FaceTime_Camera_Driver_Apple_All_x64_drp[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

FaceTime_Camera_Driver_Apple_All_x64_drp.zip
Size

39.1MB
MD5

9719b754f2050be6d56f0f8aa2c2b4ca
SHA1

73cea5014ae3540c3e4679c866b3666146e6f08c
SHA256

46d7b7123a11f0dbc545662615e17d198fbdb0131e09b4e894854797a0ed02c9
SHA512

d0b4cb2019933d3a9176fcac6795c7259f8a3766ac1cbd7e554f6341c69670c77a2313a4be0161d0092a39ee1b878f168917dea289a72e89d8c4e6013100eca9
SSDEEP

786432:02PAHzHIGb5H9rHES5PsHKHtHnH1PqPC6PYHrHLzzhYk+FjR0n:02IHzHIGH9bEI0HKHtHnH1yHAHrHLzzN

Score

3^/10

Malware Config

Signatures

Unsigned PE 71 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Apple/Allx64/AppleBluetoothBroadcom/AppleBTBC.sys
unpack001/Apple/Allx64/AppleBluetoothEnablerInstaller/BthKicker.sys
unpack001/Apple/Allx64/AppleBluetoothInstaller/AppleBT.sys
unpack001/Apple/Allx64/AppleDisplayInstaller/aaplmonf.sys
unpack001/Apple/Allx64/AppleKeyboard/BelgiumA.dll
unpack001/Apple/Allx64/AppleKeyboard/BritishA.dll
unpack001/Apple/Allx64/AppleKeyboard/CanadaA.dll
unpack001/Apple/Allx64/AppleKeyboard/ChinaSA.dll
unpack001/Apple/Allx64/AppleKeyboard/ChinaTA.dll
unpack001/Apple/Allx64/AppleKeyboard/CzechA.dll
unpack001/Apple/Allx64/AppleKeyboard/DanishA.dll
unpack001/Apple/Allx64/AppleKeyboard/DutchA.dll
unpack001/Apple/Allx64/AppleKeyboard/FinnishA.dll
unpack001/Apple/Allx64/AppleKeyboard/FrenchA.dll
unpack001/Apple/Allx64/AppleKeyboard/GermanA.dll
unpack001/Apple/Allx64/AppleKeyboard/HungaryA.dll
unpack001/Apple/Allx64/AppleKeyboard/IntlEngA.dll
unpack001/Apple/Allx64/AppleKeyboard/ItalianA.dll
unpack001/Apple/Allx64/AppleKeyboard/NorwayA.dll
unpack001/Apple/Allx64/AppleKeyboard/PolishA.dll
unpack001/Apple/Allx64/AppleKeyboard/PortuguA.dll
unpack001/Apple/Allx64/AppleKeyboard/RussianA.dll
unpack001/Apple/Allx64/AppleKeyboard/SpanishA.dll
unpack001/Apple/Allx64/AppleKeyboard/SwedishA.dll
unpack001/Apple/Allx64/AppleKeyboard/SwissA.dll
unpack001/Apple/Allx64/AppleKeyboard/TurkeyA.dll
unpack001/Apple/Allx64/AppleKeyboard/TurkeyQA.dll
unpack001/Apple/Allx64/AppleKeyboard/USA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/BelgiumA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/BritishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/CanadaA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/ChinaSA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/ChinaTA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/CzechA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/DanishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/DutchA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/FinnishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/FrenchA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/GermanA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/HungaryA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/IntlEngA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/ItalianA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/Keymagic2.sys
unpack001/Apple/Allx64/AppleKeyboardMagic2/NorwayA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/PolishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/PortuguA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/RussianA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/SpanishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/SwedishA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/SwissA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/TurkeyA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/TurkeyQA.dll
unpack001/Apple/Allx64/AppleKeyboardMagic2/USA.dll
unpack001/Apple/Allx64/AppleMultiTouchTrackPadInstaller/AppleMTP.sys
unpack001/Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTM.sys
unpack001/Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTP.sys
unpack001/Apple/Allx64/AppleODDInstaller64/AppleODD.sys
unpack001/Apple/Allx64/AppleRemoteInstaller/IRFilter.sys
unpack001/Apple/Allx64/AppleSDCardReader/AppleSDR.sys
unpack001/Apple/Allx64/AppleSPIDevice/AppleSPIDevice.sys
unpack001/Apple/Allx64/AppleSPITrackpad/AppleSPITrackpad.sys
unpack001/Apple/Allx64/AppleSSD/AppleSSD.sys
unpack001/Apple/Allx64/AppleTrackpadInstaller/aapltctp.sys
unpack001/Apple/Allx64/AppleTrackpadInstaller/aapltp.sys
unpack001/Apple/Allx64/AppleUSBEthernet/AppleUSBEthernet.sys
unpack001/Apple/Allx64/AppleWirelessMouse/AppleWirelessMouse.sys
unpack001/Apple/Allx64/AppleiSightInstaller/iSightCI.dll
unpack001/Apple/Allx64/AppleiSightInstaller/iSightFT.sys
unpack001/Apple/Allx64/AppleiSightInstaller/iSightUP.sys
unpack001/Apple/Allx64/netaapl64.sys
unpack001/Apple/Allx64/usbaapl64.sys

Files

FaceTime_Camera_Driver_Apple_All_x64_drp.zip
.zip
Apple/Allx64/AppleAudio/AppleAudio.cat
Apple/Allx64/AppleAudio/AppleAudio.inf
Apple/Allx64/AppleAudio/AppleAudio.sys
.sys windows:10 windows x64 arch:x64

98fc0b979914fcb889c3b2d0023c2f75

Code Sign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/09/2018, 19:45

Not After

20/09/2019, 19:45

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:91:bb:f8:7e:ce:54:3d:0e:fd:d1:a9:41:f3:c6:24:ee:27:fb:8d:78:7e:9e:48:db:1b:71:15:c9:93:7d:94
Signer

Actual PE Digest

a6:91:bb:f8:7e:ce:54:3d:0e:fd:d1:a9:41:f3:c6:24:ee:27:fb:8d:78:7e:9e:48:db:1b:71:15:c9:93:7d:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\A263400A-FB0F-0\AppleAudioWin-7628\srcroot\AppleAudio\AppleAudio\Driver\x64\Release\AppleAudio.pdb

Imports

ntoskrnl.exe

ExFreePool
IofCompleteRequest
IoGetDeviceProperty
RtlFreeUnicodeString
MmMapIoSpaceEx
IoRegisterDeviceInterface
IoSetDeviceInterfacePropertyData
KeInitializeEvent
KeResetEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePoolWithTag
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
ZwCreateFile
ZwWriteFile
ZwClose
_vsnwprintf
_strnicmp
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObfDereferenceObject
KeDelayExecutionThread
RtlAppendUnicodeToString
MmGetSystemRoutineAddress
RtlQueryRegistryValues
RtlInitUnicodeString
ExFreePoolWithTag
strcmp
ExSetTimerResolution
KeSetTimerEx
KeCancelTimer
KeInitializeTimerEx
RtlCopyUnicodeString
__C_specific_handler
RtlRaiseException
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
_stricmp
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeFlushQueuedDpcs
wcsstr

portcls.sys

PcNewPort
PcRegisterPhysicalConnection
PcRegisterSubdevice
PcNewMiniport
PcRegisterAdapterPowerManagement
PcAddAdapterDevice
PcDispatchIrp
PcInitializeAdapterDriver
PcGetPhysicalDeviceObject

hal

KeQueryPerformanceCounter

wdfldr.sys

WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleAudio_1803106B/AppleAudio_1803106B.cat
Apple/Allx64/AppleAudio_1803106B/AppleAudio_1803106B.inf
Apple/Allx64/AppleAudio_1803106B/Headphone_Default_Generic_Default_DolbyAtmos.xml
.xml
Apple/Allx64/AppleAudio_1803106B/PCI_DEV_1803_SUBSYS_1803106B_PCI_SUBSYS_72708086.xml
.xml
Apple/Allx64/AppleBluetoothBroadcom/AppleBTBC.cat
Apple/Allx64/AppleBluetoothBroadcom/AppleBTBC.inf
Apple/Allx64/AppleBluetoothBroadcom/AppleBTBC.sys
.sys windows:6 windows x64 arch:x64

5fb7a44c325fb8ac5444f850155ca380

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleBluetoothBroadcomWin-6206\srcroot\AppleBluetoothBroadcom\x64\Win8Release\AppleBTBC.pdb

Imports

ntoskrnl.exe

MmMapIoSpace
MmUnmapIoSpace
IoAllocateMdl
IoFreeMdl
IoWMIOpenBlock
MmUnlockPages
__C_specific_handler
RtlAnsiCharToUnicodeChar
KeBugCheckEx
RtlCopyUnicodeString
MmProbeAndLockPages
ExFreePoolWithTag
ExAllocatePoolWithTag
IoWMIQueryAllData
RtlInitUnicodeString

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 1024B - Virtual size: 903B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleBluetoothBroadcom/ArabicLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/CzechLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/DanishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/DutchLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/EnglishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/FinnishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/FrenchLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/GermanLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/HungarianLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/ItalianLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/JapaneseLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/KoreanLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/NorwegianLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/PolishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/PortugueseLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/RussianLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/SimplifiedChineseLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/SpanishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/SwedishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/TraditionalChineseLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/TurkishLicense.txt
Apple/Allx64/AppleBluetoothBroadcom/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/01/2016, 19:41

Not After

06/04/2017, 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2
Signer

Actual PE Digest

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2

Digest Algorithm

sha256

PE Digest Matches

true

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleBluetoothEnablerInstaller/ArabicLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/BthKicker.cat
Apple/Allx64/AppleBluetoothEnablerInstaller/BthKicker.sys
.sys windows:6 windows x64 arch:x64

2a4dbc12d0e06d7566a24d011faa5f64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\applebluetoothenablerwin-200.0.1\srcroot\applebluetoothenabler\objfre_wlh_amd64\amd64\BthKicker.pdb

Imports

ntoskrnl.exe

IoCreateFile
RtlInitUnicodeString
ExFreePoolWithTag
RtlCopyUnicodeString
ExAllocatePoolWithTag
KeBugCheckEx
ZwClose

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleBluetoothEnablerInstaller/BthKicker64.inf
Apple/Allx64/AppleBluetoothEnablerInstaller/CzechLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/DanishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/DutchLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/EnglishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/FinnishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/FrenchLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/GermanLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/HungarianLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/ItalianLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/JapaneseLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/KoreanLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/NorwegianLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/PolishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/PortugueseLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/RussianLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/SpanishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/SwedishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/TurkishLicense.txt
Apple/Allx64/AppleBluetoothEnablerInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleBluetoothInstaller/AppleBT.sys
.sys windows:6 windows x64 arch:x64

63f080044521d8c43f510e88c9c895c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\applebluetoothwin-10\srcroot\applebluetooth\objfre_wlh_amd64\amd64\applebt.pdb

Imports

ntoskrnl.exe

KeDelayExecutionThread
IofCallDriver
RtlGetVersion
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ZwClose
KeInitializeEvent
KeWaitForSingleObject
IoFreeIrp
IoAllocateIrp
KeClearEvent
KeBugCheckEx
RtlCopyUnicodeString
IoCreateFile
ExAllocatePoolWithTag
IoReuseIrp

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleBluetoothInstaller/AppleBT64.cat
Apple/Allx64/AppleBluetoothInstaller/AppleBT64.inf
Apple/Allx64/AppleBluetoothInstaller/ArabicLicense.txt
Apple/Allx64/AppleBluetoothInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleBluetoothInstaller/CzechLicense.txt
Apple/Allx64/AppleBluetoothInstaller/DanishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/DutchLicense.txt
Apple/Allx64/AppleBluetoothInstaller/EnglishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/FinnishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/FrenchLicense.txt
Apple/Allx64/AppleBluetoothInstaller/GermanLicense.txt
Apple/Allx64/AppleBluetoothInstaller/HungarianLicense.txt
Apple/Allx64/AppleBluetoothInstaller/ItalianLicense.txt
Apple/Allx64/AppleBluetoothInstaller/JapaneseLicense.txt
Apple/Allx64/AppleBluetoothInstaller/KoreanLicense.txt
Apple/Allx64/AppleBluetoothInstaller/NorwegianLicense.txt
Apple/Allx64/AppleBluetoothInstaller/PolishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/PortugueseLicense.txt
Apple/Allx64/AppleBluetoothInstaller/RussianLicense.txt
Apple/Allx64/AppleBluetoothInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleBluetoothInstaller/SpanishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/SwedishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleBluetoothInstaller/TurkishLicense.txt
Apple/Allx64/AppleBluetoothInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleCamera/AppleCamera.sys
.sys windows:6 windows x64 arch:x64

66cf8c1c5221693bec883ae5b688340a

Code Sign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/01/2016, 19:41

Not After

06/04/2017, 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:f0:d0:80:d3:ab:5d:37:f5:65:cc:c4:55:ff:4d:6a:90:d3:9e:ed:ec:7a:2a:64:98:f0:87:db:6d:95:31:af
Signer

Actual PE Digest

af:f0:d0:80:d3:ab:5d:37:f5:65:cc:c4:55:ff:4d:6a:90:d3:9e:ed:ec:7a:2a:64:98:f0:87:db:6d:95:31:af

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleCameraWin-6564\srcroot\x64\Win8Release\AppleCamera.pdb

Imports

ks.sys

KsInitializeDriver
KsAcquireDevice
KsReleaseDevice
KsDeviceRegisterAdapterObject
KsCreateFilterFactory
KsAddItemToObjectBag
KsGetOuterUnknown
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerUnlock
KsStreamPointerDelete
KsStreamPointerClone
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvance
KsPinGetFirstCloneStreamPointer
KsStreamPointerGetNextClone
KsPinAttemptProcessing
KsGetDevice
_KsEdit
KsPinGetReferenceClockInterface
KsGetFilterFromIrp

ntoskrnl.exe

_purecall
KeCancelTimer
KeSetTimer
ExAllocatePoolWithTag
ExFreePool
IoGetDmaAdapter
IoGetDeviceProperty
strlen
strncmp
wcscmp
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeDpc
KeInsertQueueDpc
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeInitializeTimerEx
KeWaitForMultipleObjects
KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
MmMapIoSpace
MmUnmapIoSpace
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
IoConnectInterruptEx
IoDisconnectInterruptEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
_snprintf
RtlCompareMemory
KeClearEvent
RtlRaiseException
RtlUnwindEx

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 454KB - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleCamera/AppleCamera64.cat
Apple/Allx64/AppleCamera/AppleCamera64.inf
Apple/Allx64/AppleCamera/ArabicLicense.txt
Apple/Allx64/AppleCamera/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleCamera/CzechLicense.txt
Apple/Allx64/AppleCamera/DanishLicense.txt
Apple/Allx64/AppleCamera/DutchLicense.txt
Apple/Allx64/AppleCamera/EnglishLicense.txt
Apple/Allx64/AppleCamera/FinnishLicense.txt
Apple/Allx64/AppleCamera/FrenchLicense.txt
Apple/Allx64/AppleCamera/GermanLicense.txt
Apple/Allx64/AppleCamera/HungarianLicense.txt
Apple/Allx64/AppleCamera/ItalianLicense.txt
Apple/Allx64/AppleCamera/JapaneseLicense.txt
Apple/Allx64/AppleCamera/KoreanLicense.txt
Apple/Allx64/AppleCamera/NorwegianLicense.txt
Apple/Allx64/AppleCamera/PolishLicense.txt
Apple/Allx64/AppleCamera/PortugueseLicense.txt
Apple/Allx64/AppleCamera/RussianLicense.txt
Apple/Allx64/AppleCamera/SimplifiedChineseLicense.txt
Apple/Allx64/AppleCamera/SpanishLicense.txt
Apple/Allx64/AppleCamera/SwedishLicense.txt
Apple/Allx64/AppleCamera/TraditionalChineseLicense.txt
Apple/Allx64/AppleCamera/TurkishLicense.txt
Apple/Allx64/AppleCamera2015/AppleCamera.sys
.sys windows:6 windows x64 arch:x64

b2bd372e79431214386aa934821103f2

Code Sign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:d6:99:bc:d2:90:81:e2:d8:b9:7b:54:0a:93:06:33:5d:3a:1f:47:94:e5:64:5d:0f:a5:a1:e4:49:8e:9b:2e
Signer

Actual PE Digest

20:d6:99:bc:d2:90:81:e2:d8:b9:7b:54:0a:93:06:33:5d:3a:1f:47:94:e5:64:5d:0f:a5:a1:e4:49:8e:9b:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleCameraWin-6107\srcroot\x64\Win8Release\AppleCamera.pdb

Imports

ks.sys

KsInitializeDriver
KsAcquireDevice
KsReleaseDevice
KsDeviceRegisterAdapterObject
KsCreateFilterFactory
KsAddItemToObjectBag
KsGetOuterUnknown
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerUnlock
KsStreamPointerDelete
KsStreamPointerClone
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvance
KsPinGetFirstCloneStreamPointer
KsStreamPointerGetNextClone
KsPinAttemptProcessing
KsGetDevice
_KsEdit
KsPinGetReferenceClockInterface
KsGetFilterFromIrp

ntoskrnl.exe

_purecall
KeSetTimer
ExAllocatePoolWithTag
ExFreePool
IoGetDmaAdapter
IoGetDeviceProperty
strlen
strncmp
wcscmp
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeDpc
KeInsertQueueDpc
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
MmMapIoSpace
MmUnmapIoSpace
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
IoConnectInterruptEx
IoDisconnectInterruptEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
_snprintf
RtlCompareMemory
KeClearEvent
RtlRaiseException
RtlUnwindEx

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleCamera2015/AppleCamera64.cat
Apple/Allx64/AppleCamera2015/AppleCamera64.inf
Apple/Allx64/AppleCamera2015/ArabicLicense.txt
Apple/Allx64/AppleCamera2015/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleCamera2015/CzechLicense.txt
Apple/Allx64/AppleCamera2015/DanishLicense.txt
Apple/Allx64/AppleCamera2015/DutchLicense.txt
Apple/Allx64/AppleCamera2015/EnglishLicense.txt
Apple/Allx64/AppleCamera2015/FinnishLicense.txt
Apple/Allx64/AppleCamera2015/FrenchLicense.txt
Apple/Allx64/AppleCamera2015/GermanLicense.txt
Apple/Allx64/AppleCamera2015/HungarianLicense.txt
Apple/Allx64/AppleCamera2015/ItalianLicense.txt
Apple/Allx64/AppleCamera2015/JapaneseLicense.txt
Apple/Allx64/AppleCamera2015/KoreanLicense.txt
Apple/Allx64/AppleCamera2015/NorwegianLicense.txt
Apple/Allx64/AppleCamera2015/PolishLicense.txt
Apple/Allx64/AppleCamera2015/PortugueseLicense.txt
Apple/Allx64/AppleCamera2015/RussianLicense.txt
Apple/Allx64/AppleCamera2015/SimplifiedChineseLicense.txt
Apple/Allx64/AppleCamera2015/SpanishLicense.txt
Apple/Allx64/AppleCamera2015/SwedishLicense.txt
Apple/Allx64/AppleCamera2015/TraditionalChineseLicense.txt
Apple/Allx64/AppleCamera2015/TurkishLicense.txt
Apple/Allx64/AppleDisplayInstaller/ArabicLicense.txt
Apple/Allx64/AppleDisplayInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleDisplayInstaller/CzechLicense.txt
Apple/Allx64/AppleDisplayInstaller/DanishLicense.txt
Apple/Allx64/AppleDisplayInstaller/DutchLicense.txt
Apple/Allx64/AppleDisplayInstaller/EnglishLicense.txt
Apple/Allx64/AppleDisplayInstaller/FinnishLicense.txt
Apple/Allx64/AppleDisplayInstaller/FrenchLicense.txt
Apple/Allx64/AppleDisplayInstaller/GermanLicense.txt
Apple/Allx64/AppleDisplayInstaller/HungarianLicense.txt
Apple/Allx64/AppleDisplayInstaller/ItalianLicense.txt
Apple/Allx64/AppleDisplayInstaller/JapaneseLicense.txt
Apple/Allx64/AppleDisplayInstaller/KoreanLicense.txt
Apple/Allx64/AppleDisplayInstaller/NorwegianLicense.txt
Apple/Allx64/AppleDisplayInstaller/PolishLicense.txt
Apple/Allx64/AppleDisplayInstaller/PortugueseLicense.txt
Apple/Allx64/AppleDisplayInstaller/RussianLicense.txt
Apple/Allx64/AppleDisplayInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleDisplayInstaller/SpanishLicense.txt
Apple/Allx64/AppleDisplayInstaller/SwedishLicense.txt
Apple/Allx64/AppleDisplayInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleDisplayInstaller/TurkishLicense.txt
Apple/Allx64/AppleDisplayInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleDisplayInstaller/aaplmonf.sys
.sys windows:6 windows x64 arch:x64

81d39a61413db6907747bd88cef4b3da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appledisplaywin-2034\srcroot\appledisplay\objfre_wlh_amd64\amd64\aaplmonf.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleDisplayInstaller/aaplmonf64.cat
Apple/Allx64/AppleDisplayInstaller/aaplmonf64.inf
Apple/Allx64/AppleDisplayNullDriver/AppleDisplayNull64.cat
Apple/Allx64/AppleDisplayNullDriver/AppleDisplayNull64.inf
Apple/Allx64/AppleHAL/MacHALDriver.cat
Apple/Allx64/AppleHAL/MacHALDriver.inf
Apple/Allx64/AppleHAL/MacHALDriver.sys
.sys windows:10 windows x64 arch:x64

e764083af65254916478c2c240b207a1

Code Sign

3c:92:f5:4c:60:43:b9:92:41:06:89:a1:05:2e:c3:82
Certificate

Issuer

CN=WDKTestCert build\,131521240660386684

Not Before

10/10/2017, 15:47

Not After

10/10/2027, 00:00

Subject

CN=WDKTestCert build\,131521240660386684

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/09/2018, 19:45

Not After

20/09/2019, 19:45

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:d3:97:4c:73:32:a3:6b:f0:d5:01:95:f0:82:5b:23:42:37:df:fe:17:c5:cb:00:29:4b:cd:59:6d:9d:68:1c
Signer

Actual PE Digest

47:d3:97:4c:73:32:a3:6b:f0:d5:01:95:f0:82:5b:23:42:37:df:fe:17:c5:cb:00:29:4b:cd:59:6d:9d:68:1c

Digest Algorithm

sha256

PE Digest Matches

true

2d:c6:df:74:e5:74:01:04:cc:65:95:9d:d4:c9:04:98:2d:31:9c:30
Signer

Actual PE Digest

2d:c6:df:74:e5:74:01:04:cc:65:95:9d:d4:c9:04:98:2d:31:9c:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\A58853AA-A6D1-0\AppleHALWin-7525\srcroot\AppleHAL\x64\Release\MacHalDriver.pdb

Imports

ntoskrnl.exe

ZwDeleteKey
ZwQueryValueKey
ZwSetValueKey
_vsnwprintf
RtlCopyUnicodeString
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
ExSetFirmwareEnvironmentVariable
ZwOpenKey
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWMIOpenBlock
IoWMIQueryAllData
IoWMIExecuteMethod
ObfDereferenceObject
ZwEnumerateKey
ZwFlushKey
ZwCreateKey
ZwClose
ExGetFirmwareEnvironmentVariable
ExFreePoolWithTag
ExAllocatePoolWithTag
IofCompleteRequest
RtlInitUnicodeString

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 793B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyManager/KeyManager.cat
Apple/Allx64/AppleKeyManager/KeyManager.inf
Apple/Allx64/AppleKeyManager/KeyManager.sys
.sys windows:10 windows x64 arch:x64

3375ac979fac7d036f96f0cb4ef195d1

Code Sign

3c:92:f5:4c:60:43:b9:92:41:06:89:a1:05:2e:c3:82
Certificate

Issuer

CN=WDKTestCert build\,131521240660386684

Not Before

10/10/2017, 15:47

Not After

10/10/2027, 00:00

Subject

CN=WDKTestCert build\,131521240660386684

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:be:ac:1b:95:8f:39:ac:2f:b4:b1:43:e4:e4:fe:72:02:ad:38:31:3b:12:e3:c3:c9:77:ae:6b:15:73:0b:a5
Signer

Actual PE Digest

76:be:ac:1b:95:8f:39:ac:2f:b4:b1:43:e4:e4:fe:72:02:ad:38:31:3b:12:e3:c3:c9:77:ae:6b:15:73:0b:a5

Digest Algorithm

sha256

PE Digest Matches

true

65:b8:38:f9:86:f4:c8:21:25:b1:92:2c:57:57:90:cf:24:fc:01:df
Signer

Actual PE Digest

65:b8:38:f9:86:f4:c8:21:25:b1:92:2c:57:57:90:cf:24:fc:01:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\86F94A4A-3F02-0\AppleKeyAgentWin-7045.2\srcroot\x64\Release\KeyManager.pdb

Imports

ntoskrnl.exe

IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IofCompleteRequest
ObReferenceObjectByHandle
RtlCopyUnicodeString
ExFreePoolWithTag
ExAllocatePoolWithTag
KeSetEvent
IoDeleteSymbolicLink
RtlInitUnicodeString

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/BelgiumA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/BritishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/CanadaA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/ChinaSA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/ChinaTA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/CzechA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/DanishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/DutchA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/FinnishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/FrenchA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/GermanA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/HungaryA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/IntlEngA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/ItalianA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/Keymagic.sys
.sys windows:10 windows x64 arch:x64

966953a87f3fc1ce2186691faf763e90

Code Sign

3c:92:f5:4c:60:43:b9:92:41:06:89:a1:05:2e:c3:82
Certificate

Issuer

CN=WDKTestCert build\,131521240660386684

Not Before

10/10/2017, 15:47

Not After

10/10/2027, 00:00

Subject

CN=WDKTestCert build\,131521240660386684

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:00:00:00:86:db:2a:87:44:f4:39:4c:a4:00:00:00:00:00:86
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:78:a6:8e:a1:17:ef:55:6d:a7:3c:67:48:10:c0:f0:2a:1d:11:dc:4f:c8:9e:2d:16:e8:0e:ea:e5:84:8b:0d
Signer

Actual PE Digest

aa:78:a6:8e:a1:17:ef:55:6d:a7:3c:67:48:10:c0:f0:2a:1d:11:dc:4f:c8:9e:2d:16:e8:0e:ea:e5:84:8b:0d

Digest Algorithm

sha256

PE Digest Matches

true

b2:3d:a8:ca:ad:e9:5a:41:62:c9:af:6a:9d:07:04:8d:b0:f2:56:20
Signer

Actual PE Digest

b2:3d:a8:ca:ad:e9:5a:41:62:c9:af:6a:9d:07:04:8d:b0:f2:56:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\25F57078-FAAB-0\AppleKeyboardWin-7825\srcroot\x64\Release\Keymagic.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IoBuildDeviceIoControlRequest
RtlGetVersion
IoFreeIrp
IoGetDeviceObjectPointer
IoGetDeviceProperty
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
RtlInitUnicodeString
RtlCopyUnicodeString
RtlUnicodeStringToInteger
_wcsupr
IofCallDriver
wcsstr

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/Keymagic64.cat
Apple/Allx64/AppleKeyboard/Keymagic64.inf
Apple/Allx64/AppleKeyboard/NorwayA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/PolishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/PortuguA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/RussianA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/SpanishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/SwedishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/SwissA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/TurkeyA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/TurkeyQA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/USA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/old/ArabicLicense.txt
Apple/Allx64/AppleKeyboard/old/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleKeyboard/old/CzechLicense.txt
Apple/Allx64/AppleKeyboard/old/DanishLicense.txt
Apple/Allx64/AppleKeyboard/old/DutchLicense.txt
Apple/Allx64/AppleKeyboard/old/EnglishLicense.txt
Apple/Allx64/AppleKeyboard/old/FinnishLicense.txt
Apple/Allx64/AppleKeyboard/old/FrenchLicense.txt
Apple/Allx64/AppleKeyboard/old/GermanLicense.txt
Apple/Allx64/AppleKeyboard/old/HungarianLicense.txt
Apple/Allx64/AppleKeyboard/old/ItalianLicense.txt
Apple/Allx64/AppleKeyboard/old/JapaneseLicense.txt
Apple/Allx64/AppleKeyboard/old/Keymagic.sys
.sys windows:6 windows x64 arch:x64

f2289e2b950203c7fae9f14f7f599bc3

Code Sign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:4f:c5:29:84:3d:c9:8e:5a:f1:cd:be:a1:5d:e9:c6:5a:4d:24:b7:c8:fe:5e:8e:0a:b8:8c:63:5d:ee:30:87
Signer

Actual PE Digest

c4:4f:c5:29:84:3d:c9:8e:5a:f1:cd:be:a1:5d:e9:c6:5a:4d:24:b7:c8:fe:5e:8e:0a:b8:8c:63:5d:ee:30:87

Digest Algorithm

sha256

PE Digest Matches

true

c4:4f:c5:29:84:3d:c9:8e:5a:f1:cd:be:a1:5d:e9:c6:5a:4d:24:b7:c8:fe:5e:8e:0a:b8:8c:63:5d:ee:30:87
Signer

Actual PE Digest

c4:4f:c5:29:84:3d:c9:8e:5a:f1:cd:be:a1:5d:e9:c6:5a:4d:24:b7:c8:fe:5e:8e:0a:b8:8c:63:5d:ee:30:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleKeyboardWin-6108.2\srcroot\AppleKeyboard\x64\Win8Release\Keymagic.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
RtlGetVersion
IoGetDeviceObjectPointer
IoGetDeviceProperty
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
KeBugCheckEx
RtlCopyUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToInteger
_wcsupr
IoFreeIrp
wcsstr

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboard/old/Keymagic64.cat
Apple/Allx64/AppleKeyboard/old/Keymagic64.inf
Apple/Allx64/AppleKeyboard/old/KoreanLicense.txt
Apple/Allx64/AppleKeyboard/old/NorwegianLicense.txt
Apple/Allx64/AppleKeyboard/old/PolishLicense.txt
Apple/Allx64/AppleKeyboard/old/PortugueseLicense.txt
Apple/Allx64/AppleKeyboard/old/RussianLicense.txt
Apple/Allx64/AppleKeyboard/old/SimplifiedChineseLicense.txt
Apple/Allx64/AppleKeyboard/old/SpanishLicense.txt
Apple/Allx64/AppleKeyboard/old/SwedishLicense.txt
Apple/Allx64/AppleKeyboard/old/TraditionalChineseLicense.txt
Apple/Allx64/AppleKeyboard/old/TurkishLicense.txt
Apple/Allx64/AppleKeyboard/old/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2
Signer

Actual PE Digest

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2

Digest Algorithm

sha256

PE Digest Matches

true

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/BelgiumA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/BritishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/CanadaA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/ChinaSA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/ChinaTA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/CzechA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/DanishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/DutchA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/FinnishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/FrenchA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/GermanA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/HungaryA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/IntlEngA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/ItalianA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/Keymagic2.cat
Apple/Allx64/AppleKeyboardMagic2/Keymagic2.inf
Apple/Allx64/AppleKeyboardMagic2/Keymagic2.sys
.sys windows:10 windows x64 arch:x64

91ef378bf5de553031c5cd18737fcf56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\1F5087FF-08B8-0\AppleKeyboardWin-7620\srcroot\x64\Release\KeyMagic2.pdb

Imports

ntoskrnl.exe

IoAllocateIrp
IofCallDriver
IoFreeIrp
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
wcsstr
_wcsupr
RtlUnicodeStringToInteger
KeClearEvent
KeWaitForMultipleObjects
PsCreateSystemThread
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
RtlGetVersion
IoGetDeviceProperty
ZwOpenKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ExAllocatePoolWithTag
RtlCopyUnicodeString
KeWaitForSingleObject
KeSetEvent
PsTerminateSystemThread
KeInitializeEvent

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/NorwayA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/PolishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/PortuguA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/RussianA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/SpanishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/SwedishA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/SwissA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/TurkeyA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/TurkeyQA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleKeyboardMagic2/USA.dll
.dll windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

KbdLayerDescriptor

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadInstaller/AppleMTP.sys
.sys windows:6 windows x64 arch:x64

87bbeeedffd18c9e0d962e343a6d3e81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleMultitouchTrackpadWin-5916\srcroot\AppleMultitouchTrackpad\AppleMultiTouch\Win8Release\x64\AppleMTP.pdb

Imports

ntoskrnl.exe

KeInitializeSemaphore
KeReleaseSemaphore
KeDelayExecutionThread
KeWaitForMultipleObjects
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
IoCreateSynchronizationEvent
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeSetEvent
RtlUnicodeStringToInteger
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoGetCurrentProcess
RtlConvertSidToUnicodeString
PsReferencePrimaryToken
ObOpenObjectByPointer
ZwQueryInformationToken
RtlRaiseException
RtlUnwindEx
KeBugCheckEx
RtlCopyUnicodeString
KeInitializeEvent
RtlInitUnicodeString
ExFreePoolWithTag
wcsstr
ExAllocatePoolWithTag

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadInstaller/AppleMTP64.cat
Apple/Allx64/AppleMultiTouchTrackPadInstaller/AppleMTP64.inf
Apple/Allx64/AppleMultiTouchTrackPadInstaller/ArabicLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/CzechLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/DanishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/DutchLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/EnglishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/FinnishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/FrenchLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/GermanLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/HungarianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/ItalianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/JapaneseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/KoreanLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/NorwegianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/PolishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/PortugueseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/RussianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/SpanishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/SwedishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/TurkishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTM.sys
.sys windows:6 windows x64 arch:x64

1285b4d646f64523bc510ba6b4ea938b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\bwa\applemultitouchtrackpadwin-5300\srcroot\applemultitouchtrackpad\applemultitouchmouse\objfre_wlh_amd64\amd64\AppleMTM.pdb

Imports

ntoskrnl.exe

KeReleaseSemaphore
ExFreePoolWithTag
PsCreateSystemThread
KeAcquireSpinLockRaiseToDpc
IoCreateSynchronizationEvent
ObReferenceObjectByHandle
RtlInitUnicodeString
KeWaitForSingleObject
ObfDereferenceObject
PsTerminateSystemThread
ExAllocatePoolWithTag
KeSetEvent
KeReleaseSpinLock
KeWaitForMultipleObjects
KeInitializeEvent
KeBugCheckEx
RtlCopyUnicodeString
KeInitializeSemaphore
ZwClose
KeDelayExecutionThread

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTM64.cat
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTM64.inf
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTP.sys
.sys windows:6 windows x64 arch:x64

4e573e5bbb7e4ea95254fd81b69a4581

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\bwa\applemultitouchtrackpadwin-5300\srcroot\applemultitouchtrackpad\applemultitouch\objfre_wlh_amd64\amd64\AppleMTP.pdb

Imports

ntoskrnl.exe

KeWaitForMultipleObjects
KeInitializeEvent
KeDelayExecutionThread
KeInitializeSemaphore
PsTerminateSystemThread
KeReleaseSemaphore
ExFreePoolWithTag
PsCreateSystemThread
IoCreateSynchronizationEvent
ObReferenceObjectByHandle
ExAllocatePoolWithTag
KeWaitForSingleObject
ZwClose
ObfDereferenceObject
KeSetEvent
RtlCompareMemory
PsReferencePrimaryToken
RtlAppendUnicodeToString
RtlQueryRegistryValues
wcsstr
IoGetCurrentProcess
RtlAppendUnicodeStringToString
RtlUnicodeStringToInteger
ZwQueryInformationToken
ObOpenObjectByPointer
RtlConvertSidToUnicodeString
KeBugCheckEx
RtlCopyUnicodeString
RtlInitUnicodeString
RtlRaiseException
RtlUnwindEx

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TEXT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTP64.cat
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/AppleMTP64.inf
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/ArabicLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/CzechLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/DanishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/DutchLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/EnglishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/FinnishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/FrenchLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/GermanLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/HungarianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/ItalianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/JapaneseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/KoreanLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/NorwegianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/PolishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/PortugueseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/RussianLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/SimplifiedChineseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/SpanishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/SwedishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/TraditionalChineseLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/TurkishLicense.txt
Apple/Allx64/AppleMultiTouchTrackPadInstaller/old/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadPro/AppleTPP.sys
.sys windows:10 windows x64 arch:x64

1f1aacd78e005f9fe459e13cdb4f101a

Code Sign

33:00:00:00:84:3e:00:7f:3e:a2:99:c1:82:00:00:00:00:00:84
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ab:fa:38:32:d9:d8:89:96:e6:79:17:c2:16:5e:de:1f:a3:49:4a:c7:e6:f6:b1:f5:d6:ce:58:85:53:f6:5e
Signer

Actual PE Digest

01:ab:fa:38:32:d9:d8:89:96:e6:79:17:c2:16:5e:de:1f:a3:49:4a:c7:e6:f6:b1:f5:d6:ce:58:85:53:f6:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\B3B37B4F-AC35-0\AppleMultitouchTrackpadProWin-7800.2.1\srcroot\x64\Release\AppleTPP.pdb

Imports

ntoskrnl.exe

KeInitializeSemaphore
KeReleaseSemaphore
KeWaitForMultipleObjects
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeSetEvent
RtlUnicodeStringToInteger
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoGetCurrentProcess
RtlConvertSidToUnicodeString
PsReferencePrimaryToken
ObOpenObjectByPointer
ZwQueryInformationToken
IoAllocateIrp
IoFreeIrp
KeClearEvent
RtlCopyUnicodeString
RtlRaiseException
__C_specific_handler
KeInitializeEvent
RtlInitUnicodeString
sqrt
wcsstr

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleMultiTouchTrackPadPro/AppleTPP64.inf
Apple/Allx64/AppleMultiTouchTrackPadPro/appletpp64.cat
Apple/Allx64/AppleNullDriver64/AppleNull64.cat
Apple/Allx64/AppleNullDriver64/AppleNull64.inf
Apple/Allx64/AppleNullDriver64/ArabicLicense.txt
Apple/Allx64/AppleNullDriver64/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleNullDriver64/CzechLicense.txt
Apple/Allx64/AppleNullDriver64/DanishLicense.txt
Apple/Allx64/AppleNullDriver64/DutchLicense.txt
Apple/Allx64/AppleNullDriver64/EnglishLicense.txt
Apple/Allx64/AppleNullDriver64/FinnishLicense.txt
Apple/Allx64/AppleNullDriver64/FrenchLicense.txt
Apple/Allx64/AppleNullDriver64/GermanLicense.txt
Apple/Allx64/AppleNullDriver64/HungarianLicense.txt
Apple/Allx64/AppleNullDriver64/ItalianLicense.txt
Apple/Allx64/AppleNullDriver64/JapaneseLicense.txt
Apple/Allx64/AppleNullDriver64/KoreanLicense.txt
Apple/Allx64/AppleNullDriver64/NorwegianLicense.txt
Apple/Allx64/AppleNullDriver64/PolishLicense.txt
Apple/Allx64/AppleNullDriver64/PortugueseLicense.txt
Apple/Allx64/AppleNullDriver64/RussianLicense.txt
Apple/Allx64/AppleNullDriver64/SimplifiedChineseLicense.txt
Apple/Allx64/AppleNullDriver64/SpanishLicense.txt
Apple/Allx64/AppleNullDriver64/SwedishLicense.txt
Apple/Allx64/AppleNullDriver64/TraditionalChineseLicense.txt
Apple/Allx64/AppleNullDriver64/TurkishLicense.txt
Apple/Allx64/AppleODDInstaller64/AppleODD.sys
.sys windows:6 windows x64 arch:x64

161bde8b018f405eb80a178dc5a708aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleoddwin-2601\srcroot\appleodd\objfre_wlh_amd64\amd64\AppleODD.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx
KeDelayExecutionThread

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleODDInstaller64/AppleODD64.cat
Apple/Allx64/AppleODDInstaller64/AppleODD64.inf
Apple/Allx64/AppleODDInstaller64/ArabicLicense.txt
Apple/Allx64/AppleODDInstaller64/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleODDInstaller64/CzechLicense.txt
Apple/Allx64/AppleODDInstaller64/DanishLicense.txt
Apple/Allx64/AppleODDInstaller64/DutchLicense.txt
Apple/Allx64/AppleODDInstaller64/EnglishLicense.txt
Apple/Allx64/AppleODDInstaller64/FinnishLicense.txt
Apple/Allx64/AppleODDInstaller64/FrenchLicense.txt
Apple/Allx64/AppleODDInstaller64/GermanLicense.txt
Apple/Allx64/AppleODDInstaller64/HungarianLicense.txt
Apple/Allx64/AppleODDInstaller64/ItalianLicense.txt
Apple/Allx64/AppleODDInstaller64/JapaneseLicense.txt
Apple/Allx64/AppleODDInstaller64/KoreanLicense.txt
Apple/Allx64/AppleODDInstaller64/NorwegianLicense.txt
Apple/Allx64/AppleODDInstaller64/PolishLicense.txt
Apple/Allx64/AppleODDInstaller64/PortugueseLicense.txt
Apple/Allx64/AppleODDInstaller64/RussianLicense.txt
Apple/Allx64/AppleODDInstaller64/SimplifiedChineseLicense.txt
Apple/Allx64/AppleODDInstaller64/SpanishLicense.txt
Apple/Allx64/AppleODDInstaller64/SwedishLicense.txt
Apple/Allx64/AppleODDInstaller64/TraditionalChineseLicense.txt
Apple/Allx64/AppleODDInstaller64/TurkishLicense.txt
Apple/Allx64/AppleODDInstaller64/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleProDisplayXDRUSBCompositeDevice/AppleProDisplayXDRUSBCompositeDevice.cat
Apple/Allx64/AppleProDisplayXDRUSBCompositeDevice/AppleProDisplayXDRUSBCompositeDevice.inf
Apple/Allx64/AppleRemoteInstaller/ArabicLicense.txt
Apple/Allx64/AppleRemoteInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleRemoteInstaller/CzechLicense.txt
Apple/Allx64/AppleRemoteInstaller/DanishLicense.txt
Apple/Allx64/AppleRemoteInstaller/DutchLicense.txt
Apple/Allx64/AppleRemoteInstaller/EnglishLicense.txt
Apple/Allx64/AppleRemoteInstaller/FinnishLicense.txt
Apple/Allx64/AppleRemoteInstaller/FrenchLicense.txt
Apple/Allx64/AppleRemoteInstaller/GermanLicense.txt
Apple/Allx64/AppleRemoteInstaller/HungarianLicense.txt
Apple/Allx64/AppleRemoteInstaller/IRFilter.sys
.sys windows:6 windows x64 arch:x64

a5070bb4f44365d929bd7f6f0e1d7746

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleremotewin-200.4.0\srcroot\appleremote\objfre_wlh_amd64\amd64\IRFilter.pdb

Imports

ntoskrnl.exe

PsCreateSystemThread
IoGetDeviceObjectPointer
KeClearEvent
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
KeInitializeEvent
ExFreePoolWithTag
ObfDereferenceObject
KeWaitForMultipleObjects
KeBugCheckEx
RtlCopyUnicodeString
DbgPrint
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
KeSetEvent
IofCallDriver

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 709B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleRemoteInstaller/IRFilter64.cat
Apple/Allx64/AppleRemoteInstaller/IRFilter64.inf
Apple/Allx64/AppleRemoteInstaller/ItalianLicense.txt
Apple/Allx64/AppleRemoteInstaller/JapaneseLicense.txt
Apple/Allx64/AppleRemoteInstaller/KoreanLicense.txt
Apple/Allx64/AppleRemoteInstaller/NorwegianLicense.txt
Apple/Allx64/AppleRemoteInstaller/PolishLicense.txt
Apple/Allx64/AppleRemoteInstaller/PortugueseLicense.txt
Apple/Allx64/AppleRemoteInstaller/RussianLicense.txt
Apple/Allx64/AppleRemoteInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleRemoteInstaller/SpanishLicense.txt
Apple/Allx64/AppleRemoteInstaller/SwedishLicense.txt
Apple/Allx64/AppleRemoteInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleRemoteInstaller/TurkishLicense.txt
Apple/Allx64/AppleRemoteInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSDCardReader/AppleSDR.sys
.sys windows:6 windows x64 arch:x64

d5233ee952b76c49607cf384a57b79fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\bwa\applesdcardreaderwin-5344\srcroot\applesdcardreader\objfre_wlh_amd64\amd64\AppleSDR.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ZwOpenKey
RtlQueryRegistryValues
RtlInitUnicodeString
KeBugCheckEx
RtlCopyUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
ZwQueryValueKey

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 814B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSDCardReader/AppleSDR64.cat
Apple/Allx64/AppleSDCardReader/AppleSDR64.inf
Apple/Allx64/AppleSDCardReader/ArabicLicense.txt
Apple/Allx64/AppleSDCardReader/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleSDCardReader/CzechLicense.txt
Apple/Allx64/AppleSDCardReader/DanishLicense.txt
Apple/Allx64/AppleSDCardReader/DutchLicense.txt
Apple/Allx64/AppleSDCardReader/EnglishLicense.txt
Apple/Allx64/AppleSDCardReader/FinnishLicense.txt
Apple/Allx64/AppleSDCardReader/FrenchLicense.txt
Apple/Allx64/AppleSDCardReader/GermanLicense.txt
Apple/Allx64/AppleSDCardReader/HungarianLicense.txt
Apple/Allx64/AppleSDCardReader/ItalianLicense.txt
Apple/Allx64/AppleSDCardReader/JapaneseLicense.txt
Apple/Allx64/AppleSDCardReader/KoreanLicense.txt
Apple/Allx64/AppleSDCardReader/NorwegianLicense.txt
Apple/Allx64/AppleSDCardReader/PolishLicense.txt
Apple/Allx64/AppleSDCardReader/PortugueseLicense.txt
Apple/Allx64/AppleSDCardReader/RussianLicense.txt
Apple/Allx64/AppleSDCardReader/SimplifiedChineseLicense.txt
Apple/Allx64/AppleSDCardReader/SpanishLicense.txt
Apple/Allx64/AppleSDCardReader/SwedishLicense.txt
Apple/Allx64/AppleSDCardReader/TraditionalChineseLicense.txt
Apple/Allx64/AppleSDCardReader/TurkishLicense.txt
Apple/Allx64/AppleSDCardReader/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPIDevice/AppleSPIDevice.cat
Apple/Allx64/AppleSPIDevice/AppleSPIDevice.inf
Apple/Allx64/AppleSPIDevice/AppleSPIDevice.sys
.sys windows:6 windows x64 arch:x64

07fe52f91bb57cc4ebb84b7b5fb43d9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleSPIDeviceWin-5867\srcroot\x64\Win8Release\AppleSPIDevice.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IofCallDriver
_vsnwprintf
KeSetEvent
RtlStringFromGUID
PsTerminateSystemThread
ObReferenceObjectByHandle
KeBugCheckEx
RtlCopyUnicodeString
KeDelayExecutionThread
ExFreePoolWithTag
ExAllocatePoolWithTag
PsCreateSystemThread
KeInitializeEvent

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 942B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPIDevice/ArabicLicense.txt
Apple/Allx64/AppleSPIDevice/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleSPIDevice/CzechLicense.txt
Apple/Allx64/AppleSPIDevice/DanishLicense.txt
Apple/Allx64/AppleSPIDevice/DutchLicense.txt
Apple/Allx64/AppleSPIDevice/EnglishLicense.txt
Apple/Allx64/AppleSPIDevice/FinnishLicense.txt
Apple/Allx64/AppleSPIDevice/FrenchLicense.txt
Apple/Allx64/AppleSPIDevice/GermanLicense.txt
Apple/Allx64/AppleSPIDevice/HungarianLicense.txt
Apple/Allx64/AppleSPIDevice/ItalianLicense.txt
Apple/Allx64/AppleSPIDevice/JapaneseLicense.txt
Apple/Allx64/AppleSPIDevice/KoreanLicense.txt
Apple/Allx64/AppleSPIDevice/NorwegianLicense.txt
Apple/Allx64/AppleSPIDevice/PolishLicense.txt
Apple/Allx64/AppleSPIDevice/PortugueseLicense.txt
Apple/Allx64/AppleSPIDevice/RussianLicense.txt
Apple/Allx64/AppleSPIDevice/SimplifiedChineseLicense.txt
Apple/Allx64/AppleSPIDevice/SpanishLicense.txt
Apple/Allx64/AppleSPIDevice/SwedishLicense.txt
Apple/Allx64/AppleSPIDevice/TraditionalChineseLicense.txt
Apple/Allx64/AppleSPIDevice/TurkishLicense.txt
Apple/Allx64/AppleSPIDevice/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPIKeyboard/AppleSPIKeyboard.cat
Apple/Allx64/AppleSPIKeyboard/AppleSPIKeyboard.inf
Apple/Allx64/AppleSPIKeyboard/AppleSPIKeyboard.sys
.sys windows:6 windows x64 arch:x64

aa53b10efc21f85f277269687a409088

Code Sign

03:a8:de:b3:05:a7:91:47:70:56:0b:c2:c3:0a:56
Certificate

Issuer

CN=L&RE AppleInternal

Not Before

23/05/2013, 07:00

Not After

23/07/2015, 07:00

Subject

CN=L&RE AppleInternal

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

15:2c:b1:6c:6c:9a:8f:5e:73:70:33:f8:ec:8c:60:df:2f:dd:04:12
Signer

Actual PE Digest

15:2c:b1:6c:6c:9a:8f:5e:73:70:33:f8:ec:8c:60:df:2f:dd:04:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleSPIKeyboardWin-6005.2\srcroot\AppleSPIKeyboard\x64\Win8Release\AppleSPIKeyboard.pdb

Imports

ntoskrnl.exe

KeSetEvent
KeDelayExecutionThread
KeWaitForMultipleObjects
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
KeClearEvent
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryKey
ZwQueryValueKey
KeBugCheckEx
RtlCopyUnicodeString
KeInitializeEvent
RtlInitUnicodeString
IoGetDeviceObjectPointer

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 1024B - Virtual size: 970B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 898B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPIKeyboard/ArabicLicense.txt
Apple/Allx64/AppleSPIKeyboard/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleSPIKeyboard/CzechLicense.txt
Apple/Allx64/AppleSPIKeyboard/DanishLicense.txt
Apple/Allx64/AppleSPIKeyboard/DutchLicense.txt
Apple/Allx64/AppleSPIKeyboard/EnglishLicense.txt
Apple/Allx64/AppleSPIKeyboard/FinnishLicense.txt
Apple/Allx64/AppleSPIKeyboard/FrenchLicense.txt
Apple/Allx64/AppleSPIKeyboard/GermanLicense.txt
Apple/Allx64/AppleSPIKeyboard/HungarianLicense.txt
Apple/Allx64/AppleSPIKeyboard/ItalianLicense.txt
Apple/Allx64/AppleSPIKeyboard/JapaneseLicense.txt
Apple/Allx64/AppleSPIKeyboard/KoreanLicense.txt
Apple/Allx64/AppleSPIKeyboard/NorwegianLicense.txt
Apple/Allx64/AppleSPIKeyboard/PolishLicense.txt
Apple/Allx64/AppleSPIKeyboard/PortugueseLicense.txt
Apple/Allx64/AppleSPIKeyboard/RussianLicense.txt
Apple/Allx64/AppleSPIKeyboard/SimplifiedChineseLicense.txt
Apple/Allx64/AppleSPIKeyboard/SpanishLicense.txt
Apple/Allx64/AppleSPIKeyboard/SwedishLicense.txt
Apple/Allx64/AppleSPIKeyboard/TraditionalChineseLicense.txt
Apple/Allx64/AppleSPIKeyboard/TurkishLicense.txt
Apple/Allx64/AppleSPIKeyboard/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPIKeyboard/hidkmdf.sys
.sys windows:6 windows x64 arch:x64

af397e9e1a8741de7d78cab93a78c534

Code Sign

16:a4:27:4d:4e:03:ed:9a:48:44:ef:2c:13:af:48:96
Certificate

Issuer

CN=MnEloWdk

Not Before

27/06/2009, 19:02

Not After

31/12/2039, 23:59

Subject

CN=MnEloWdk

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:53:73:21:de:da:2e:0c:cf:ad:42:ee:5b:80:89:2c:eb:7f:fe:71
Signer

Actual PE Digest

fd:53:73:21:de:da:2e:0c:cf:ad:42:ee:5b:80:89:2c:eb:7f:fe:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\winddk\7100.0.0\src\hid\hidusbfx2\hidmapper\objchk_win7_amd64\amd64\hidkmdf.pdb

Imports

ntoskrnl.exe

DbgPrint
IofCallDriver
KeBugCheckEx
RtlAssert
PoCallDriver
PoStartNextPowerIrp

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 1024B - Virtual size: 857B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 213B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPITrackpad/AppleSPITrackpad.cat
Apple/Allx64/AppleSPITrackpad/AppleSPITrackpad.inf
Apple/Allx64/AppleSPITrackpad/AppleSPITrackpad.sys
.sys windows:6 windows x64 arch:x64

57eafd2b269c6d911a4b1ca24e19a178

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleSPITrackpadWin-5885\srcroot\AppleSPITrackpad\x64\Win8Release\AppleSPITrackpad.pdb

Imports

ntoskrnl.exe

MmGetSystemRoutineAddress
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KeDelayExecutionThread
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
RtlConvertSidToUnicodeString
RtlQueryRegistryValues
ObOpenObjectByPointer
ZwQueryInformationToken
RtlCompareMemory
RtlRaiseException
RtlUnwindEx
KeBugCheckEx
RtlCopyUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToInteger
ExFreePoolWithTag
PsReferencePrimaryToken
ExAllocatePoolWithTag

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPITrackpad/ArabicLicense.txt
Apple/Allx64/AppleSPITrackpad/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleSPITrackpad/CzechLicense.txt
Apple/Allx64/AppleSPITrackpad/DanishLicense.txt
Apple/Allx64/AppleSPITrackpad/DutchLicense.txt
Apple/Allx64/AppleSPITrackpad/EnglishLicense.txt
Apple/Allx64/AppleSPITrackpad/FinnishLicense.txt
Apple/Allx64/AppleSPITrackpad/FrenchLicense.txt
Apple/Allx64/AppleSPITrackpad/GermanLicense.txt
Apple/Allx64/AppleSPITrackpad/HungarianLicense.txt
Apple/Allx64/AppleSPITrackpad/ItalianLicense.txt
Apple/Allx64/AppleSPITrackpad/JapaneseLicense.txt
Apple/Allx64/AppleSPITrackpad/KoreanLicense.txt
Apple/Allx64/AppleSPITrackpad/NorwegianLicense.txt
Apple/Allx64/AppleSPITrackpad/PolishLicense.txt
Apple/Allx64/AppleSPITrackpad/PortugueseLicense.txt
Apple/Allx64/AppleSPITrackpad/RussianLicense.txt
Apple/Allx64/AppleSPITrackpad/SimplifiedChineseLicense.txt
Apple/Allx64/AppleSPITrackpad/SpanishLicense.txt
Apple/Allx64/AppleSPITrackpad/SwedishLicense.txt
Apple/Allx64/AppleSPITrackpad/TraditionalChineseLicense.txt
Apple/Allx64/AppleSPITrackpad/TurkishLicense.txt
Apple/Allx64/AppleSPITrackpad/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSPITrackpad/hidkmdf.sys
.sys windows:6 windows x64 arch:x64

af397e9e1a8741de7d78cab93a78c534

Code Sign

16:a4:27:4d:4e:03:ed:9a:48:44:ef:2c:13:af:48:96
Certificate

Issuer

CN=MnEloWdk

Not Before

27/06/2009, 19:02

Not After

31/12/2039, 23:59

Subject

CN=MnEloWdk

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:53:73:21:de:da:2e:0c:cf:ad:42:ee:5b:80:89:2c:eb:7f:fe:71
Signer

Actual PE Digest

fd:53:73:21:de:da:2e:0c:cf:ad:42:ee:5b:80:89:2c:eb:7f:fe:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\winddk\7100.0.0\src\hid\hidusbfx2\hidmapper\objchk_win7_amd64\amd64\hidkmdf.pdb

Imports

ntoskrnl.exe

DbgPrint
IofCallDriver
KeBugCheckEx
RtlAssert
PoCallDriver
PoStartNextPowerIrp

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 1024B - Virtual size: 857B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 213B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSSD/AppleSSD.cat
Apple/Allx64/AppleSSD/AppleSSD.inf
Apple/Allx64/AppleSSD/AppleSSD.sys
.sys windows:10 windows x64 arch:x64

1a7db22d2652cbf9076157b89a3940ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\D6E65D82-7ED0-0\AppleSSDWin-7538\srcroot\x64\Release\AppleSSD.pdb

Imports

ntoskrnl.exe

ExGetFirmwareEnvironmentVariable

storport.sys

StorPortDebugPrint
StorPortGetPhysicalAddress
StorPortGetUncachedExtension
StorPortNotification
StorPortStallExecution
StorPortQuerySystemTime
StorPortInitialize
StorPortFreeDeviceBase
StorPortGetBusData
StorPortGetDeviceBase
StorPortBusy
StorPortReady
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortExtendedFunction
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSSD64/AppleSSD.cat
Apple/Allx64/AppleSSD64/AppleSSD.inf
Apple/Allx64/AppleSSD64/AppleSSD.sys
.sys windows:6 windows x64 arch:x64

431a112cf03f59fede642e2f647c55e7

Code Sign

03:a8:de:b3:05:a7:91:47:70:56:0b:c2:c3:0a:56
Certificate

Issuer

CN=L&RE AppleInternal

Not Before

23/05/2013, 07:00

Not After

23/07/2015, 07:00

Subject

CN=L&RE AppleInternal

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b0:50:76:13:49:69:d6:a2:e2:ab:f3:a6:e1:3d:23:4b:ee:7b:be:ea
Signer

Actual PE Digest

b0:50:76:13:49:69:d6:a2:e2:ab:f3:a6:e1:3d:23:4b:ee:7b:be:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\AppleSSDWin-6009.2\srcroot\x64\Win8Release\AppleSSD.pdb

Imports

storport.sys

StorPortNotification
StorPortStallExecution
StorPortDebugPrint
StorPortGetPhysicalAddress
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortInitialize
StorPortGetDeviceBase
StorPortBusy
StorPortReady
StorPortAllocateRegistryBuffer
StorPortRegistryRead
StorPortExtendedFunction
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleSSD64/ArabicLicense.txt
Apple/Allx64/AppleSSD64/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleSSD64/CzechLicense.txt
Apple/Allx64/AppleSSD64/DanishLicense.txt
Apple/Allx64/AppleSSD64/DutchLicense.txt
Apple/Allx64/AppleSSD64/EnglishLicense.txt
Apple/Allx64/AppleSSD64/FinnishLicense.txt
Apple/Allx64/AppleSSD64/FrenchLicense.txt
Apple/Allx64/AppleSSD64/GermanLicense.txt
Apple/Allx64/AppleSSD64/HungarianLicense.txt
Apple/Allx64/AppleSSD64/ItalianLicense.txt
Apple/Allx64/AppleSSD64/JapaneseLicense.txt
Apple/Allx64/AppleSSD64/KoreanLicense.txt
Apple/Allx64/AppleSSD64/NorwegianLicense.txt
Apple/Allx64/AppleSSD64/PolishLicense.txt
Apple/Allx64/AppleSSD64/PortugueseLicense.txt
Apple/Allx64/AppleSSD64/RussianLicense.txt
Apple/Allx64/AppleSSD64/SimplifiedChineseLicense.txt
Apple/Allx64/AppleSSD64/SpanishLicense.txt
Apple/Allx64/AppleSSD64/SwedishLicense.txt
Apple/Allx64/AppleSSD64/TraditionalChineseLicense.txt
Apple/Allx64/AppleSSD64/TurkishLicense.txt
Apple/Allx64/AppleThunderboltNullDriver/AppleThunderboltNull64.cat
Apple/Allx64/AppleThunderboltNullDriver/AppleThunderboltNull64.inf
Apple/Allx64/AppleTrackpadInstaller/ArabicLicense.txt
Apple/Allx64/AppleTrackpadInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleTrackpadInstaller/CzechLicense.txt
Apple/Allx64/AppleTrackpadInstaller/DanishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/DutchLicense.txt
Apple/Allx64/AppleTrackpadInstaller/EnglishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/FinnishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/FrenchLicense.txt
Apple/Allx64/AppleTrackpadInstaller/GermanLicense.txt
Apple/Allx64/AppleTrackpadInstaller/HungarianLicense.txt
Apple/Allx64/AppleTrackpadInstaller/ItalianLicense.txt
Apple/Allx64/AppleTrackpadInstaller/JapaneseLicense.txt
Apple/Allx64/AppleTrackpadInstaller/KoreanLicense.txt
Apple/Allx64/AppleTrackpadInstaller/NorwegianLicense.txt
Apple/Allx64/AppleTrackpadInstaller/PolishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/PortugueseLicense.txt
Apple/Allx64/AppleTrackpadInstaller/RussianLicense.txt
Apple/Allx64/AppleTrackpadInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleTrackpadInstaller/SpanishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/SwedishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleTrackpadInstaller/TurkishLicense.txt
Apple/Allx64/AppleTrackpadInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleTrackpadInstaller/aapltctp.sys
.sys windows:6 windows x64 arch:x64

5190b284de67af2911911f54a47b645b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appletrackpadwin-2048\srcroot\trackpaddriver\aapltctp\objfre_wlh_amd64\amd64\aapltctp.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
PoStartNextPowerIrp
IofCompleteRequest
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateDevice
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 895B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleTrackpadInstaller/aapltctp64.cat
Apple/Allx64/AppleTrackpadInstaller/aapltctp64.inf
Apple/Allx64/AppleTrackpadInstaller/aapltp.sys
.sys windows:6 windows x64 arch:x64

9ef9c7fda09ff3b18d6c610c5d01cd4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appletrackpadwin-2048\srcroot\trackpaddriver\aapltp\objfre_wlh_amd64\amd64\aapltp.pdb

Imports

ntoskrnl.exe

IoWMIRegistrationControl
ZwClose
RtlAppendUnicodeStringToString
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwQueryInformationToken
RtlCompareMemory
RtlConvertSidToUnicodeString
PsReferencePrimaryToken
RtlAppendUnicodeToString
RtlQueryRegistryValues
IoGetCurrentProcess
KeBugCheckEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIWriteEvent
RtlCopyUnicodeString
ExAllocatePoolWithTag
ObOpenObjectByPointer
ExFreePoolWithTag

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

wdfldr.sys

WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleTrackpadInstaller/aapltp64.cat
Apple/Allx64/AppleTrackpadInstaller/aapltp64.inf
Apple/Allx64/AppleUSBEthernet/AppleUSBEthernet.inf
Apple/Allx64/AppleUSBEthernet/AppleUSBEthernet.sys
.sys windows:6 windows x64 arch:x64

ef30376cfdf5d8d3897028a3fea7fa94

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\asix\ax88772a\vista\ax88772_asix_vista_64bit_source_rev3.10.3.9\objfre_wlh_amd64\amd64\ax88772.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
RtlCopyUnicodeString
KeReleaseSpinLock
IoGetDeviceProperty
MmMapLockedPagesSpecifyCache

hal

KeStallExecutionProcessor

ndis.sys

NdisGetVersion
NdisFreeMemory
NdisAllocateNetBufferListPool
NdisFreeMdl
NdisAllocateNetBufferAndNetBufferList
NdisMSleep
NdisFreeNetBufferListPool
NdisMDeregisterMiniportDriver
NdisReadConfiguration
NdisOpenConfigurationEx
NdisAllocateMemoryWithTagPriority
NdisMGetDeviceProperty
NdisCancelTimerObject
NdisMIndicateStatusEx
NdisMSetMiniportAttributes
NdisMRegisterMiniportDriver
NdisMSendNetBufferListsComplete
NdisFreeTimerObject
NdisSetTimerObject
NdisMIndicateReceiveNetBufferLists
NdisAllocateMdl
NdisMOidRequestComplete
NdisMPauseComplete
NdisCloseConfiguration
NdisFreeNetBufferList
NdisReadNetworkAddress
NdisAllocateTimerObject

usbd.sys

USBD_GetUSBDIVersion

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleUSBEthernet/AppleUSBEthernetex.cat
Apple/Allx64/AppleUSBEthernet/ArabicLicense.txt
Apple/Allx64/AppleUSBEthernet/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleUSBEthernet/CzechLicense.txt
Apple/Allx64/AppleUSBEthernet/DanishLicense.txt
Apple/Allx64/AppleUSBEthernet/DutchLicense.txt
Apple/Allx64/AppleUSBEthernet/EnglishLicense.txt
Apple/Allx64/AppleUSBEthernet/FinnishLicense.txt
Apple/Allx64/AppleUSBEthernet/FrenchLicense.txt
Apple/Allx64/AppleUSBEthernet/GermanLicense.txt
Apple/Allx64/AppleUSBEthernet/HungarianLicense.txt
Apple/Allx64/AppleUSBEthernet/ItalianLicense.txt
Apple/Allx64/AppleUSBEthernet/JapaneseLicense.txt
Apple/Allx64/AppleUSBEthernet/KoreanLicense.txt
Apple/Allx64/AppleUSBEthernet/NorwegianLicense.txt
Apple/Allx64/AppleUSBEthernet/PolishLicense.txt
Apple/Allx64/AppleUSBEthernet/PortugueseLicense.txt
Apple/Allx64/AppleUSBEthernet/RussianLicense.txt
Apple/Allx64/AppleUSBEthernet/SimplifiedChineseLicense.txt
Apple/Allx64/AppleUSBEthernet/SpanishLicense.txt
Apple/Allx64/AppleUSBEthernet/SwedishLicense.txt
Apple/Allx64/AppleUSBEthernet/TraditionalChineseLicense.txt
Apple/Allx64/AppleUSBEthernet/TurkishLicense.txt
Apple/Allx64/AppleUSBVHCI/AppleUSBVHCI.cat
Apple/Allx64/AppleUSBVHCI/AppleUSBVHCI.inf
Apple/Allx64/AppleUSBVHCI/AppleUSBVHCI.sys
.sys windows:10 windows x64 arch:x64

f0dcb6fbc99333ca8668070458ecc7cb

Code Sign

3c:92:f5:4c:60:43:b9:92:41:06:89:a1:05:2e:c3:82
Certificate

Issuer

CN=WDKTestCert build\,131521240660386684

Not Before

10/10/2017, 15:47

Not After

10/10/2027, 00:00

Subject

CN=WDKTestCert build\,131521240660386684

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2a:20:59:8f:a8:20:9b:df:80:ef:6d:32:9c:98:48:29:dd:bb:78:48:ba:e9:10:25:72:33:94:f9:28:77:08:49
Signer

Actual PE Digest

2a:20:59:8f:a8:20:9b:df:80:ef:6d:32:9c:98:48:29:dd:bb:78:48:ba:e9:10:25:72:33:94:f9:28:77:08:49

Digest Algorithm

sha256

PE Digest Matches

true

11:6d:17:e4:ed:e4:45:f1:a3:58:d5:1c:f8:c0:e2:0e:2d:d4:bc:59
Signer

Actual PE Digest

11:6d:17:e4:ed:e4:45:f1:a3:58:d5:1c:f8:c0:e2:0e:2d:d4:bc:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\E1C94AF2-C948-0\AppleUSBVHCIWin-7921\srcroot\x64\Release\AppleUSBVHCI.pdb

Imports

ntoskrnl.exe

MmFreeContiguousMemory
IoAllocateMdl
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeMdl
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ObfDereferenceObject
__C_specific_handler
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
MmAllocateContiguousMemory
KeReleaseMutex
PsCreateSystemThread
PsTerminateSystemThread
MmBuildMdlForNonPagedPool
_snprintf
MmMapIoSpaceEx
RtlCompareMemory
KeLowerIrql
KfRaiseIrql
KeResetEvent
MmUnlockPages
MmProbeAndLockPages
KeWaitForSingleObject
RtlCopyUnicodeString
KeSetEvent
KeInitializeEvent
KeInitializeMutex
KeDelayExecutionThread

hal

KeQueryPerformanceCounter

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleWirelessMouse/AppleWirelessMouse.cat
Apple/Allx64/AppleWirelessMouse/AppleWirelessMouse.inf
Apple/Allx64/AppleWirelessMouse/AppleWirelessMouse.sys
.sys windows:10 windows x64 arch:x64

8f3b0b2596e8543e4351fc6fed17bb45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\B69DF622-5A99-0\AppleWirelessMouseWin-7635\srcroot\x64\Release\AppleWirelessMouse.pdb

Imports

ntoskrnl.exe

RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
MmGetSystemRoutineAddress
IoGetCurrentProcess
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
RtlConvertSidToUnicodeString
PsReferencePrimaryToken
ObOpenObjectByPointer
ZwQueryInformationToken
IoAllocateIrp
sqrt
RtlQueryRegistryValues
__C_specific_handler
RtlRaiseException
RtlCopyUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToInteger
IoFreeIrp
wcsstr

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleWirelessTrackpad/AppleWTP.cat
Apple/Allx64/AppleWirelessTrackpad/AppleWTP.sys
.sys windows:10 windows x64 arch:x64

26a135877d52aa873e6eff6e9914006f

Code Sign

3c:92:f5:4c:60:43:b9:92:41:06:89:a1:05:2e:c3:82
Certificate

Issuer

CN=WDKTestCert build\,131521240660386684

Not Before

10/10/2017, 15:47

Not After

10/10/2027, 00:00

Subject

CN=WDKTestCert build\,131521240660386684

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:e9:8f:e8:25:6c:d6:2e:52:04:f8:88:bf:4f:13:36:ae:ac:82:09:cb:d9:e5:5f:9d:72:eb:c3:5a:cb:71:89
Signer

Actual PE Digest

5e:e9:8f:e8:25:6c:d6:2e:52:04:f8:88:bf:4f:13:36:ae:ac:82:09:cb:d9:e5:5f:9d:72:eb:c3:5a:cb:71:89

Digest Algorithm

sha256

PE Digest Matches

true

60:61:da:d3:e8:3f:de:8b:86:ce:7c:9a:f4:5b:e2:73:f0:66:4e:17
Signer

Actual PE Digest

60:61:da:d3:e8:3f:de:8b:86:ce:7c:9a:f4:5b:e2:73:f0:66:4e:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BWA\02FBA3DC-44F0-0\AppleWirelessTrackpadWin-7048.2\srcroot\x64\Release\applewtp.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
IoIsWdmVersionAvailable
IoFreeIrp
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeWaitForMultipleObjects
IoAllocateIrp
RtlUnicodeStringToInteger
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoGetCurrentProcess
RtlConvertSidToUnicodeString
PsReferencePrimaryToken
ObOpenObjectByPointer
ZwQueryInformationToken
__C_specific_handler
RtlRaiseException
RtlCopyUnicodeString
KeSetEvent
KeClearEvent
KeInitializeEvent
sqrt
RtlInitUnicodeString

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NONPAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleWirelessTrackpad/AppleWirelessTrackpad.inf
Apple/Allx64/AppleiSightInstaller/ArabicLicense.txt
Apple/Allx64/AppleiSightInstaller/BrazilianPortugueseLicense.txt
Apple/Allx64/AppleiSightInstaller/CzechLicense.txt
Apple/Allx64/AppleiSightInstaller/DanishLicense.txt
Apple/Allx64/AppleiSightInstaller/DutchLicense.txt
Apple/Allx64/AppleiSightInstaller/EnglishLicense.txt
Apple/Allx64/AppleiSightInstaller/FinnishLicense.txt
Apple/Allx64/AppleiSightInstaller/FrenchLicense.txt
Apple/Allx64/AppleiSightInstaller/GermanLicense.txt
Apple/Allx64/AppleiSightInstaller/HungarianLicense.txt
Apple/Allx64/AppleiSightInstaller/ItalianLicense.txt
Apple/Allx64/AppleiSightInstaller/JapaneseLicense.txt
Apple/Allx64/AppleiSightInstaller/KoreanLicense.txt
Apple/Allx64/AppleiSightInstaller/NorwegianLicense.txt
Apple/Allx64/AppleiSightInstaller/PolishLicense.txt
Apple/Allx64/AppleiSightInstaller/PortugueseLicense.txt
Apple/Allx64/AppleiSightInstaller/RussianLicense.txt
Apple/Allx64/AppleiSightInstaller/SimplifiedChineseLicense.txt
Apple/Allx64/AppleiSightInstaller/SpanishLicense.txt
Apple/Allx64/AppleiSightInstaller/SwedishLicense.txt
Apple/Allx64/AppleiSightInstaller/TraditionalChineseLicense.txt
Apple/Allx64/AppleiSightInstaller/TurkishLicense.txt
Apple/Allx64/AppleiSightInstaller/WdfCoInstaller01005.dll
.dll windows:6 windows x64 arch:x64

831f1fc1bf81528bc9624d69c49d6e74

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

Actual PE Digest

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01005.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_ultow
_stricmp
_vsnwprintf

setupapi

SetupOpenLog
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
SetupLogErrorW
SetupInstallServicesFromInfSectionW
SetupDiGetSelectedDriverW
SetupFindNextMatchLineW
SetupGetLineCountW
SetupGetStringFieldW
SetupDiGetActualSectionToInstallW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW

kernel32

GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
WriteFile
RemoveDirectoryW
LockResource
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
GetLocalTime
FindClose
CreateProcessW
LoadResource
SetLastError
FindResourceW
FindFirstFileW
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
DeleteFileW
CloseHandle
TerminateProcess
GetExitCodeProcess
FindNextFileW
FormatMessageW
SizeofResource
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
VerSetConditionMask
GlobalFree
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetProcAddress
GetLastError
VerifyVersionInfoW
LocalAlloc

advapi32

LockServiceDatabase
RegCloseKey
OpenServiceW
QueryServiceLockStatusW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
UnlockServiceDatabase
ChangeServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

shell32

CommandLineToArgvW

user32

IsCharAlphaW
LoadStringW
IsCharAlphaNumericW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleiSightInstaller/iSight64.cat
Apple/Allx64/AppleiSightInstaller/iSight64.inf
Apple/Allx64/AppleiSightInstaller/iSightCI.dll
.dll windows:6 windows x64 arch:x64

56c5e2141b729ce34ad161041af8d1d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\bwa\appleusbcamerawin-200.1.0\srcroot\appleusbcamera\isightcoinstaller\objfre_wlh_amd64\amd64\iSightCI.pdb

Imports

setupapi

SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyA

kernel32

SetUnhandledExceptionFilter
lstrlenA
FlsSetValue
GetCommandLineA
GetVersionExW
GetProcAddress
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery

user32

wsprintfA

Exports

Exports

iSightCI

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleiSightInstaller/iSightFT.sys
.sys windows:6 windows x64 arch:x64

e2f5f6a8e42df986c0e2265bb5b3cd31

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleusbcamerawin-200.1.0\srcroot\appleusbcamera\isightfilter\objfre_wlh_amd64\amd64\iSightFT.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx
ExAllocatePoolWithTag
ExFreePoolWithTag

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/AppleiSightInstaller/iSightUP.sys
.sys windows:6 windows x64 arch:x64

81d39a61413db6907747bd88cef4b3da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleusbcamerawin-200.1.0\srcroot\appleusbcamera\isightupdate\objfre_wlh_amd64\amd64\iSightUP.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/NullSystemDevice/ArabicLicense.txt
Apple/Allx64/NullSystemDevice/BrazilianPortugueseLicense.txt
Apple/Allx64/NullSystemDevice/CzechLicense.txt
Apple/Allx64/NullSystemDevice/DanishLicense.txt
Apple/Allx64/NullSystemDevice/DutchLicense.txt
Apple/Allx64/NullSystemDevice/EnglishLicense.txt
Apple/Allx64/NullSystemDevice/FinnishLicense.txt
Apple/Allx64/NullSystemDevice/FrenchLicense.txt
Apple/Allx64/NullSystemDevice/GermanLicense.txt
Apple/Allx64/NullSystemDevice/HungarianLicense.txt
Apple/Allx64/NullSystemDevice/ItalianLicense.txt
Apple/Allx64/NullSystemDevice/JapaneseLicense.txt
Apple/Allx64/NullSystemDevice/KoreanLicense.txt
Apple/Allx64/NullSystemDevice/NorwegianLicense.txt
Apple/Allx64/NullSystemDevice/NullSystemDevice64.cat
Apple/Allx64/NullSystemDevice/NullSystemDevice64.inf
Apple/Allx64/NullSystemDevice/PolishLicense.txt
Apple/Allx64/NullSystemDevice/PortugueseLicense.txt
Apple/Allx64/NullSystemDevice/RussianLicense.txt
Apple/Allx64/NullSystemDevice/SimplifiedChineseLicense.txt
Apple/Allx64/NullSystemDevice/SpanishLicense.txt
Apple/Allx64/NullSystemDevice/SwedishLicense.txt
Apple/Allx64/NullSystemDevice/TraditionalChineseLicense.txt
Apple/Allx64/NullSystemDevice/TurkishLicense.txt
Apple/Allx64/TrackPad64/WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

cc:ca:51:24:f5:73:01:fd:81:fa:0e:6f:99:0a:64:4f:d5:d4:b5:39
Signer

Actual PE Digest

cc:ca:51:24:f5:73:01:fd:81:fa:0e:6f:99:0a:64:4f:d5:d4:b5:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/TrackPad64/trackpad_plus_plus_x64.cat
Apple/Allx64/TrackPad64/trackpad_plus_plus_x64.inf
Apple/Allx64/TrackPad64/trackpad_plus_plus_x64.sys
.sys windows:6 windows x64 arch:x64

4ae226bb536896d3249d6bd51a78acec

Code Sign

4f:44:6d:4d:b8:18:0c:7d:b5:b5:a1:08:38:84:9d:30
Certificate

Issuer

CN=NGO

Not Before

22/11/2011, 10:00

Not After

31/12/2039, 23:59

Subject

CN=NGO

Extended Key Usages

ExtKeyUsageCodeSigning

77:ed:45:88:2d:d4:8d:c5:e8:d1:df:b8:38:fe:0f:33:9b:85:ec:74
Signer

Actual PE Digest

77:ed:45:88:2d:d4:8d:c5:e8:d1:df:b8:38:fe:0f:33:9b:85:ec:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\moufiltr_trackpad++_11a_27052010\moufiltr\objfre_win7_amd64\amd64\trackpad_plus_plus_x64.pdb

Imports

ntoskrnl.exe

ExReleaseFastMutexUnsafe
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoDetachDevice
ExAcquireFastMutexUnsafe
PoStartNextPowerIrp
KeQueryTimeIncrement
IofCompleteRequest
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 256B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/WdfCoInstaller01009.dll
.dll windows:6 windows x64 arch:x64

70497fec79daa5f71de3b34faee686a5

Code Sign

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:02:a4:e9:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2009, 05:58

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Component Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e
Signer

Actual PE Digest

05:63:99:fa:ac:b9:fc:49:f3:cf:78:bf:c3:d9:f2:f4:63:e5:01:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01009.pdb

Imports

msvcrt

memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_ultow
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_stricmp
_vsnwprintf

setupapi

SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupOpenLog
SetupDiGetActualSectionToInstallW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupDiGetDriverInfoDetailW

kernel32

GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
ExpandEnvironmentStringsW
GetFileInformationByHandle
DeleteFileW
CloseHandle
FindNextFileW
RemoveDirectoryW
LockResource
GetLocalTime
FindClose
SetLastError
CreateFileW
FileTimeToSystemTime
TerminateProcess
GetExitCodeProcess
FormatMessageW
SizeofResource
WriteFile
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
LocalFree
GetWindowsDirectoryW
LocalAlloc
GlobalFree
GetProcAddress
GetLastError
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask

advapi32

DeleteService
OpenSCManagerW
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

shell32

CommandLineToArgvW

user32

LoadStringW
IsCharAlphaNumericW
IsCharAlphaW

ole32

CoTaskMemFree

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/netaapl64.cat
Apple/Allx64/netaapl64.inf
Apple/Allx64/netaapl64.sys
.sys windows:6 windows x64 arch:x64

ab32f637d167f07f2c0fd77c247d0f15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleembeddedusbethernetdriverwin-1.8.4\srcroot\netaapl\objfre_win7_amd64\amd64\netaapl64.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
ExFreePoolWithTag
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
ExInterlockedRemoveHeadList
ExInterlockedInsertTailList
IoFreeMdl
KeInitializeEvent
RtlCopyUnicodeString
KeAcquireSpinLockRaiseToDpc
IoGetDeviceProperty
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
KeReleaseSpinLock

ndis.sys

NdisAllocatePacket
NdisAllocatePacketPool
NdisFreeMemory
NdisReadNetworkAddress
NdisCloseConfiguration
NdisInitializeEvent
NdisFreePacketPool
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisAllocateMemoryWithTag
NdisAllocateBuffer
NdisReadConfiguration
NdisFreeBufferPool
NdisGetVersion
NdisMSleep
NdisMRegisterUnloadHandler
NdisMRegisterMiniport
NdisSetEvent
NdisWaitEvent
NdisInitializeWrapper
NdisMSetAttributesEx
NdisTerminateWrapper
NdisMGetDeviceProperty
NdisFreePacket
NdisOpenConfiguration
NdisAllocateBufferPool

usbd.sys

USBD_ParseConfigurationDescriptorEx

wdfldr.sys

WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/usbaapl64.cat
Apple/Allx64/usbaapl64.inf
Apple/Allx64/usbaapl64.sys
.sys windows:6 windows x64 arch:x64

c0d2e1595d14062390e8d0e6476d0c6d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\bwa\appleusbdevicemuxdriverwin-64\srcroot\windowsdriver\appleusbdevicemuxdriver\appleusbdevicemuxdriver\objfre_win7_amd64\amd64\usbaapl64.pdb

Imports

ntoskrnl.exe

KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
IofCompleteRequest
KeWaitForSingleObject
IoFreeIrp
IoSetCompletionRoutineEx
IoAllocateIrp
IofCallDriver
KeRegisterBugCheckReasonCallback
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
IoRegisterDeviceInterface
IoGetAttachedDevice
IoSetDeviceInterfaceState
RtlInitUnicodeString
RtlIntegerToUnicodeString
IoDeleteDevice
IoFreeWorkItem
RtlQueryRegistryValues
ZwDeleteValueKey
IoInvalidateDeviceRelations
IoCancelIrp
KeDelayExecutionThread
RtlFreeUnicodeString
IoStopTimer
KeResetEvent
IoAllocateWorkItem
PoStartNextPowerIrp
KeQueryTimeIncrement
ZwClose
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoCreateDevice
IoQueueWorkItem
IoInitializeIrp
KeReadStateEvent
IoStartTimer
PoRequestPowerIrp
PoCallDriver
IoInitializeTimer
IoDetachDevice
KeDeregisterBugCheckReasonCallback
IoReleaseRemoveLockAndWaitEx
IoAttachDeviceToDeviceStack
ObfReferenceObject
IoInitializeRemoveLockEx
RtlUnicodeStringToAnsiString
MmMapLockedPagesSpecifyCache
RtlFreeAnsiString
RtlCompareUnicodeString
ZwSetValueKey
_vsnwprintf
KeBugCheckEx
IoAcquireRemoveLockEx
ExFreePoolWithTag
ExFreePool
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion

wmilib.sys

WmiSystemControl

usbd.sys

USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 394B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Apple/Allx64/usbaaplrc.dll
.dll windows:5 windows x86 arch:x86

d056332cf3b8d6b9c5dfda1fdbccf8ca

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:a2:a6:e5:14:b1:87:c5:2e:1f:ea:52:40:cb:04:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/04/2011, 00:00

Not After

25/06/2013, 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:11:02:4c:83:dc:23:8e:a3:39:1f:13:30:c1:32:dd:96:17:da:8a
Signer

Actual PE Digest

2f:11:02:4c:83:dc:23:8e:a3:39:1f:13:30:c1:32:dd:96:17:da:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BWA\AppleUSBDeviceMuxDriverWin-64\srcroot\WindowsDriver\AppleUSBDeviceMuxRC\Release\usbaaplrc.pdb

Imports

msvcr90

_lock
__dllonexit
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_onexit
_encode_pointer

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98fc0b979914fcb889c3b2d0023c2f75

Code Sign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

a6:91:bb:f8:7e:ce:54:3d:0e:fd:d1:a9:41:f3:c6:24:ee:27:fb:8d:78:7e:9e:48:db:1b:71:15:c9:93:7d:94Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

portcls.sys

hal

wdfldr.sys

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 10KB - Virtual size: 10KB

.pdata Size: 3KB - Virtual size: 2KB

PAGE Size: 28KB - Virtual size: 27KB

INIT Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 824B

.reloc Size: 1024B - Virtual size: 888B

5fb7a44c325fb8ac5444f850155ca380

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 13KB - Virtual size: 13KB

NONPAGE Size: 1024B - Virtual size: 903B

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 540B

INIT Size: 1024B - Virtual size: 1000B

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 512B - Virtual size: 132B

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20Certificate

Extended Key Usages

61:05:dd:42:00:00:00:00:00:14Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2Signer

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

setupapi

kernel32

advapi32

shell32

user32

shlwapi

Exports

Exports

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

a6:91:bb:f8:7e:ce:54:3d:0e:fd:d1:a9:41:f3:c6:24:ee:27:fb:8d:78:7e:9e:48:db:1b:71:15:c9:93:7d:94
Signer

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 10KB - Virtual size: 10KB

.pdata
Size: 3KB - Virtual size: 2KB

PAGE
Size: 28KB - Virtual size: 27KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 1024B - Virtual size: 888B

.text
Size: 13KB - Virtual size: 13KB

NONPAGE
Size: 1024B - Virtual size: 903B

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 540B

INIT
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 512B - Virtual size: 132B

61:02:92:4a:00:00:00:00:00:20
Certificate

61:05:dd:42:00:00:00:00:00:14
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2
Signer

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

.text
Size: 55KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 18KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 108B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 132B

PAGE
Size: 1024B - Virtual size: 656B

INIT
Size: 1024B - Virtual size: 626B

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 512B - Virtual size: 48B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

61:10:c3:52:00:00:00:00:00:03
Certificate

fc:e2:2b:24:be:83:7b:df:1a:e3:86:dd:77:3f:1e:0a:86:ea:2f:a4
Signer

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 1KB - Virtual size: 18KB

.pdata
Size: 1024B - Virtual size: 948B

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 512B - Virtual size: 250B