General

Malware Config

Signatures

Files

• SpooferV1.zip

  .zip
• Readme.txt
• SpooferV1.exe

  .exe windows:4 windows x86 arch:x86

  2c5f2513605e48f2d8ea5440a870cb9e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  memset

  wcsncmp

  memmove

  wcsncpy

  wcsstr

  _wcsnicmp

  _wcsdup

  free

  _wcsicmp

  wcslen

  wcscpy

  wcscmp

  wcscat

  memcpy

  tolower

  malloc

  kernel32

  GetModuleHandleW

  HeapCreate

  GetStdHandle

  SetConsoleCtrlHandler

  HeapDestroy

  ExitProcess

  WriteFile

  GetTempFileNameW

  LoadLibraryExW

  EnumResourceTypesW

  FreeLibrary

  RemoveDirectoryW

  EnumResourceNamesW

  GetCommandLineW

  LoadResource

  SizeofResource

  FreeResource

  FindResourceW

  GetNativeSystemInfo

  GetShortPathNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  EnterCriticalSection

  CloseHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WaitForSingleObject

  TerminateThread

  CreateThread

  GetProcAddress

  GetVersionExW

  Sleep

  WideCharToMultiByte

  HeapAlloc

  HeapFree

  LoadLibraryW

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameW

  PeekNamedPipe

  TerminateProcess

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetCurrentProcess

  DuplicateHandle

  CreatePipe

  CreateProcessW

  GetExitCodeProcess

  SetUnhandledExceptionFilter

  HeapSize

  MultiByteToWideChar

  CreateDirectoryW

  SetFileAttributesW

  GetTempPathW

  DeleteFileW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateFileW

  SetFilePointer

  TlsFree

  TlsGetValue

  TlsSetValue

  TlsAlloc

  HeapReAlloc

  DeleteCriticalSection

  InterlockedCompareExchange

  InterlockedExchange

  GetLastError

  SetLastError

  UnregisterWait

  GetCurrentThread

  RegisterWaitForSingleObject

  user32

  CharUpperW

  CharLowerW

  MessageBoxW

  DefWindowProcW

  DestroyWindow

  GetWindowLongW

  GetWindowTextLengthW

  GetWindowTextW

  UnregisterClassW

  LoadIconW

  LoadCursorW

  RegisterClassExW

  IsWindowEnabled

  EnableWindow

  GetSystemMetrics

  CreateWindowExW

  SetWindowLongW

  SendMessageW

  SetFocus

  CreateAcceleratorTableW

  SetForegroundWindow

  BringWindowToTop

  GetMessageW

  TranslateAcceleratorW

  TranslateMessage

  DispatchMessageW

  DestroyAcceleratorTable

  PostMessageW

  GetForegroundWindow

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  SetWindowPos

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  shell32

  ShellExecuteExW

  SHGetFolderLocation

  SHGetPathFromIDListW

  winmm

  timeBeginPeriod

  ole32

  CoInitialize

  CoTaskMemFree

  shlwapi

  PathAddBackslashW

  PathRenameExtensionW

  PathQuoteSpacesW

  PathRemoveArgsW

  PathRemoveBackslashW

  Sections

  .code

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 54KB - Virtual size: 54KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• req/AMIDEWIN.EXE

  .exe windows:4 windows x86 arch:x86

  e4bef79f59242df9daf28c2c8193c40e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCurrentDirectoryA

  SetFileAttributesA

  GetFileAttributesA

  GetSystemDirectoryA

  CopyFileA

  GetCurrentProcess

  GetTimeZoneInformation

  CreateProcessA

  WaitForSingleObject

  Sleep

  GetVersionExA

  DeviceIoControl

  GetLastError

  SetFilePointer

  WriteFile

  ReadFile

  CreateFileA

  SetProcessAffinityMask

  CloseHandle

  GetSystemTimeAsFileTime

  HeapFree

  HeapAlloc

  ExitProcess

  TerminateProcess

  DeleteFileA

  GetCommandLineA

  GetVersion

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  GetModuleHandleA

  GetModuleFileNameA

  GetEnvironmentVariableA

  HeapDestroy

  HeapCreate

  VirtualFree

  VirtualAlloc

  HeapReAlloc

  FlushFileBuffers

  GetProcAddress

  GetFullPathNameA

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStrings

  GetEnvironmentStringsW

  RtlUnwind

  SetStdHandle

  MultiByteToWideChar

  GetStringTypeA

  GetStringTypeW

  GetDriveTypeA

  GetCPInfo

  GetACP

  GetOEMCP

  LoadLibraryA

  SetEndOfFile

  LCMapStringA

  LCMapStringW

  CompareStringA

  CompareStringW

  SetEnvironmentVariableA

  ReadConsoleInputA

  SetConsoleMode

  GetConsoleMode

  user32

  wsprintfA

  advapi32

  StartServiceA

  OpenServiceA

  DeleteService

  CreateServiceA

  OpenSCManagerA

  CloseServiceHandle

  ControlService

  Sections

  .text

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 36KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 40KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• req/AMIDEWINx64.EXE

  .exe windows:6 windows x64 arch:x64

  ed928bd060b03bab412d37a11b9d26a0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  ReadConsoleInputA

  SetConsoleMode

  GetCommandLineA

  QueryPerformanceCounter

  GetCurrentProcessId

  GetFullPathNameA

  CloseHandle

  Sleep

  GetCurrentProcess

  GetSystemDirectoryA

  GetWindowsDirectoryA

  CreateFileA

  DeviceIoControl

  GetModuleFileNameA

  GetModuleHandleA

  GetCurrentDirectoryA

  DeleteFileA

  GetLastError

  CreateMutexA

  SetThreadExecutionState

  SetConsoleCtrlHandler

  ReadFile

  WriteFile

  CreateNamedPipeA

  CreateThread

  LocalFree

  EncodePointer

  DecodePointer

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  ExitProcess

  GetModuleHandleExW

  AreFileApisANSI

  MultiByteToWideChar

  WideCharToMultiByte

  HeapFree

  RtlLookupFunctionEntry

  RtlUnwindEx

  HeapAlloc

  RtlPcToFileHeader

  RaiseException

  GetEnvironmentStringsW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  GetCurrentThreadId

  DeleteCriticalSection

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetStdHandle

  GetFileType

  GetStartupInfoW

  RtlCaptureContext

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  InitializeCriticalSectionAndSpinCount

  TerminateProcess

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  GetModuleFileNameW

  LoadLibraryExW

  GetProcessHeap

  ReadConsoleW

  SetFilePointerEx

  HeapReAlloc

  GetStringTypeW

  CompareStringW

  LCMapStringW

  SetStdHandle

  WriteConsoleW

  OutputDebugStringW

  CreateFileW

  SetEnvironmentVariableA

  SetEndOfFile

  GetVersionExA

  LoadLibraryA

  GetProcAddress

  HeapSize

  FreeLibrary

  FreeEnvironmentStringsW

  shell32

  ShellExecuteA

  user32

  DefWindowProcA

  DispatchMessageA

  TranslateMessage

  GetMessageA

  RegisterClassExA

  MessageBoxA

  BlockInput

  SystemParametersInfoA

  ExitWindowsEx

  CreateWindowExA

  wsprintfA

  advapi32

  ControlService

  RegOpenKeyExA

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  OpenProcessToken

  CloseServiceHandle

  CreateServiceA

  DeleteService

  OpenSCManagerA

  OpenServiceA

  StartServiceA

  Sections

  .text

  Size: 240KB - Virtual size: 239KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 114KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 78KB - Virtual size: 116KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• req/DMI16.EXE
• req/DMIEDIT.EXE

  .exe windows:6 windows x64 arch:x64

  9bbd972bee7030506f62236dff565e85

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  LoadCursorW

  LoadCursorA

  MapVirtualKeyA

  GetKeyNameTextA

  IsDialogMessageA

  SetWindowTextA

  CheckDlgButton

  SetDlgItemTextA

  MoveWindow

  GetMonitorInfoA

  MonitorFromWindow

  GetScrollInfo

  SetScrollInfo

  LoadIconA

  GetTopWindow

  GetClassLongPtrA

  GetClassLongA

  SetWindowLongPtrA

  GetWindowLongPtrA

  MapWindowPoints

  AdjustWindowRectEx

  GetWindowTextLengthA

  GetWindowTextA

  RemovePropA

  GetPropA

  SetPropA

  ShowScrollBar

  GetScrollRange

  SetScrollRange

  GetScrollPos

  SetScrollPos

  ScrollWindow

  SetForegroundWindow

  GetForegroundWindow

  TrackPopupMenu

  SetWindowPlacement

  GetWindowPlacement

  IsChild

  CreateWindowExA

  GetClassInfoExA

  RegisterClassA

  CallWindowProcA

  DefWindowProcA

  GetMessageTime

  GetMessagePos

  RegisterWindowMessageA

  UnhookWindowsHookEx

  DestroyCursor

  EndDialog

  CreateDialogIndirectParamA

  DestroyWindow

  CallNextHookEx

  SetWindowsHookExA

  ValidateRect

  DispatchMessageA

  TranslateMessage

  GetMessageA

  ClientToScreen

  EndPaint

  BeginPaint

  GetWindowDC

  ReuseDDElParam

  UnpackDDElParam

  WinHelpA

  LoadImageA

  LoadIconW

  GetWindow

  IntersectRect

  SetRectEmpty

  SetActiveWindow

  InsertMenuItemA

  DestroyMenu

  SetMenu

  GetMenu

  LoadMenuA

  TranslateAcceleratorA

  LoadAcceleratorsA

  GetCapture

  GetActiveWindow

  SetFocus

  GetDlgCtrlID

  LockWindowUpdate

  IsIconic

  IsWindowVisible

  GetNextDlgGroupItem

  DrawFocusRect

  GetIconInfo

  ShowWindow

  GetClassInfoA

  EnableWindow

  UpdateWindow

  ReleaseCapture

  IsWindow

  GetSysColor

  SetCursorPos

  SetTimer

  KillTimer

  DrawIcon

  SetWindowRgn

  IsRectEmpty

  GetSystemMenu

  SetParent

  IsZoomed

  RealChildWindowFromPoint

  LoadAcceleratorsW

  GetDCEx

  LoadMenuW

  CopyImage

  SendDlgItemMessageA

  ShowOwnedPopups

  WindowFromPoint

  ScreenToClient

  GetCursorPos

  SetWindowPos

  SetMenuItemInfoA

  UnionRect

  GetTabbedTextExtentW

  PostThreadMessageA

  CopyAcceleratorTableA

  GetNextDlgTabItem

  RedrawWindow

  ReleaseDC

  PeekMessageA

  InvalidateRect

  SetWindowLongA

  InflateRect

  GetDC

  PtInRect

  SendMessageA

  GetClientRect

  MessageBeep

  GetParent

  SetCapture

  PostQuitMessage

  GetWindowRect

  SetCursor

  IsMenu

  CopyRect

  ModifyMenuA

  DestroyIcon

  InsertMenuA

  UnregisterClassA

  GetSystemMetrics

  SystemParametersInfoA

  RemoveMenu

  GetMenuItemCount

  AppendMenuA

  LoadBitmapW

  GetSysColorBrush

  CreatePopupMenu

  GetMenuItemInfoA

  GetDesktopWindow

  TabbedTextOutA

  GetMenuState

  SetRect

  DrawTextExA

  DrawEdge

  GrayStringA

  CreateMenu

  DeleteMenu

  DrawIconEx

  GetSubMenu

  DrawTextA

  GetMenuItemID

  FillRect

  GetWindowLongA

  OffsetRect

  CharUpperA

  GetFocus

  GetKeyState

  EndDeferWindowPos

  BeginDeferWindowPos

  DeferWindowPos

  EqualRect

  GetDlgItem

  GetClassNameA

  OpenClipboard

  PostMessageA

  CloseClipboard

  IsWindowEnabled

  MessageBoxA

  GetWindowThreadProcessId

  GetLastActivePopup

  GetMenuStringA

  wsprintfA

  RegisterClassExA

  BlockInput

  ExitWindowsEx

  CheckMenuItem

  EnableMenuItem

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  GetAsyncKeyState

  EnableScrollBar

  HideCaret

  InvertRect

  NotifyWinEvent

  GetMenuDefaultItem

  WaitMessage

  IsClipboardFormatAvailable

  SetLayeredWindowAttributes

  EnumDisplayMonitors

  SetClipboardData

  EmptyClipboard

  DrawStateA

  LoadImageW

  DrawFrameControl

  UpdateLayeredWindow

  MonitorFromPoint

  TrackMouseEvent

  GetComboBoxInfo

  GetKeyboardLayout

  IsCharLowerA

  MapVirtualKeyExA

  RegisterClipboardFormatA

  GetKeyboardState

  ToAsciiEx

  CreateAcceleratorTableA

  DestroyAcceleratorTable

  SetClassLongPtrA

  GetDoubleClickTime

  CopyIcon

  SetMenuDefaultItem

  CharUpperBuffA

  FrameRect

  DrawMenuBar

  DefFrameProcA

  DefMDIChildProcA

  TranslateMDISysAccel

  GetUpdateRect

  SubtractRect

  MapDialogRect

  GetWindowRgn

  BringWindowToTop

  kernel32

  SetThreadExecutionState

  SetConsoleCtrlHandler

  DeviceIoControl

  CreateNamedPipeA

  CreateThread

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  ExitProcess

  AreFileApisANSI

  GetCommandLineA

  RtlLookupFunctionEntry

  RtlUnwindEx

  RtlPcToFileHeader

  GetSystemInfo

  VirtualAlloc

  VirtualQuery

  ExitThread

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapQueryInformation

  SetStdHandle

  GetFileType

  IsValidCodePage

  GetConsoleCP

  GetConsoleMode

  GetStdHandle

  GetSystemDirectoryA

  RtlCaptureContext

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  SetConsoleMode

  SetFilePointerEx

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStringTypeW

  ReadConsoleW

  LCMapStringW

  IsValidLocale

  EnumSystemLocalesW

  WriteConsoleW

  OutputDebugStringW

  CreateFileW

  SetEnvironmentVariableA

  ReadConsoleInputA

  GetStartupInfoW

  FindResourceExW

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetVersionExA

  HeapReAlloc

  HeapAlloc

  HeapFree

  GetProcessHeap

  InitializeCriticalSectionEx

  RaiseException

  GetLastError

  HeapSize

  DecodePointer

  GetModuleHandleA

  DeleteCriticalSection

  lstrlenA

  FindResourceW

  LoadResource

  WideCharToMultiByte

  SizeofResource

  lstrcatA

  LockResource

  CreateMutexA

  WinExec

  lstrcpyA

  WaitForSingleObject

  CloseHandle

  GetCurrentDirectoryA

  FindResourceA

  GetCPInfo

  MultiByteToWideChar

  lstrcmpiA

  GetVersion

  FreeResource

  GlobalLock

  GlobalUnlock

  GetCurrentProcessId

  GetModuleFileNameA

  SetLastError

  GlobalAlloc

  GlobalSize

  GlobalFree

  LocalFree

  MulDiv

  FormatMessageA

  CopyFileA

  GetCurrentThread

  GetCurrentThreadId

  LoadLibraryExW

  GlobalDeleteAtom

  lstrcmpA

  CompareStringA

  GetModuleHandleW

  GetPrivateProfileIntA

  GetPrivateProfileStringA

  WritePrivateProfileStringA

  OutputDebugStringA

  GetModuleFileNameW

  GetModuleHandleExW

  LoadLibraryW

  CreateActCtxW

  ActivateActCtx

  DeactivateActCtx

  FindActCtxSectionStringW

  QueryActCtxW

  GlobalAddAtomA

  GlobalGetAtomNameA

  SetEvent

  CreateEventA

  SetThreadPriority

  SuspendThread

  ResumeThread

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetSystemDirectoryW

  lstrcmpW

  GlobalFindAtomA

  GetDiskFreeSpaceA

  GetFileAttributesA

  GetFileTime

  GetFullPathNameA

  SetFileTime

  GetTempFileNameA

  ReplaceFileA

  SystemTimeToFileTime

  GetUserDefaultLCID

  CreateFileA

  DeleteFileA

  FindClose

  FindFirstFileA

  FlushFileBuffers

  GetFileSize

  LockFile

  ReadFile

  SetEndOfFile

  SetFilePointer

  UnlockFile

  WriteFile

  DuplicateHandle

  GetCurrentProcess

  LoadLibraryExA

  GetShortPathNameA

  MoveFileA

  GetVolumeInformationA

  GetThreadLocale

  GetStringTypeExA

  SetErrorMode

  FileTimeToSystemTime

  InitializeCriticalSection

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GlobalReAlloc

  GlobalHandle

  LocalAlloc

  LocalReAlloc

  GlobalFlags

  CompareStringW

  GetLocaleInfoW

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetACP

  GetOEMCP

  FileTimeToLocalFileTime

  GetFileAttributesExA

  GetFileSizeEx

  LocalFileTimeToFileTime

  GetWindowsDirectoryA

  VerSetConditionMask

  VerifyVersionInfoA

  GetTickCount

  GetProfileIntA

  GetTempPathA

  Sleep

  SearchPathA

  VirtualProtect

  advapi32

  RegOpenKeyExA

  RegQueryValueA

  RegCloseKey

  RegQueryValueExA

  StartServiceA

  OpenServiceA

  OpenSCManagerA

  DeleteService

  CreateServiceA

  ControlService

  CloseServiceHandle

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  OpenProcessToken

  RegSetValueA

  RegCreateKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegSetValueExA

  RegEnumKeyA

  SetFileSecurityA

  GetFileSecurityA

  RegOpenKeyExW

  RegEnumValueA

  RegEnumKeyExA

  gdi32

  CreatePen

  Escape

  PtVisible

  Ellipse

  Rectangle

  CreateCompatibleBitmap

  GetPixel

  SelectObject

  DeleteObject

  SetPixel

  GetDeviceCaps

  CreateDIBSection

  DeleteDC

  GetBkMode

  CreateHatchBrush

  PatBlt

  GetTextExtentPoint32W

  BitBlt

  GetCurrentObject

  CopyMetaFileA

  CreateDCA

  CreateBitmap

  CreatePatternBrush

  CreateRectRgn

  ExcludeClipRect

  GetClipBox

  GetCurrentPositionEx

  GetObjectType

  GetViewportExtEx

  GetWindowExtEx

  IntersectClipRect

  LineTo

  RestoreDC

  SaveDC

  SelectClipRgn

  ExtTextOutA

  CreateSolidBrush

  TextOutA

  GetTextExtentPoint32A

  CreateFontA

  CreateFontIndirectA

  GetObjectA

  GetStockObject

  CreateCompatibleDC

  GetBoundsRect

  FillRgn

  SetPaletteEntries

  ExtFloodFill

  SetPixelV

  PtInRegion

  FrameRgn

  RoundRect

  CreateRoundRectRgn

  OffsetRgn

  GetRgnBox

  EnumFontFamiliesExA

  Polyline

  Polygon

  CreatePolygonRgn

  SetDIBColorTable

  StretchBlt

  GetTextCharsetInfo

  EnumFontFamiliesA

  CreateDIBitmap

  RealizePalette

  GetSystemPaletteEntries

  GetPaletteEntries

  GetNearestPaletteIndex

  CreatePalette

  GetTextFaceA

  GetWindowOrgEx

  GetTextExtentPointA

  GetTextColor

  GetTextAlign

  GetStretchBltMode

  GetPolyFillMode

  GetNearestColor

  GetROP2

  GetBkColor

  SetRectRgn

  CombineRgn

  StretchDIBits

  GetCharWidthA

  GetTextMetricsA

  LPtoDP

  CreateEllipticRgn

  SetAbortProc

  AbortDoc

  EndPage

  StartPage

  EndDoc

  DPtoLP

  GetViewportOrgEx

  CreateRectRgnIndirect

  ScaleWindowExtEx

  ScaleViewportExtEx

  OffsetWindowOrgEx

  OffsetViewportOrgEx

  SetWindowOrgEx

  SetWindowExtEx

  SetViewportOrgEx

  SetViewportExtEx

  MoveToEx

  StartDocA

  SetTextAlign

  SetTextColor

  SetStretchBltMode

  SetROP2

  SetPolyFillMode

  GetLayout

  SetLayout

  SetMapMode

  SetBkMode

  SetBkColor

  SelectPalette

  ExtSelectClipRgn

  RectVisible

  msimg32

  AlphaBlend

  TransparentBlt

  comdlg32

  GetSaveFileNameA

  winspool.drv

  OpenPrinterA

  GetJobA

  ClosePrinter

  DocumentPropertiesA

  shell32

  SHAppBarMessage

  DragQueryFileA

  DragFinish

  SHGetFileInfoA

  ExtractIconA

  SHGetPathFromIDListA

  SHGetSpecialFolderLocation

  SHBrowseForFolderA

  SHGetDesktopFolder

  ShellExecuteA

  comctl32

  ImageList_Draw

  ImageList_GetIcon

  ImageList_GetImageCount

  shlwapi

  PathIsUNCA

  PathStripToRootA

  PathRemoveFileSpecW

  StrFormatKBSizeA

  PathFindFileNameA

  PathFindExtensionA

  uxtheme

  GetThemeColor

  GetWindowTheme

  DrawThemeBackground

  IsThemeBackgroundPartiallyTransparent

  DrawThemeParentBackground

  DrawThemeText

  OpenThemeData

  CloseThemeData

  GetThemePartSize

  IsAppThemed

  GetThemeSysColor

  GetCurrentThemeName

  ole32

  OleGetClipboard

  CoLockObjectExternal

  OleLockRunning

  CreateStreamOnHGlobal

  CoInitializeEx

  IsAccelerator

  OleTranslateAccelerator

  OleDestroyMenuDescriptor

  OleCreateMenuDescriptor

  CoDisconnectObject

  CoInitialize

  CoCreateInstance

  CoCreateGuid

  CoUninitialize

  ReleaseStgMedium

  OleDuplicateData

  CoTaskMemFree

  CoTaskMemAlloc

  StringFromCLSID

  DoDragDrop

  RegisterDragDrop

  RevokeDragDrop

  oleaut32

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  SysStringLen

  VariantChangeType

  VariantClear

  VariantInit

  SysAllocStringByteLen

  SysFreeString

  VariantCopy

  VarBstrFromDate

  LoadTypeLi

  SysAllocString

  SysAllocStringLen

  oleacc

  AccessibleObjectFromWindow

  LresultFromObject

  CreateStdAccessibleObject

  gdiplus

  GdiplusShutdown

  GdipAlloc

  GdipFree

  GdiplusStartup

  GdipCloneImage

  GdipDisposeImage

  GdipGetImageGraphicsContext

  GdipGetImageWidth

  GdipGetImageHeight

  GdipGetImagePixelFormat

  GdipGetImagePalette

  GdipGetImagePaletteSize

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromScan0

  GdipBitmapLockBits

  GdipBitmapUnlockBits

  GdipDeleteGraphics

  GdipDrawImageI

  GdipCreateBitmapFromHBITMAP

  GdipCreateFromHDC

  GdipSetInterpolationMode

  GdipDrawImageRectI

  imm32

  ImmReleaseContext

  ImmGetOpenStatus

  ImmGetContext

  winmm

  PlaySoundA

  Sections

  .text

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 775KB - Virtual size: 774KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 107KB - Virtual size: 2.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 98KB - Virtual size: 97KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 70KB - Virtual size: 69KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• req/Serials.bat
• req/UCOREDLL.DLL

  .dll windows:4 windows x86 arch:x86

  6b893ca0388ae7a60f134fafc899b16d

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetCurrentDirectoryA

  Sleep

  DeviceIoControl

  GetVersionExA

  GetCurrentProcess

  SetProcessAffinityMask

  GetLastError

  SetFilePointer

  WriteFile

  ReadFile

  CreateFileA

  GetFileSize

  CloseHandle

  GetTimeZoneInformation

  GetSystemTime

  GetLocalTime

  GetSystemTimeAsFileTime

  HeapFree

  HeapAlloc

  GetCommandLineA

  GetVersion

  EnterCriticalSection

  LeaveCriticalSection

  GetProcAddress

  GetModuleHandleA

  WideCharToMultiByte

  GetModuleFileNameA

  GetEnvironmentVariableA

  HeapDestroy

  HeapCreate

  VirtualFree

  VirtualAlloc

  HeapReAlloc

  InitializeCriticalSection

  DeleteCriticalSection

  ExitProcess

  RtlUnwind

  TerminateProcess

  GetCurrentThreadId

  TlsSetValue

  TlsAlloc

  TlsFree

  SetLastError

  TlsGetValue

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  InterlockedDecrement

  InterlockedIncrement

  MultiByteToWideChar

  GetStringTypeA

  GetStringTypeW

  GetCPInfo

  GetACP

  GetOEMCP

  LoadLibraryA

  FlushFileBuffers

  SetStdHandle

  LCMapStringA

  LCMapStringW

  CompareStringA

  CompareStringW

  SetEnvironmentVariableA

  advapi32

  StartServiceA

  OpenServiceA

  DeleteService

  CreateServiceA

  OpenSCManagerA

  CloseServiceHandle

  ControlService

  Exports

  Exports

  fnUCAPI_Compress

  fnUCAPI_Decompress

  fnUCAPI_DeleteModuleByID

  fnUCAPI_DeleteModuleByIndex

  fnUCAPI_DeleteNCB

  fnUCAPI_DeleteROMHole

  fnUCAPI_FreeDRVBy16Bit

  fnUCAPI_GETDMIDATA

  fnUCAPI_GetBiosCoreVersion

  fnUCAPI_GetBiosGroupInfo

  fnUCAPI_GetDRVVersion

  fnUCAPI_GetDllVersion

  fnUCAPI_GetInitGroupInfo

  fnUCAPI_GetModuleInfoByID

  fnUCAPI_GetModuleInfoByIndex

  fnUCAPI_GetNCBInfo

  fnUCAPI_GetNumberOfModules

  fnUCAPI_GetNumberOfNCBs

  fnUCAPI_GetNumberOfROMHoles

  fnUCAPI_GetROMHoleInfo

  fnUCAPI_GetRomImageGroupInfo

  fnUCAPI_InsertModule

  fnUCAPI_InsertNCB

  fnUCAPI_InsertROMHole

  fnUCAPI_LoadDRVBy16Bit

  fnUCAPI_LoadROMFile

  fnUCAPI_LoadSYSDriver

  fnUCAPI_LoadVxDDriver

  fnUCAPI_RebuildROM

  fnUCAPI_RegisterBiosGroup

  fnUCAPI_RegisterInitGroup

  fnUCAPI_RegisterRomImageGroup

  fnUCAPI_ReplaceModule

  fnUCAPI_ReplaceNCB

  fnUCAPI_ReplaceROMHole

  fnUCAPI_SETDMIDATA

  fnUCAPI_SetCallGate32

  fnUCAPI_SetSelector32

  fnUCAPI_SetSelectorPhy32

  fnUCAPI_UnloadROMFile

  fnUCAPI_UnloadSYSDriver

  fnUCAPI_UnloadVxDDriver

  Sections

  .text

  Size: 76KB - Virtual size: 73KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 231KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 8KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• req/UCORESYS.SYS

  .sys windows:4 windows x86 arch:x86

  072f277c4d89044b84c482307008a355

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  16-07-2004 00:00

  Not After

  15-07-2014 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  61:0c:12:06:00:00:00:00:00:1b

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-05-2006 17:01

  Not After

  23-05-2016 17:11

  Subject

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:df:d8:0b:28:26:71:65:54:b1:fb:8c:fa:50:43:d7

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Not Before

  30-09-2006 00:00

  Not After

  16-11-2009 23:59

  Subject

  CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  58:5d:db:1d:04:c7:4b:32:3b:2e:01:b5:59:b7:19:db:74:e5:e6:da

  Signer

  Actual PE Digest

  58:5d:db:1d:04:c7:4b:32:3b:2e:01:b5:59:b7:19:db:74:e5:e6:da

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntoskrnl.exe

  MmMapIoSpace

  MmUnmapIoSpace

  READ_REGISTER_UCHAR

  READ_REGISTER_USHORT

  READ_REGISTER_ULONG

  WRITE_REGISTER_UCHAR

  WRITE_REGISTER_USHORT

  WRITE_REGISTER_ULONG

  ZwClose

  ZwMapViewOfSection

  ObReferenceObjectByHandle

  ZwOpenSection

  MmUnmapLockedPages

  ZwUnmapViewOfSection

  IoDeleteDevice

  IoDeleteSymbolicLink

  MmAllocateNonCachedMemory

  MmFreeNonCachedMemory

  Ke386SetIoAccessMap

  Ke386IoSetAccessProcess

  IoGetCurrentProcess

  memmove

  IofCompleteRequest

  IoCreateSymbolicLink

  IoCreateDevice

  DbgPrint

  MmAllocateContiguousMemory

  MmIsAddressValid

  MmGetPhysicalAddress

  IoAllocateMdl

  MmFreeContiguousMemory

  MmBuildMdlForNonPagedPool

  MmMapLockedPages

  RtlInitUnicodeString

  IoFreeMdl

  hal

  KfLowerIrql

  WRITE_PORT_ULONG

  WRITE_PORT_USHORT

  WRITE_PORT_UCHAR

  READ_PORT_ULONG

  READ_PORT_USHORT

  READ_PORT_UCHAR

  HalTranslateBusAddress

  KfRaiseIrql

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 32B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  INIT

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 384B - Virtual size: 378B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• req/UCOREVXD.VXD
• req/UCOREW64.SYS

  .sys windows:4 windows x64 arch:x64

  0dcd262801389f839ce909cb173448e2

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  16-07-2004 00:00

  Not After

  15-07-2014 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  61:0c:12:06:00:00:00:00:00:1b

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-05-2006 17:01

  Not After

  23-05-2016 17:11

  Subject

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:df:d8:0b:28:26:71:65:54:b1:fb:8c:fa:50:43:d7

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Not Before

  30-09-2006 00:00

  Not After

  16-11-2009 23:59

  Subject

  CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  c5:51:73:b9:26:23:5b:86:78:bd:db:9b:49:a1:a8:b9:a9:2a:1a:da

  Signer

  Actual PE Digest

  c5:51:73:b9:26:23:5b:86:78:bd:db:9b:49:a1:a8:b9:a9:2a:1a:da

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  ntoskrnl.exe

  MmMapLockedPages

  MmBuildMdlForNonPagedPool

  IoAllocateMdl

  MmGetPhysicalAddress

  MmIsAddressValid

  MmAllocateContiguousMemory

  DbgPrint

  MmUnmapLockedPages

  MmMapIoSpace

  MmUnmapIoSpace

  IoFreeMdl

  ZwMapViewOfSection

  ObReferenceObjectByHandle

  ZwOpenSection

  RtlInitUnicodeString

  ZwUnmapViewOfSection

  IoDeleteDevice

  IoDeleteSymbolicLink

  IofCompleteRequest

  IoCreateSymbolicLink

  IoCreateDevice

  ZwClose

  MmFreeContiguousMemory

  hal

  HalTranslateBusAddress

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 160B - Virtual size: 144B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  INIT

  Size: 800B - Virtual size: 794B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• req/amifldrv64.sys

  .sys windows:6 windows x64 arch:x64

  363922cc73591e60f2af113182414230

  
  

  Code Sign

  61:20:4d:b4:00:00:00:00:00:27

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:45

  Not After

  15-04-2021 19:55

  Subject

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  24-06-2014 00:00

  Not After

  30-08-2017 12:00

  Subject

  SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

  Signer

  Actual PE Digest

  6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb

  Imports

  ntoskrnl.exe

  ZwMapViewOfSection

  RtlInitUnicodeString

  ZwUnmapViewOfSection

  ZwClose

  ObReferenceObjectByHandle

  ZwOpenSection

  MmUnmapLockedPages

  MmMapLockedPages

  MmFreeContiguousMemory

  MmBuildMdlForNonPagedPool

  IoFreeMdl

  MmGetPhysicalAddress

  MmMapIoSpace

  PsGetVersion

  MmIsAddressValid

  IoAllocateMdl

  MmAllocateContiguousMemory

  DbgPrint

  IoDeleteSymbolicLink

  IoDeleteDevice

  IofCompleteRequest

  IoCreateSymbolicLink

  IoCreateDevice

  KeBugCheckEx

  MmMapLockedPagesSpecifyCache

  MmUnmapIoSpace

  hal

  HalTranslateBusAddress

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 572B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 272B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  INIT

  Size: 1024B - Virtual size: 1010B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• req/applecleaner.exe

  .exe windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  Size: 54KB - Virtual size: 142KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  Size: 12KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Size: 3KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 49KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 512B - Virtual size: 300B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 49KB - Virtual size: 49KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .themida

  Size: - Virtual size: 5.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .boot

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16B - Virtual size: 4KB

  IMAGE_SCN_MEM_READ