Filter Agent[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Filter Agent.zip
Size

19.4MB
MD5

8a4db45f61bed53d731127acfc1e001a
SHA1

9b7b5631016f23ea2f7b826b0fe7097ce44a8e15
SHA256

6e70787ee5c3ac271bd9c2b5c65ef2a7d490a03649b15136dea0bb01ad6406a8
SHA512

5d19ada8cd2dfe276ed9e6472dc2e358d0f02f36956943f6e84de868a225b5f608a6932e580f4a49e8a291389bf250d667bf55014bb54e6369a140f05a49b73b
SSDEEP

393216:N2c5+IZvMWRnH3PHbNftTDgeNLSXbINfHfHD+a5pFJagoktpUGo9MBaJcmXs6+a:353RRHfHBVTDhtQbsfHvD+aJJoi9o9fL

Score

1^/10

Malware Config

Signatures

Files

Filter Agent.zip
.zip
Filter Agent/Copyright.txt
Filter Agent/Driver/LSSADrv.Cat
Filter Agent/Driver/LSSADrv.Inf
Filter Agent/Driver/LSSADrv.sys
.sys windows:10 windows x64 arch:x64

d86d857648966a6225267399456769da

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e
Signer

Actual PE Digest

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e

Digest Algorithm

sha256

PE Digest Matches

true

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e
Signer

Actual PE Digest

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

W:\Build\x64\Release\Crash\Symbols\sys\LSSADrv.pdb

Imports

ntoskrnl.exe

MmMapLockedPagesSpecifyCache
RtlFreeUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlUpcaseUnicodeString
RtlLengthSid
RtlCopySid
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwOpenProcessTokenEx
ZwQueryInformationToken
PsProcessType
DbgPrint
RtlTimeToTimeFields
KeInitializeMutex
KeReleaseMutex
ExSystemTimeToLocalTime
_vsnprintf
ZwOpenKey
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeClearEvent
RtlAppendUnicodeStringToString
ZwOpenSymbolicLinkObject
MmBuildMdlForNonPagedPool
ObQueryNameString
ZwOpenDirectoryObject
ZwCreateKey
ZwQueryValueKey
RtlInitUnicodeString
ZwAllocateVirtualMemory
RtlUnicodeToUTF8N
PsCreateSystemThread
PsThreadType
KeBugCheckEx
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeSetEvent
KeDelayExecutionThread
KeUnstackDetachProcess
KeStackAttachProcess
MmIsAddressValid
IoGetCurrentProcess
IoFreeMdl
IoAllocateMdl
MmMapLockedPages
MmUnlockPages
MmProbeAndLockPages
ExEventObjectType
ZwCreateEvent
ZwNotifyChangeKey
KeWaitForMultipleObjects
RtlAppendUnicodeToString
ZwSetValueKey
MmGetSystemRoutineAddress
CmUnRegisterCallback
RtlRandomEx
PsGetCurrentThreadId
PsGetCurrentProcessId
PsSetCreateProcessNotifyRoutine
__C_specific_handler
ProbeForWrite
ProbeForRead
KeWaitForSingleObject
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExDeletePagedLookasideList
ExInitializePagedLookasideList
ExpInterlockedPushEntrySList
RtlAnsiCharToUnicodeChar
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExReleaseFastMutex
ExAcquireFastMutex
KeInitializeEvent
RtlCompareUnicodeString
IoFileObjectType
ZwClose
ZwWriteFile
ZwReadFile
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
ObfDereferenceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
RtlInitAnsiString
ExFreePoolWithTag
ZwQuerySymbolicLinkObject
ExAllocatePoolWithTag

fltmgr.sys

FltGetRoutineAddress
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltCreateFile
FltReadFile
FltWriteFile
FltQueryInformationFile
FltSetInformationFile
FltClose
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltReferenceFileNameInformation
FltGetTunneledName
FltGetVolumeName
FltAllocateContext
FltSetInstanceContext
FltSetStreamHandleContext
FltDeleteStreamHandleContext
FltGetStreamHandleContext
FltReleaseContext
FltGetVolumeProperties
FltEnumerateVolumes
FltObjectDereference
FltEnumerateInstances

ndis.sys

NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisFreeNetBufferListPool
NdisRetreatNetBufferDataStart
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsFlowAssociateContext0
FwpsCalloutRegister1
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportReceiveAsync0
FwpsQueryPacketInjectionState0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpsCloneStreamData0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmSubLayerAdd0
FwpmCalloutAdd0
FwpmFilterAdd0

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Filter Agent/ExtensionManifest_Chrome.json
Filter Agent/ExtensionManifest_Edge.json
Filter Agent/ExtensionManifest_Firefox.json
Filter Agent/LSSASvc.exe
.exe windows:6 windows x64 arch:x64

f40eea52df87d6750cf2854bc45ba996

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:6a:f3:53:7d:58:83:01:bf:7e:1a:9f:e3:a0:24:49:40:1e:21:05:a3:c1:d4:d8:16:ba:42:bb:8c:69:93:41
Signer

Actual PE Digest

89:6a:f3:53:7d:58:83:01:bf:7e:1a:9f:e3:a0:24:49:40:1e:21:05:a3:c1:d4:d8:16:ba:42:bb:8c:69:93:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

W:\Build\x64\Release\Crash\Symbols\exe\LSSASvc.pdb

Imports

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

crypt32

CertOpenStore
CertFindCertificateInStore
CertCreateCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertNameToStrW
CryptStringToBinaryA
CertGetNameStringW
CertCloseStore

shlwapi

PathFindFileNameW

ws2_32

WSAIsBlocking
WSACancelBlockingCall
WSAAsyncSelect
gethostbyname
getpeername
__WSAFDIsSet
inet_addr
ioctlsocket
bind
closesocket
htonl
htons
select
setsockopt
ntohs
getsockname
recv
socket
WSAIoctl
gethostname
send
connect
getsockopt
GetAddrInfoW
WSAGetLastError
WSASetLastError
WSACleanup
freeaddrinfo
getaddrinfo
WSAStartup
FreeAddrInfoW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo
NotifyAddrChange
CancelIPChangeNotify

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

activeds

ord9

kernel32

DeleteFileW
CreateDirectoryW
GetFileAttributesW
lstrcmpW
lstrcpyW
lstrlenW
CreateProcessW
OpenProcess
RemoveDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
FindClose
FindFirstFileW
FindNextFileW
ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcAddress
GetCurrentDirectoryA
CreateDirectoryA
FindFirstFileA
Sleep
WaitForMultipleObjects
GetCurrentProcessId
lstrcmpiW
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
QueryFullProcessImageNameW
VerSetConditionMask
VerifyVersionInfoW
SetEvent
CreateEventW
TerminateThread
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToFileTime
ConnectNamedPipe
CreateNamedPipeW
ResetEvent
GetCurrentThreadId
DeviceIoControl
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetWaitableTimer
CreateWaitableTimerW
ResumeThread
GetSystemTime
WriteFile
QueryPerformanceCounter
QueryPerformanceFrequency
CreateThread
GetTempPathW
RaiseException
InitializeCriticalSectionEx
GetSystemInfo
ReadFile
GetEnvironmentVariableW
OutputDebugStringW
TlsAlloc
TlsGetValue
TlsSetValue
GetLocalTime
GetModuleHandleW
MoveFileW
InitializeCriticalSection
FormatMessageW
VirtualFree
FreeLibrary
SetLastError
LoadResource
LockResource
FindResourceW
FormatMessageA
lstrcmpA
lstrcmpiA
lstrcpynW
lstrcpyA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
SearchPathW
GetThreadLocale
GetComputerNameA
lstrcpynA
GetVersionExA
LoadLibraryA
GetFileSize
SetFilePointer
CreateFileA
GetTickCount
GetACP
GetExitCodeThread
GetVersion
DeleteFileA
GetTempFileNameA
GetTempPathA
IsDBCSLeadByte
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetStdHandle
GetFileSizeEx
CreateFileW
WTSGetActiveConsoleSessionId
GetComputerNameW
MoveFileExW
LCMapStringW
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapSize
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
WaitForSingleObjectEx
LocalFree
GetLastError
CloseHandle
SetFilePointerEx
HeapFree
HeapReAlloc
HeapAlloc
LoadLibraryExW
FlushFileBuffers
SetEndOfFile
WriteConsoleW
GetVersionExW
TryEnterCriticalSection
AcquireSRWLockExclusive
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetCommandLineW
GetCommandLineA
ReleaseSRWLockExclusive
InitializeSRWLock
IsDebuggerPresent
LoadLibraryExA
VirtualQuery
VirtualProtect
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
GetFileType
TlsFree
EncodePointer
RtlPcToFileHeader
RtlCaptureContext

user32

TranslateMessage
DispatchMessageA
PeekMessageA
PostMessageA
RegisterClassA
UnregisterClassA
GetWindowLongPtrA
DefWindowProcA
SendMessageA
SetWindowLongPtrA
MessageBeep
MessageBoxA
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
MessageBoxW
MsgWaitForMultipleObjects
CharUpperA
CharUpperW
CreateWindowExA
PostQuitMessage
wsprintfA
DestroyWindow
IsWindow

advapi32

CryptReleaseContext
CryptDestroyKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegNotifyChangeKeyValue
StartServiceCtrlDispatcherW
LookupPrivilegeValueW
CryptAcquireContextA
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
RegDeleteValueW
RegCreateKeyExW
LsaNtStatusToWinError
LsaLookupSids
LsaOpenPolicy
LsaClose
LsaFreeMemory
ConvertSidToStringSidW
RegOpenKeyExW
RegCloseKey
GetLengthSid
CryptImportKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoInitialize
CoUninitialize

oleaut32

VariantClear
VariantInit
SafeArrayGetLBound
SysStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SafeArrayGetElement

Exports

Exports

IPWorks_HTTP_CheckIndex
IPWorks_HTTP_Create
IPWorks_HTTP_Destroy
IPWorks_HTTP_Do
IPWorks_HTTP_Get
IPWorks_HTTP_GetLastError
IPWorks_HTTP_GetLastErrorCode
IPWorks_HTTP_Set
IPWorks_HTTP_StaticDestroy
IPWorks_HTTP_StaticInit
IPWorks_IPPort_CheckIndex
IPWorks_IPPort_Create
IPWorks_IPPort_Destroy
IPWorks_IPPort_Do
IPWorks_IPPort_Get
IPWorks_IPPort_GetLastError
IPWorks_IPPort_GetLastErrorCode
IPWorks_IPPort_Set
IPWorks_IPPort_StaticDestroy
IPWorks_IPPort_StaticInit
IPWorks_WebUpload_CheckIndex
IPWorks_WebUpload_Create
IPWorks_WebUpload_Destroy
IPWorks_WebUpload_Do
IPWorks_WebUpload_Get
IPWorks_WebUpload_GetLastError
IPWorks_WebUpload_GetLastErrorCode
IPWorks_WebUpload_Set
IPWorks_WebUpload_StaticDestroy
IPWorks_WebUpload_StaticInit

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Filter Agent/LSSASvc.log
Filter Agent/PolicyData/block
Filter Agent/PolicyData/cache
Filter Agent/PolicyData/exclusions
Filter Agent/PolicyData/helpers
Filter Agent/PolicyData/license
Filter Agent/PolicyData/pac
Filter Agent/PolicyData/policy
Filter Agent/PolicyLogs/lsfilter-panic-1707166149697.log
Filter Agent/PolicyLogs/lsfilter-panic-1707488867668.log
Filter Agent/PolicyLogs/lsfilter-panic-1709051690520.log
Filter Agent/PolicyLogs/lsfilter-panic-1709242744489.log
Filter Agent/PolicyLogs/lsfilter-panic-1709738612767.log
Filter Agent/PolicyLogs/lsfilter.log
Filter Agent/Update.exe
.exe windows:6 windows x64 arch:x64

f03fca0baa2ef99147e2ce39e99712da

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:ee:5f:dd:6e:e7:51:ec:05:f8:7d:26:8b:e5:20:b9:09:b3:12:28:5d:44:b0:87:16:9e:1b:1c:d3:7a:f6:2f
Signer

Actual PE Digest

d3:ee:5f:dd:6e:e7:51:ec:05:f8:7d:26:8b:e5:20:b9:09:b3:12:28:5d:44:b0:87:16:9e:1b:1c:d3:7a:f6:2f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

W:\Build\x64\Release\Crash\Symbols\exe\Update.pdb

Imports

msimg32

AlphaBlend
TransparentBlt

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipCreateBitmapFromScan0
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawString
GdipCreateStringFormat
GdipBitmapLockBits
GdipSetStringFormatAlign
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdiplusStartup
GdiplusShutdown
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetStringFormatLineAlign
GdipDrawImageI
GdipBitmapUnlockBits
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteStringFormat
GdipDeleteGraphics
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectI

kernel32

WideCharToMultiByte
MultiByteToWideChar
lstrcpynW
lstrcmpA
FormatMessageW
FormatMessageA
LoadLibraryExW
FreeLibrary
FindResourceW
SizeofResource
LockResource
LoadResource
MoveFileW
GetModuleHandleW
GetLocalTime
GetSystemTime
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
CreateEventW
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
GetLocaleInfoW
WriteFile
GetFileSizeEx
FindNextFileW
FindFirstFileW
DeleteFileW
CreateFileW
GetEnvironmentVariableW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapAlloc
RaiseException
DecodePointer
lstrcmpiW
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
TerminateThread
LocalFree
LocalAlloc
GetCurrentProcess
CreateProcessA
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
FindNextFileA
FindFirstFileA
FindClose
GetCurrentDirectoryA
GetTempPathA
GetProcAddress
CloseHandle
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
lstrlenW
lstrcpyW
lstrcmpW
SetLastError
GetLastError
GetFileAttributesW
GetThreadLocale
SetCurrentDirectoryW
HeapReAlloc
CreateDirectoryW
SearchPathW
LCMapStringW
WriteConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetConsoleOutputCP
GetConsoleMode
OutputDebugStringA
EncodePointer
GetModuleHandleExW
LoadLibraryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
MulDiv
CopyFileW
InitializeCriticalSection
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetThreadPriority
ResumeThread
CompareStringW
GlobalGetAtomNameW
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
GlobalFlags
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
GetVersionExW
GetUserDefaultUILanguage
VirtualProtect
GetFileTime
GetTempFileNameW
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
FindResourceExW
VerSetConditionMask
VerifyVersionInfoW
GetTempPathW
GetTickCount
GetProfileIntW
Sleep
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
RtlUnwindEx
RtlPcToFileHeader
GetFileType
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
HeapQueryInformation
GetSystemInfo
VirtualQuery
QueryPerformanceFrequency
SetStdHandle
ExitProcess
GetStdHandle
SetFilePointerEx

user32

IsChild
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetMenu
SetMenu
TrackPopupMenu
GetForegroundWindow
SetForegroundWindow
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
CopyRect
EqualRect
PtInRect
GetClassLongPtrW
GetTopWindow
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
FillRect
RealChildWindowFromPoint
DestroyIcon
DestroyMenu
GetMenuItemInfoW
InflateRect
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
PostQuitMessage
CreateDialogIndirectParamW
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
IntersectRect
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
LoadMenuW
CreatePopupMenu
InsertMenuItemW
SetCursor
LoadImageW
UnpackDDElParam
ReuseDDElParam
ShowOwnedPopups
DeleteMenu
GetKeyNameTextW
MapVirtualKeyW
UnionRect
IsRectEmpty
GetSystemMenu
SetParent
GetNextDlgGroupItem
WindowFromPoint
DrawFocusRect
DrawIconEx
GetIconInfo
CreateWindowExW
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongPtrW
SetWindowRgn
DrawEdge
DrawFrameControl
IsZoomed
SetCursorPos
CopyIcon
FrameRect
DrawIcon
LockWindowUpdate
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMessagePos
LoadCursorW
GetSysColorBrush
GetSysColor
GetSystemMetrics
GetLastActivePopup
GetWindowThreadProcessId
UnhookWindowsHookEx
SetRect
MessageBeep
AdjustWindowRectEx
SetActiveWindow
IsClipboardFormatAvailable
RegisterWindowMessageW
IsMenu
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
ScreenToClient
ClientToScreen
GetWindowRect
DragDetect
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetActiveWindow
EndDialog
DialogBoxParamW
ShowWindow
MessageBoxW
ExitWindowsEx
GetWindow
GetClassNameW
MapWindowPoints
GetWindowTextLengthW
GetWindowTextW
ReleaseDC
GetDC
GetDlgItem
CharUpperW
UnregisterClassW
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
GetClientRect
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
SetFocus
GetDlgCtrlID
SetWindowPos
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageW
TrackMouseEvent
EnableWindow
GetFocus
CheckDlgButton
MoveWindow
IsWindow
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
EnableScrollBar

gdi32

Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
CreateDCW
SetBkColor
CreateBitmap
CreateHatchBrush
CreatePen
Rectangle
CreateRectRgn
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
Polyline
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
CreateRoundRectRgn
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
RectVisible
LPtoDP
CreatePatternBrush
CreateCompatibleDC
SetTextColor
SetBkMode
GetStockObject
CreateSolidBrush
GetObjectW
GetTextExtentPoint32W
DeleteDC
CreateCompatibleBitmap
BitBlt
SetWindowOrgEx
SetViewportOrgEx
DPtoLP
ModifyWorldTransform
GetTextMetricsW
SetGraphicsMode
SelectObject
SaveDC
RestoreDC
GetDeviceCaps
DeleteObject
CreateFontIndirectW
SetTextAlign
CopyMetaFileW
MoveToEx
TextOutW
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
SetRectRgn
PatBlt
CreateRectRgnIndirect
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowExtEx
SetViewportExtEx
ExtTextOutW

advapi32

RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegDeleteTreeW
GetUserNameA
OpenProcessToken
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteW
SHGetFolderPathA
SHGetFolderPathW
SHAppBarMessage
SHBrowseForFolderW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoLockObjectExternal
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoTaskMemAlloc
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
OleLockRunning
RevokeDragDrop
RegisterDragDrop
OleCreateMenuDescriptor

oleaut32

VarBstrFromDate
VariantChangeType
VariantClear
VariantInit
SysAllocString
VariantCopy
LoadTypeLi
SysAllocStringLen
SysStringLen
SystemTimeToVariantTime
SysFreeString
VariantTimeToSystemTime

shlwapi

StrFormatKBSizeW
PathRemoveFileSpecW
PathFindExtensionW
PathStripToRootW
PathFindFileNameW
PathIsUNCW

uxtheme

DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
OpenThemeData
CloseThemeData
GetThemeColor
GetCurrentThemeName
GetThemePartSize
IsAppThemed
GetWindowTheme
GetThemeSysColor
DrawThemeText

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 527KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Filter Agent/ca.pem
Filter Agent/ca_key.pem
Filter Agent/localhost.pem
Filter Agent/localhost_key.pem
Filter Agent/lsconfig.json
Filter Agent/lsfilter.exe
.exe windows:6 windows x64 arch:x64

65892a964106b5e0c6c363fdf21975eb

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:8e:ec:00:75:97:78:2d:d2:8b:11:90:eb:27:60:71:64:d1:8c:e9:92:73:f5:8b:32:8f:c3:50:0f:ac:30:48
Signer

Actual PE Digest

7e:8e:ec:00:75:97:78:2d:d2:8b:11:90:eb:27:60:71:64:d1:8c:e9:92:73:f5:8b:32:8f:c3:50:0f:ac:30:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 285KB - Virtual size: 710KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 295B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 821KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 830KB - Virtual size: 830KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Filter Agent/lsproxy.exe
.exe windows:6 windows x64 arch:x64

ff9f3a86709796c17211f9df12aae74d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:5d:26:43:9c:f0:98:71:3a:24:6f:e9:af:b3:77:36:20:79:e7:9e:62:a9:f4:04:b1:75:c3:07:85:4d:54:34
Signer

Actual PE Digest

c6:5d:26:43:9c:f0:98:71:3a:24:6f:e9:af:b3:77:36:20:79:e7:9e:62:a9:f4:04:b1:75:c3:07:85:4d:54:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 295B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 599KB - Virtual size: 598KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 965KB - Virtual size: 965KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 830KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 211KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Filter Agent/makeca.exe
.exe windows:6 windows x64 arch:x64

c7269d59926fa4252270f407e4dab043

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2023, 00:00

Not After

10/01/2026, 23:59

Subject

CN=Lightspeed Solutions\, LLC,O=Lightspeed Solutions\, LLC,L=Austin,ST=TEXAS,C=US,1.2.840.113549.1.9.1=#0c186974406c69676874737065656473797374656d732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:00:e6:67:91:5b:c9:3c:31:9d:88:89:41:24:8e:a1:7d:2c:1d:d4:35:4f:3d:08:c4:38:d1:f6:b1:cf:c7:c2
Signer

Actual PE Digest

6f:00:e6:67:91:5b:c9:3c:31:9d:88:89:41:24:8e:a1:7d:2c:1d:d4:35:4f:3d:08:c4:38:d1:f6:b1:cf:c7:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
Sleep
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 281B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Filter Agent/manifest.json

Sharing

General

Malware Config

Signatures

Files

d86d857648966a6225267399456769da

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ecCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8eSigner

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

fltmgr.sys

ndis.sys

fwpkclnt.sys

Sections

.text Size: 86KB - Virtual size: 86KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 5KB - Virtual size: 4KB

INIT Size: 5KB - Virtual size: 5KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 208B

f40eea52df87d6750cf2854bc45ba996

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ecCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

89:6a:f3:53:7d:58:83:01:bf:7e:1a:9f:e3:a0:24:49:40:1e:21:05:a3:c1:d4:d8:16:ba:42:bb:8c:69:93:41Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wintrust

crypt32

shlwapi

ws2_32

version

iphlpapi

wtsapi32

userenv

activeds

kernel32

user32

advapi32

shell32

ole32

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e
Signer

71:51:82:a3:a9:3d:6d:25:09:93:e8:d4:95:a4:7d:aa:04:19:06:5e:a2:a7:26:31:cf:c3:5e:d7:09:9b:06:8e
Signer

.text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 5KB - Virtual size: 4KB

INIT
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 208B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

89:6a:f3:53:7d:58:83:01:bf:7e:1a:9f:e3:a0:24:49:40:1e:21:05:a3:c1:d4:d8:16:ba:42:bb:8c:69:93:41
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 346KB - Virtual size: 346KB

.data
Size: 55KB - Virtual size: 107KB

.pdata
Size: 39KB - Virtual size: 39KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 232KB - Virtual size: 232KB

.reloc
Size: 7KB - Virtual size: 7KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d3:ee:5f:dd:6e:e7:51:ec:05:f8:7d:26:8b:e5:20:b9:09:b3:12:28:5d:44:b0:87:16:9e:1b:1c:d3:7a:f6:2f
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 527KB - Virtual size: 526KB

.data
Size: 28KB - Virtual size: 58KB

.pdata
Size: 84KB - Virtual size: 83KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 228KB - Virtual size: 227KB

.reloc
Size: 57KB - Virtual size: 56KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:ee:36:cc:02:8e:98:cc:d8:68:ce:35:e8:c9:7c:ec
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate