevRegKey
CM_Get_DevNode_Status
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

MMDUtl_Cancel
MMDUtl_ChangeToNBOnlySingleDisplayMode
MMDUtl_DeInit
MMDUtl_DeInitExtendMode
MMDUtl_DetectDisplayConnectedFeatureIsValid
MMDUtl_EnableExtendMode
MMDUtl_FlushRememberedSettings
MMDUtl_GetActiveDisplays
MMDUtl_GetConnectedDisplays
MMDUtl_GetCurrentDisplayMode
MMDUtl_GetVgaVendor
MMDUtl_HasDualOutputCapability
MMDUtl_HasExternalMonitorConnected
MMDUtl_Init
MMDUtl_InitExtendMode
MMDUtl_IsExtendModeEnabled
MMDUtl_PermitToChangeMode
MMDUtl_Run
MMDUtl_SaveCurrentMode
MMDUtl_SetNewDisplayMode
MMDUtl_Stop

Sections

.text
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMDUtl.x64
.dll windows:5 windows x64 arch:x64

a0998064795fb243ac87a2538f9537a8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:95:6d:ef:77:86:48:84:c2:e8:c8:78:b0:3a:8b:b4:3a:25:73:db
Signer

Actual PE Digest

39:95:6d:ef:77:86:48:84:c2:e8:c8:78:b0:3a:8b:b4:3a:25:73:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

PathCombineA
PathFileExistsA
PathRemoveFileSpecW

comctl32

ord17

kernel32

GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryA
lstrcpyA
lstrcpynA
GetPrivateProfileIntA
WritePrivateProfileStringA
DeleteFileA
GetTempPathA
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
OutputDebugStringA
GetModuleFileNameA
GetTempPathW
WritePrivateProfileStringW
OutputDebugStringW
ExpandEnvironmentStringsA
GetCurrentProcess
MultiByteToWideChar
FlushFileBuffers
CreateFileA
lstrlenA
Process32Next
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
HeapSetInformation
GetStdHandle
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetModuleFileNameW
Sleep
GetPrivateProfileIntW
lstrlenW
GetVersionExA
GetConsoleOutputCP
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteConsoleW
TerminateProcess
DeleteCriticalSection
WriteFile
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetACP
GetCPInfo
ExitProcess
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
GetCommandLineA
FlsSetValue
GetCurrentThreadId
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RtlVirtualUnwind

user32

GetCursorPos
GetWindowRect
GetClientRect
MapWindowPoints
GetDC
ReleaseDC
UpdateWindow
InvalidateRect
GetWindow
GetParent
MonitorFromWindow
GetMonitorInfoA
CreateDialogParamA
ChangeDisplaySettingsExA
EnumDisplaySettingsA
EnumDisplaySettingsExA
UpdateLayeredWindow
FindWindowW
EnumChildWindows
DestroyWindow
GetWindowLongA
GetWindowLongPtrA
SetWindowLongPtrA
SetWindowPos
GetDesktopWindow
SetForegroundWindow
GetForegroundWindow
keybd_event
wsprintfA
EnumDisplaySettingsW
GetClassNameW
SetCursorPos
EnumDisplayDevicesA
ChangeDisplaySettingsA
GetWindowTextW
EnumWindows
BringWindowToTop

gdi32

CreateDCA
CreateSolidBrush
DeleteDC
CreateCompatibleDC
DeleteObject
SelectObject
ExtEscape

advapi32

RegQueryValueExA
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocStringLen

gdiplus

GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipLoadImageFromFile
GdipCloneImage
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdiplusStartup
GdiplusShutdown
GdipCreatePen1
GdipDeletePen

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status

Exports

Exports

MMDUtl_Cancel
MMDUtl_ChangeToNBOnlySingleDisplayMode
MMDUtl_DeInit
MMDUtl_DeInitExtendMode
MMDUtl_DetectDisplayConnectedFeatureIsValid
MMDUtl_EnableExtendMode
MMDUtl_FlushRememberedSettings
MMDUtl_GetActiveDisplays
MMDUtl_GetConnectedDisplays
MMDUtl_GetCurrentDisplayMode
MMDUtl_GetVgaVendor
MMDUtl_HasDualOutputCapability
MMDUtl_HasExternalMonitorConnected
MMDUtl_Init
MMDUtl_InitExtendMode
MMDUtl_IsExtendModeEnabled
MMDUtl_PermitToChangeMode
MMDUtl_Run
MMDUtl_SaveCurrentMode
MMDUtl_SetNewDisplayMode
MMDUtl_Stop

Sections

.text
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMDUtlStarter.cfg
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMDx64Fx.exe
.exe windows:5 windows x64 arch:x64

a202e93a0d43e319361c210433b28b11

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:70:13:f2:2b:b7:0c:8d:dd:22:8b:09:5d:1c:f7:5d:c6:58:3f:e9
Signer

Actual PE Digest

fc:70:13:f2:2b:b7:0c:8d:dd:22:8b:09:5d:1c:f7:5d:c6:58:3f:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mmdutl

MMDUtl_Run
MMDUtl_IsExtendModeEnabled
MMDUtl_EnableExtendMode
MMDUtl_HasExternalMonitorConnected
MMDUtl_DetectDisplayConnectedFeatureIsValid
MMDUtl_HasDualOutputCapability
MMDUtl_DeInitExtendMode
MMDUtl_InitExtendMode
MMDUtl_Cancel
MMDUtl_Init
MMDUtl_DeInit
MMDUtl_ChangeToNBOnlySingleDisplayMode
MMDUtl_Stop
MMDUtl_SaveCurrentMode
MMDUtl_PermitToChangeMode

kernel32

SetLastError
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
CloseHandle
SetEvent
GetLastError
CreateEventW
CreateEventA
GetTempPathW
WritePrivateProfileStringW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapReAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
Sleep
HeapSize
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection

user32

CreateWindowExA
PostQuitMessage
DefWindowProcA
RegisterClassExA
LoadCursorA
DispatchMessageA
TranslateMessage
GetMessageA

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMKEYBD.CFG
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMKEYBD.MCE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMKEYBD.XPE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMKEYBDStarter.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMKEYBD_MCE.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/CRT.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/DP.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/DVI.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/Extend.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/HDMI.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/LCD.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB-CRT.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB-DP.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB-DVI.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB-HDMI.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB-TV.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/NB.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/TV.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/bg_center.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/bg_left.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/bg_right.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/p1024x768.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/p800x600.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/MMRes/selected.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/NTKCUtl.dll
.dll windows:4 windows x86 arch:x86

300b457e9f71aac978ebe5a56c436405

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:67:c3:71:77:ec:7b:84:2c:e4:f0:f9:62:64:f9:c1:06:af:24:fc
Signer

Actual PE Digest

fa:67:c3:71:77:ec:7b:84:2c:e4:f0:f9:62:64:f9:c1:06:af:24:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetVersionExA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetFileAttributesA
lstrcatA
GetModuleFileNameA
lstrcpyA
WideCharToMultiByte
RtlUnwind
LoadLibraryA
GetCommandLineA
GetVersion
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress

user32

SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
MapVirtualKeyA
CallNextHookEx
PostMessageA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetKeyState

Exports

Exports

NTKCUtl_DeInit
NTKCUtl_DeleteAllRegisterKey
NTKCUtl_HookKey
NTKCUtl_IgnoreRejectKeyWhenFnKeyPressed
NTKCUtl_Init
NTKCUtl_IsKeyStateEnabled
NTKCUtl_Register
NTKCUtl_RegisterKey
NTKCUtl_RegisterKeyBySectionA
NTKCUtl_RegisterKeyBySectionW
NTKCUtl_UnRegister
NTKCUtl_UnRegisterKey
NTKCUtl_UnRegisterKeyBySectionA
NTKCUtl_UnRegisterKeyBySectionW

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/3G_Disable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/3G_Enable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/3G_NotExists.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Bluetooth_Disable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Bluetooth_Enable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Bluetooth_NotExists.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Mute.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Power.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Setting.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Touchpad_Disable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Touchpad_Enable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/UnMute.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_000.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_001.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_002.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_003.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_004.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_005.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_006.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_007.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_008.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_009.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_010.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_011.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_012.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_013.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_014.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_015.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/Vol_016.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiFi_Disable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiFi_Enable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiFi_NotExists.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiMax_Disable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiMax_Enable.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDRC/WiMax_NotExists.png
.png
LaunchManager_Dritek_v.3.0.00_Win7x86x64/OSDUtl2.dll
.dll windows:5 windows x86 arch:x86

1bee04e5ffbc2262ad35da75c53861e3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:7e:f4:8a:38:27:91:d3:66:35:98:40:5e:46:5d:41:97:a7:b5:d4
Signer

Actual PE Digest

a1:7e:f4:8a:38:27:91:d3:66:35:98:40:5e:46:5d:41:97:a7:b5:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
RaiseException
ExitThread
CreateThread
HeapReAlloc
Sleep
ExitProcess
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
TerminateProcess
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
WritePrivateProfileStringW
GetModuleHandleA
GlobalFlags
lstrlenA
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
InterlockedExchange
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
CreateEventW
SuspendThread
SetEvent
GetCurrentThreadId
ResumeThread
CloseHandle
GetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
FreeLibrary
InterlockedDecrement
SetLastError
lstrlenW
GetProcAddress
GetModuleHandleW
SetThreadPriority
GetCurrentThread
GetThreadPriority
MulDiv
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
MultiByteToWideChar
WaitForSingleObject
LockResource
SizeofResource
LoadResource
HeapDestroy
FindResourceW

user32

GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ClientToScreen
DestroyMenu
GetSysColorBrush
UnregisterClassW
ShowWindow
SetWindowTextW
GetWindowThreadProcessId
IsWindowEnabled
SetCursor
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
LoadIconW
WinHelpW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
GetDlgCtrlID
CallWindowProcW
PtInRect
GetMenu
GetWindowLongW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetWindowsHookExW
CallNextHookEx
GetCapture
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
SendMessageW
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
DestroyIcon
EnableWindow
GetSystemMetrics
UpdateLayeredWindow
SetTimer
KillTimer
EqualRect
CopyRect
SystemParametersInfoW
ReleaseDC
SetRect
GetDC
PostThreadMessageW
IsWindow
PostMessageW
LoadCursorW
DefWindowProcW

gdi32

GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
CreateCompatibleDC
SetMapMode
RestoreDC
SaveDC
ExtTextOutW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
BitBlt
CreateDIBSection
SelectObject
GetObjectW
GetDeviceCaps
DeleteObject
DeleteDC

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW

shlwapi

PathFileExistsW
PathFindFileNameW
PathFindExtensionW

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdipDeleteStringFormat
GdipCreateStringFormat
GdipFillPath
GdipDrawPath
GdipSetCompositingMode
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatAlign
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipGetFontHeightGivenDPI
GdipAddPathLineI
GdipAddPathArcI
GdipSetStringFormatLineAlign
GdipDrawString
GdipCloneBrush
GdipCreateFontFamilyFromName
GdiplusStartup
GdiplusShutdown
GdipDeleteFont
GdipFree
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipAlloc
GdipCloneFont
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCloneImage
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreatePath
GdipDeletePath
GdipClonePath

Exports

Exports

OSDUtl_AddStringA
OSDUtl_AddStringW
OSDUtl_ChangeStringA
OSDUtl_ChangeStringW
OSDUtl_DeInit
OSDUtl_DeleteString
OSDUtl_EnableShowString
OSDUtl_GetPredefinedOSDStringA
OSDUtl_GetPredefinedOSDStringW
OSDUtl_GetProperties
OSDUtl_GetVolumePropertiesA
OSDUtl_Hide
OSDUtl_HideAll
OSDUtl_HideAllOthers
OSDUtl_HideNow
OSDUtl_InitA
OSDUtl_InitW
OSDUtl_SetPredefinedOSDStringA
OSDUtl_SetPredefinedOSDStringW
OSDUtl_SetProperties
OSDUtl_SetVolumePropertiesA
OSDUtl_Show
OSDUtl_ShowConfigDialog
OSDUtl_ShowStringA
OSDUtl_ShowStringW
OSDUtl_ShowVolume

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Panel/LManager.ICO
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Panel/PM.ico
LaunchManager_Dritek_v.3.0.00_Win7x86x64/PowerUtl.dll
.dll windows:4 windows x86 arch:x86

26607775cdea552bbc2d9d5872fa209a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:f8:51:3f:7f:af:42:64:6a:97:2d:b0:92:bb:f6:eb:23:02:ab:0a
Signer

Actual PE Digest

af:f8:51:3f:7f:af:42:64:6a:97:2d:b0:92:bb:f6:eb:23:02:ab:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

powrprof

EnumPwrSchemes
SetActivePwrScheme
GetActivePwrScheme

kernel32

FreeEnvironmentStringsW
WideCharToMultiByte
GetVersionExW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSection
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

PowerUtl_DeInit
PowerUtl_GetActivePowerScheme
PowerUtl_GetActivePowerSchemeEx
PowerUtl_GetAllPowerScheme
PowerUtl_GetPowerSchemeCounts
PowerUtl_Init
PowerUtl_SetActivePowerScheme
PowerUtl_SetActivePowerSchemeEx
PowerUtl_SetPowerPolicy

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Readme.txt
LaunchManager_Dritek_v.3.0.00_Win7x86x64/SETUPDEV.INI
LaunchManager_Dritek_v.3.0.00_Win7x86x64/STD_Tool_Button/ButtonDown.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/STD_Tool_Button/ButtonUp.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/STD_Tool_Button/Disabled.bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/SZUPFUTL.DLL
.dll windows:5 windows x86 arch:x86

1e29fd66eb0a0056784da6f68130c001

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:7d:57:e1:33:71:b6:ee:ec:bc:8c:4f:a4:a8:7c:6e:62:21:e5:9a
Signer

Actual PE Digest

78:7d:57:e1:33:71:b6:ee:ec:bc:8c:4f:a4:a8:7c:6e:62:21:e5:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetSystemDefaultLangID
GetUserDefaultLangID
VirtualAlloc
VirtualFree
lstrcatW
lstrcatA
lstrlenW
lstrlenA
lstrcpyW
WideCharToMultiByte
lstrcpyA
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize

user32

wsprintfA
wsprintfW

advapi32

RegOpenKeyExA
RegEnumValueW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegEnumValueA
RegDeleteValueA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW

Exports

Exports

SzUPFUtl_CopyRegistryTree
SzUPFUtl_CopyRegistryTreeA
SzUPFUtl_CopyRegistryTreeW
SzUPFUtl_CreateKey
SzUPFUtl_CreateKeyA
SzUPFUtl_CreateKeyW
SzUPFUtl_DeleteRegistryTree
SzUPFUtl_DeleteRegistryTreeA
SzUPFUtl_DeleteRegistryTreeW
SzUPFUtl_EnumKeyName
SzUPFUtl_EnumKeyNameA
SzUPFUtl_EnumKeyNameW
SzUPFUtl_EnumValueName
SzUPFUtl_EnumValueNameA
SzUPFUtl_EnumValueNameW
SzUPFUtl_GetProfileBoolean
SzUPFUtl_GetProfileBooleanA
SzUPFUtl_GetProfileBooleanEx
SzUPFUtl_GetProfileBooleanExA
SzUPFUtl_GetProfileBooleanExW
SzUPFUtl_GetProfileBooleanW
SzUPFUtl_GetProfileByteArray
SzUPFUtl_GetProfileByteArrayA
SzUPFUtl_GetProfileByteArrayEx
SzUPFUtl_GetProfileByteArrayExA
SzUPFUtl_GetProfileByteArrayExW
SzUPFUtl_GetProfileByteArrayW
SzUPFUtl_GetProfileDWord
SzUPFUtl_GetProfileDWordA
SzUPFUtl_GetProfileDWordByRadix
SzUPFUtl_GetProfileDWordByRadixA
SzUPFUtl_GetProfileDWordByRadixW
SzUPFUtl_GetProfileDWordEx
SzUPFUtl_GetProfileDWordExA
SzUPFUtl_GetProfileDWordExByRadix
SzUPFUtl_GetProfileDWordExByRadixA
SzUPFUtl_GetProfileDWordExByRadixW
SzUPFUtl_GetProfileDWordExW
SzUPFUtl_GetProfileDWordW
SzUPFUtl_GetProfileMultiString
SzUPFUtl_GetProfileMultiStringA
SzUPFUtl_GetProfileMultiStringEx
SzUPFUtl_GetProfileMultiStringExA
SzUPFUtl_GetProfileMultiStringExW
SzUPFUtl_GetProfileMultiStringW
SzUPFUtl_GetProfileString
SzUPFUtl_GetProfileStringA
SzUPFUtl_GetProfileStringEx
SzUPFUtl_GetProfileStringExA
SzUPFUtl_GetProfileStringExW
SzUPFUtl_GetProfileStringW
SzUPFUtl_GetUserProfileInfo
SzUPFUtl_GetUserProfileInfoA
SzUPFUtl_GetUserProfileInfoW
SzUPFUtl_GetUserProfileSettings
SzUPFUtl_GetUserProfileSettingsA
SzUPFUtl_GetUserProfileSettingsW
SzUPFUtl_GetUserProfileSuffixSubKeySettings
SzUPFUtl_GetUserProfileSuffixSubKeySettingsA
SzUPFUtl_GetUserProfileSuffixSubKeySettingsW
SzUPFUtl_OpenKey
SzUPFUtl_OpenKeyA
SzUPFUtl_OpenKeyW
SzUPFUtl_QueryRegistryValue
SzUPFUtl_QueryRegistryValueA
SzUPFUtl_QueryRegistryValueW
SzUPFUtl_SetProfileBoolean
SzUPFUtl_SetProfileBooleanA
SzUPFUtl_SetProfileBooleanW
SzUPFUtl_SetProfileByteArray
SzUPFUtl_SetProfileByteArrayA
SzUPFUtl_SetProfileByteArrayW
SzUPFUtl_SetProfileDWord
SzUPFUtl_SetProfileDWordA
SzUPFUtl_SetProfileDWordByRadix
SzUPFUtl_SetProfileDWordByRadixA
SzUPFUtl_SetProfileDWordByRadixW
SzUPFUtl_SetProfileDWordW
SzUPFUtl_SetProfileMultiString
SzUPFUtl_SetProfileMultiStringA
SzUPFUtl_SetProfileMultiStringW
SzUPFUtl_SetProfileString
SzUPFUtl_SetProfileStringA
SzUPFUtl_SetProfileStringW
SzUPFUtl_SetRegistryValue
SzUPFUtl_SetRegistryValueA
SzUPFUtl_SetRegistryValueW
SzUPFUtl_SetUserProfileInfo
SzUPFUtl_SetUserProfileInfoA
SzUPFUtl_SetUserProfileInfoEx
SzUPFUtl_SetUserProfileInfoExA
SzUPFUtl_SetUserProfileInfoExW
SzUPFUtl_SetUserProfileInfoW
SzUPFUtl_SetUserProfileSettings
SzUPFUtl_SetUserProfileSettingsA
SzUPFUtl_SetUserProfileSettingsW
SzUPFUtl_SetUserProfileSuffixSubKeySettings
SzUPFUtl_SetUserProfileSuffixSubKeySettingsA
SzUPFUtl_SetUserProfileSuffixSubKeySettingsW

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Setup.exe
.exe windows:4 windows x86 arch:x86

2c622413de0d523de637aff76aa9151e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:1d:2d:19:dd:ca:e2:08:0e:7c:4e:74:70:4c:e7:f5:a0:c3:44:15
Signer

Actual PE Digest

67:1d:2d:19:dd:ca:e2:08:0e:7c:4e:74:70:4c:e7:f5:a0:c3:44:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerInstallFileA

ole32

WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTreatAsClass
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
StringFromCLSID

shlwapi

PathIsDirectoryA
PathAddBackslashA
PathFileExistsA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathRemoveExtensionA

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList

kernel32

GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
GetAtomNameA
SystemTimeToFileTime
LocalUnlock
LocalLock
LocalFileTimeToFileTime
SetFileTime
GetTempFileNameA
RtlUnwind
HeapFree
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapReAlloc
VirtualProtect
TlsGetValue
VirtualQuery
GetCommandLineA
GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
ExitProcess
HeapSize
GetACP
IsValidCodePage
HeapDestroy
HeapCreate
FatalAppExitA
GetStdHandle
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GetCurrentProcessId
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
GetThreadLocale
MoveFileA
GlobalSize
FormatMessageA
CreateEventA
SuspendThread
SetEvent
SetThreadPriority
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetTempPathA
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrcmpiW
CompareStringW
CompareStringA
lstrlenW
InterlockedExchange
GetModuleHandleW
CreateMutexA
CopyFileA
GetDiskFreeSpaceA
DeleteFileA
Sleep
GetSystemDefaultLangID
GetSystemTime
WaitForSingleObject
OutputDebugStringA
GetProfileStringA
WriteProfileStringA
CreateProcessA
MulDiv
GetModuleFileNameA
GetShortPathNameA
SetFilePointer
ResumeThread
OpenProcess
GetCurrentThread
LocalAlloc
LocalFree
ExpandEnvironmentStringsA
GetComputerNameA
GetDriveTypeA
GetVersion
GetCurrentProcess
lstrcmpA
GetModuleHandleA
WritePrivateProfileStringA
SetFileAttributesA
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateDirectoryA
GetLastError
GetCurrentDirectoryA
SetCurrentDirectoryA
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualAlloc
VirtualFree
ReadFile
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersionExA
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
GetFileSize
CloseHandle
SetErrorMode
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
lstrcmpiA
lstrcpynA
GetFileAttributesA
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcpyA
lstrlenA
lstrcatA
GetSystemInfo
InterlockedCompareExchange

user32

DeleteMenu
GetSystemMenu
SetParent
UnionRect
WindowFromPoint
GetDCEx
LockWindowUpdate
SetCapture
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
MapVirtualKeyA
GetKeyNameTextA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
ScrollWindowEx
IsWindowEnabled
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetActiveWindow
GetCursorPos
ValidateRect
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
GetMenuItemID
IsRectEmpty
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
CopyRect
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
UnhookWindowsHookEx
CharUpperW
CharUpperA
CharLowerW
CharLowerA
SetClassLongA
keybd_event
GetForegroundWindow
ShowWindow
SetForegroundWindow
DdeCreateDataHandle
PostQuitMessage
IsWindowVisible
OffsetRect
FindWindowA
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
ExitWindowsEx
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeFreeStringHandle
DdeDisconnect
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeUninitialize
GetMessageA
GetDC
GetSysColorBrush
GetSysColor
GetDesktopWindow
FillRect
DrawTextA
ReleaseDC
GetDlgItem
IsWindow
PostMessageA
MapWindowPoints
GetTabbedTextExtentA
SetRect
MessageBeep
IsClipboardFormatAvailable
GetDialogBaseUnits
LoadCursorA
GetMenuItemInfoA
InflateRect
UnregisterClassA
ShowOwnedPopups
GetClientRect
PeekMessageA
DispatchMessageA
TranslateMessage
LoadIconA
DestroyIcon
wsprintfA
GetSystemMetrics
SendMessageA
EnableWindow
KillTimer
SetTimer
GetWindowRect
LoadStringA
MessageBoxA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
TabbedTextOutA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
SetCursor
ReleaseCapture
GetMenuItemCount
LoadAcceleratorsA
GetSubMenu

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExcludeClipRect
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
PlayMetaFileRecord
GetObjectType
StartDocA
PlayMetaFile
CreatePen
ExtCreatePen
CreateHatchBrush
GetTextMetricsA
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
GetCharWidthA
StretchDIBits
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetBkColor
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
CreateFontIndirectA
CreateFontA
GetTextExtentPoint32A
SetTextColor
DeleteObject
GetDeviceCaps
CreatePalette
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
BitBlt
GetStockObject
SelectObject
SetBkMode
EnumMetaFile
SetBkColor
RestoreDC
SaveDC
PatBlt
CreateRectRgnIndirect
CreateDCA
CopyMetaFileA
CreateBitmap
GetClipBox
GetDCOrgEx
StretchBlt
CreateSolidBrush
Rectangle
CreateDIBitmap
SelectPalette
RealizePalette
IntersectClipRect

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA
GetJobA

advapi32

SetFileSecurityA
RegCreateKeyA
RegDeleteValueA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
ImpersonateSelf
OpenThreadToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
GetFileSecurityA

shell32

SHBrowseForFolderA
ExtractIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
DragFinish
SHGetFileInfoA
DragQueryFileA

oleaut32

VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen

Sections

.text
Size: 580KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 536KB - Virtual size: 533KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Setup.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/SetupDev.dll
.dll windows:4 windows x86 arch:x86

3fb1b236ed57fc51f5a729d5ddd40d85

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:29:36:cb:fc:d6:21:46:e1:ad:09:0f:cd:40:4a:2a:ad:5d:d1:f7
Signer

Actual PE Digest

f9:29:36:cb:fc:d6:21:46:e1:ad:09:0f:cd:40:4a:2a:ad:5d:d1:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GetPrivateProfileStringA
LocalAlloc
GetVersionExA
GlobalAlloc
LocalFree
GetPrivateProfileIntA
GlobalFree
GetCurrentProcess
GetCurrentThread
GetLastError
SetErrorMode
CloseHandle
FreeLibrary
lstrcpyA
LoadLibraryA
GetProcAddress
lstrlenA
lstrcmpiA
GetModuleFileNameA
InterlockedDecrement
FreeEnvironmentStringsA
GetStartupInfoA
RtlUnwind
GetCommandLineA
GetVersion
lstrcatA
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc
HeapReAlloc

user32

wsprintfA

advapi32

OpenThreadToken
OpenProcessToken
InitializeSecurityDescriptor
GetLengthSid
AllocateAndInitializeSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
InitializeAcl
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
SetSecurityDescriptorGroup
RevertToSelf
FreeSid
AccessCheck
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
RegSetValueExA
RegOpenKeyExA
ImpersonateSelf
RegCloseKey

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

Exports

Exports

SetupDev_AddDevicesRegistry
SetupDev_AddDevicesRegistryEx
SetupDev_IsAdministrator

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/SzPtcUtl.dll
.dll windows:4 windows x86 arch:x86

05736871180a0ca59eaa47fc7b128712

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:05:46:dc:04:26:ce:05:a0:04:f2:13:db:7a:38:0d:2d:64:b5:6f
Signer

Actual PE Digest

06:05:46:dc:04:26:ce:05:a0:04:f2:13:db:7a:38:0d:2d:64:b5:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapDestroy
lstrlenA
lstrcatA
VirtualFree
HeapFree
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
InterlockedDecrement
InterlockedIncrement
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
lstrcpyA
HeapCreate
GetOEMCP
GetACP
WriteFile
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind

user32

wsprintfA

Exports

Exports

SzPtcUtl_Decode
SzPtcUtl_DecodeEx
SzPtcUtl_Encode
SzPtcUtl_EncodeEx

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/UNINST32.EXE
.exe windows:4 windows x86 arch:x86

bde1370da0091c2c5e3d81e4b66ef6a7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:b6:4f:11:2d:3e:3a:5d:a7:9a:ca:4e:42:a6:9b:d2:63:d5:c2:05
Signer

Actual PE Digest

94:b6:4f:11:2d:3e:3a:5d:a7:9a:ca:4e:42:a6:9b:d2:63:d5:c2:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrTrimA
PathIsRootA
PathFindFileNameA
PathIsDirectoryA
PathFileExistsA
PathAddBackslashA
PathStripPathA

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
CM_Locate_DevNodeA
SetupDiGetDeviceInstanceIdA
SetupDiCallClassInstaller

kernel32

lstrcpynA
SetErrorMode
GetCurrentProcess
GetCurrentThread
LocalFree
GlobalAlloc
GlobalFree
GetModuleFileNameA
SetEndOfFile
GetTempPathA
LocalAlloc
GetModuleHandleA
lstrcmpA
GetModuleHandleW
GetFileAttributesW
CreateMutexA
GetModuleFileNameW
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32Next
OutputDebugStringA
OpenProcess
Process32First
GetVersion
LoadLibraryW
SetLastError
GetCurrentThreadId
GetProfileStringA
WriteProfileStringA
InitializeCriticalSection
GetLocaleInfoA
VirtualFree
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetStdHandle
HeapReAlloc
HeapCreate
HeapDestroy
ExitProcess
HeapSize
Sleep
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
MoveFileExA
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
RaiseException
GetStartupInfoA
GetProcessHeap
EnterCriticalSection
VirtualAlloc
GetLastError
DeleteCriticalSection
LeaveCriticalSection
CreateProcessA
CloseHandle
LoadLibraryA
GetVersionExA
GetProcAddress
GetPrivateProfileStringA
WriteFile
FindClose
lstrcmpiA
lstrlenA
lstrcpyA
SetFilePointer
DeleteFileA
SetFileAttributesA
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
SetCurrentDirectoryA
GetFileAttributesA
FreeLibrary
lstrcatA
WaitForSingleObject
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
RemoveDirectoryA
GetShortPathNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA

user32

IsWindowEnabled
IsWindowVisible
GetClientRect
MapWindowPoints
GetForegroundWindow
SetTimer
IsIconic
GetWindowLongA
SetForegroundWindow
ShowWindow
GetParent
AttachThreadInput
IsWindow
ExitWindowsEx
SetFocus
SendMessageA
EnableWindow
KillTimer
DialogBoxParamA
GetDC
PeekMessageA
LoadStringA
ReleaseDC
TranslateMessage
DispatchMessageA
GetDlgItem
GetWindowRect
LoadIconA
EndDialog
GetWindowThreadProcessId
GetSystemMetrics
MessageBeep
SetWindowPos
SetWindowTextA
MessageBoxA
DdeInitializeA
PostMessageA
DdeClientTransaction
DdeConnect
DdeFreeStringHandle
FindWindowA
DdeDisconnect
DdeUninitialize
DdeFreeDataHandle
DdeCreateStringHandleA
DdeCreateDataHandle
wsprintfA
MoveWindow

gdi32

DeleteObject
SelectObject
MoveToEx
LineTo
CreatePen

advapi32

AccessCheck
RegEnumValueA
RegCreateKeyExA
RegDeleteKeyA
SetTokenInformation
CreateProcessAsUserA
GetTokenInformation
FreeSid
RevertToSelf
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
SetSecurityDescriptorGroup
LookupPrivilegeValueA
GetSidSubAuthorityCount
ConvertStringSidToSidA
DuplicateTokenEx
ConvertSidToStringSidA
GetSidSubAuthority
OpenProcessToken
AddAce
RegSetKeySecurity
AddAccessAllowedAce
RegDeleteValueA
InitializeAcl
RegGetKeySecurity
GetAce
SetSecurityDescriptorDacl
RegEnumKeyExA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
RegEnumKeyA
LookupAccountNameA
GetLengthSid
IsValidSecurityDescriptor
GetUserNameA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
SetSecurityDescriptorOwner
AllocateAndInitializeSid

shell32

SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
ShellExecuteA
ShellExecuteExA

Sections

.text
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LaunchManager_Dritek_v.3.0.00_Win7x86x64/VistaVol.dll
.dll windows:5 windows x86 arch:x86

1b929c3f3eeaf824c0ef24844fa7dd72

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:49:55:41:37:a0:70:06:f9:a5:b6:f1:61:b9:00:cf:bd:cc:89:f8
Signer

Actual PE Digest

6f:49:55:41:37:a0:70:06:f9:a5:b6:f1:61:b9:00:cf:bd:cc:89:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitOnceExecuteOnce
CloseHandle
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetModuleHandleA

user32

PostMessageW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree

Exports

Exports

VistaVol_DeInit
VistaVol_DeviceChanged
VistaVol_GetMute
VistaVol_GetVolumeLevel
VistaVol_Init
VistaVol_InitEx
VistaVol_OnDefaultDeviceChanged
VistaVol_OnDeviceRemoved
VistaVol_Register
VistaVol_SetMute
VistaVol_SetVolumeLevel
VistaVol_Unregister
VistaVol_VolumeLevelStepDown
VistaVol_VolumeLevelStepUp

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_Aero/ButtonDown.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_Aero/ButtonUp.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_Aero/Disabled.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_STD/ButtonDown.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_STD/ButtonUp.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/Vista_STD/Disabled.Bmp
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH/DKbFltr.sys
.sys windows:6 windows x86 arch:x86

4c3130190a0a5a07072d74c5de0520d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:04:6c:5d:8c:ac:80:d1:ee:54:a4:b5:d3:ca:09:ec:94:03:54:b4
Signer

Actual PE Digest

f9:04:6c:5d:8c:ac:80:d1:ee:54:a4:b5:d3:ca:09:ec:94:03:54:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
IoStartNextPacket
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSynchronizationEvent
IofCallDriver
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
IoCreateSymbolicLink
KeResetEvent
KeTickCount
KeClearEvent
IoReleaseRemoveLockEx
KeSetEvent
memset
IoCreateDevice
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
ZwClose
IoDeleteDevice

hal

WRITE_PORT_USHORT
READ_PORT_ULONG
READ_PORT_USHORT
KeStallExecutionProcessor
READ_PORT_UCHAR
WRITE_PORT_UCHAR
WRITE_PORT_ULONG

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH64/DKbFltr.sys
.sys windows:6 windows x64 arch:x64

6e6d1c223507fa14f85cc2a7cb87362a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:0d:e5:4c:e9:20:e8:a1:ca:c6:eb:ca:8b:58:ae:17:24:dd:df:3c
Signer

Actual PE Digest

a8:0d:e5:4c:e9:20:e8:a1:ca:c6:eb:ca:8b:58:ae:17:24:dd:df:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
IoCreateSynchronizationEvent
IoStartNextPacket
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
KeWaitForSingleObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeResetEvent
KeBugCheckEx
IoGetAttachedDeviceReference
IoBuildDeviceIoControlRequest

hal

KeStallExecutionProcessor

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH64/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_LH64/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W7/DKbFltr.sys
.sys windows:6 windows x86 arch:x86

4c3130190a0a5a07072d74c5de0520d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:04:6c:5d:8c:ac:80:d1:ee:54:a4:b5:d3:ca:09:ec:94:03:54:b4
Signer

Actual PE Digest

f9:04:6c:5d:8c:ac:80:d1:ee:54:a4:b5:d3:ca:09:ec:94:03:54:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
IoStartNextPacket
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSynchronizationEvent
IofCallDriver
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
IoCreateSymbolicLink
KeResetEvent
KeTickCount
KeClearEvent
IoReleaseRemoveLockEx
KeSetEvent
memset
IoCreateDevice
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
ZwClose
IoDeleteDevice

hal

WRITE_PORT_USHORT
READ_PORT_ULONG
READ_PORT_USHORT
KeStallExecutionProcessor
READ_PORT_UCHAR
WRITE_PORT_UCHAR
WRITE_PORT_ULONG

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W7/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W7/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W764/DKbFltr.sys
.sys windows:6 windows x64 arch:x64

6e6d1c223507fa14f85cc2a7cb87362a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:0d:e5:4c:e9:20:e8:a1:ca:c6:eb:ca:8b:58:ae:17:24:dd:df:3c
Signer

Actual PE Digest

a8:0d:e5:4c:e9:20:e8:a1:ca:c6:eb:ca:8b:58:ae:17:24:dd:df:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
IoCreateSynchronizationEvent
IoStartNextPacket
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
KeWaitForSingleObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeResetEvent
KeBugCheckEx
IoGetAttachedDeviceReference
IoBuildDeviceIoControlRequest

hal

KeStallExecutionProcessor

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W764/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_W764/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP/DKbFltr.sys
.sys windows:6 windows x86 arch:x86

4c3130190a0a5a07072d74c5de0520d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:ea:89:93:be:2f:e3:5f:4f:a1:ca:11:12:81:5f:dc:22:4c:8e:58
Signer

Actual PE Digest

77:ea:89:93:be:2f:e3:5f:4f:a1:ca:11:12:81:5f:dc:22:4c:8e:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
IoStartNextPacket
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSynchronizationEvent
IofCallDriver
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
IoCreateSymbolicLink
KeResetEvent
KeTickCount
KeClearEvent
IoReleaseRemoveLockEx
KeSetEvent
memset
IoCreateDevice
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
ZwClose
IoDeleteDevice

hal

WRITE_PORT_USHORT
READ_PORT_ULONG
READ_PORT_USHORT
KeStallExecutionProcessor
READ_PORT_UCHAR
WRITE_PORT_UCHAR
WRITE_PORT_ULONG

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 640B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP64/DKbFltr.sys
.sys windows:6 windows x64 arch:x64

6e6d1c223507fa14f85cc2a7cb87362a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:fd:ad:37:e4:67:d7:55:97:b5:61:d4:fa:f8:6b:21:a5:6b:47:74
Signer

Actual PE Digest

b4:fd:ad:37:e4:67:d7:55:97:b5:61:d4:fa:f8:6b:21:a5:6b:47:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
IoCreateSynchronizationEvent
IoStartNextPacket
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
KeWaitForSingleObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
IofCallDriver
KeResetEvent
KeBugCheckEx
IoGetAttachedDeviceReference
IoBuildDeviceIoControlRequest

hal

KeStallExecutionProcessor

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP64/LManager.inf
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHQL_XP64/lmanager.cat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHookCtl.dll
.dll windows:4 windows x86 arch:x86

369ac093c7cd7117731a78badf00f087

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:89:f6:1f:6a:e4:52:0a:b5:24:58:13:86:2c:b1:fd:c4:c8:c0:fd
Signer

Actual PE Digest

56:89:f6:1f:6a:e4:52:0a:b5:24:58:13:86:2c:b1:fd:c4:c8:c0:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateEventW
CreateThread
SetEvent
LocalAlloc
LocalFree
OutputDebugStringW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
WideCharToMultiByte
LoadLibraryA
MapViewOfFile
GetLastError
CreateFileMappingW
GetPrivateProfileStringW
GetPrivateProfileIntW
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
GetExitCodeProcess
WaitForSingleObject
GetCurrentThread
CloseHandle
lstrlenW
CreateProcessW
RtlUnwind
InitializeCriticalSection
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

FindWindowW
SetTimer
wsprintfW
SendMessageW
KillTimer
PostMessageW

advapi32

RegCreateKeyExW
ConvertStringSidToSidW
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
GetSidSubAuthorityCount
GetLengthSid
GetSidSubAuthority
OpenProcessToken
DuplicateTokenEx
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

shell32

ShellExecuteExW

Exports

Exports

WHC_AddProcessPreventFromMonitor
WHC_AddWindowPreventFromMonitor
WHC_AllowLaunchIfLMPresentationModeOn
WHC_Close
WHC_Deinitial
WHC_EnableFunction
WHC_GetDisplayDisplayNameA
WHC_GetDisplayDisplayNameW
WHC_GetDisplayGridMode
WHC_GetFirstGridModeValue
WHC_GetFirstValidDisplayID
WHC_GetGridModeDisplayNameA
WHC_GetGridModeDisplayNameW
WHC_GetNextGridModeValue
WHC_GetNextValidDisplayID
WHC_IdentifyAllGrids
WHC_IdentifyGrids
WHC_IgnoreExternalDisplayExtending
WHC_Initial
WHC_IsControlConnected
WHC_IsControlInterfaceSupported
WHC_IsExternalDisplayExtendingIgnore
WHC_IsFunctionEnabled
WHC_IsHighILSupported
WHC_IsInstalled
WHC_IsLMPresentationModeOn
WHC_IsNotifyConnected
WHC_IsRunning
WHC_NotifyAllowLaunchIfLMPresentationModeOn
WHC_NotifyLMPresentationMode
WHC_RegisterNotifyCallback
WHC_RegisterNotifyMessage
WHC_RemoveProcessPreventFromMonitor
WHC_RemoveWindowPreventFromMonitor
WHC_Run
WHC_SetDisplayGridMode
WHC_SupportHighIL
WHC_UnregisterNotifyCallback
WHC_UnregisterNotifyMessage

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WHookCtl64.dll
.dll windows:4 windows x64 arch:x64

2da0c9433d7cd727e1f0ed8e3de4a9d9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:85:ca:b1:bc:a4:4e:43:19:b2:e3:a5:2c:33:f3:19:41:54:50:be
Signer

Actual PE Digest

c0:85:ca:b1:bc:a4:4e:43:19:b2:e3:a5:2c:33:f3:19:41:54:50:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
CreateEventW
CreateThread
LocalAlloc
OutputDebugStringW
LocalFree
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
WideCharToMultiByte
HeapReAlloc
InitializeCriticalSection
LoadLibraryA
MapViewOfFile
GetLastError
CreateFileMappingW
GetCurrentProcess
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
GetCurrentThread
CloseHandle
CreateProcessW
GetPrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
RtlUnwindEx
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA

user32

FindWindowW
SetTimer
wsprintfW
SendMessageW
KillTimer
PostMessageW

advapi32

RegCreateKeyExW
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
CreateProcessAsUserW
GetLengthSid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

shell32

ShellExecuteExW

Exports

Exports

WHC_AddProcessPreventFromMonitor
WHC_AddWindowPreventFromMonitor
WHC_AllowLaunchIfLMPresentationModeOn
WHC_Close
WHC_Deinitial
WHC_EnableFunction
WHC_GetDisplayDisplayNameA
WHC_GetDisplayDisplayNameW
WHC_GetDisplayGridMode
WHC_GetFirstGridModeValue
WHC_GetFirstValidDisplayID
WHC_GetGridModeDisplayNameA
WHC_GetGridModeDisplayNameW
WHC_GetNextGridModeValue
WHC_GetNextValidDisplayID
WHC_IdentifyAllGrids
WHC_IdentifyGrids
WHC_IgnoreExternalDisplayExtending
WHC_Initial
WHC_IsControlConnected
WHC_IsControlInterfaceSupported
WHC_IsExternalDisplayExtendingIgnore
WHC_IsFunctionEnabled
WHC_IsHighILSupported
WHC_IsInstalled
WHC_IsLMPresentationModeOn
WHC_IsNotifyConnected
WHC_IsRunning
WHC_NotifyAllowLaunchIfLMPresentationModeOn
WHC_NotifyLMPresentationMode
WHC_RegisterNotifyCallback
WHC_RegisterNotifyMessage
WHC_RemoveProcessPreventFromMonitor
WHC_RemoveWindowPreventFromMonitor
WHC_Run
WHC_SetDisplayGridMode
WHC_SupportHighIL
WHC_UnregisterNotifyCallback
WHC_UnregisterNotifyMessage

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/WND2FILE.DLL
.dll windows:5 windows x86 arch:x86

18d183c79182c4bf6dbe900dd62f5dc1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:35:9e:87:90:3d:aa:bc:f1:65:ce:93:9b:f9:c9:e7:db:fe:a9:46
Signer

Actual PE Digest

e5:35:9e:87:90:3d:aa:bc:f1:65:ce:93:9b:f9:c9:e7:db:fe:a9:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiW
HeapSize
LoadLibraryA
GetModuleFileNameW
lstrlenW
lstrcatW
GetLocaleInfoA
GetStringTypeA
GetLastError
HeapReAlloc
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStringTypeW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW

user32

IsWindowEnabled
GetClassNameW
IsIconic
EnumWindows
wsprintfW
IsWindow
GetWindowThreadProcessId
IsWindowVisible

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

FindExecutableW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Exports

Exports

WND2FILE_GetExecutableFileFromWindowHandle
WND2FILE_GetExecutableFileFromWindowHandleA
WND2FILE_GetExecutableFileFromWindowHandleW
WND2FILE_GetWindowHandleFromExecutableFile
WND2FILE_GetWindowHandleFromExecutableFileA
WND2FILE_GetWindowHandleFromExecutableFileW
WND2FILE_GetWindowHandlesFromExecutableFile
WND2FILE_GetWindowHandlesFromExecutableFileA
WND2FILE_GetWindowHandlesFromExecutableFileW

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/runxx.exe
.exe windows:4 windows x86 arch:x86

3c7317e5a1e0d6111c70ea72c51a4d2a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:b9:85:84:a4:1b:83:ee:ae:90:f6:32:98:53:0a:fd:15:87:65:4d
Signer

Actual PE Digest

71:b9:85:84:a4:1b:83:ee:ae:90:f6:32:98:53:0a:fd:15:87:65:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateProcessW
GetStartupInfoW
LocalFree
InitializeCriticalSection
LoadLibraryA
RaiseException
RtlUnwind
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

shell32

ShellExecuteExW
CommandLineToArgvW

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/setall.bat
LaunchManager_Dritek_v.3.0.00_Win7x86x64/x64Commander.exe
.exe windows:4 windows x64 arch:x64

eed21ee37dddea2f022ecd4b80da009f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:15:ec:cb:7d:64:4f:af:ce:c2:f7:04:49:57:1b:1d:0a:4e:03:57
Signer

Actual PE Digest

f3:15:ec:cb:7d:64:4f:af:ce:c2:f7:04:49:57:1b:1d:0a:4e:03:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CreateProcessW
GetStartupInfoW
LocalFree
InitializeCriticalSection
LoadLibraryA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetLastError
RtlVirtualUnwind
GetModuleHandleA
GetProcAddress
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc

shell32

ShellExecuteExW
CommandLineToArgvW

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/x64DrvFx.exe
.exe windows:5 windows x64 arch:x64

d3eabafdad693f3f59214a42e84c742f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/10/2006, 00:00

Not After

16/10/2009, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:29:1c:29:3f:8b:3d:36:c9:43:66:66:e3:8b:f8:6f:e9:73:50:cb
Signer

Actual PE Digest

fb:29:1c:29:3f:8b:3d:36:c9:43:66:66:e3:8b:f8:6f:e9:73:50:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesA

shlwapi

PathFileExistsA
PathGetDriveNumberA
PathStripPathA

setupapi

CM_Locate_DevNodeA
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupCopyOEMInfA
SetupUninstallOEMInfA
SetupDiCallClassInstaller

kernel32

GetStartupInfoA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
lstrcpyA
lstrlenA
CloseHandle
GetLastError
CreateMutexA
lstrcpynA
GetSystemDirectoryA
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
WritePrivateProfileStringA
GetTempPathA
WideCharToMultiByte
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
LCMapStringA
LCMapStringW
HeapSetInformation
HeapCreate
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW

user32

wsprintfA

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LaunchManager_Dritek_v.3.0.00_Win7x86x64/x64DrvFx.ini
LaunchManager_Dritek_v.3.0.00_Win7x86x64/x64DrvFx.lh
LaunchManager_Dritek_v.3.0.00_Win7x86x64/x64DrvFx.w7

Sharing

General

Malware Config

Signatures

Files

d90ac94ff22c174e8c4ff0db5b137461

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

d5:4a:1d:4f:25:3b:df:1a:4a:a2:e9:8e:67:8d:e0:9b:c4:63:25:08Signer

Headers

File Characteristics

Imports

winmm

kernel32

user32

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 94KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

395dc3652b1ff5c2221d842e50e3b6de

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

3b:7d:1d:71:cc:df:c7:d7:1f:6e:9b:ec:3b:73:d1:b6:23:8b:26:5fSigner

Headers

File Characteristics

Imports

version

kernel32

user32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 90KB - Virtual size: 89KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 4KB - Virtual size: 4KB

203b3a76dce6981b5b3f200e0ae21169

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 10KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

d5:4a:1d:4f:25:3b:df:1a:4a:a2:e9:8e:67:8d:e0:9b:c4:63:25:08
Signer

.text
Size: 95KB - Virtual size: 94KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

3b:7d:1d:71:cc:df:c7:d7:1f:6e:9b:ec:3b:73:d1:b6:23:8b:26:5f
Signer

.text
Size: 90KB - Virtual size: 89KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 10KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

4e:5d:8f:e2:61:d2:4f:8d:a9:ba:db:89:e8:73:b3:c1:76:e3:e0:e2
Signer

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2f:17:4e:52:60:b0:e8:b1:34:3c:09:06:03:d5:a2:9c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

99:ba:5d:82:bb:9f:5d:31:56:3d:94:b0:1b:f8:56:db:23:3d:d5:21
Signer

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate