vac v415 full[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

vac v415 full.rar
Size

564KB
MD5

fb02f8f49f460ee3fb5b457e4117cb21
SHA1

f3d362e31690b6b7f10d102d32dcb7dace25e242
SHA256

eda533334f0690bfd96b796212c8331fd1c7fe16e24a42de9a2bdcbe30bad9a6
SHA512

82ceca33ebfc927f2c9875b7f088f0c14d69b6e1e7be54b05f2d0db5a422ba0dd10f23396f5aafaa55566b90957a55778745b90f10edf535bd20f8961eaf1e9a
SSDEEP

12288:lHmpzNDx1RTkbGSLIvsHR1Bnlqs5C2dkqd8PJpQJI/cz4ryrOqvX:lGpNvRTszsMR1BnP42uc8PMI/cz4XqP

Score

1^/10

Malware Config

Signatures

Files

vac v415 full.rar
.rar
256cables/vrtaucbl.cat
256cables/vrtaucbl.inf
Beni Oku - Read Me.vbe
Ne ararsanız mevcut tılayın--indirin.url
file_id.diz
homepage.url
license.txt
readme.txt
removeservice.inf
setup.exe
.exe windows:6 windows x86 arch:x86

d6d6c4a0f2bd2f9b94944373b4a6f935

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ca:1f:bf:1b:3a:0a:c3:30:2f:b9:6c:68:fa:96:68:01:0a:9d:97:ad
Signer

Actual PE Digest

ca:1f:bf:1b:3a:0a:c3:30:2f:b9:6c:68:fa:96:68:01:0a:9d:97:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\music\win\setup\17x\objfre_wxp_x86\i386\setup.pdb

Imports

advapi32

GetUserNameW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
GetServiceDisplayNameW
DeleteService
StartServiceW
QueryServiceStatus
ControlService
RegQueryValueExW

kernel32

RemoveDirectoryW
CloseHandle
CreateEventW
WaitForSingleObject
CreateProcessW
GetEnvironmentVariableW
WriteFile
GetCurrentProcessId
SetEnvironmentVariableW
SetEvent
OpenProcess
CopyFileW
GetCurrentDirectoryW
LocalFree
RtlZeroMemory
GetVersionExW
GetSystemInfo
GetModuleHandleW
CreateFileW
CreateThread
GetPrivateProfileStringW
DeleteFileW
SetLastError
lstrcmpW
GetLocalTime
CreateDirectoryW
MultiByteToWideChar
GetACP
ReadFile
GetFileSize
SetEndOfFile
MoveFileExW
CompareStringW
lstrcmpiW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetTempPathW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetProcAddress
GetDriveTypeW
GetCurrentProcess
GetSystemDirectoryW
Sleep
GetTickCount
lstrcatW
lstrcpyW
lstrlenW
FlushFileBuffers
lstrlenA
GetProcessHeap
HeapAlloc
FormatMessageW
GetCommandLineW
GetLastError
ExitProcess
ProcessIdToSessionId
HeapFree

gdi32

SetTextColor
CreateSolidBrush
DeleteObject
SetBkColor

user32

GetMessageW
CreateDialogParamW
PostThreadMessageW
wvsprintfW
MessageBoxW
IsDialogMessageW
GetSystemMetrics
wsprintfA
DefWindowProcW
CreateWindowExW
GetDesktopWindow
TranslateMessage
DispatchMessageW
DestroyWindow
SetFocus
GetDlgItem
DialogBoxParamW
GetWindowTextW
SetWindowTextW
SendDlgItemMessageW
ShowWindow
ExitWindowsEx
wsprintfW
RegisterClassW
EndDialog

comctl32

ord17

ole32

CoInitialize
CoCreateInstance

shell32

SHGetSpecialFolderPathW
ShellExecuteW

shlwapi

wvnsprintfW

setupapi

CM_Get_DevNode_Status
CM_Locate_DevNodeW

rpcrt4

UuidCreate

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup.ini
setup64.exe
.exe windows:6 windows x64 arch:x64

cd8701aa4dcfe24e97fefd58db26598a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:0a:90:b4:4d:0c:22:f2:56:ee:85:08:ea:00:11:b4:97:2e:30:20
Signer

Actual PE Digest

19:0a:90:b4:4d:0c:22:f2:56:ee:85:08:ea:00:11:b4:97:2e:30:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\music\win\setup\17x\objfre_wnet_amd64\amd64\setup.pdb

Imports

advapi32

GetUserNameW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
GetServiceDisplayNameW
DeleteService
StartServiceW
QueryServiceStatus
ControlService
RegQueryValueExW

kernel32

RemoveDirectoryW
CloseHandle
CreateEventW
WaitForSingleObject
CreateProcessW
GetEnvironmentVariableW
WriteFile
GetCurrentProcessId
SetEnvironmentVariableW
SetEvent
OpenProcess
CopyFileW
GetCurrentDirectoryW
LocalFree
RtlZeroMemory
GetVersionExW
GetSystemInfo
GetModuleHandleW
CreateFileW
CreateThread
GetPrivateProfileStringW
DeleteFileW
SetLastError
lstrcmpW
GetLocalTime
CreateDirectoryW
MultiByteToWideChar
GetACP
ReadFile
GetFileSize
SetEndOfFile
MoveFileExW
CompareStringW
lstrcmpiW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetTempPathW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetProcAddress
GetDriveTypeW
GetCurrentProcess
GetSystemDirectoryW
Sleep
GetTickCount
lstrcatW
lstrcpyW
lstrlenW
FlushFileBuffers
lstrlenA
GetProcessHeap
HeapAlloc
FormatMessageW
GetCommandLineW
GetLastError
ExitProcess
ProcessIdToSessionId
HeapFree

gdi32

SetTextColor
CreateSolidBrush
DeleteObject
SetBkColor

user32

IsDialogMessageW
CreateDialogParamW
PostThreadMessageW
wvsprintfW
MessageBoxW
TranslateMessage
GetSystemMetrics
wsprintfA
DefWindowProcW
CreateWindowExW
GetDesktopWindow
DispatchMessageW
GetMessageW
DestroyWindow
SetFocus
GetDlgItem
DialogBoxParamW
GetWindowTextW
SetWindowTextW
SendDlgItemMessageW
ShowWindow
ExitWindowsEx
wsprintfW
RegisterClassW
EndDialog

comctl32

ord17

ole32

CoInitialize
CoCreateInstance

shell32

SHGetSpecialFolderPathW
ShellExecuteW

shlwapi

wvnsprintfW

setupapi

CM_Get_DevNode_Status
CM_Locate_DevNodeW

rpcrt4

UuidCreate

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vac.chm
.chm
vrtaucbl.cat
vrtaucbl.inf
x64/audiorepeater.exe
.exe windows:6 windows x64 arch:x64

46c2c2969708aa79937166d0ecfe684a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:4e:c4:18:1d:fb:89:71:5a:b7:29:e1:40:ca:4f:c8:6a:f5:cb:3f
Signer

Actual PE Digest

f1:4e:c4:18:1d:fb:89:71:5a:b7:29:e1:40:ca:4f:c8:6a:f5:cb:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\music\win\audiorepeater\1xxmme\objfre_wnet_amd64\amd64\audiorepeater.pdb

Imports

kernel32

RtlZeroMemory
SetThreadPriority
GetCurrentThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
WaitForSingleObject
Sleep
GetStartupInfoW
GetLastError
CreateThread
SetPriorityClass
GetTickCount
OpenProcess
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
GetModuleHandleW
lstrlenW
lstrcmpW
HeapFree
GetProcessHeap
HeapAlloc
lstrlenA
GetVersionExW
GetSystemInfo
FormatMessageW
SetLastError
QueryPerformanceFrequency
GetCommandLineW
ExitProcess
lstrcmpiW
GetProcAddress
lstrcpyW
FreeLibrary

user32

GetCursorPos
SetWindowLongPtrW
LoadMenuW
LoadIconW
EndDialog
TrackPopupMenuEx
ShowWindow
SetWindowTextW
GetSubMenu
DialogBoxParamW
FindWindowW
GetClassNameW
MessageBoxW
wvsprintfW
OpenClipboard
EmptyClipboard
GetWindowTextW
wsprintfW
HiliteMenuItem
SendDlgItemMessageW
GetDlgItem
EnableWindow
SendMessageW
SetDlgItemInt
PostMessageW
SetTimer
KillTimer
PostThreadMessageW
GetMessageW
CallWindowProcW
CloseClipboard
SetClipboardData

comctl32

ord17
ord16

shell32

Shell_NotifyIconW

winmm

waveInUnprepareHeader
waveOutGetDevCapsW
waveOutGetNumDevs
waveInGetDevCapsW
waveInGetNumDevs
waveInStart
waveOutGetErrorTextW
waveOutPrepareHeader
waveOutWrite
waveOutRestart
waveOutUnprepareHeader
waveInOpen
waveOutOpen
waveInPrepareHeader
waveInAddBuffer
waveInClose
waveOutClose
waveInReset
waveOutReset
waveOutPause

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/audiorepeater_ks.exe
.exe windows:6 windows x64 arch:x64

35a2abbb2c13c45852fd1790e0948f31

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:94:4c:2f:27:02:bd:d0:87:cb:18:47:9b:3d:8b:f9:19:ee:af:ff
Signer

Actual PE Digest

7f:94:4c:2f:27:02:bd:d0:87:cb:18:47:9b:3d:8b:f9:19:ee:af:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\music\win\audiorepeater\1xxks\objfre_wnet_amd64\amd64\audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

kernel32

SetEvent
GetLastError
GetOverlappedResult
GetTickCount
WaitForMultipleObjects
SetWaitableTimer
SetThreadPriority
GetCurrentThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
CreateWaitableTimerW
CreateEventW
RtlFillMemory
WaitForSingleObject
GetStartupInfoW
CreateThread
SetPriorityClass
RtlZeroMemory
GetCurrentProcessId
LoadLibraryW
GetProcAddress
QueryPerformanceFrequency
GetModuleHandleW
lstrlenW
lstrcmpW
SetLastError
FreeLibrary
DeviceIoControl
CreateFileW
GetProcessHeap
HeapAlloc
lstrlenA
RtlMoveMemory
GetVersionExW
GetSystemInfo
FormatMessageW
HeapFree
GetCommandLineW
ExitProcess
QueryPerformanceCounter
lstrcmpiW
lstrcpyW
OpenProcess

user32

EndDialog
SetTimer
ShowWindow
DialogBoxParamW
FindWindowW
GetClassNameW
wsprintfW
wvsprintfW
SetDlgItemTextW
OpenClipboard
EmptyClipboard
TrackPopupMenuEx
SetWindowTextW
LoadIconW
LoadMenuW
SetWindowLongPtrW
GetCursorPos
GetSubMenu
HiliteMenuItem
MessageBoxW
GetWindowTextW
SetClipboardData
CloseClipboard
KillTimer
PostMessageW
GetDlgItem
GetDlgItemInt
SetDlgItemInt
SendMessageW
EnableWindow
SendDlgItemMessageW
CallWindowProcW

comctl32

ord16
ord17

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDestroyDeviceInfoList

shell32

Shell_NotifyIconW

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/vcctlpan.exe
.exe windows:6 windows x64 arch:x64

1144a5dee9994bc46c5f3eba5cbcdc66

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:fc:dc:9b:7e:10:f0:c6:9b:a2:5e:4c:31:ca:d1:ac:75:39:99:43
Signer

Actual PE Digest

4d:fc:dc:9b:7e:10:f0:c6:9b:a2:5e:4c:31:ca:d1:ac:75:39:99:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\music\win\vac\4\4xx\ctlpan\objfre_win7_amd64\amd64\vcctlpan.pdb

Imports

advapi32

CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

GetCurrentProcess
RtlMoveMemory
FileTimeToSystemTime
lstrcatW
DeviceIoControl
SetLastError
GetLocalTime
lstrcmpiW
GetModuleHandleW
Sleep
GetModuleFileNameW
CreateMutexW
GetTickCount
RtlZeroMemory
CreateFileW
WriteFile
GetVersionExW
CloseHandle
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
LoadLibraryW
FreeLibrary
lstrlenA
FormatMessageW
GetSystemInfo
GetCommandLineW
ExitProcess
GetLastError
GetProcAddress
lstrcpyW
lstrlenW
HeapFree
GetSystemTimeAsFileTime

gdi32

ExcludeClipRect
RectVisible
CreateSolidBrush
MoveToEx
LineTo
SetBkMode
SetTextColor
GetTextExtentPoint32W
DeleteObject
CreateFontIndirectW
GetStockObject
GetObjectW
SelectObject

user32

SetDlgItemInt
GetDesktopWindow
wsprintfW
IsWindowVisible
wvsprintfW
IsWindowEnabled
SetWindowLongW
GetWindowLongW
SetFocus
ReleaseDC
FillRect
GetFocus
GetDC
GetClientRect
SetDlgItemTextW
UnregisterClassW
GetWindowLongPtrW
DefWindowProcW
CallWindowProcW
MessageBoxW
ChildWindowFromPoint
SetCursor
GetWindowTextW
GetSysColorBrush
ShowWindow
SendMessageW
DialogBoxParamW
LoadIconW
GetSystemMetrics
EnableWindow
SetTimer
GetDlgItemTextW
SetWindowLongPtrW
GetSysColor
SetWindowPos
EndDialog
SetWindowTextW
SystemParametersInfoW
LoadCursorW
GetParent
GetWindowRect
DestroyWindow
CreateDialogParamW
SendDlgItemMessageW
GetDlgItem

comctl32

ord17
ord16

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW

setupapi

SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 414B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/vrtaucbl.sys
.sys windows:6 windows x64 arch:x64

5e4ea19782ae41d806b419d9434fc1fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:b3:71:ab:98:1b:f6:df:c0:22:8a:5b:e1:88:9e:3b:ad:d5:e0:ad
Signer

Actual PE Digest

20:b3:71:ab:98:1b:f6:df:c0:22:8a:5b:e1:88:9e:3b:ad:d5:e0:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\music\win\vac\4\4xx\driver\objfre_win7_amd64\amd64\vrtaucbl.pdb

Imports

ntoskrnl.exe

ExSetTimerResolution
IoSetDeviceInterfaceState
RtlFreeUnicodeString
_wcsnicmp
IoRegisterDeviceInterface
wcsncpy
wcsrchr
IofCompleteRequest
__C_specific_handler
ProbeForRead
ProbeForWrite
ZwOpenKey
ZwCreateKey
ZwClose
__chkstk
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoReleaseCancelSpinLock
ObfDereferenceObject
IoGetCurrentProcess
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ExFreePool
IoGetDeviceInterfaces
_snwprintf
KeSetTimer
KeCancelTimer
KeWaitForSingleObject
_purecall
MmMapLockedPagesSpecifyCache
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitUnicodeString
RtlZeroMemory
RtlMoveMemory
PsGetCurrentProcessId
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
MmGetPhysicalAddress
KeSetSystemAffinityThread
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ZwQueryInformationProcess
PsInitialSystemProcess
PsGetCurrentThreadId
RtlGetVersion
KeNumberProcessors
ExAllocatePool
KeClearEvent
KeSetEvent
RtlCompareUnicodeString
KeInitializeTimerEx
KeWaitForMultipleObjects
KeInitializeMutex
KeReleaseMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeEvent
ZwQuerySystemInformation

hal

KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcInitializeAdapterDriver
PcForwardIrpSynchronous
PcDispatchIrp
PcAddAdapterDevice
PcNewPort
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcRegisterAdapterPowerManagement

ks.sys

KsAcquireResetValue
KsProbeStreamIrp

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 768B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/audiorepeater.exe
.exe windows:6 windows x86 arch:x86

eb085f1c17246f5730ee74456656526d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:db:7e:c1:21:d9:5c:62:c4:c8:7f:e3:a2:67:54:87:b0:5c:fa:34
Signer

Actual PE Digest

d9:db:7e:c1:21:d9:5c:62:c4:c8:7f:e3:a2:67:54:87:b0:5c:fa:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\music\win\audiorepeater\1xxmme\objfre_wxp_x86\i386\audiorepeater.pdb

Imports

kernel32

RtlZeroMemory
SetThreadPriority
GetCurrentThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
WaitForSingleObject
Sleep
GetLastError
CreateThread
SetPriorityClass
GetTickCount
GetStartupInfoW
OpenProcess
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
GetModuleHandleW
lstrlenW
lstrcmpW
HeapFree
GetProcessHeap
HeapAlloc
lstrlenA
GetVersionExW
GetSystemInfo
FormatMessageW
SetLastError
QueryPerformanceFrequency
GetCommandLineW
ExitProcess
lstrcmpiW
GetProcAddress
lstrcpyW
FreeLibrary

user32

GetCursorPos
SetTimer
ShowWindow
SetWindowLongW
EndDialog
TrackPopupMenuEx
LoadIconW
SetWindowTextW
GetSubMenu
DialogBoxParamW
FindWindowW
GetClassNameW
MessageBoxW
wvsprintfW
OpenClipboard
EmptyClipboard
GetWindowTextW
wsprintfW
HiliteMenuItem
SendDlgItemMessageW
GetDlgItem
EnableWindow
SendMessageW
SetDlgItemInt
PostMessageW
LoadMenuW
KillTimer
PostThreadMessageW
GetMessageW
CallWindowProcW
CloseClipboard
SetClipboardData

comctl32

ord17
ord16

shell32

Shell_NotifyIconW

winmm

waveInUnprepareHeader
waveInStart
waveOutGetDevCapsW
waveOutGetNumDevs
waveInGetDevCapsW
waveInGetNumDevs
waveOutGetErrorTextW
waveOutPrepareHeader
waveOutWrite
waveOutRestart
waveOutUnprepareHeader
waveOutOpen
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInClose
waveOutClose
waveInReset
waveOutReset
waveOutPause

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/audiorepeater_ks.exe
.exe windows:6 windows x86 arch:x86

aafd27ce5f8bdceaee627983c477b757

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:08:ab:ac:8b:ae:61:a6:36:40:c1:a7:4c:4f:e3:5c:87:b8:0b:22
Signer

Actual PE Digest

a4:08:ab:ac:8b:ae:61:a6:36:40:c1:a7:4c:4f:e3:5c:87:b8:0b:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\music\win\audiorepeater\1xxks\objfre_wxp_x86\i386\audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

kernel32

SetEvent
GetLastError
GetOverlappedResult
GetTickCount
WaitForMultipleObjects
SetWaitableTimer
SetThreadPriority
GetCurrentThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
CreateWaitableTimerW
CreateEventW
RtlFillMemory
WaitForSingleObject
CreateThread
SetPriorityClass
GetStartupInfoW
RtlZeroMemory
GetCurrentProcessId
LoadLibraryW
GetProcAddress
QueryPerformanceFrequency
GetModuleHandleW
lstrlenW
lstrcmpW
SetLastError
FreeLibrary
DeviceIoControl
CreateFileW
GetProcessHeap
HeapAlloc
lstrlenA
RtlMoveMemory
GetVersionExW
GetSystemInfo
FormatMessageW
HeapFree
GetCommandLineW
ExitProcess
QueryPerformanceCounter
lstrcmpiW
lstrcpyW
OpenProcess

user32

LoadIconW
SetWindowTextW
wsprintfW
DialogBoxParamW
FindWindowW
GetClassNameW
LoadMenuW
wvsprintfW
SetDlgItemTextW
OpenClipboard
EmptyClipboard
TrackPopupMenuEx
EndDialog
SetWindowLongW
ShowWindow
SetTimer
GetCursorPos
GetSubMenu
HiliteMenuItem
MessageBoxW
GetWindowTextW
SetClipboardData
CloseClipboard
KillTimer
PostMessageW
GetDlgItem
GetDlgItemInt
SetDlgItemInt
SendMessageW
EnableWindow
SendDlgItemMessageW
CallWindowProcW

comctl32

ord16
ord17

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDestroyDeviceInfoList

shell32

Shell_NotifyIconW

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/vcctlpan.exe
.exe windows:6 windows x86 arch:x86

235c8b8e1fb535fad1610099b5554908

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:10:31:03:01:f1:03:7c:33:17:ac:3c:b8:47:28:fe:4d:06:3a:69
Signer

Actual PE Digest

6d:10:31:03:01:f1:03:7c:33:17:ac:3c:b8:47:28:fe:4d:06:3a:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\music\win\vac\4\4xx\ctlpan\objfre_win7_x86\i386\vcctlpan.pdb

Imports

advapi32

CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

GetCurrentProcess
RtlMoveMemory
FileTimeToSystemTime
lstrcatW
DeviceIoControl
SetLastError
GetLocalTime
lstrcmpiW
GetModuleHandleW
Sleep
GetModuleFileNameW
CreateMutexW
GetTickCount
RtlZeroMemory
CreateFileW
WriteFile
GetVersionExW
CloseHandle
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
LoadLibraryW
FreeLibrary
lstrlenA
FormatMessageW
GetSystemInfo
GetCommandLineW
ExitProcess
GetLastError
GetProcAddress
lstrcpyW
HeapFree
lstrlenW
GetSystemTimeAsFileTime

gdi32

ExcludeClipRect
RectVisible
CreateSolidBrush
MoveToEx
LineTo
CreateFontIndirectW
GetStockObject
DeleteObject
SetBkMode
SetTextColor
SelectObject
GetTextExtentPoint32W
GetObjectW

user32

LoadIconW
GetDesktopWindow
wsprintfW
IsWindowVisible
wvsprintfW
IsWindowEnabled
GetWindowLongW
SetFocus
ReleaseDC
FillRect
GetFocus
GetDC
GetClientRect
SendMessageW
UnregisterClassW
DefWindowProcW
CallWindowProcW
MessageBoxW
GetDlgItem
SetWindowTextW
SystemParametersInfoW
LoadCursorW
EnableWindow
GetSystemMetrics
SetTimer
DialogBoxParamW
ShowWindow
GetDlgItemTextW
SetDlgItemInt
SetDlgItemTextW
SetWindowLongW
GetParent
GetWindowRect
SetWindowPos
GetSysColorBrush
GetSysColor
GetWindowTextW
ChildWindowFromPoint
SetCursor
DestroyWindow
CreateDialogParamW
SendDlgItemMessageW
EndDialog

comctl32

ord17
ord16

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW

setupapi

SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/vrtaucbl.sys
.sys windows:6 windows x86 arch:x86

f2da9c64ea7a805da2aa85f3936313f3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-05-2013 18:32

Not After

17-05-2016 18:32

Subject

CN=Muzychenko Evgenii Viktorovich,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:55

Not After

15-04-2021 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:c2:1c:22:e4:5a:2d:db:ac:00:d2:c5:ad:00:3f:16:fd:31:c1:c1
Signer

Actual PE Digest

d8:c2:1c:22:e4:5a:2d:db:ac:00:d2:c5:ad:00:3f:16:fd:31:c1:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\music\win\vac\4\4xx\driver\objfre_win7_x86\i386\vrtaucbl.pdb

Imports

ntoskrnl.exe

IoRegisterDeviceInterface
ExSetTimerResolution
IoSetDeviceInterfaceState
RtlFreeUnicodeString
_wcsnicmp
memcpy
wcsncpy
wcsrchr
IofCompleteRequest
ProbeForRead
ProbeForWrite
ZwOpenKey
ZwCreateKey
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
InterlockedExchange
IoReleaseCancelSpinLock
ObfDereferenceObject
IoGetCurrentProcess
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ExFreePool
IoGetDeviceInterfaces
_snwprintf
KeSetTimer
KeCancelTimer
KeWaitForSingleObject
KeInitializeTimerEx
RtlZeroMemory
memset
MmMapLockedPagesSpecifyCache
KeQueryInterruptTime
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlCompareUnicodeString
RtlUnwind
PsGetCurrentProcessId
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
MmGetPhysicalAddress
KeSetSystemAffinityThread
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ZwQueryInformationProcess
PsInitialSystemProcess
PsGetCurrentThreadId
RtlGetVersion
KeNumberProcessors
ExAllocatePool
KeClearEvent
KeSetEvent
_purecall
RtlInitUnicodeString
RtlMoveMemory
KeInitializeMutex
KeReleaseMutex
KeInitializeSpinLock
KeWaitForMultipleObjects
KeGetCurrentThread
KeInitializeEvent
ZwQuerySystemInformation

hal

KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql
KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcInitializeAdapterDriver
PcForwardIrpSynchronous
PcDispatchIrp
PcAddAdapterDevice
PcNewPort
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcRegisterAdapterPowerManagement

ks.sys

KsProbeStreamIrp
KsAcquireResetValue

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6d6c4a0f2bd2f9b94944373b4a6f935

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4aCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

ca:1f:bf:1b:3a:0a:c3:30:2f:b9:6c:68:fa:96:68:01:0a:9d:97:adSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

ole32

shell32

shlwapi

setupapi

rpcrt4

Sections

.text Size: 66KB - Virtual size: 66KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

cd8701aa4dcfe24e97fefd58db26598a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4aCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

19:0a:90:b4:4d:0c:22:f2:56:ee:85:08:ea:00:11:b4:97:2e:30:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

ole32

shell32

shlwapi

setupapi

rpcrt4

Sections

.text Size: 79KB - Virtual size: 78KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 444B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

ca:1f:bf:1b:3a:0a:c3:30:2f:b9:6c:68:fa:96:68:01:0a:9d:97:ad
Signer

.text
Size: 66KB - Virtual size: 66KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

19:0a:90:b4:4d:0c:22:f2:56:ee:85:08:ea:00:11:b4:97:2e:30:20
Signer

.text
Size: 79KB - Virtual size: 78KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 444B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

f1:4e:c4:18:1d:fb:89:71:5a:b7:29:e1:40:ca:4f:c8:6a:f5:cb:3f
Signer

.text
Size: 28KB - Virtual size: 27KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 984B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 140B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:6a:b7:18:6b:19:12:d9:35:60:38:c6:13:bc:28:92:4a
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

7f:94:4c:2f:27:02:bd:d0:87:cb:18:47:9b:3d:8b:f9:19:ee:af:ff
Signer

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 512B - Virtual size: 218B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate