BT502[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BT502.zip
Size

76.5MB
MD5

2d8db4d6dab6b3d5ecf552520d09be18
SHA1

5bb318080d079ebb23460dc4fb9a51cac2f1e9d1
SHA256

e5284e33921c150f56ea551ac1418014b465ecfa53671a73e753bd42b7b95eb0
SHA512

ce6a56198c81bc2f3ce00f77dbfbbaad235e6f32dbfb96a9e03da7aa6eefb644ad8c7e279ff8842d7447d60c96ecbc81c52c6f1e39542d73de561f5e5511b62d
SSDEEP

1572864:iPo/mXPRmcA2JYSDm++fYmr3Nzqs38WsZ0S5rMzh+7V4G18kak7a9KRES39tWtn7:iHj2+B4G18C7LREStInXlWmd1kUrOHfe

Score

6^/10

pdf evasion link

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

HTTP links in PDF interactive object 2 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/doc/Realtek_Linux_Bluetooth_Porting_Guide.pdf	pdf_with_link_action
static1/unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/doc/Realtek_Linux_Bluetooth_Porting_Guide_English.pdf	pdf_with_link_action

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/RtkBtManServ.exe
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/RtkBtManServ.exe
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkBtfilter.sys
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/ISSetup.dll
unpack001/RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/setup.exe

Files

BT502.zip
.zip
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0402.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0403.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0404.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0405.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0406.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0407.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0408.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0409.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x040a.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x040b.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x040c.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x040e.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0410.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0411.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0412.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0413.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0414.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0415.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0416.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0418.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0419.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x041a.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x041b.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x041d.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x041e.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x041f.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0421.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0424.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x042d.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0804.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0816.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0c0c.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/0x0c1a.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BTIsConfig.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/Readme.txt
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/ReleaseNotes_for_Realtek_BT_Linux.txt
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/doc/Realtek_Linux_Bluetooth_Porting_Guide.pdf
.pdf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/doc/Realtek_Linux_Bluetooth_Porting_Guide_English.pdf
.pdf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/fw_btcoex_ver_table.txt
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723b_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723b_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723du_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723du_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723fu_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8723fu_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8725au_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8725au_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761a_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761au8192ee_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761au8812ae_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761au_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761aw_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761aw_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761bu_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8761bu_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8821a_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8821a_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8821cu_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8821cu_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8822bu_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8822bu_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8822cu_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8822cu_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8852au_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtl8852au_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723b_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723b_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723d_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723d_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723fs_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8723fs_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8725as_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8725as_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8761a_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8761a_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8761at8192ee_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8761b_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8761b_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8821a_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8821a_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8821c_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8821c_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8822b_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8822b_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8822cs_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8822cs_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8852as_config
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/rtkbt-firmware/lib/firmware/rtlbt/rtl8852as_fw
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/Kconfig
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/hci_h4.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/hci_ldisc.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/hci_rtk_h5.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/hci_uart.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/rtk_coex.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/bluetooth_uart_driver/rtk_coex.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/hciattach.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/hciattach.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/hciattach_h4.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/hciattach_h4.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/hciattach_rtk.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/rtb_fwc.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/uart/rtk_hciattach/rtb_fwc.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/Makefile
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_bt.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_bt.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_coex.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_coex.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_misc.c
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/20201202_LINUX_BT_DRIVER(32850)/20201202_LINUX_BT_DRIVER/usb/bluetooth_usb_driver/rtk_misc.h
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/DPInst.exe
.exe windows:6 windows x64 arch:x64

3eacb9638877275335da4b58e52824f8

Code Sign

33:00:00:00:42:13:73:74:0a:c9:1a:0f:03:00:00:00:00:00:42
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/03/2017, 19:05

Not After

01/06/2018, 19:05

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:ef:c5:fb:49:a6:94:f1:73:23:09:11:a9:e2:00:4d:c6:dc:a1:cf:27:41:17:d9:ef:bf:44:75:d3:e7:0b:e7
Signer

Actual PE Digest

79:ef:c5:fb:49:a6:94:f1:73:23:09:11:a9:e2:00:4d:c6:dc:a1:cf:27:41:17:d9:ef:bf:44:75:d3:e7:0b:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

DpInst.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
IsTextUnicode
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
DeleteService
CloseServiceHandle
ControlService
StartServiceW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
QueryServiceStatus
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
CheckTokenMembership

kernel32

CreateMutexW
ReleaseMutex
SetFilePointer
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
GetProcAddress
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleOutputW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
FreeConsole
FreeLibrary
WriteConsoleOutputW
WriteConsoleW
IsValidLocale
VirtualProtect
Sleep
GetFileAttributesW
DeleteFileW
FormatMessageW
RaiseException
CopyFileW
SetFileAttributesW
GetTempFileNameW
FindClose
FindNextFileW
CompareStringW
lstrcmpW
FindFirstFileW
lstrlenW
UnmapViewOfFile
GetConsoleScreenBufferInfo
CreateFileMappingW
LCMapStringW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
SetEndOfFile
CreateEventW
SetEvent
LocalReAlloc
DeviceIoControl
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
GetShortPathNameW
RemoveDirectoryW
MoveFileExW
CreateDirectoryW
GetFullPathNameW
SetLastError
GetLocaleInfoW
LoadLibraryExW
GetSystemDefaultUILanguage
SearchPathW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
GetEnvironmentVariableW
lstrcmpiW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
GetFileSize
CreateThread
SetThreadLocale
GetThreadLocale
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetCurrentProcess
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
SetCurrentDirectoryW
GetUserDefaultUILanguage
EnumResourceLanguagesW
GetModuleFileNameW
GetExitCodeProcess
WaitForSingleObject
LocalFree
GlobalFree
LocalAlloc
GetLastError
GetCommandLineW
CloseHandle
MapViewOfFile

gdi32

CreateBitmap
CreateCompatibleBitmap
GetObjectW
DeleteDC
SetLayout
CreateCompatibleDC
EndPage
StartPage
EndDoc
StartDocW
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
DeleteObject
SelectObject

user32

DestroyIcon
CreateIconIndirect
DrawIconEx
GetIconInfo
LoadIconW
LoadBitmapW
CharLowerW
UnregisterClassA
PostQuitMessage
DefWindowProcW
RegisterClassExW
CreateWindowExW
ShowWindow
AllowSetForegroundWindow
DialogBoxParamW
SetDlgItemTextW
EndDialog
MessageBoxW
GetDlgItem
SendMessageW
GetProcessWindowStation
GetUserObjectInformationW
LoadImageW
SetWindowTextW
PostMessageW
GetParent
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
SendDlgItemMessageW
InvalidateRect
GetSystemMetrics
GetSysColor
DestroyWindow
SetWindowLongW
SystemParametersInfoW
GetDC
ReleaseDC
DrawTextExW

msvcrt

_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_resetstkoflw
__C_specific_handler
memset
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
fread
_initterm
fclose
fwprintf
_wfopen
realloc
??2@YAPEAX_K@Z
wcsstr
_wcsicmp
_wtol
_vscwprintf
free
malloc
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
memcpy
memmove
_CxxThrowException
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
_wcsnicmp
_vsnwprintf
wcsncmp
bsearch
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
iswalpha
??_U@YAPEAX_K@Z
wcschr
wcspbrk
wcsrchr
iswdigit
feof
memcmp

ntdll

NtQueryInformationToken
RtlNtStatusToDosError
NtClose
NtOpenThreadToken
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenProcessToken

shell32

ord59
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
pSetupSetGlobalFlags
SetupDefaultQueueCallbackW
pSetupGetGlobalFlags
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupGetFieldCount
SetupGetIntField
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupFindNextLine
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupPromptReboot
SetupDiGetDeviceInstanceIdW
SetupFindFirstLineW
SetupOpenAppendInfFileW
SetupGetLineCountW
SetupDiGetActualSectionToInstallW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetSelectedDriverW
SetupCommitFileQueueW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupQueueCopyW
CMP_WaitNoPendingInstallEvents
SetupCloseFileQueue
SetupOpenFileQueue
SetupDiGetDriverInfoDetailW
SetupDiSetClassInstallParamsW
SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupInstallFilesFromInfSectionW
SetupDiCallClassInstaller
SetupDiClassNameFromGuidW
SetupDiOpenClassRegKey
CM_Enumerate_Classes
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Query_And_Remove_SubTreeW
CM_Setup_DevNode
CM_Get_Device_IDW
SetupCopyOEMInfW
SetupGetTargetPathW

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString
VariantChangeType

comctl32

PropertySheetW
CreatePropertySheetPageW
ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor

comdlg32

PrintDlgExW
GetSaveFileNameW

crypt32

CertFreeCTLContext
CertFreeCertificateContext
CertGetCTLContextProperty
CryptQueryObject

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 470KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/PidVid_List.dll
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/RtkBtManServ.exe
.exe windows:6 windows x64 arch:x64

c2d9fde39619d57abf8b5d597c886bd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

Imports

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapSize
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-1-0

CreateMutexW
WaitForSingleObject
ReleaseMutex
ResetEvent
EnterCriticalSection
LeaveCriticalSection
CreateEventW
OpenEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSectionEx
SetEvent
InitializeCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcess
OpenProcessToken
ExitThread
CreateProcessAsUserW
GetCurrentThreadId
ResumeThread
SuspendThread
GetCurrentThread
GetExitCodeProcess
CreateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
LockResource
FindResourceExW
FreeLibraryAndExitThread
LoadResource
SizeofResource

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
AdjustTokenPrivileges
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryInfoKeyW

api-ms-win-devices-config-l1-1-1

CM_Get_Device_IDW
CM_Get_Device_ID_List_SizeW
CM_Register_Notification
CM_Unregister_Notification
CM_Get_Parent
CM_Get_Device_ID_ListW
CM_Enable_DevNode
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Disable_DevNode
CM_Get_Device_Interface_PropertyW

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
SetEndOfFile
GetFileType
ReadFile
CreateDirectoryW
FindClose
DeleteFileW
FindFirstFileExW
FindNextFileW
GetFileSize
SetFilePointerEx
FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetLocalTime
GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GetSystemDirectoryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceW
CreateServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32NextW
Process32FirstW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
GlobalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
FreeEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32GetModuleBaseNameW
K32EnumProcesses

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalHandle
GlobalUnlock

rpcrt4

UuidToStringW
RpcStringFreeW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle
WlanCloseHandle
WlanFreeMemory
WlanQueryInterface
WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiBuildDriverInfoList
SetupDiSetClassInstallParamsW
SetupDiEnumDriverInfoW
SetupDiSetDeviceInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsFree
FlsAlloc
FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
CompareStringW
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

LCMapStringW
IsValidCodePage
GetACP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetOEMCP
EnumSystemLocalesW
GetCPInfo

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
ReadConsoleW
WriteConsoleW
GetConsoleCP
GetConsoleMode

Sections

.text
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/RtkBtfilter.sys
.sys windows:10 windows x64 arch:x64

0938bf20fb0bec4662124a43188b3202

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win10Release\x64\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
MmGetSystemRoutineAddress
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeInitializeEvent
RtlEqualUnicodeString
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
RtlTimeToTimeFields
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 490KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 162KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X64/rtl8761b_mp_chip_bt40_fw_asic_rom_patch_new.dll
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/DPInst.exe
.exe windows:6 windows x86 arch:x86

3ab7cc62e4963955ad408cd420cd8ef1

Code Sign

33:00:00:00:42:13:73:74:0a:c9:1a:0f:03:00:00:00:00:00:42
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/03/2017, 19:05

Not After

01/06/2018, 19:05

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:e8:89:46:2c:5e:5e:5d:b5:f6:4c:5e:ad:e8:52:40:7c:3b:84:7b:61:e8:f4:d4:18:2e:af:c8:78:93:c5:17
Signer

Actual PE Digest

a0:e8:89:46:2c:5e:5e:5d:b5:f6:4c:5e:ad:e8:52:40:7c:3b:84:7b:61:e8:f4:d4:18:2e:af:c8:78:93:c5:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DpInst.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
IsTextUnicode
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetEntriesInAclW
DeleteService
StartServiceW
ControlService
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatus
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetFileAttributesW
DeleteFileW
ReleaseMutex
SetFilePointer
HeapFree
GetProcessHeap
HeapAlloc
CreateMutexW
FreeConsole
SetConsoleMode
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
FreeLibrary
FillConsoleOutputCharacterW
ReadConsoleOutputW
GetConsoleMode
GetStdHandle
GetProcAddress
LoadLibraryW
WriteConsoleW
IsValidLocale
lstrlenW
lstrcmpW
CompareStringW
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
SetFileAttributesW
FormatMessageW
RaiseException
GetFileSize
CreateFileMappingW
MapViewOfFile
WriteConsoleOutputW
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
CreateFileW
WriteFile
CreateThread
WaitForMultipleObjectsEx
InterlockedCompareExchange
WaitForSingleObjectEx
SetEvent
CreateEventW
GetExitCodeProcess
DeviceIoControl
VerSetConditionMask
VerifyVersionInfoW
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetFullPathNameW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
MoveFileExW
SearchPathW
GetSystemDefaultUILanguage
LoadLibraryExW
CreateFileA
SetEndOfFile
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleCP
GetLocaleInfoA
Sleep
LoadLibraryExA
ReadFile
LCMapStringW
LCMapStringA
GetThreadLocale
SetThreadLocale
GetUserDefaultUILanguage
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameW
SetCurrentDirectoryW
WaitForSingleObject
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
ExitProcess
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetStartupInfoW
GetEnvironmentVariableW
lstrcmpiW
WideCharToMultiByte
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
LocalAlloc
GlobalFree
LocalFree
MultiByteToWideChar
GetCurrentProcess
GetLastError
CloseHandle
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceLanguagesW
LocalReAlloc
EnterCriticalSection

gdi32

SetLayout
DeleteDC
GetObjectW
CreateCompatibleBitmap
CreateBitmap
SelectObject
StartPage
EndPage
StartDocW
EndDoc
GetTextMetricsW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC

user32

AllowSetForegroundWindow
DefWindowProcW
PostQuitMessage
GetUserObjectInformationW
GetProcessWindowStation
GetIconInfo
DrawIconEx
CreateIconIndirect
LoadIconW
LoadBitmapW
DrawTextExW
LoadImageW
GetSystemMetrics
GetSysColor
DestroyWindow
GetWindowLongW
SendDlgItemMessageW
InvalidateRect
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowLongW
SetWindowTextW
GetParent
PostMessageW
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
DestroyIcon
DialogBoxParamW
SetDlgItemTextW
CharLowerW
GetDlgItem
SendMessageW
MessageBoxW
RegisterClassExW
CreateWindowExW
ShowWindow
UnregisterClassA
EndDialog

ntdll

RtlNtStatusToDosError
NtOpenThreadToken
NtQueryInformationToken
NtOpenProcessToken
RtlUnwind
NtClose

shell32

SHGetFolderPathW
ShellExecuteExW
ord59
CommandLineToArgvW

setupapi

SetupDiClassNameFromGuidW
SetupDiOpenClassRegKey
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupGetLineCountW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetStringFieldW
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupGetFieldCount
SetupGetIntField
SetupOpenAppendInfFileW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiGetSelectedDriverW
SetupDiGetDriverInfoDetailW
CM_Enumerate_Classes
CM_Get_DevNode_Status
SetupDiCreateDeviceInfoList
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupGetTargetPathW
SetupQueueCopyIndirectW
SetupQueueCopyW
SetupOpenFileQueue
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupTermDefaultQueueCallback
SetupCloseFileQueue
SetupCopyOEMInfW
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Setup_DevNode
SetupDiEnumDeviceInfo
CMP_WaitNoPendingInstallEvents
CM_Query_And_Remove_SubTreeW

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

ole32

CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantInit
VariantClear
VariantChangeType
SysAllocString
SysFreeString

comctl32

CreatePropertySheetPageW
ImageList_ReplaceIcon
ImageList_SetBkColor
PropertySheetW
ImageList_Create

comdlg32

PrintDlgExW
GetSaveFileNameW

crypt32

CertFreeCertificateContext
CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 470KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/PidVid_List.dll
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/RtkBtManServ.exe
.exe windows:6 windows x86 arch:x86

a4ef8a2edbab2888f2f90415cc3e0b17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\Win32\Win10 Release\RtkBtManServ.pdb

Imports

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize
HeapDestroy

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
SetEvent
InitializeCriticalSection
CreateEventW
ResetEvent
OpenEventW
ReleaseMutex
WaitForSingleObject
CreateMutexW
InitializeCriticalSectionEx

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsAlloc
GetStartupInfoW
TlsFree
SuspendThread
GetCurrentThread
CreateProcessAsUserW
GetCurrentProcessId
GetCurrentProcess
CreateThread
ExitThread
ExitProcess
GetCurrentThreadId
TerminateProcess
TlsSetValue
GetExitCodeProcess
OpenProcessToken
ResumeThread

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibraryAndExitThread
FreeLibrary
GetModuleFileNameW
LockResource
SizeofResource
GetModuleHandleExW
FindResourceExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor
SetTokenInformation
AdjustTokenPrivileges
SetSecurityDescriptorDacl
DuplicateTokenEx

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegNotifyChangeKeyValue

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Get_Parent
CM_Get_DevNode_Status
CM_Get_Device_Interface_PropertyW
CM_Locate_DevNodeW
CM_Disable_DevNode
CM_Enable_DevNode
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-file-l1-1-0

FlushFileBuffers
SetFilePointerEx
GetFileSize
DeleteFileW
FindClose
GetFileType
WriteFile
ReadFile
FindFirstFileExW
CreateFileW
CreateDirectoryW
SetEndOfFile
FindNextFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount64
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

CloseServiceHandle
CreateServiceW
StartServiceW
DeleteService
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetEnvironmentStringsW
SetStdHandle
ExpandEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalLock
GlobalUnlock

rpcrt4

UuidToStringW
RpcStringFreeW

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory
WlanOpenHandle
WlanEnumInterfaces
WlanQueryInterface
WlanCloseHandle

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiEnumDriverInfoW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiBuildDriverInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiSetClassInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceRegistryPropertyW

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsAlloc
FlsGetValue
FlsFree

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetCPInfo
IsValidLocale
GetLocaleInfoW
GetOEMCP
GetACP

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
WriteConsoleW
ReadConsoleW
GetConsoleCP
GetConsoleMode

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/RtkBtfilter.sys
.sys windows:10 windows x86 arch:x86

b8561d87a083577e8d2f69230297cbf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win10Release\Win32\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeQuerySystemTime
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
MmGetSystemRoutineAddress
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeWaitForSingleObject
RtlEqualUnicodeString
KeGetCurrentThread
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeSpinLock
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
KeWaitForMultipleObjects
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlTimeToTimeFields
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 421KB - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win10X86/rtl8761b_mp_chip_bt40_fw_asic_rom_patch_new.dll
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkA2dp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkA2dp.sys
.sys windows:6 windows x64 arch:x64

1988cc1f58bd5c405099bb9e854b7152

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:21:de:86:87:12:8c:2e:8f:e2:2e:e8:d6:3c:52:68:7e:c0:03:72:aa:c1:b5:06:b0:8f:44:69:ac:6e:2a:44
Signer

Actual PE Digest

85:21:de:86:87:12:8c:2e:8f:e2:2e:e8:d6:3c:52:68:7e:c0:03:72:aa:c1:b5:06:b0:8f:44:69:ac:6e:2a:44

Digest Algorithm

sha256

PE Digest Matches

true

d5:d8:a4:47:e6:fc:74:a7:e1:c3:c2:dd:96:89:79:44:7d:10:62:96
Signer

Actual PE Digest

d5:d8:a4:47:e6:fc:74:a7:e1:c3:c2:dd:96:89:79:44:7d:10:62:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\btsw\hostsw\profiles\audio\a2dp\amd64\RtkA2dp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
IoFreeIrp
IoSetCompletionRoutineEx
IoAllocateIrp
IofCallDriver
IoAcquireRemoveLockEx
KeClearEvent
KeResetEvent
ExInitializeNPagedLookasideList
RtlInitUnicodeString
ExpInterlockedPushEntrySList
ZwSetValueKey
IoReleaseRemoveLockEx
RtlInitString
KeReleaseSpinLock
RtlUTF8ToUnicodeN
ExpInterlockedPopEntrySList
ObQueryNameString
ZwClose
ExQueryDepthSList
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
ObfDereferenceObject
IoOpenDeviceRegistryKey
RtlDeleteRegistryValue
ExDeleteNPagedLookasideList
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
PsCreateSystemThread
ExInterlockedInsertTailList
PsTerminateSystemThread
ExFreePool
ExInterlockedRemoveHeadList
ObfReferenceObject
KeWaitForMultipleObjects
IoWMIRegistrationControl
IoDeleteSymbolicLink
IoWMIWriteEvent
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDeleteDevice
RtlCheckRegistryKey
MmGetSystemRoutineAddress
RtlQueryRegistryValues
IoCsqInsertIrp
RtlEqualUnicodeString
KeSetTimerEx
RtlFreeUnicodeString
IoCsqInitialize
IofCompleteRequest
IoCsqRemoveNextIrp
RtlWriteRegistryValue
RtlCompareMemory
IoCreateSymbolicLink
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
IoGetDeviceProperty
KeReleaseSpinLockFromDpcLevel
KeAcquireSpinLockAtDpcLevel
KeInitializeMutex
KeInitializeDpc
KeReleaseMutex
_purecall
KeInitializeTimer
KeDelayExecutionThread
KeSetTimer
KeBugCheckEx

portcls.sys

PcDispatchIrp
PcNewPort
PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterAdapterPowerManagement
PcRegisterPhysicalConnection
PcInitializeAdapterDriver
PcNewMiniport
PcNewServiceGroup

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkAvrcp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkAvrcp.sys
.sys windows:6 windows x64 arch:x64

fbc7a1d7dfac9ebe55086e7a582efb1d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:88:1e:57:b4:bc:a7:59:36:7d:da:ed:cb:4e:04:fc:cc:6f:1f:d4:f9:53:65:c6:09:f3:e9:42:a9:dd:0c:b9
Signer

Actual PE Digest

7c:88:1e:57:b4:bc:a7:59:36:7d:da:ed:cb:4e:04:fc:cc:6f:1f:d4:f9:53:65:c6:09:f3:e9:42:a9:dd:0c:b9

Digest Algorithm

sha256

PE Digest Matches

true

12:fd:18:0f:eb:3c:9a:4d:2f:54:b8:fb:e3:d6:ce:35:0e:48:9b:68
Signer

Actual PE Digest

12:fd:18:0f:eb:3c:9a:4d:2f:54:b8:fb:e3:d6:ce:35:0e:48:9b:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\btsw\hostsw\profiles\audio\avrcp\amd64\RtkAvrcp.pdb

Imports

ntoskrnl.exe

IoWMIRegistrationControl
ExFreePoolWithTag
IoWMIWriteEvent
RtlInitUnicodeString
KeSetEvent
MmGetSystemRoutineAddress
KeInitializeEvent
ExFreePool
IofCompleteRequest
KeWaitForSingleObject
PoCallDriver
IoInitializeRemoveLockEx
IofCallDriver
ExInitializeNPagedLookasideList
ObfDereferenceObject
ExDeleteNPagedLookasideList
PsCreateSystemThread
ExInterlockedInsertTailList
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
ExInterlockedRemoveHeadList
KeWaitForMultipleObjects
ExAllocatePoolWithTag
KeClearEvent
KeResetEvent
ExpInterlockedPushEntrySList
ZwSetValueKey
IoReleaseRemoveLockEx
RtlInitString
KeReleaseSpinLock
ExpInterlockedPopEntrySList
ExAllocatePool
ExQueryDepthSList
IoReleaseRemoveLockAndWaitEx
IoFreeIrp
IoSetCompletionRoutineEx
IoAllocateIrp
IoOpenDeviceRegistryKey
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
KeBugCheckEx
IoAcquireRemoveLockEx
RtlCompareMemory
IoGetLowerDeviceObject
RtlUTF8ToUnicodeN
ObQueryNameString

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkAvrcpCtrlr.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkAvrcpCtrlr.sys
.sys windows:6 windows x64 arch:x64

2e31ecb378b76f6a523f1b5ed2d9981f

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/06/2016, 00:00

Not After

24/01/2019, 12:00

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:43:9b:d4:99:23:01:cb:6d:34:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/03/2017, 19:05

Not After

01/06/2018, 19:05

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c9:d2:32:34:39:3d:10:ea:e5:38:bb:dd:0c:c9:d7:5f:7e:a7:ea:d7:7c:a6:0e:a5:2f:6b:7c:d2:8d:ce:f9:5f
Signer

Actual PE Digest

c9:d2:32:34:39:3d:10:ea:e5:38:bb:dd:0c:c9:d7:5f:7e:a7:ea:d7:7c:a6:0e:a5:2f:6b:7c:d2:8d:ce:f9:5f

Digest Algorithm

sha256

PE Digest Matches

true

77:34:0e:6d:39:48:e2:e0:7b:ec:56:f4:6a:51:bc:4e:65:44:f6:53
Signer

Actual PE Digest

77:34:0e:6d:39:48:e2:e0:7b:ec:56:f4:6a:51:bc:4e:65:44:f6:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\svnwork\hostsw\profiles\audio\avrcpctrlr\amd64\RtkAvrcpCtrlr.pdb

Imports

ntoskrnl.exe

IoWMIWriteEvent
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
MmGetSystemRoutineAddress
KeInitializeEvent
RtlQueryRegistryValues
IoReleaseRemoveLockEx
IoDetachDevice
PoStartNextPowerIrp
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
RtlCompareMemory
RtlCopyUnicodeString
IoInitializeRemoveLockEx
IoCreateDevice
DbgPrint
IofCallDriver
KeClearEvent
KeInitializeDpc
KeInitializeTimer
KeDelayExecutionThread
PsCreateSystemThread
PsTerminateSystemThread
ExFreePool
ZwClose
ObReferenceObjectByHandle
ExFreePoolWithTag
IoWMIDeviceObjectToProviderId
ObfDereferenceObject
KeCancelTimer
KeWaitForMultipleObjects
IoBuildDeviceIoControlRequest
IoFreeIrp
IoSetCompletionRoutineEx
IoAllocateIrp
KeResetEvent
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
KeReleaseSpinLock
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
KeAcquireSpinLockRaiseToDpc
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
KeBugCheckEx
RtlUTF8ToUnicodeN
IoWMIRegistrationControl
IoAcquireRemoveLockEx
KeSetTimer
ExAllocatePoolWithTag

wmilib.sys

WmiSystemControl
WmiFireEvent
WmiCompleteRequest

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 896B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkBtfilter.sys
.sys windows:10 windows x64 arch:x64

658d35357c6de3332aedd7041d05bd4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win7Release\x64\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeInitializeEvent
RtlEqualUnicodeString
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
KeTryToAcquireGuardedMutex
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
RtlTimeToTimeFields
KeBugCheckEx
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 162KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkHandsfree.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkHandsfree.sys
.sys windows:6 windows x64 arch:x64

35cdea2ec2762e98ae8e38557cd8e05d

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

81:dd:1a:36:f8:47:25:61:92:ef:c5:b9:f9:a3:44:d1:51:73:4d:94
Signer

Actual PE Digest

81:dd:1a:36:f8:47:25:61:92:ef:c5:b9:f9:a3:44:d1:51:73:4d:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\Audio\RtkHandsfree\x64\Win7Release\RtkHandsfree.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlInitUnicodeString
swprintf
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
KeSetEvent
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
KeBugCheckEx
RtlCopyUnicodeString
KeClearEvent
KeInitializeEvent
KeInsertQueueDpc
ExFreePoolWithTag
KeInitializeDpc

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 150B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkHfp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/RtkHfp.sys
.sys windows:6 windows x64 arch:x64

1c41e5ca970b58524f67bc9b611c22ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:cd:20:a6:7f:4a:ca:57:ca:f3:47:1c:cc:de:69:14:5d:57:a0:ad:40:03:73:dc:0f:0e:49:a1:bd:2d:b9:ba
Signer

Actual PE Digest

c3:cd:20:a6:7f:4a:ca:57:ca:f3:47:1c:cc:de:69:14:5d:57:a0:ad:40:03:73:dc:0f:0e:49:a1:bd:2d:b9:ba

Digest Algorithm

sha256

PE Digest Matches

true

1c:1b:c2:ad:4c:34:b6:17:0a:c7:b6:90:3e:97:ad:99:5c:2b:32:12
Signer

Actual PE Digest

1c:1b:c2:ad:4c:34:b6:17:0a:c7:b6:90:3e:97:ad:99:5c:2b:32:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\btsw\hostsw\profiles\audio\hfp\amd64\RtkHfp.pdb

Imports

ntoskrnl.exe

KeResetEvent
ExInitializeNPagedLookasideList
KeSetEvent
IoFreeWorkItem
ExpInterlockedPushEntrySList
KeInitializeEvent
KeInitializeDpc
IoReleaseRemoveLockEx
KeReleaseSpinLock
ExpInterlockedPopEntrySList
KeInitializeTimer
IoAllocateWorkItem
ExQueryDepthSList
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
IoFreeIrp
IoSetCompletionRoutineEx
KeSetTimer
IoAllocateIrp
IoQueueWorkItem
KeCancelTimer
ExDeleteNPagedLookasideList
IofCallDriver
KeAcquireSpinLockRaiseToDpc
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
IoWMIRegistrationControl
IoDeleteSymbolicLink
IoWMIWriteEvent
IoQueueWorkItemEx
KeClearEvent
RtlCheckRegistryKey
MmGetSystemRoutineAddress
RtlQueryRegistryValues
ExFreePool
IofCompleteRequest
IoInitializeWorkItem
RtlCompareMemory
IoCreateSymbolicLink
RtlCopyUnicodeString
IoInitializeRemoveLockEx
IoCreateDevice
IoGetDeviceProperty
KeReleaseSpinLockFromDpcLevel
KeAcquireSpinLockAtDpcLevel
KeInitializeMutex
KeSetTimerEx
KeReleaseMutex
_purecall
KeInitializeTimerEx
ZwSetValueKey
RtlInitString
RtlUTF8ToUnicodeN
ObQueryNameString
ExAllocatePool
ZwClose
ObReferenceObjectByHandle
ObfDereferenceObject
IoOpenDeviceRegistryKey
RtlDeleteRegistryValue
ZwOpenKey
IoGetLowerDeviceObject
KeBugCheckEx
IoAcquireRemoveLockEx
ExFreePoolWithTag
IoDeleteDevice
ExAllocatePoolWithTag

wmilib.sys

WmiSystemControl
WmiFireEvent
WmiCompleteRequest

portcls.sys

PcDispatchIrp
PcNewPort
PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterAdapterPowerManagement
PcRegisterPhysicalConnection
PcInitializeAdapterDriver
PcNewMiniport
PcNewServiceGroup

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/bthvirtual.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/bthvirtual.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtka2dp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtkavrcp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtkavrcpctrlr.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtkhandsfree.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X64/rtkhfp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkA2dp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkA2dp.sys
.sys windows:6 windows x86 arch:x86

c87443e2405630208df453c5e2bc58a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:96:1b:b8:5f:b6:62:40:20:a4:c0:d0:b2:68:ab:67:c0:77:2a:6c:f1:ac:84:77:b0:54:d5:ac:2c:85:04:35
Signer

Actual PE Digest

0a:96:1b:b8:5f:b6:62:40:20:a4:c0:d0:b2:68:ab:67:c0:77:2a:6c:f1:ac:84:77:b0:54:d5:ac:2c:85:04:35

Digest Algorithm

sha256

PE Digest Matches

true

4b:75:da:07:2e:59:a1:81:d2:ad:a0:60:a0:21:d7:f9:d2:a9:ae:4d
Signer

Actual PE Digest

4b:75:da:07:2e:59:a1:81:d2:ad:a0:60:a0:21:d7:f9:d2:a9:ae:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\btsw\hostsw\profiles\audio\a2dp\i386\RtkA2dp.pdb

Imports

ntoskrnl.exe

IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoSetCompletionRoutineEx
IoAllocateIrp
InterlockedPopEntrySList
InterlockedPushEntrySList
KeResetEvent
KeClearEvent
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
memcpy
KeInitializeSpinLock
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
ZwClose
ZwSetValueKey
RtlInitUnicodeString
ZwOpenKey
IoOpenDeviceRegistryKey
RtlUTF8ToUnicodeN
RtlInitString
RtlDeleteRegistryValue
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeWaitForMultipleObjects
PsCreateSystemThread
ExfInterlockedInsertTailList
ExFreePool
ObfReferenceObject
IoWMIWriteEvent
ExFreePoolWithTag
RtlCompareMemory
IoWMIRegistrationControl
IofCompleteRequest
KeSetTimerEx
KeInitializeTimerEx
_allmul
IoCsqRemoveNextIrp
IoCsqInsertIrp
RtlEqualUnicodeString
IoGetDeviceProperty
IoDeleteDevice
IoDeleteSymbolicLink
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlCheckRegistryKey
IoSetDeviceInterfaceState
IoCsqInitialize
IoCreateSymbolicLink
IoCreateDevice
KeCancelTimer
RtlFreeUnicodeString
IoRegisterDeviceInterface
IoInitializeRemoveLockEx
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeInitializeMutex
_purecall
KeQueryInterruptTime
_aullrem
_alldiv
KeReleaseMutex
KeInitializeDpc
KeSetTimer
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeTimer
InterlockedIncrement
InterlockedDecrement
KeTickCount
KeBugCheckEx
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
memset

hal

KfReleaseSpinLock
KfAcquireSpinLock

portcls.sys

PcDispatchIrp
PcRegisterSubdevice
PcNewMiniport
PcNewPort
PcRegisterAdapterPowerManagement
PcRegisterPhysicalConnection
PcAddAdapterDevice
PcInitializeAdapterDriver
PcNewServiceGroup

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkAvrcp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkAvrcp.sys
.sys windows:6 windows x86 arch:x86

f3171b1610b35b63291380296180a77c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:61:bd:98:c7:5f:23:b5:1a:7e:6c:1f:cd:c8:21:f9:96:53:f7:84:72:4f:4a:61:50:2f:7b:1e:c7:b2:c7:69
Signer

Actual PE Digest

36:61:bd:98:c7:5f:23:b5:1a:7e:6c:1f:cd:c8:21:f9:96:53:f7:84:72:4f:4a:61:50:2f:7b:1e:c7:b2:c7:69

Digest Algorithm

sha256

PE Digest Matches

true

2d:73:24:9b:ce:95:0e:67:16:16:47:48:4c:3b:0f:62:28:4a:13:b3
Signer

Actual PE Digest

2d:73:24:9b:ce:95:0e:67:16:16:47:48:4c:3b:0f:62:28:4a:13:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\btsw\hostsw\profiles\audio\avrcp\i386\RtkAvrcp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoWMIRegistrationControl
IofCompleteRequest
IofCallDriver
ExFreePoolWithTag
IoInitializeRemoveLockEx
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
PoCallDriver
ObfDereferenceObject
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
PsTerminateSystemThread
KeWaitForMultipleObjects
ExfInterlockedRemoveHeadList
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoWMIWriteEvent
InterlockedPopEntrySList
InterlockedPushEntrySList
IoFreeIrp
ExFreePool
memcpy
KeResetEvent
KeClearEvent
IoReleaseRemoveLockEx
IoSetCompletionRoutineEx
IoAcquireRemoveLockEx
IoAllocateIrp
ZwSetValueKey
ZwOpenKey
IoOpenDeviceRegistryKey
ExAllocatePool
RtlInitString
IoReleaseRemoveLockAndWaitEx
IoBuildDeviceIoControlRequest
KeTickCount
KeBugCheckEx
RtlCompareMemory
ExfInterlockedInsertTailList
memset
IoGetLowerDeviceObject
ObQueryNameString
RtlUTF8ToUnicodeN

hal

KfAcquireSpinLock
KfReleaseSpinLock

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 768B - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkAvrcpCtrlr.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkAvrcpCtrlr.sys
.sys windows:6 windows x86 arch:x86

e5a2e87a3dc9f81e1bee9a33caa098d1

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/06/2016, 00:00

Not After

24/01/2019, 12:00

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:43:9b:d4:99:23:01:cb:6d:34:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/03/2017, 19:05

Not After

01/06/2018, 19:05

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:0b:d4:e2:0a:c3:7f:80:2f:96:0d:bb:4b:b7:c0:ff:d5:ed:d3:f8:f8:55:b9:d6:0c:db:61:eb:00:3e:f3:21
Signer

Actual PE Digest

0c:0b:d4:e2:0a:c3:7f:80:2f:96:0d:bb:4b:b7:c0:ff:d5:ed:d3:f8:f8:55:b9:d6:0c:db:61:eb:00:3e:f3:21

Digest Algorithm

sha256

PE Digest Matches

true

72:79:2a:81:08:37:25:39:9d:3d:80:9d:5a:b1:4f:85:32:45:e8:c8
Signer

Actual PE Digest

72:79:2a:81:08:37:25:39:9d:3d:80:9d:5a:b1:4f:85:32:45:e8:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\svnwork\hostsw\profiles\audio\avrcpctrlr\i386\RtkAvrcpCtrlr.pdb

Imports

ntoskrnl.exe

RtlCompareMemory
IoWMIRegistrationControl
IofCompleteRequest
IofCallDriver
IoInitializeRemoveLockEx
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
IoReleaseRemoveLockEx
RtlQueryRegistryValues
IoAcquireRemoveLockEx
KeWaitForSingleObject
KeInitializeEvent
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
DbgPrint
PoCallDriver
PoStartNextPowerIrp
RtlCopyUnicodeString
KeDelayExecutionThread
KeCancelTimer
ObfDereferenceObject
ExFreePool
KeQuerySystemTime
PsTerminateSystemThread
KeClearEvent
KeWaitForMultipleObjects
KeInitializeDpc
RtlInitUnicodeString
KeSetTimer
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
IoFreeIrp
IoBuildDeviceIoControlRequest
IoSetCompletionRoutineEx
IoAllocateIrp
InterlockedPopEntrySList
InterlockedPushEntrySList
MmGetSystemRoutineAddress
memset
KeResetEvent
KeInitializeSpinLock
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
KeTickCount
KeBugCheckEx
memcpy
RtlUTF8ToUnicodeN
ExAllocatePoolWithTag
IoWMIWriteEvent
KeInitializeTimer
ExFreePoolWithTag

hal

KfAcquireSpinLock
KfReleaseSpinLock

wmilib.sys

WmiFireEvent
WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 768B - Virtual size: 719B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkBtfilter.sys
.sys windows:10 windows x86 arch:x86

f26c207db11de10f39e02d4422d74f53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win7Release\Win32\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeQuerySystemTime
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeWaitForSingleObject
RtlEqualUnicodeString
KeGetCurrentThread
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
KeTryToAcquireGuardedMutex
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
KeWaitForMultipleObjects
KeBugCheckEx
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlTimeToTimeFields
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkHandsfree.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkHandsfree.sys
.sys windows:6 windows x86 arch:x86

3535c60f3762b05c51392f1fb3a26426

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:08:4e:e4:63:65:2c:31:0c:3d:ec:07:57:e5:14:1d:a8:13:cd:75
Signer

Actual PE Digest

b2:08:4e:e4:63:65:2c:31:0c:3d:ec:07:57:e5:14:1d:a8:13:cd:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\Audio\RtkHandsfree\Win7Release\RtkHandsfree.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlInitUnicodeString
swprintf
memcpy
memset
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeSetEvent
ExFreePoolWithTag
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
KeTickCount
KeBugCheckEx
RtlCopyUnicodeString
KeClearEvent
KeInitializeEvent
KeInsertQueueDpc
ExAllocatePoolWithTag
KeInitializeDpc

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkHfp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/RtkHfp.sys
.sys windows:6 windows x86 arch:x86

b3ee0e42bf452485f62552cdaafa7943

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:6b:6d:7e:2f:ff:be:ed:86:5a:af:72:6f:ca:a5:b7:39:29:04:e4:77:24:8d:0d:77:87:df:24:86:28:21:60
Signer

Actual PE Digest

dd:6b:6d:7e:2f:ff:be:ed:86:5a:af:72:6f:ca:a5:b7:39:29:04:e4:77:24:8d:0d:77:87:df:24:86:28:21:60

Digest Algorithm

sha256

PE Digest Matches

true

5a:e9:59:fa:71:11:d6:ff:47:8d:77:4c:65:c9:41:f0:da:dd:77:8a
Signer

Actual PE Digest

5a:e9:59:fa:71:11:d6:ff:47:8d:77:4c:65:c9:41:f0:da:dd:77:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\btsw\hostsw\profiles\audio\hfp\i386\RtkHfp.pdb

Imports

ntoskrnl.exe

KeSetEvent
IoFreeIrp
KeResetEvent
KeCancelTimer
KeSetTimer
KeWaitForSingleObject
IofCallDriver
KeClearEvent
IoSetCompletionRoutineEx
IoAllocateIrp
memcpy
IoQueueWorkItem
KeInitializeEvent
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
KeInitializeDpc
IoFreeWorkItem
KeInitializeTimer
ExInitializeNPagedLookasideList
KeInitializeSpinLock
IoAllocateWorkItem
ExDeleteNPagedLookasideList
IoReleaseRemoveLockAndWaitEx
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
ExFreePool
IoWMIWriteEvent
MmGetSystemRoutineAddress
RtlCompareMemory
IoWMIRegistrationControl
IofCompleteRequest
InterlockedPushEntrySList
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoDeleteDevice
RtlQueryRegistryValues
RtlCheckRegistryKey
IoQueueWorkItemEx
IoInitializeRemoveLockEx
IoInitializeWorkItem
RtlCopyUnicodeString
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeInitializeMutex
_purecall
KeQueryInterruptTime
_aullrem
_alldiv
KeReleaseMutex
KeSetTimerEx
KeInitializeTimerEx
ZwClose
ZwSetValueKey
ZwOpenKey
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
IoOpenDeviceRegistryKey
ExAllocatePool
RtlUTF8ToUnicodeN
RtlInitString
RtlDeleteRegistryValue
IoGetLowerDeviceObject
KeTickCount
KeBugCheckEx
InterlockedPopEntrySList
ExFreePoolWithTag
ExAllocatePoolWithTag
_allshr
_allmul
IoGetDeviceProperty
memset
InterlockedIncrement
InterlockedDecrement

hal

KfAcquireSpinLock
KfReleaseSpinLock

wmilib.sys

WmiFireEvent
WmiSystemControl
WmiCompleteRequest

portcls.sys

PcNewMiniport
PcNewPort
PcRegisterAdapterPowerManagement
PcAddAdapterDevice
PcRegisterPhysicalConnection
PcInitializeAdapterDriver
PcNewServiceGroup
PcDispatchIrp
PcRegisterSubdevice

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/bthvirtual.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/bthvirtual.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtka2dp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtkavrcp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtkavrcpctrlr.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtkhandsfree.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win7X86/rtkhfp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/LeImAlertService.dll
.dll regsvr32 windows:6 windows x64 arch:x64

572f29b188aa73c4143a2549d1c8cdbc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d8:c4:2f:d1:71:2d:66:78:5f:2b:4e:c3:ab:dd:f6:cb:54:44:eb:f3
Signer

Actual PE Digest

d8:c4:2f:d1:71:2d:66:78:5f:2b:4e:c3:ab:dd:f6:cb:54:44:eb:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\UserMode_Profile\WpdLEService\WpdImAlert\x64\Win8Release\LeImAlertService.pdb

Imports

kernel32

CloseHandle
FindResourceExW
LockResource
CreateThread
SetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
CreateFileW
GetStringTypeW
LoadLibraryW
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlPcToFileHeader
WriteFile
RtlUnwindEx
Sleep
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
RtlVirtualUnwind
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
InitializeCriticalSectionEx
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
WriteConsoleW

ole32

CoInitializeEx
CoUninitialize
CoCreateGuid
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextW
DefWindowProcW
CreateWindowExW
DestroyWindow
MsgWaitForMultipleObjects
GetWindowLongPtrW
SetWindowLongPtrW
RegisterClassExW
UnregisterClassW

advapi32

GetTraceEnableFlags
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey

shlwapi

StrToInt64ExW

bluetoothapis

BluetoothGATTGetServices
BluetoothGATTGetCharacteristics
BluetoothGATTSetCharacteristicValue
BluetoothFindRadioClose
BluetoothFindFirstRadio

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/LeImAlertService.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/LeLinkLossService.dll
.dll regsvr32 windows:6 windows x64 arch:x64

3dc12aad5de2d21e8e3806e89f0cade6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:d7:36:41:f3:3c:7a:c7:73:f2:59:d4:65:8a:c6:66:88:a5:e2:e3
Signer

Actual PE Digest

90:d7:36:41:f3:3c:7a:c7:73:f2:59:d4:65:8a:c6:66:88:a5:e2:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\UserMode_Profile\WpdLEService\WpdLinkLoss\x64\Win8Release\LeLinkLossService.pdb

Imports

kernel32

LockResource
CreateThread
SetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
FindResourceExW
LoadLibraryW
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlPcToFileHeader
WriteFile
RtlUnwindEx
Sleep
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
CloseHandle
CreateFileW
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
EncodePointer
FreeLibrary
UnhandledExceptionFilter
RtlVirtualUnwind
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
GetStringTypeW
InitializeCriticalSectionEx
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
WriteConsoleW

ole32

CoInitializeEx
CoUninitialize
CoCreateGuid
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextW
DefWindowProcW
CreateWindowExW
DestroyWindow
MsgWaitForMultipleObjects
GetWindowLongPtrW
SetWindowLongPtrW
RegisterClassExW
UnregisterClassW

advapi32

TraceMessage
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
RegCloseKey

shlwapi

StrToInt64ExW

bluetoothapis

BluetoothGATTGetServices
BluetoothGATTGetCharacteristics
BluetoothGATTGetCharacteristicValue
BluetoothGATTSetCharacteristicValue
BluetoothGATTUnregisterEvent
BluetoothFindRadioClose
BluetoothFindFirstRadio

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/LeLinkLossService.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkA2dp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkA2dp.sys
.sys windows:6 windows x64 arch:x64

7d65c8dcb55f8e4ab94fffa789720960

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:50:5b:a6:fd:d3:8b:f2:c8:29:e3:51:2c:e5:af:67:7c:25:1e:35:62:7c:3b:38:2c:52:b9:6d:5a:b9:13:d4
Signer

Actual PE Digest

59:50:5b:a6:fd:d3:8b:f2:c8:29:e3:51:2c:e5:af:67:7c:25:1e:35:62:7c:3b:38:2c:52:b9:6d:5a:b9:13:d4

Digest Algorithm

sha256

PE Digest Matches

true

0b:60:de:33:0b:b6:f1:79:19:94:a0:bb:b9:20:8d:13:19:df:4b:ff
Signer

Actual PE Digest

0b:60:de:33:0b:b6:f1:79:19:94:a0:bb:b9:20:8d:13:19:df:4b:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\A2DP\x64\RtkA2dp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
RtlInitString
RtlInitUnicodeString
RtlDeleteRegistryValue
RtlUTF8ToUnicodeN
KeClearEvent
KeResetEvent
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
KeWaitForMultipleObjects
KeInitializeSpinLock
ExFreePool
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
ObfReferenceObject
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlWriteRegistryValue
RtlCheckRegistryKey
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlCompareMemory
KeInitializeTimerEx
KeCancelTimer
KeSetTimerEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoWMIRegistrationControl
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoGetDeviceProperty
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
_purecall
KeInitializeDpc
KeInitializeMutex
KeReleaseMutex
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeTimer
KeSetTimer

portcls.sys

PcInitializeAdapterDriver
PcDispatchIrp
PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterAdapterPowerManagement
PcNewServiceGroup

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkAvrcp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkAvrcp.sys
.sys windows:6 windows x64 arch:x64

29a72948f9f8fedfe9f8787004713195

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:cb:4c:0d:fa:2e:3f:ed:c8:c7:b4:89:69:25:16:86:bf:0f:ff:9c:0b:d3:b9:50:c5:ca:ff:d0:4c:82:b2:46
Signer

Actual PE Digest

37:cb:4c:0d:fa:2e:3f:ed:c8:c7:b4:89:69:25:16:86:bf:0f:ff:9c:0b:d3:b9:50:c5:ca:ff:d0:4c:82:b2:46

Digest Algorithm

sha256

PE Digest Matches

true

1c:cf:86:0c:0b:fe:26:f6:a0:95:ea:87:80:e5:19:a2:d1:aa:08:67
Signer

Actual PE Digest

1c:cf:86:0c:0b:fe:26:f6:a0:95:ea:87:80:e5:19:a2:d1:aa:08:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\AVRCP\x64\RtkAvrcp.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
IoGetLowerDeviceObject
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCallDriver
IofCompleteRequest
IoInitializeRemoveLockEx
IoWMIRegistrationControl
PoCallDriver
KeWaitForMultipleObjects
KeInitializeSpinLock
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ZwClose
ExDeleteNPagedLookasideList
RtlUTF8ToUnicodeN
KeClearEvent
KeResetEvent
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
IoAllocateIrp
IoFreeIrp
IoSetCompletionRoutineEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoOpenDeviceRegistryKey
ZwOpenKey
ZwSetValueKey
ObQueryNameString
IoBuildDeviceIoControlRequest
RtlInitString
ExInitializeNPagedLookasideList

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkAvrcpCtrlr.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkAvrcpCtrlr.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkAvrcpCtrlr.sys
.sys windows:6 windows x64 arch:x64

a7246776584983fffbd396b375705927

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:79:56:2a:58:bb:09:2f:83:eb:f8:f3:4e:e3:61:9e:0c:e8:f1:40:bd:cf:e0:f6:9e:5d:43:a4:10:8a:bd:5b
Signer

Actual PE Digest

03:79:56:2a:58:bb:09:2f:83:eb:f8:f3:4e:e3:61:9e:0c:e8:f1:40:bd:cf:e0:f6:9e:5d:43:a4:10:8a:bd:5b

Digest Algorithm

sha256

PE Digest Matches

true

b4:8d:26:87:85:ba:f3:fd:56:bd:89:c6:6d:f5:be:29:cf:1a:d2:b5
Signer

Actual PE Digest

b4:8d:26:87:85:ba:f3:fd:56:bd:89:c6:6d:f5:be:29:cf:1a:d2:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\AVRCPCtrlr\x64\RtkAvrcpCtrlr.pdb

Imports

ntoskrnl.exe

RtlUTF8ToUnicodeN
DbgPrint
KeInitializeEvent
KeClearEvent
KeResetEvent
KeSetEvent
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
MmGetSystemRoutineAddress
KeInitializeSpinLock
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
KeInitializeDpc
KeDelayExecutionThread
KeInitializeTimer
KeCancelTimer
KeSetTimer
ExFreePool
IoWMIWriteEvent
IoWMIDeviceObjectToProviderId
RtlCopyUnicodeString
IoAttachDeviceToDeviceStack
IofCompleteRequest
IoCreateDevice
IoDeleteDevice
IoDetachDevice
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
IoWMIRegistrationControl
RtlQueryRegistryValues
RtlInitUnicodeString
KeWaitForMultipleObjects

wmilib.sys

WmiCompleteRequest
WmiFireEvent
WmiSystemControl

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkBtfilter.sys
.sys windows:10 windows x64 arch:x64

658d35357c6de3332aedd7041d05bd4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win7Release\x64\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeSetEvent
KeWaitForMultipleObjects
KeWaitForSingleObject
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeInitializeEvent
RtlEqualUnicodeString
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
KeTryToAcquireGuardedMutex
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
RtlTimeToTimeFields
KeBugCheckEx
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 162KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkHandsfree.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkHandsfree.sys
.sys windows:6 windows x64 arch:x64

35cdea2ec2762e98ae8e38557cd8e05d

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

81:dd:1a:36:f8:47:25:61:92:ef:c5:b9:f9:a3:44:d1:51:73:4d:94
Signer

Actual PE Digest

81:dd:1a:36:f8:47:25:61:92:ef:c5:b9:f9:a3:44:d1:51:73:4d:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\Audio\RtkHandsfree\x64\Win7Release\RtkHandsfree.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlInitUnicodeString
swprintf
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
KeSetEvent
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
KeBugCheckEx
RtlCopyUnicodeString
KeClearEvent
KeInitializeEvent
KeInsertQueueDpc
ExFreePoolWithTag
KeInitializeDpc

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 150B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkHfp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkHfp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/RtkHfp.sys
.sys windows:6 windows x64 arch:x64

6748cbb86439190d9906b53d4d178946

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:b0:05:a1:87:ed:0b:63:54:11:d3:12:ef:d6:5e:c0:0a:f9:9e:ac:c1:ee:82:55:de:2d:a4:37:11:5e:2c:aa
Signer

Actual PE Digest

e5:b0:05:a1:87:ed:0b:63:54:11:d3:12:ef:d6:5e:c0:0a:f9:9e:ac:c1:ee:82:55:de:2d:a4:37:11:5e:2c:aa

Digest Algorithm

sha256

PE Digest Matches

true

7d:38:1e:ff:bd:72:90:66:e5:62:cd:62:3d:89:59:b9:7f:13:bc:45
Signer

Actual PE Digest

7d:38:1e:ff:bd:72:90:66:e5:62:cd:62:3d:89:59:b9:7f:13:bc:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\HFP\x64\RtkHfp.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeResetEvent
KeSetEvent
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlCheckRegistryKey
KeInitializeEvent
RtlCompareMemory
ExFreePool
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoQueueWorkItemEx
IoInitializeWorkItem
IoWMIRegistrationControl
IoGetDeviceProperty
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
_purecall
KeInitializeMutex
KeReleaseMutex
KeInitializeTimerEx
KeSetTimerEx
KeInitializeSpinLock
RtlInitString
RtlDeleteRegistryValue
RtlUTF8ToUnicodeN
ExAllocatePool
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
IoGetLowerDeviceObject
KeInitializeDpc
ExFreePoolWithTag
RtlCopyUnicodeString
ExAllocatePoolWithTag

wmilib.sys

WmiCompleteRequest
WmiFireEvent
WmiSystemControl

portcls.sys

PcInitializeAdapterDriver
PcDispatchIrp
PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterAdapterPowerManagement
PcNewServiceGroup

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/bthvirtual.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/bthvirtual.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/leimalertservice.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/lelinklossservice.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/rtka2dp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/rtkavrcp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X64/rtkhandsfree.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/LeImAlertService.dll
.dll regsvr32 windows:6 windows x86 arch:x86

78b07373fd7999778981fdb4a97317ae

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:c3:4a:cc:ff:ae:c6:53:ab:60:a7:f4:8a:1c:04:1f:37:81:f4:39
Signer

Actual PE Digest

9d:c3:4a:cc:ff:ae:c6:53:ab:60:a7:f4:8a:1c:04:1f:37:81:f4:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\UserMode_Profile\WpdLEService\WpdImAlert\Win8Release\LeImAlertService.pdb

Imports

kernel32

SetThreadLocale
CreateFileW
CloseHandle
FindResourceExW
LockResource
CreateThread
SetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
GetThreadLocale
GetStringTypeW
LoadLibraryW
OutputDebugStringW
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WriteFile
Sleep
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
EncodePointer
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

ole32

CoInitializeEx
CoUninitialize
CoCreateGuid
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextW
DefWindowProcW
CreateWindowExW
DestroyWindow
MsgWaitForMultipleObjects
GetWindowLongW
SetWindowLongW
RegisterClassExW
UnregisterClassW

advapi32

UnregisterTraceGuids
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey

shlwapi

StrToInt64ExW

bluetoothapis

BluetoothGATTGetServices
BluetoothGATTGetCharacteristics
BluetoothGATTSetCharacteristicValue
BluetoothFindRadioClose
BluetoothFindFirstRadio

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/LeImAlertService.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/LeLinkLossService.dll
.dll regsvr32 windows:6 windows x86 arch:x86

26b230a36d25243e1c7560da5ee8ddab

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:87:4b:ac:42:b3:8b:b0:1c:2b:4c:3d:2c:57:b1:40:69:f2:41:b3
Signer

Actual PE Digest

d6:87:4b:ac:42:b3:8b:b0:1c:2b:4c:3d:2c:57:b1:40:69:f2:41:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\UserMode_Profile\WpdLEService\WpdLinkLoss\Win8Release\LeLinkLossService.pdb

Imports

kernel32

CloseHandle
FindResourceExW
LockResource
CreateThread
SetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
CreateFileW
GetStringTypeW
LoadLibraryW
OutputDebugStringW
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WriteFile
Sleep
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
EncodePointer
GetModuleFileNameW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

ole32

CoInitializeEx
CoUninitialize
CoCreateGuid
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextW
DefWindowProcW
CreateWindowExW
DestroyWindow
MsgWaitForMultipleObjects
GetWindowLongW
SetWindowLongW
RegisterClassExW
UnregisterClassW

advapi32

GetTraceLoggerHandle
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
RegCloseKey

shlwapi

StrToInt64ExW

bluetoothapis

BluetoothGATTGetServices
BluetoothGATTGetCharacteristics
BluetoothGATTGetCharacteristicValue
BluetoothGATTSetCharacteristicValue
BluetoothGATTUnregisterEvent
BluetoothFindRadioClose
BluetoothFindFirstRadio

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Microsoft_WDF_UMDF_Version

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/LeLinkLossService.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkA2dp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkA2dp.sys
.sys windows:6 windows x86 arch:x86

4c7dad75164bad8dc5d8f626a890475f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:5f:d3:3d:5e:d5:f8:86:f3:1f:16:1e:73:4d:89:be:89:d7:31:5e:ac:03:58:62:9c:ae:60:6f:2c:f6:cc:22
Signer

Actual PE Digest

84:5f:d3:3d:5e:d5:f8:86:f3:1f:16:1e:73:4d:89:be:89:d7:31:5e:ac:03:58:62:9c:ae:60:6f:2c:f6:cc:22

Digest Algorithm

sha256

PE Digest Matches

true

5b:57:92:82:0e:be:fe:79:f0:7e:c5:1e:6c:9d:8d:27:3c:65:c7:ce
Signer

Actual PE Digest

5b:57:92:82:0e:be:fe:79:f0:7e:c5:1e:6c:9d:8d:27:3c:65:c7:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\A2DP\x86\RtkA2dp.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
RtlInitString
RtlInitUnicodeString
RtlDeleteRegistryValue
RtlUTF8ToUnicodeN
KeClearEvent
KeResetEvent
KeInitializeSpinLock
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
memcpy
KeWaitForMultipleObjects
ExFreePool
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
memset
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlWriteRegistryValue
RtlCheckRegistryKey
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlCompareMemory
KeInitializeTimerEx
KeCancelTimer
KeSetTimerEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoWMIRegistrationControl
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoGetDeviceProperty
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
_allmul
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
_purecall
KeInitializeDpc
KeInitializeMutex
KeReleaseMutex
KeQueryInterruptTime
_alldiv
_aullrem
memcmp
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeTimer
KeSetTimer
ExFreePoolWithTag
ObfReferenceObject
ExAllocatePoolWithTag
InterlockedDecrement
InterlockedIncrement

hal

KfAcquireSpinLock
KfReleaseSpinLock

portcls.sys

PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterAdapterPowerManagement
PcNewServiceGroup
PcInitializeAdapterDriver
PcDispatchIrp

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkAvrcp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkAvrcp.sys
.sys windows:6 windows x86 arch:x86

29347a5bb0aeadba961e3989e4b799a6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:df:c4:4b:05:26:b0:6f:c8:f6:68:74:e6:5b:0c:c9:e4:a5:28:11:5d:7f:47:76:6b:ba:5b:54:24:5e:ed:d0
Signer

Actual PE Digest

85:df:c4:4b:05:26:b0:6f:c8:f6:68:74:e6:5b:0c:c9:e4:a5:28:11:5d:7f:47:76:6b:ba:5b:54:24:5e:ed:d0

Digest Algorithm

sha256

PE Digest Matches

true

e9:e9:6f:34:78:6c:e8:df:de:99:ba:0f:40:14:31:78:b1:7d:c6:17
Signer

Actual PE Digest

e9:e9:6f:34:78:6c:e8:df:de:99:ba:0f:40:14:31:78:b1:7d:c6:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\AVRCP\x86\RtkAvrcp.pdb

Imports

ntoskrnl.exe

memset
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCallDriver
IofCompleteRequest
IoInitializeRemoveLockEx
IoWMIRegistrationControl
PoCallDriver
KeWaitForMultipleObjects
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
memcpy
RtlInitString
RtlUTF8ToUnicodeN
KeClearEvent
KeResetEvent
ExAllocatePool
InterlockedPopEntrySList
InterlockedPushEntrySList
IoAllocateIrp
IoFreeIrp
IoSetCompletionRoutineEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoOpenDeviceRegistryKey
ZwOpenKey
ZwSetValueKey
ObQueryNameString
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
ObfDereferenceObject
ExDeleteNPagedLookasideList
ZwClose
ExInitializeNPagedLookasideList

hal

KfReleaseSpinLock
KfAcquireSpinLock

hidclass.sys

HidRegisterMinidriver

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkAvrcpCtrlr.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkAvrcpCtrlr.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkAvrcpCtrlr.sys
.sys windows:6 windows x86 arch:x86

d56795abce252a345782ac20947d3185

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:b8:20:ca:c3:3f:e1:7d:37:52:a9:41:dd:0f:32:4c:27:ef:89:d6:44:34:88:31:14:cf:9e:6d:48:b3:2d:7e
Signer

Actual PE Digest

6f:b8:20:ca:c3:3f:e1:7d:37:52:a9:41:dd:0f:32:4c:27:ef:89:d6:44:34:88:31:14:cf:9e:6d:48:b3:2d:7e

Digest Algorithm

sha256

PE Digest Matches

true

fa:8a:b8:41:e6:ae:09:af:df:fa:e1:03:cf:0f:49:6b:4c:24:0e:4f
Signer

Actual PE Digest

fa:8a:b8:41:e6:ae:09:af:df:fa:e1:03:cf:0f:49:6b:4c:24:0e:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\AVRCPCtrlr\x86\RtkAvrcpCtrlr.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
KeClearEvent
KeResetEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
memcpy
memset
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
KeWaitForMultipleObjects
DbgPrint
ExfInterlockedRemoveHeadList
PsCreateSystemThread
PsTerminateSystemThread
KeInitializeDpc
KeDelayExecutionThread
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeQuerySystemTime
ExFreePool
IoWMIWriteEvent
_allmul
RtlCopyUnicodeString
IoAttachDeviceToDeviceStack
IofCompleteRequest
IoCreateDevice
IoDeleteDevice
IoDetachDevice
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
IoWMIRegistrationControl
RtlUTF8ToUnicodeN
MmGetSystemRoutineAddress
RtlQueryRegistryValues
RtlInitUnicodeString
ExfInterlockedInsertTailList

hal

KfReleaseSpinLock
KfAcquireSpinLock

wmilib.sys

WmiFireEvent
WmiCompleteRequest
WmiSystemControl

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkBtfilter.sys
.sys windows:10 windows x86 arch:x86

f26c207db11de10f39e02d4422d74f53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVN\RtkFilter\VS2015_RtkFilter\bin\Win7Release\Win32\RtkBtfilter.pdb

Imports

ntoskrnl.exe

KeQuerySystemTime
ExSystemTimeToLocalTime
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
wcsncpy_s
RtlGetVersion
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ZwQueryInformationFile
ZwReadFile
KeWaitForSingleObject
RtlEqualUnicodeString
KeGetCurrentThread
KeInitializeSemaphore
KeReadStateSemaphore
KeReleaseSemaphore
KeQueryPriorityThread
KeDelayExecutionThread
KeSetPriorityThread
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
KeTryToAcquireGuardedMutex
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
PoRequestPowerIrp
RtlAnsiCharToUnicodeChar
KeWaitForMultipleObjects
KeBugCheckEx
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlTimeToTimeFields
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlInitUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkHandsfree.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkHandsfree.sys
.sys windows:6 windows x86 arch:x86

3535c60f3762b05c51392f1fb3a26426

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:08:4e:e4:63:65:2c:31:0c:3d:ec:07:57:e5:14:1d:a8:13:cd:75
Signer

Actual PE Digest

b2:08:4e:e4:63:65:2c:31:0c:3d:ec:07:57:e5:14:1d:a8:13:cd:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\BTProject\BTSW\trunk\HostSW\Profiles\Audio\RtkHandsfree\Win7Release\RtkHandsfree.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
RtlInitUnicodeString
swprintf
memcpy
memset
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeSetEvent
ExFreePoolWithTag
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
KeTickCount
KeBugCheckEx
RtlCopyUnicodeString
KeClearEvent
KeInitializeEvent
KeInsertQueueDpc
ExAllocatePoolWithTag
KeInitializeDpc

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkHfp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkHfp.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/RtkHfp.sys
.sys windows:6 windows x86 arch:x86

5706668eaa98f3903610df16b855648e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1d:c3:1a:76:16:24:75:4f:80:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2014, 19:27

Not After

19/03/2016, 19:27

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:ee:0d:1a:08:d8:25:3a:50:ee:35:c6:c4:d1:36:14:85:30:63:44:01:6b:64:4a:17:55:c6:cd:d1:8f:b4:96
Signer

Actual PE Digest

75:ee:0d:1a:08:d8:25:3a:50:ee:35:c6:c4:d1:36:14:85:30:63:44:01:6b:64:4a:17:55:c6:cd:d1:8f:b4:96

Digest Algorithm

sha256

PE Digest Matches

true

ef:2b:81:cc:b0:fd:69:03:d4:9a:8d:f7:dd:8f:5b:e5:e6:41:d6:c7
Signer

Actual PE Digest

ef:2b:81:cc:b0:fd:69:03:d4:9a:8d:f7:dd:8f:5b:e5:e6:41:d6:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\BTSW\HostSW\Profiles\Audio\HFP\x86\RtkHfp.pdb

Imports

ntoskrnl.exe

KeResetEvent
KeSetEvent
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeWaitForSingleObject
KeInitializeSpinLock
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoSetCompletionRoutineEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
memcpy
IoBuildDeviceIoControlRequest
RtlInitUnicodeString
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlCheckRegistryKey
RtlCopyUnicodeString
RtlCompareMemory
ExFreePool
KeClearEvent
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoQueueWorkItemEx
IoInitializeWorkItem
IoWMIRegistrationControl
IoGetDeviceProperty
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
_purecall
KeInitializeMutex
KeReleaseMutex
KeInitializeTimerEx
KeSetTimerEx
KeQueryInterruptTime
_alldiv
_aullrem
memcmp
RtlInitString
RtlDeleteRegistryValue
RtlUTF8ToUnicodeN
ExAllocatePool
IoOpenDeviceRegistryKey
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwSetValueKey
ObQueryNameString
IoGetLowerDeviceObject
KeInitializeEvent
KeInitializeDpc
memset
_allmul
ExFreePoolWithTag
IofCompleteRequest
ExAllocatePoolWithTag

hal

KfReleaseSpinLock
KfAcquireSpinLock

wmilib.sys

WmiFireEvent
WmiCompleteRequest
WmiSystemControl

portcls.sys

PcInitializeAdapterDriver
PcDispatchIrp
PcAddAdapterDevice
PcRegisterSubdevice
PcRegisterPhysicalConnection
PcNewPort
PcNewMiniport
PcRegisterAdapterPowerManagement
PcNewServiceGroup

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/Rtkfilter.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/bthvirtual.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/bthvirtual.inf
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/leimalertservice.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/lelinklossservice.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/rtka2dp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/rtkavrcp.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/rtkfilter.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/BT_Driver/Win81X86/rtkhandsfree.cat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/ISLangUni.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/ISSetup.dll
.dll regsvr32 windows:6 windows x86 arch:x86

af93d22cb4944e6dc29e33177a19eda0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rpcrt4

UuidCreate

winmm

sndPlaySoundW

user32

DestroyWindow

gdi32

CreatePalette

advapi32

IsValidSecurityDescriptor

shell32

SHGetFolderPathW

ole32

CoCreateInstance

oleaut32

GetErrorInfo

shlwapi

SHStrDupW

version

VerQueryValueW

gdiplus

GdipDeleteGraphics

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProductSKU
GetScriptEngine
InstallEngineTypelib
RemoveEngineTypelib
SuiteIsFeatureInstalled
SuiteStartupInstall

Sections

.text
Size: 640KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/Install.bat
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/IsConfig.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/Release notes/Release_RTKBluetoothE.txt
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/UnInstall.bat
.bat .vbs
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/Uninstall.iss
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/_Setup.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:66:2a:26:09:bd:43:1d:09:6e:e5:c3:96:de:9c:a2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/03/2008, 00:00

Not After

18/03/2011, 23:59

Subject

CN=Acresso Software Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Acresso Software Inc.,L=Schaumburg,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:51:69:ff:ab:ea:52:06:69:49:61:5d:a6:a3:85:1c:97:7c:08:3e
Signer

Actual PE Digest

bd:51:69:ff:ab:ea:52:06:69:49:61:5d:a6:a3:85:1c:97:7c:08:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/data1.cab
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/data1.hdr
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/data2.cab
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/layout.bin
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/setup.exe
.exe windows:5 windows x86 arch:x86

c56467cb733da5d0dc212a96a41dcb6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

Imports

comctl32

ord17

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

lz32

LZOpenFileW
LZCopy
LZClose

msi

ord88
ord17
ord137
ord141
ord8
ord125
ord171
ord169

kernel32

CreateDirectoryW
FindClose
FindFirstFileW
GetDiskFreeSpaceW
GetDriveTypeW
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
RaiseException
SetErrorMode
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
CreateMutexW
CreateEventW
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FindResourceExW
FreeLibrary
LoadLibraryExW
lstrcmpiW
lstrcpynW
lstrcatW
LoadLibraryW
GetPrivateProfileIntW
IsBadReadPtr
CompareStringW
CompareStringA
GetSystemDefaultLangID
GetUserDefaultLangID
ExpandEnvironmentStringsW
GetCurrentDirectoryW
FileTimeToLocalFileTime
GetFileTime
SetFileAttributesW
HeapAlloc
VerLanguageNameW
GetProcessHeap
CopyFileW
IsValidLocale
GetLocaleInfoW
WideCharToMultiByte
lstrcpyA
GetTickCount
ExitThread
CreateThread
GetExitCodeProcess
ReadFile
GetCommandLineW
FormatMessageW
LocalFree
GetVersionExW
GetWindowsDirectoryW
InterlockedDecrement
InterlockedIncrement
GetTempPathW
CreateFileW
FindResourceW
GlobalFree
GlobalUnlock
FreeResource
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcatA
lstrcmpiA
MulDiv
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
HeapReAlloc
GetStringTypeW
GetCurrentThreadId
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
AreFileApisANSI
GetModuleHandleExW
GetStdHandle
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
MoveFileExW
WriteProcessMemory
VirtualProtectEx
GetSystemDirectoryW
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
TerminateProcess
ExitProcess
GetCurrentProcess
WaitForSingleObject
SetLastError
GetLastError
DuplicateHandle
RemoveDirectoryW
HeapFree
DeleteFileW
SetCurrentDirectoryW
lstrlenW
lstrcpyW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
Sleep
CloseHandle
GetACP
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
InterlockedExchange
lstrcpynA
ReadConsoleW
LocalAlloc
FindNextFileW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
lstrcmpW
GetShortPathNameW
GetCurrentThread
QueryPerformanceCounter
SearchPathW
lstrcmpA
SystemTimeToFileTime
ResetEvent
SetEvent
VirtualProtect
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetDateFormatW
GetTimeFormatW
GetTempFileNameW
GetEnvironmentVariableW
CompareFileTime
SetFileTime
OpenProcess
GetProcessTimes
lstrlenA
GetLocalTime
GetCurrentProcessId
GetVersion
LCMapStringW
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection

user32

wsprintfW
CharUpperBuffW
SendMessageW
MoveWindow
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetDlgItemTextW
SetActiveWindow
SetForegroundWindow
SetWindowTextW
GetWindowRect
MessageBoxW
GetWindowLongW
WaitForInputIdle
SetWindowLongW
LoadIconW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
SystemParametersInfoW
GetWindow
FillRect
GetSysColor
MapWindowPoints
RemovePropW
GetPropW
SetPropW
EndPaint
BeginPaint
EnableMenuItem
GetSystemMetrics
SetFocus
DefWindowProcW
GetMessageW
LoadStringW
LoadImageW
ReleaseDC
GetDC
CreateDialogParamW
GetParent
GetWindowTextW
CharNextW
GetDesktopWindow
GetClientRect
IsWindowEnabled
CreateDialogIndirectParamW
IsWindowVisible
IsDialogMessageW
FindWindowExW
ScreenToClient
EnableWindow
MsgWaitForMultipleObjects
SendDlgItemMessageW
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
ExitWindowsEx
CharUpperW
wsprintfA
CallWindowProcW
CreateWindowExW
DrawIcon
DrawTextW
UpdateWindow
GetWindowDC
InvalidateRect
DrawFocusRect
CopyRect
InflateRect
EnumChildWindows
GetClassNameW
MapDialogRect
RegisterClassExW
GetDlgItemTextW
IntersectRect
MonitorFromPoint

gdi32

SetTextColor
SetBkMode
SetBkColor
SaveDC
RestoreDC
CreateSolidBrush
UnrealizeObject
CreateHalftonePalette
GetDIBColorTable
SelectPalette
SelectObject
RealizePalette
GetSystemPaletteEntries
GetDeviceCaps
DeleteDC
CreatePalette
CreateCompatibleDC
BitBlt
GetObjectW
TranslateCharsetInfo
DeleteObject
CreateFontIndirectW
CreateCompatibleBitmap
CreateDCW
CreatePatternBrush
GetStockObject
GetTextExtentPoint32W
DeleteMetaFile
CreateDIBitmap
CreateBitmap
CreateRectRgn
PatBlt
PlayMetaFile
SelectClipRgn
SetMapMode
SetMetaFileBitsEx
SetPixel
StretchBlt
SetStretchBltMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
TextOutW

advapi32

RegCreateKeyExW
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
RegEnumKeyW
RegCreateKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteExW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
ProgIDFromCLSID
CreateStreamOnHGlobal
GetRunningObjectTable
CreateItemMoniker
CoLoadLibrary
CoCreateGuid
StringFromGUID2

oleaut32

LoadTypeLi
SetErrorInfo
SysReAllocStringLen
GetErrorInfo
CreateErrorInfo
VarBstrCmp
SysAllocStringLen
RegisterTypeLi
VariantClear
SysAllocString
SysFreeString
SysStringByteLen
SysStringLen
SysAllocStringByteLen
VariantInit
VariantChangeType
VarBstrCat
VarUI4FromStr

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

gdiplus

GdipGetImageWidth
GdipCreateFromHDC
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromResource
GdipDrawImageRectI
GdipSetInterpolationMode
GdiplusStartup
GdipGetImageHeight
GdipDeleteGraphics

Sections

.text
Size: 682KB - Virtual size: 682KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/setup.ini
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/setup.inx
RTBlueR_Windows_1015.1016.1016.0528.2020_F027_L/setup.iss

Sharing

General

Malware Config

Signatures

Files

3eacb9638877275335da4b58e52824f8

Code Sign

33:00:00:00:42:13:73:74:0a:c9:1a:0f:03:00:00:00:00:00:42Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

79:ef:c5:fb:49:a6:94:f1:73:23:09:11:a9:e2:00:4d:c6:dc:a1:cf:27:41:17:d9:ef:bf:44:75:d3:e7:0b:e7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

shell32

setupapi

wintrust

ole32

oleaut32

comctl32

comdlg32

crypt32

version

Sections

.text Size: 510KB - Virtual size: 510KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 27KB - Virtual size: 27KB

.rsrc Size: 470KB - Virtual size: 472KB

.reloc Size: 4KB - Virtual size: 3KB

c2d9fde39619d57abf8b5d597c886bd5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

33:00:00:00:42:13:73:74:0a:c9:1a:0f:03:00:00:00:00:00:42
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

79:ef:c5:fb:49:a6:94:f1:73:23:09:11:a9:e2:00:4d:c6:dc:a1:cf:27:41:17:d9:ef:bf:44:75:d3:e7:0b:e7
Signer

.text
Size: 510KB - Virtual size: 510KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 470KB - Virtual size: 472KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 497KB - Virtual size: 497KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 490KB - Virtual size: 489KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 162KB - Virtual size: 228KB

.pdata
Size: 12KB - Virtual size: 11KB

PAGE
Size: 38KB - Virtual size: 37KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

33:00:00:00:42:13:73:74:0a:c9:1a:0f:03:00:00:00:00:00:42
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

a0:e8:89:46:2c:5e:5e:5d:b5:f6:4c:5e:ad:e8:52:40:7c:3b:84:7b:61:e8:f4:d4:18:2e:af:c8:78:93:c5:17
Signer