LGS_9[.]04[.]49_x64_Logitech[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

LGS_9.04.49_x64_Logitech.exe
Size

120.0MB
MD5

87a1119a7108e33da161b24b6aa763ad
SHA1

3f32007e62f174b411f0c69be9779a6321363153
SHA256

6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0
SHA512

69d5d7808dae0d84fe588850b1cc0f749debdfed6646191c51bdb67ad99d683c4507a38d2c65e05571bdffb32914b656fb74a1d37d1f09b05370fed0d26cba0d
SSDEEP

3145728:NAhY0THiaUvrE7pisu8402Ujk45hAacfBQHHvh9l:NABksEj45hAacfunvh9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll

Files

LGS_9.04.49_x64_Logitech.exe
.exe windows:4 windows x86 arch:x86

4ea4df5d94204fc550be1874e1b77ea7

Code Sign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-06-2020 00:00

Not After

22-07-2022 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

86:bc:ef:eb:61:1a:c0:df:1c:02:d2:d8:62:07:90:22:20:55:91:57
Signer

Actual PE Digest

86:bc:ef:eb:61:1a:c0:df:1c:02:d2:d8:62:07:90:22:20:55:91:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
CreateFileW
GetFileSize
MoveFileW
SetFileAttributesW
GetModuleFileNameW
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
WaitForSingleObject
GetCurrentProcess
CompareFileTime
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GetDiskFreeSpaceW
lstrlenW
lstrcpynW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW

advapi32

RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_32_/1-LGS-x64/DiFxAPI.dll
.dll windows:6 windows x64 arch:x64

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11-10-2005 21:55

Not After

26-04-2010 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-10-2005 23:24

Not After

11-01-2007 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08
Signer

Actual PE Digest

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DIFXAPI.pdb

Imports

msvcrt

mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
memmove
memcpy
??1type_info@@UEAA@XZ
_amsg_exit
_initterm
_XcptFilter
__C_specific_handler
__dllonexit
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
_unlock
iswdigit
iswalpha
_isatty
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vscwprintf
??3@YAXPEAX@Z
_onexit
_lock
_wcsnicmp
wcsrchr
wcspbrk
wcschr
??2@YAPEAX_K@Z
_CxxThrowException
wcsstr
_wcsicmp
??_U@YAPEAX_K@Z
_vsnwprintf
_resetstkoflw
malloc
free
??_V@YAXPEAX@Z
memset
memcmp

ntdll

RtlNtStatusToDosError
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

WaitForMultipleObjects
GetThreadLocale
SetEndOfFile
SetFilePointer
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
GetVersionExA
RaiseException
VirtualProtect
Sleep
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetProcessHeap
GetSystemTimeAsFileTime
DeviceIoControl
GetSystemDirectoryW
LocalReAlloc
LocalAlloc
GetEnvironmentVariableW
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CloseHandle
CreateFileW
MoveFileExW
GetSystemWindowsDirectoryW
EnterCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
DeleteCriticalSection
OutputDebugStringA
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
GetLastError
FindResourceW
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
VerifyVersionInfoW
lstrlenW
SetFileAttributesW
DeleteFileW
SetLastError
LoadLibraryW
GetVersionExW
GetProcAddress
FreeLibrary
GetFileSize
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
WideCharToMultiByte
CompareStringW
LocalFree
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
CopyFileW
GetTempFileNameW
SetEvent

user32

CharLowerW
UnregisterClassA
CharPrevW

setupapi

pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupDiClassNameFromGuidW
SetupDiGetDeviceInstallParamsW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiSetClassInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
CM_Get_Device_IDW
SetupDiSetDeviceRegistryPropertyW
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Enumerate_Classes
SetupDiOpenClassRegKey
SetupGetTargetPathW
SetupInstallFromInfSectionW
SetupDiGetClassDevsW
SetupPromptReboot
SetupDiDestroyDeviceInfoList
SetupInstallFilesFromInfSectionW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupCommitFileQueueW
SetupQueueCopyW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupCopyOEMInfW
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetIntField
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenFileQueue
SetupGetLineCountW
SetupCloseFileQueue
SetupOpenAppendInfFileW

advapi32

FreeSid
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
ControlService
StartServiceW
DeleteService
CloseServiceHandle

ole32

CoInitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

crypt32

CertFreeCertificateContext
CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 457KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_32_/1-LGS-x64/Setup.exe
.exe windows:6 windows x64 arch:x64

1a0a9e1e75898ee0315138eaabeb44d7

Code Sign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-06-2020 00:00

Not After

22-07-2022 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:14:5d:0e:c9:4b:ab:ba:a9:c1:f9:be:69:00:33:85:7f:a0:61:de
Signer

Actual PE Digest

e4:14:5d:0e:c9:4b:ab:ba:a9:c1:f9:be:69:00:33:85:7f:a0:61:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BuildAgent_2021.2.2\work\ca71a79ad5332f7c\Src\Install\msi_setup\x64\Release\msi_setup.pdb

Imports

setupapi

SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiBuildDriverInfoList

difxapi

DriverPackageUninstallW

kernel32

HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadConsoleW
SetStdHandle
WriteConsoleW
FindResourceExW
LoadResource
CreateDirectoryW
WaitForSingleObject
SetEvent
OpenProcess
Sleep
SizeofResource
OutputDebugStringW
GetLastError
Process32FirstW
LocalAlloc
LockResource
Process32NextW
CreateToolhelp32Snapshot
OpenEventW
CloseHandle
LocalFree
GetCommandLineW
SetThreadLocale
CreateProcessW
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
CreateFileW
SetEndOfFile
FileTimeToSystemTime
GetCommandLineA
GetModuleFileNameA
LoadLibraryExW
GetModuleFileNameW
HeapSize
GetConsoleMode
GetConsoleCP
WriteFile
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetProcAddress
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThreadId
GetStdHandle
GetFileType
GetProcessHeap
ReadFile
SetFilePointerEx
FlushFileBuffers

user32

LoadStringW
MessageBoxW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

shell32

CommandLineToArgvW

msi

ord205
ord113
ord70
ord169
ord88
ord141

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 117.9MB - Virtual size: 117.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_32_/1-LGS-x64/compcfg.ini
$_32_/1-LGS-x86/compcfg.ini
$_32_/LogiKey.pub
$_32_/MSetup.exe
.exe windows:4 windows x86 arch:x86

2bf4b850cc5713055acbd79961b6a026

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-06-2020 00:00

Not After

22-07-2022 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:99:19:95:0e:ab:8b:73:57:4f:89:1a:9c:a0:80:3b:c7:c5:8d:ae
Signer

Actual PE Digest

54:99:19:95:0e:ab:8b:73:57:4f:89:1a:9c:a0:80:3b:c7:c5:8d:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Build\FESetup\FE_220\2.20.0.13\Source\release\MSetup.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdiplus

GdipCreateBitmapFromFileICM
GdipLoadImageFromStreamICM
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipGetImageWidth
GdipGetImagePixelFormat
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipGraphicsClear
GdipSetClipRectI
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile
GdipCreateBitmapFromGdiDib
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipFree
GdipImageRotateFlip
GdipAlloc
GdipCloneImage
GdipDisposeImage

msi

ord88
ord8
ord96
ord72
ord232
ord175
ord137
ord169
ord141

uxtheme

SetWindowTheme

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetModuleBaseNameW

dbghelp

SymGetModuleBase64
SymCleanup
SymGetOptions
SymInitialize
SymSetOptions

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces

wtsapi32

WTSEnumerateProcessesW

setupdll

?RunNonElevated@@YAHPAUHWND__@@PB_W11PAK@Z
?RunElevated@@YAHPAUHWND__@@PB_W11PAK@Z

kernel32

WideCharToMultiByte
GetSystemPowerStatus
GetSystemInfo
CopyFileW
GetVersionExA
lstrcmpW
LoadLibraryA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetThreadLocale
SetThreadPriority
SuspendThread
GetModuleHandleA
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
GetVersion
ConvertDefaultLocale
GetCurrentThread
MoveFileW
DeleteFileW
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
IsBadCodePtr
GetFullPathNameW
SetFileTime
GetFileTime
GetDiskFreeSpaceW
SystemTimeToFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalGetAtomNameW
GlobalFlags
SetErrorMode
LocalFileTimeToFileTime
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
SetEnvironmentVariableW
ExitThread
RtlUnwind
VirtualProtect
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
HeapAlloc
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
lstrlenA
FormatMessageW
FreeResource
ResumeThread
ExitProcess
CompareStringW
GetExitCodeProcess
OpenProcess
ResetEvent
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetCurrentDirectoryW
InterlockedIncrement
WriteFile
GetLocalTime
GetCurrentProcessId
SetFilePointer
GetCurrentThreadId
FlushFileBuffers
lstrlenW
lstrcatW
SetLastError
CreateEventW
SetEvent
OutputDebugStringW
Sleep
GetFileAttributesW
GetModuleHandleW
FreeLibrary
lstrcmpiW
GetTickCount
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
ReleaseMutex
CreateMutexW
EnumSystemLocalesW
GetUserDefaultLangID
GetTempFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FindNextFileW
FindClose
InitializeCriticalSection
FindFirstFileW
GetProcAddress
GetCurrentProcess
LoadLibraryW
RaiseException
GetVersionExW
GetDiskFreeSpaceExW
CreateThread
GetSystemDirectoryW
WaitForSingleObject
InterlockedDecrement
ReadFile
LocalAlloc
GetFileSize
GetLastError
CreateFileW
GetModuleFileNameW
LocalFree
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
CloseHandle
OpenEventW
VerSetConditionMask
VerifyVersionInfoW
SetThreadAffinityMask
CopyFileExW
WaitForMultipleObjects
GetSystemDefaultUILanguage
QueryPerformanceFrequency
TerminateThread
GetCurrentDirectoryA
GetDriveTypeA
GetVolumeInformationW
InterlockedCompareExchange

user32

LoadMenuW
ReuseDDElParam
UnpackDDElParam
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
CharNextW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetWindowTextW
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
SetMenu
GetLastActivePopup
IsWindowEnabled
MessageBoxW
wsprintfW
SetDlgItemTextW
MessageBoxExW
MessageBeep
BringWindowToTop
LoadAcceleratorsW
GetWindowThreadProcessId
SetWindowLongW
DestroyCursor
SetCursor
SendMessageTimeoutW
ReleaseCapture
SetCapture
GetAsyncKeyState
GrayStringW
DrawTextExW
DrawTextW
DrawEdge
TabbedTextOutW
PtInRect
DrawFrameControl
keybd_event
SetScrollPos
GetScrollPos
IsRectEmpty
LoadCursorW
DefWindowProcW
GetWindowInfo
GetDialogBaseUnits
EnumChildWindows
LoadBitmapW
FindWindowW
SetFocus
SetWindowPos
GetWindow
GetFocus
EnableMenuItem
GetSystemMenu
RegisterWindowMessageW
GetClassNameW
FrameRect
InflateRect
GetMenu
AdjustWindowRectEx
GetDesktopWindow
SetRect
KillTimer
SetTimer
GetSysColor
UpdateWindow
GetParent
RedrawWindow
SetRectEmpty
FillRect
OffsetRect
DrawStateW
GetWindowLongW
CopyRect
GetIconInfo
IsIconic
IsWindow
ReleaseDC
LoadIconW
GetWindowRect
GetDlgItem
GetDC
DrawIcon
GetSystemMetrics
GetClientRect
TranslateAcceleratorW
UnregisterClassW
GetNextDlgGroupItem
PostThreadMessageW
GetSysColorBrush
InvalidateRgn
CopyAcceleratorTableW
SetWindowRgn
DestroyMenu
GetMenuItemInfoW
InvalidateRect
LoadImageW
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
CharUpperW
PostQuitMessage
ExitWindowsEx
GetForegroundWindow
PostMessageW
SendMessageW
EnableWindow
InsertMenuItemW
AttachThreadInput
CreatePopupMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
UnregisterClassA
GetSubMenu
GetActiveWindow
SystemParametersInfoW

gdi32

GetTextCharset
CreateFontIndirectW
GetTextExtentPoint32W
StretchBlt
DeleteObject
DeleteDC
CreateBitmap
SetStretchBltMode
SetBkMode
GetStockObject
GetTextFaceW
GetDeviceCaps
CreateCompatibleBitmap
GetMapMode
GetWindowExtEx
PtVisible
GetViewportExtEx
RectVisible
DPtoLP
CreateFontW
ExtTextOutW
GetBkColor
GetTextColor
GetCurrentObject
GetBkMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetPixel
SetWindowExtEx
ScaleWindowExtEx
RestoreDC
ExtSelectClipRgn
CreatePatternBrush
CreateRectRgnIndirect
CreateEllipticRgn
Ellipse
GetRgnBox
SaveDC
GetClipBox
RealizePalette
SelectPalette
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SelectObject
TextOutW
BitBlt
CreateCompatibleDC
SetBkColor
SetMapMode
SetTextColor
CreateSolidBrush
AddFontResourceW
GetObjectW
SetWindowOrgEx
GetBitmapBits
Rectangle
FillRgn
LPtoDP
CreateRoundRectRgn
Escape

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

GetFileSecurityW
CryptReleaseContext
CryptVerifySignatureW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptImportKey
CryptAcquireContextW
SetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegOpenKeyExW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyW
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
AdjustTokenPrivileges
RegDeleteKeyW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegEnumKeyExW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetMalloc
SHParseDisplayName
SHGetFolderPathW
ShellExecuteExW
DragQueryFileW
DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathFileExistsW
PathFindExtensionW
PathIsUNCW
PathFindFileNameW
PathCanonicalizeW
UrlUnescapeW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
CLSIDFromString
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoRevokeClassObject
OleInitialize

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
DispCallFunc
OleCreateFontIndirect
SafeArrayGetElemsize
SafeArrayGetDim
OleLoadPicture
SysStringLen
SysAllocStringByteLen
SafeArrayCreate
VariantCopy
VariantChangeType
VariantInit
VariantClear
SysAllocStringLen
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString

ws2_32

WSAStartup
WSACleanup
WSASetLastError

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable
InternetSetOptionExW
InternetOpenUrlW
InternetGetConnectedState
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCheckConnectionW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 392KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_32_/Setup.exe
.exe windows:4 windows x86 arch:x86

1c1c31dd18e600d1eead1fee641218a3

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-06-2020 00:00

Not After

22-07-2022 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:ae:42:ce:2e:fe:f7:a7:92:1b:0c:35:00:49:3a:32:04:83:8a:51
Signer

Actual PE Digest

84:ae:42:ce:2e:fe:f7:a7:92:1b:0c:35:00:49:3a:32:04:83:8a:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Build\FESetup\FE_220\2.20.0.13\Source\release\BStart.pdb

Imports

shlwapi

PathRemoveFileSpecW

setupdll

?SetCompanionAppWindow@@YAHPAUHWND__@@@Z
?DoTheRequestedLaunch@@YAHXZ
?GetElevationMessage@@YAIXZ
?LockCompanionWindow@@YAXH@Z

kernel32

DeleteCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
OutputDebugStringW
CloseHandle
GetModuleFileNameW
CreateThread
GetVersionExW
OpenProcess
GetCurrentProcessId
WaitForSingleObject
GetPriorityClass
Sleep
GetPrivateProfileStringW
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RaiseException
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
RtlUnwind
HeapSize
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetProcAddress
GetModuleHandleA
ExitProcess
HeapAlloc
GetLastError
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW

user32

RegisterWindowMessageW
GetMessageW
BeginPaint
DefWindowProcW
DestroyWindow
MessageBoxW
TranslateMessage
EndPaint
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
TranslateAcceleratorW
LoadAcceleratorsW
PostQuitMessage
DispatchMessageW
FindWindowW
LoadStringW
PostMessageW
UpdateWindow

shell32

ShellExecuteExW

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_32_/Setup.ini
$_32_/SetupDll.dll
.dll windows:4 windows x86 arch:x86

c016803e1c604efc9c5fba85efe03476

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:f0:5f:3f:3c:03:7d:74:39:41:db:75:d7:fb:86:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-04-2011 00:00

Not After

27-04-2013 23:59

Subject

CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Logitech,L=Fremont,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b5:1b:58:fa:4e:da:3b:c3:b1:51:6a:b9:b0:af:62:8c:08:91:15:4a
Signer

Actual PE Digest

b5:1b:58:fa:4e:da:3b:c3:b1:51:6a:b9:b0:af:62:8c:08:91:15:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\fesetup\fe_220\2.20.0.13\source\release\SetupDll.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetVersionExW
CloseHandle
LCMapStringW
LCMapStringA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

SendMessageW
RegisterWindowMessageW

advapi32

GetTokenInformation
OpenProcessToken

shell32

ShellExecuteExW

Exports

Exports

?DoTheRequestedLaunch@@YAHXZ
?GetElevationMessage@@YAIXZ
?GetElevationType@@YAJPAW4_TOKEN_ELEVATION_TYPE@@@Z
?IsElevated@@YAJPAH@Z
?IsVista@@YAHXZ
?LockCompanionWindow@@YAXH@Z
?MyShellExec@@YAHPAUHWND__@@PB_W111PAK@Z
?RunElevated@@YAHPAUHWND__@@PB_W11PAK@Z
?RunNonElevated@@YAHPAUHWND__@@PB_W11PAK@Z
?SetCompanionAppWindow@@YAHPAUHWND__@@@Z

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

logfesha
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_32_/lgs.ico
$_32_/msetup.manifest
$_32_/setup.manifest
$_32_/ui/StockLayout.xml
.xml
$_32_/ui/chs/CustomLayout.xml
.xml
$_32_/ui/chs/CustomStrings.xml
.xml
$_32_/ui/chs/License.txt
$_32_/ui/chs/StockStringsBase.xml
$_32_/ui/chs/StockStringsBranded.xml
$_32_/ui/chs/wizpage.css
$_32_/ui/cht/CustomLayout.xml
.xml
$_32_/ui/cht/CustomStrings.xml
.xml
$_32_/ui/cht/License.txt
$_32_/ui/cht/StockStringsBase.xml
$_32_/ui/cht/StockStringsBranded.xml
$_32_/ui/cht/wizpage.css
$_32_/ui/csy/CustomLayout.xml
.xml
$_32_/ui/csy/CustomStrings.xml
.xml
$_32_/ui/csy/License.txt
$_32_/ui/csy/StockStringsBase.xml
$_32_/ui/csy/StockStringsBranded.xml
$_32_/ui/csy/wizpage.css
$_32_/ui/dan/CustomLayout.xml
.xml
$_32_/ui/dan/CustomStrings.xml
.xml
$_32_/ui/dan/License.txt
$_32_/ui/dan/StockStringsBase.xml
$_32_/ui/dan/StockStringsBranded.xml
$_32_/ui/dan/wizpage.css
$_32_/ui/deu/CustomLayout.xml
.xml
$_32_/ui/deu/CustomStrings.xml
.xml
$_32_/ui/deu/License.txt
$_32_/ui/deu/StockStringsBase.xml
$_32_/ui/deu/StockStringsBranded.xml
$_32_/ui/deu/wizpage.css
$_32_/ui/enu/CustomLayout.xml
.xml
$_32_/ui/enu/CustomStrings.xml
.xml
$_32_/ui/enu/License.txt
$_32_/ui/enu/StockStringsBase.xml
$_32_/ui/enu/StockStringsBranded.xml
$_32_/ui/enu/wizpage.css
$_32_/ui/esp/CustomLayout.xml
.xml
$_32_/ui/esp/CustomStrings.xml
.xml
$_32_/ui/esp/License.txt
$_32_/ui/esp/StockStringsBase.xml
$_32_/ui/esp/StockStringsBranded.xml
$_32_/ui/esp/wizpage.css
$_32_/ui/fin/CustomLayout.xml
.xml
$_32_/ui/fin/CustomStrings.xml
.xml
$_32_/ui/fin/License.txt
$_32_/ui/fin/StockStringsBase.xml
$_32_/ui/fin/StockStringsBranded.xml
$_32_/ui/fin/wizpage.css
$_32_/ui/fra/CustomLayout.xml
.xml
$_32_/ui/fra/CustomStrings.xml
.xml
$_32_/ui/fra/License.txt
$_32_/ui/fra/StockStringsBase.xml
$_32_/ui/fra/StockStringsBranded.xml
$_32_/ui/fra/wizpage.css
$_32_/ui/html/FinishWithTasks.html
.js
$_32_/ui/html/FinishWithTasks_deu.html
.js
$_32_/ui/html/FinishWithTasks_trk.html
.js
$_32_/ui/html/Install_1.html
.js
$_32_/ui/html/Install_Overwolf.html
.js
$_32_/ui/html/exit.html
.js
$_32_/ui/html/install_progress.html
.js
$_32_/ui/hun/CustomLayout.xml
.xml
$_32_/ui/hun/CustomStrings.xml
.xml
$_32_/ui/hun/License.txt
$_32_/ui/hun/StockStringsBase.xml
$_32_/ui/hun/StockStringsBranded.xml
$_32_/ui/hun/wizpage.css
$_32_/ui/images/animation/spinner.gif
.gif
$_32_/ui/images/collateral/LogitechG_horz.png
.png
$_32_/ui/images/collateral/OverWolf_C.png
.png
$_32_/ui/images/collateral/bkgnd.png
.png
$_32_/ui/images/collateral/blank.gif
.gif
$_32_/ui/images/collateral/header_uninst_1.png
.png
$_32_/ui/images/collateral/header_uninst_2.png
.png
$_32_/ui/images/collateral/header_uninst_3.png
.png
$_32_/ui/images/collateral/header_uninst_4.png
.png
$_32_/ui/images/collateral/please_wait.gif
.gif
$_32_/ui/images/collateral/step_num_complete.png
.png
$_32_/ui/images/collateral/warning.png
.png
$_32_/ui/images/controls/checkbox.gif
.gif
$_32_/ui/images/controls/edit_bg.gif
$_32_/ui/images/controls/edit_left.gif
.gif
$_32_/ui/images/controls/formfield.jpg
.jpg
$_32_/ui/images/controls/pbar.jpg
.jpg
$_32_/ui/images/controls/progress.gif
.gif
$_32_/ui/images/controls/progress_done.gif
$_32_/ui/images/controls/radio.gif
.gif
$_32_/ui/images/controls/select.gif
$_32_/ui/images/controls/text_bg.gif
$_32_/ui/images/icons/app_store_apple_chs.png
.png
$_32_/ui/images/icons/app_store_apple_cht.png
.png
$_32_/ui/images/icons/app_store_apple_csy.png
.png
$_32_/ui/images/icons/app_store_apple_dan.png
.png
$_32_/ui/images/icons/app_store_apple_deu.png
.png
$_32_/ui/images/icons/app_store_apple_enu.png
.png
$_32_/ui/images/icons/app_store_apple_esp.png
.png
$_32_/ui/images/icons/app_store_apple_fin.png
.png
$_32_/ui/images/icons/app_store_apple_fra.png
.png
$_32_/ui/images/icons/app_store_apple_hun.png
.png
$_32_/ui/images/icons/app_store_apple_ita.png
.png
$_32_/ui/images/icons/app_store_apple_kor.png
.png
$_32_/ui/images/icons/app_store_apple_nld.png
.png
$_32_/ui/images/icons/app_store_apple_nor.png
.png
$_32_/ui/images/icons/app_store_apple_plk.png
.png
$_32_/ui/images/icons/app_store_apple_ptg.png
.png
$_32_/ui/images/icons/app_store_apple_rus.png
.png
$_32_/ui/images/icons/app_store_apple_sve.png
.png
$_32_/ui/images/icons/app_store_apple_trk.png
.png
$_32_/ui/images/icons/app_store_google_chs.png
.png
$_32_/ui/images/icons/app_store_google_cht.png
.png
$_32_/ui/images/icons/app_store_google_csy.png
.png
$_32_/ui/images/icons/app_store_google_dan.png
.png
$_32_/ui/images/icons/app_store_google_deu.png
.png
$_32_/ui/images/icons/app_store_google_enu.png
.png
$_32_/ui/images/icons/app_store_google_esp.png
.png
$_32_/ui/images/icons/app_store_google_fin.png
.png
$_32_/ui/images/icons/app_store_google_fra.png
.png
$_32_/ui/images/icons/app_store_google_hun.png
.png
$_32_/ui/images/icons/app_store_google_ita.png
.png
$_32_/ui/images/icons/app_store_google_kor.png
.png
$_32_/ui/images/icons/app_store_google_nld.png
.png
$_32_/ui/images/icons/app_store_google_nor.png
.png
$_32_/ui/images/icons/app_store_google_plk.png
.png
$_32_/ui/images/icons/app_store_google_ptg.png
.png
$_32_/ui/images/icons/app_store_google_rus.png
.png
$_32_/ui/images/icons/app_store_google_sve.png
.png
$_32_/ui/images/icons/app_store_google_trk.png
.png
$_32_/ui/images/icons/fb-icon.png
.png
$_32_/ui/images/icons/gaming-tribe-icon.png
.png
$_32_/ui/images/icons/logo-32x32.png
.png
$_32_/ui/images/icons/twitter-icon.png
.png
$_32_/ui/images/icons/youtube-icon.png
.png
$_32_/ui/images/logos/logo.png
.png
$_32_/ui/images/logos/logo_enu.png
.png
$_32_/ui/images/standard/Logitech_G.png
.png
$_32_/ui/images/standard/Overwolf.ico
$_32_/ui/images/standard/backgroundimage.png
.png
$_32_/ui/images/standard/btn_disabled.png
.png
$_32_/ui/images/standard/btn_hover.png
.png
$_32_/ui/images/standard/btn_normal.png
.png
$_32_/ui/images/standard/btn_normal_grey.png
.png
$_32_/ui/images/standard/btn_pressed.png
.png
$_32_/ui/images/standard/digiplay.png
.png
$_32_/ui/images/standard/facebook.png
.png
$_32_/ui/images/standard/g-log-onyxia-32x32.png
.png
$_32_/ui/images/standard/radio_active.ico
$_32_/ui/images/standard/radio_complete.ico
$_32_/ui/images/standard/radio_inactive.ico
$_32_/ui/images/standard/register.png
.png
$_32_/ui/images/standard/stepimage.png
.png
$_32_/ui/images/standard/twitter.png
.png
$_32_/ui/ita/CustomLayout.xml
.xml
$_32_/ui/ita/CustomStrings.xml
.xml
$_32_/ui/ita/License.txt
$_32_/ui/ita/StockStringsBase.xml
$_32_/ui/ita/StockStringsBranded.xml
$_32_/ui/ita/wizpage.css
$_32_/ui/js/crawler.js
.js
$_32_/ui/js/custom_ui.js
.js
$_32_/ui/js/effects.js
.js
$_32_/ui/js/local_code.js
.js
$_32_/ui/js/logi_code.js
.js
$_32_/ui/js/logi_helper.vbs
.vbs
$_32_/ui/js/logi_uninstall.js
.js
$_32_/ui/js/progress.js
.js
$_32_/ui/js/prototype.js
.js
$_32_/ui/kor/CustomLayout.xml
.xml
$_32_/ui/kor/CustomStrings.xml
.xml
$_32_/ui/kor/License.txt
$_32_/ui/kor/StockStringsBase.xml
$_32_/ui/kor/StockStringsBranded.xml
$_32_/ui/kor/wizpage.css
$_32_/ui/nld/CustomLayout.xml
.xml
$_32_/ui/nld/CustomStrings.xml
.xml
$_32_/ui/nld/License.txt
$_32_/ui/nld/StockStringsBase.xml
$_32_/ui/nld/StockStringsBranded.xml
$_32_/ui/nld/wizpage.css
$_32_/ui/nor/CustomLayout.xml
.xml
$_32_/ui/nor/CustomStrings.xml
.xml
$_32_/ui/nor/License.txt
$_32_/ui/nor/StockStringsBase.xml
$_32_/ui/nor/StockStringsBranded.xml
$_32_/ui/nor/wizpage.css
$_32_/ui/plk/CustomLayout.xml
.xml
$_32_/ui/plk/CustomStrings.xml
.xml
$_32_/ui/plk/License.txt
$_32_/ui/plk/StockStringsBase.xml
$_32_/ui/plk/StockStringsBranded.xml
$_32_/ui/plk/wizpage.css
$_32_/ui/ptg/CustomLayout.xml
.xml
$_32_/ui/ptg/CustomStrings.xml
.xml
$_32_/ui/ptg/License.txt
$_32_/ui/ptg/StockStringsBase.xml
$_32_/ui/ptg/StockStringsBranded.xml
$_32_/ui/ptg/wizpage.css
$_32_/ui/resource_ids.txt
$_32_/ui/rus/CustomLayout.xml
.xml
$_32_/ui/rus/CustomStrings.xml
.xml
$_32_/ui/rus/License.txt
$_32_/ui/rus/StockStringsBase.xml
$_32_/ui/rus/StockStringsBranded.xml
$_32_/ui/rus/wizpage.css
$_32_/ui/spinner.html
.html
$_32_/ui/sve/CustomLayout.xml
.xml
$_32_/ui/sve/CustomStrings.xml
.xml
$_32_/ui/sve/License.txt
$_32_/ui/sve/StockStringsBase.xml
$_32_/ui/sve/StockStringsBranded.xml
$_32_/ui/sve/wizpage.css
$_32_/ui/trk/CustomLayout.xml
.xml
$_32_/ui/trk/CustomStrings.xml
.xml
$_32_/ui/trk/License.txt
$_32_/ui/trk/StockStringsBase.xml
$_32_/ui/trk/StockStringsBranded.xml
$_32_/ui/trk/wizpage.css

Sharing

General

Malware Config

Signatures

Files

4ea4df5d94204fc550be1874e1b77ea7

Code Sign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

86:bc:ef:eb:61:1a:c0:df:1c:02:d2:d8:62:07:90:22:20:55:91:57Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 184KB

.rsrc Size: 3KB - Virtual size: 2KB

fc0224e99e736751432961db63a41b76

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 851B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 610B

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

61:10:c3:52:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

setupapi

advapi32

ole32

wintrust

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

86:bc:ef:eb:61:1a:c0:df:1c:02:d2:d8:62:07:90:22:20:55:91:57
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 184KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 610B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

61:10:c3:52:00:00:00:00:00:03
Certificate

f4:69:b9:5c:65:18:8a:12:ea:59:04:15:58:02:b6:44:82:7e:6d:08
Signer

.text
Size: 457KB - Virtual size: 456KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

e4:14:5d:0e:c9:4b:ab:ba:a9:c1:f9:be:69:00:33:85:7f:a0:61:de
Signer

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 9KB - Virtual size: 19KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 117.9MB - Virtual size: 117.9MB

.reloc
Size: 3KB - Virtual size: 2KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

54:99:19:95:0e:ab:8b:73:57:4f:89:1a:9c:a0:80:3b:c7:c5:8d:ae
Signer