CheapFTN Perm Updated[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

CheapFTN Perm Updated.rar
Size

12.4MB
MD5

f1e3ee0026710bb59b13982b20b3341b
SHA1

8be255ac7792ff0808dd379e8859e5eed1057297
SHA256

1cc17720354ee080b2ff890af3d5937a3c73a7c636f7e7a6bfaadcba91bef108
SHA512

a8e2d4a268551fde2896e233788cc6888747a760d85565fe0c77e24f078ec4b05f8ea30e63180c120673de2b92064308bda0e8ad59c32c8c08abdd23a7ee1c85
SSDEEP

196608:GVYuO9EjW+gZ9Lu/tQljv2Wzi3nYn3M5qupnxD8PrJkbEgQLorT:iH2ExgZA/8aWQnYwqupnxowEVLeT

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/CheapFTN Perm Updated/applecleaner/applecleaner.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CheapFTN Perm Updated/NewLoader.exe
unpack001/CheapFTN Perm Updated/applecleaner/applecleaner.exe
unpack003/Raid Drivers/AMD RAID/detectdrives.exe

Files

CheapFTN Perm Updated.rar
.rar
CheapFTN Perm Updated/NewLoader.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

4`DF<[H
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

4`DF<[H
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

vDpMbr
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Code Enc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Xerin
Size: 512B - Virtual size: 141B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CheapFTN Perm Updated/ReadMe.txt
CheapFTN Perm Updated/applecleaner/applecleaner.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 54KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
CheapFTN Perm Updated/spoofing guide/spoofing guide/Extract_This_Folder_On_To_Your_USB_INTEL.zip
.zip
Extract_This_Folder_On_To_Your_USB_INTEL/HfcDisableService.exe
.exe windows:6 windows x64 arch:x64

6ed9069470e02e397bbe48349bdeacef

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa
Signer

Actual PE Digest

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa

Digest Algorithm

sha256

PE Digest Matches

true

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa
Signer

Actual PE Digest

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Middleware\HfcDisableService\HfcDisableService\output\Release\x64\HfcDisableService.pdb

Imports

setupapi

CM_Locate_DevNodeA
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_Interface_List_SizeA
CM_Reenumerate_DevNode
CM_Get_Device_Interface_ListA

advapi32

StartServiceCtrlDispatcherW
RegDeleteTreeW
ControlService
EnumDependentServicesW
StartServiceW
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
OpenServiceW
ChangeServiceConfigW
QueryServiceStatusEx
RegSetKeyValueW
LookupPrivilegeValueA
OpenSCManagerW
CloseServiceHandle
RegDeleteValueA
LookupPrivilegeValueW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
AdjustTokenPrivileges
InitiateSystemShutdownW
OpenProcessToken

kernel32

GlobalAddAtomW
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
HeapSize
FileTimeToSystemTime
FormatMessageW
LocalFree
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateFileA
SetLastError
DeviceIoControl
WriteFile
ReadFile
lstrlenA
GetCurrentThreadId
CreateMutexA
ReleaseMutex
GetACP
IsValidCodePage
CreateProcessW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetFirmwareEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
VerSetConditionMask
VerifyVersionInfoA
GetExitCodeProcess
CloseHandle
GetLastError
CreateEventW
GetDiskFreeSpaceExA
LCMapStringW
SetWaitableTimer
CreateWaitableTimerA
__C_specific_handler
CompareStringW
GetTimeFormatW
GetDateFormatW
GetProcessHeap
TlsFree
CreateEventA
OpenEventA
OpenMutexA
CreateSemaphoreA
ResetEvent
CreateThread
SetEvent
TlsSetValue
TlsGetValue
TlsAlloc
HeapReAlloc
GetFinalPathNameByHandleW
OpenFileById
CreateFileW
GetProcAddress
GetModuleHandleW
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
GetTimeZoneInformation
SetStdHandle
FindClose
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetFileType
HeapAlloc
Sleep
WaitForSingleObject
WriteConsoleW
GetOEMCP
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetTickCount
FreeLibrary
LoadLibraryExW
HeapFree
GetConsoleOutputCP
DeleteFileW
LocalAlloc
GetCommandLineW
GetCommandLineA
EnumSystemLocalesW
ExitProcess
FindFirstFileExW
GetStdHandle
FlsFree
FlsSetValue
ReadConsoleW
RtlUnwind
K32GetModuleBaseNameW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
TryEnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
InitOnceExecuteOnce
GetStringTypeW
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
FlsAlloc
FlsGetValue
GetConsoleMode

user32

GetSystemMetrics

ole32

CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoInitializeEx
CoTaskMemFree

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
NdrClientCall3

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiRaidLevelModify
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/Optane.dll
.dll windows:6 windows x64 arch:x64

733a95c74febe8b57c6e0b53244745df

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07
Signer

Actual PE Digest

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07

Digest Algorithm

sha256

PE Digest Matches

true

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07
Signer

Actual PE Digest

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Common\build\OptaneApi\x64\ReleaseOEM\Optane.pdb

Imports

advapi32

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

kernel32

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
__C_specific_handler
WriteConsoleW
CreateFileW
DeleteCriticalSection
LocalAlloc
LocalFree
CloseHandle
LeaveCriticalSection
GetConsoleMode
RtlLookupFunctionEntry
GetLastError
SetLastError
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedFlushSList
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP

rpcrt4

NdrClientCall3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

Exports

Exports

OptanePinOemApplication

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/OptaneEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76
Signer

Actual PE Digest

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76

Digest Algorithm

sha256

PE Digest Matches

true

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76
Signer

Actual PE Digest

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\7210\Output\Driver\x64\Release\OptaneEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/RstMwEventLogMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:23:8b:b5:98:ea:cf:8b:59:e8:52:65:ee:09:d3:94:c3:03:49:05:7c:0d:77:45:08:e3:c4:e7:53:1b:20:7c
Signer

Actual PE Digest

12:23:8b:b5:98:ea:cf:8b:59:e8:52:65:ee:09:d3:94:c3:03:49:05:7c:0d:77:45:08:e3:c4:e7:53:1b:20:7c

Digest Algorithm

sha256

PE Digest Matches

true

12:23:8b:b5:98:ea:cf:8b:59:e8:52:65:ee:09:d3:94:c3:03:49:05:7c:0d:77:45:08:e3:c4:e7:53:1b:20:7c
Signer

Actual PE Digest

12:23:8b:b5:98:ea:cf:8b:59:e8:52:65:ee:09:d3:94:c3:03:49:05:7c:0d:77:45:08:e3:c4:e7:53:1b:20:7c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\7210\Output\Driver\x64\Release\RstMwEventLogMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/RstMwService.exe
.exe windows:6 windows x64 arch:x64

29d47052087c0ce4adc69ab322fa420b

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:27:be:23:b8:88:fc:39:af:0a:e2:ef:85:f9:2c:f1:02:cc:1e:b1:5d:d6:8b:7c:7d:02:be:bd:3b:04:84:5e
Signer

Actual PE Digest

2e:27:be:23:b8:88:fc:39:af:0a:e2:ef:85:f9:2c:f1:02:cc:1e:b1:5d:d6:8b:7c:7d:02:be:bd:3b:04:84:5e

Digest Algorithm

sha256

PE Digest Matches

true

2e:27:be:23:b8:88:fc:39:af:0a:e2:ef:85:f9:2c:f1:02:cc:1e:b1:5d:d6:8b:7c:7d:02:be:bd:3b:04:84:5e
Signer

Actual PE Digest

2e:27:be:23:b8:88:fc:39:af:0a:e2:ef:85:f9:2c:f1:02:cc:1e:b1:5d:d6:8b:7c:7d:02:be:bd:3b:04:84:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CreateEventA
GetExitCodeThread
CreateFileA
WriteFile
InitOnceExecuteOnce
InitializeSRWLock
TryAcquireSRWLockExclusive
GetCurrentThread
LocalAlloc
WaitForSingleObjectEx
FileTimeToSystemTime
GetSystemTime
GetSystemTimeAsFileTime
GetModuleHandleA
FormatMessageW
SystemTimeToFileTime
GetTimeFormatEx
GetDateFormatEx
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentThreadId
VerSetConditionMask
VerifyVersionInfoA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
lstrlenA
GetDiskFreeSpaceExA
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapDestroy
ReleaseMutex
DecodePointer
TryEnterCriticalSection
WTSGetActiveConsoleSessionId
QueryPerformanceCounter
InitializeSListHead
OpenProcess
GetPackageId
GetPackagePath
SleepConditionVariableSRW
K32GetModuleBaseNameW
K32GetModuleFileNameExW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
DeviceIoControl
ReadFile
EncodePointer
FreeLibrary
LoadLibraryExW
FlsFree
FlsSetValue
SetWaitableTimer
CreateWaitableTimerA
FlsGetValue
FlsAlloc
RtlUnwind
GetFinalPathNameByHandleW
OpenFileById
CreateFileW
GetProcAddress
GetModuleHandleW
InterlockedPushEntrySList
RtlPcToFileHeader
FindNextFileW
GetModuleHandleExW
GetModuleFileNameW
RtlUnwindEx
WriteConsoleW
FindClose
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadConsoleW
FindFirstFileExW
GetConsoleMode
GetConsoleOutputCP
OpenEventA
OpenMutexA
GetCurrentProcess
InitializeConditionVariable
WakeConditionVariable
CreateSemaphoreA
SleepConditionVariableCS
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
LCMapStringEx
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
WideCharToMultiByte
CreateMutexW
WaitForMultipleObjects
CompareStringEx
LocalFree
GetCommandLineA
InitializeCriticalSection
GetCommandLineW
GetLastError
CreateEventW
ResetEvent
CreateThread
CloseHandle
SetEvent
GetTickCount
GetFirmwareEnvironmentVariableW
GetOEMCP
GetACP
IsValidCodePage
MultiByteToWideChar
GetStringTypeW
GetCPInfo
CreateMutexA
WaitForSingleObject
DeleteFileW
RaiseException
GetTimeZoneInformation
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitThread
FreeLibraryAndExitThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetStdHandle
GetFileType

advapi32

RegDeleteTreeW
CloseServiceHandle
OpenSCManagerW
ControlService
StartServiceCtrlDispatcherW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterServiceCtrlHandlerW
TraceMessage
SetServiceStatus
EnumDependentServicesW
StartServiceW
DeregisterEventSource
RegisterEventSourceW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
InitiateSystemShutdownA
RegSetKeyValueW
RegCreateKeyExW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RevertToSelf
SetEntriesInAclW
ImpersonateLoggedOnUser
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpRegisterW
RpcEpUnregister
UuidToStringA
I_RpcBindingInqLocalClientPID
I_RpcGetCurrentCallHandle
RpcImpersonateClient
RpcRevertToSelfEx
RpcStringFreeA
NdrServerCallAll
NdrClientCall3
RpcRevertToSelf
NdrServerCall2

userenv

UnloadUserProfile

ole32

CoReleaseMarshalData
StringFromGUID2
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoGetInterfaceAndReleaseStream

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

user32

GetSystemMetrics

setupapi

CM_Locate_DevNodeA
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA
CM_Locate_DevNodeW
CM_Reenumerate_DevNode

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

Exports

Exports

??0CConsolidatedError@@QEAA@AEBV0@@Z
??0CConsolidatedError@@QEAA@W4ISDI2_ERRORS@CConsolidatedErrorGenerated@@@Z
??0CConsolidatedError@@QEAA@XZ
??0GlobalLogger@@AEAA@XZ
??0ISIAccelerateAction@@QEAA@XZ
??0scoped_c_thread_locale@details@utility@@QEAA@XZ
??0value@json@web@@QEAA@$$QEAV012@@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@H@Z
??0value@json@web@@QEAA@I@Z
??0value@json@web@@QEAA@N@Z
??0value@json@web@@QEAA@PEB_W@Z
??0value@json@web@@QEAA@PEB_W_N@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QEAA@XZ
??0value@json@web@@QEAA@_J@Z
??0value@json@web@@QEAA@_K@Z
??0value@json@web@@QEAA@_N@Z
??1CConsolidatedError@@QEAA@XZ
??1GlobalLogger@@QEAA@XZ
??1ISIAccelerateAction@@QEAA@XZ
??1scoped_c_thread_locale@details@utility@@QEAA@XZ
??4CConsolidatedError@@QEAAAEAV0@AEBV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@$$QEAV0@@Z
??4CConsolidatedErrorGenerated@@QEAAAEAV0@AEBV0@@Z
??4GlobalLogger@@AEAAAEAV0@$$QEAV0@@Z
??4value@json@web@@QEAAAEAV012@$$QEAV012@@Z
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
??5json@web@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEAVvalue@01@@Z
??6json@web@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AEAV23@AEBVvalue@01@@Z
??8value@json@web@@QEBA_NAEBV012@@Z
??Avalue@json@web@@AEAAAEAV012@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QEAAAEAV012@_K@Z
??BCConsolidatedError@@QEBA?AU_ISI_Error@@XZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEBDZZ
?AddDebugInformation@CConsolidatedError@@QEAAXPEB_WZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEBDZZ
?AddErrorMessage@CConsolidatedError@@QEAAXPEB_WZZ
?CleanupIsiError@@YAXI@Z
?CleanupIsiError@@YAXPEAU_ISI_Error@@@Z
?ClearError@CConsolidatedError@@QEAAXXZ
?FreeStringResources@CConsolidatedError@@AEAAXXZ
?GetDebugInformation@CConsolidatedError@@QEBAKPEADH@Z
?GetDebugInformation@CConsolidatedError@@QEBAKPEA_WH@Z
?GetDebugInformation@CConsolidatedError@@QEBAPEBDXZ
?GetErrorCodeString@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorCodeString@CConsolidatedError@@QEBAPEBDXZ
?GetErrorMessage@CConsolidatedError@@QEBAKPEADH@Z
?GetErrorMessage@CConsolidatedError@@QEBAKPEA_WH@Z
?GetErrorMessage@CConsolidatedError@@QEBAPEBDXZ
?GetSrtEolError@CConsolidatedError@@SA?AV1@XZ
?InternalAddDebugInformation@CConsolidatedError@@AEAAXPEBDPEAD@Z
?InternalAddErrorMessage@CConsolidatedError@@AEAAXPEBDPEAD@Z
?IsBusy@CConsolidatedError@@QEBA_NXZ
?IsError@CConsolidatedError@@QEBA_NXZ
?IsPending@CConsolidatedError@@QEBA_NXZ
?IsSuccessful@CConsolidatedError@@QEBA_NXZ
?MAX_ERROR_STRING_SIZE@CConsolidatedError@@2HB
?MapIsiStatus@CConsolidatedError@@AEBA?AW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@W4_ISI_Status@@@Z
?NO_ID@GlobalLogger@@2_KB
?SMALL_STRING_SIZE@CConsolidatedError@@2HB
?SetError@CConsolidatedError@@QEAAXV1@@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W1@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERRORS@CConsolidatedErrorGenerated@@PEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEBD@Z
?SetError@CConsolidatedError@@QEAAXW4ISDI2_ERROR_TYPE@1@KPEB_W@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEBD1@Z
?SetError@CConsolidatedError@@QEAAXW4_ISI_Status@@PEB_W1@Z
?SetErrorCodeString@CConsolidatedError@@AEAAXXZ
?SetLoggingOff@GlobalLogger@@SAXXZ
?SetLoggingOn@GlobalLogger@@SAXXZ
?__autoclassinit2@CConsolidatedError@@QEAAX_K@Z
?__autoclassinit2@GlobalLogger@@QEAAX_K@Z
?_disableLogging@GlobalLogger@@0_NA
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?array@value@json@web@@SA?AV123@_K@Z
?as_array@value@json@web@@QEAAAEAVarray@23@XZ
?as_array@value@json@web@@QEBAAEBVarray@23@XZ
?as_bool@value@json@web@@QEBA_NXZ
?as_double@value@json@web@@QEBANXZ
?as_integer@value@json@web@@QEBAHXZ
?as_number@value@json@web@@QEBAAEBVnumber@23@XZ
?as_object@value@json@web@@QEAAAEAVobject@23@XZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEAAAEAV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEAAAEAV123@_K@Z
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
?boolean@value@json@web@@SA?AV123@_N@Z
?c_locale@scoped_c_thread_locale@details@utility@@SAPEAU__crt_locale_pointers@@XZ
?checkIfDiskPairValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IIAEAW4_ISI_NgsaDiskPairStatus@@@Z
?checkIfDiskValid@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NgsaDiskConcatenationMember@@AEAW4_ISI_NgsaDiskValidForConcatenationStatus@@@Z
?clean@GlobalLogger@@QEAAX_K@Z
?configDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?configVolumeAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?default_error_condition@windows_category_impl@details@utility@@UEBA?AVerror_condition@std@@H@Z
?doClearBlockCache@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doCreateCacheVolumeTask@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doDisassociate@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEBU_ISI_VolumeInfo@@@Z
?doNgsaAutomation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@AEAI@Z
?doNgsaDisableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaEnableOneStep@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doNgsaStartTools@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doResetVolportPerformanceCounters@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?doSeparateConcatenation@ISIAccelerateAction@@UEAA?AU_ISI_Error@@XZ
?doSeparateConcatenationNoSync@ISIAccelerateAction@@QEAA?AU_ISI_Error@@XZ
?erase@value@json@web@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QEAAX_K@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@AEBAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from_string@datetime@utility@@SA?AV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?generate@nonce_generator@utility@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?get@GlobalLogger@@SAAEAV1@XZ
?getError@GlobalLogger@@QEAA?AVCConsolidatedError@@_K_N@Z
?getLastError@GlobalLogger@@QEAA?AVCConsolidatedError@@_N@Z
?getLastId@GlobalLogger@@QEAA_KXZ
?getMaxCacheSize@ISIAccelerateAction@@SA_K_N@Z
?getMinCacheSize@ISIAccelerateAction@@SA_K_N@Z
?has_array_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_integer_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QEBA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?is_double@value@json@web@@QEBA_NXZ
?is_int32@number@json@web@@QEBA_NXZ
?is_int64@number@json@web@@QEBA_NXZ
?is_integer@value@json@web@@QEBA_NXZ
?is_uint32@number@json@web@@QEBA_NXZ
?keep_object_element_order@json@web@@YAX_N@Z
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
?message@windows_category_impl@details@utility@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AEAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AEAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAVerror_code@5@@Z
?platform_category@details@utility@@YAAEBVerror_category@std@@XZ
?resetCacheToAvailable@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QEBAXAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?setCacheVolSize@ISIAccelerateAction@@UEAAX_K@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@@Z
?setError@GlobalLogger@@QEAA_KAEBVCConsolidatedError@@AEAU_ISI_Error@@@Z
?setFastDisk@ISIAccelerateAction@@UEAAXI@Z
?setFcMode@ISIAccelerateAction@@UEAAXW4_ISI_NgsaFileCacheMode@@@Z
?setFileCacheSize@ISIAccelerateAction@@UEAAXI@Z
?setMigrationStart@ISIAccelerateAction@@UEAAX_K@Z
?setPreservePinningData@ISIAccelerateAction@@UEAAX_N@Z
?setSeparationSafe@ISIAccelerateAction@@UEAAX_N@Z
?setSlowDisk@ISIAccelerateAction@@UEAAXI@Z
?string@value@json@web@@CA?AV123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPEAX_KPEAV12@@Z
?to_string@datetime@utility@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@value@json@web@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?turnOffVolumeOrDiskAcceleration@ISIAccelerateAction@@UEAA?AU_ISI_Error@@I@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?waitForNvcMode@ISIAccelerateAction@@UEAA?AU_ISI_Error@@IW4_ISI_NvcMode@@@Z
?windows_category@details@utility@@YAAEBVerror_category@std@@XZ
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z
GetLPCId
ISI_NgsaDiskPairStatusToDescription
ISI_NgsaDiskValidForConcatenationStatusToDescription
ISI_NgsaOperationStatusToDescription
IsiAddDisksToArray
IsiArraySetWriteCacheState
IsiCacheVolumeCreateFromArray
IsiCacheVolumeCreateFromDisks
IsiDiskAssignStoragePool
IsiDiskClaim
IsiDiskClearMetadata
IsiDiskDestroyCache
IsiDiskMarkAsFailed
IsiDiskMarkAsNormal
IsiDiskMarkAsSpare
IsiDiskMarkOffline
IsiDiskMarkOnline
IsiDiskResetSmartEvent
IsiDiskSetCacheBufferFlushSetting
IsiDiskSetCacheMode
IsiDiskSetCacheSpindownPolicy
IsiDiskSetSmartEvent
IsiDiskSetWriteCachingPolicySetting
IsiDiskUnlock
IsiDiskUnmarkAsSpare
IsiEventClose
IsiEventSetUpForAllWithHandle
IsiEventWaitWithHandle
IsiExpandVolume
IsiFinalize
IsiGetArrayHandles
IsiGetArrayHandlesByControllerHandle
IsiGetArrayInfo
IsiGetControllerHandles
IsiGetControllerInfo
IsiGetDiskIdentifyData
IsiGetEndDeviceHandles
IsiGetEndDeviceInfo
IsiGetErrorDebugMessage
IsiGetErrorMessage
IsiGetIsRTD3HotEnabled
IsiGetIsmArrays
IsiGetIsmEndDevices
IsiGetIsmVolumes
IsiGetLastErrorDebugMessage
IsiGetLastErrorMessage
IsiGetMiddlewareVersionInfo
IsiGetNgsaDiskPairHandles
IsiGetNgsaDiskPairInfo
IsiGetNgsaHandles
IsiGetNgsaInfo
IsiGetNgsaInfoEx
IsiGetNvCachePolicyStatInfo
IsiGetNvCacheStat2Info
IsiGetNvCacheStatInfo
IsiGetNvCacheUnifiedStats
IsiGetNvcInfo
IsiGetOptaneOptimizationInfo
IsiGetPhyHandles
IsiGetPhyInfo
IsiGetRaidInfo
IsiGetRaidInfoHandles
IsiGetRaidLevelInfo
IsiGetRdpDictEndDevices
IsiGetSystemInfo
IsiGetVolportPerformanceCounters
IsiGetVolumeHandles
IsiGetVolumeInfo
IsiGetVolumeMigrationRange
IsiGetZpoddInfo
IsiInitialize
IsiNvcDisassociate
IsiROHISetState
IsiRaidLevelModify
IsiReadPatrolSetState
IsiRefreshPartitionInfo
IsiRescan
IsiSessionClose
IsiSessionOpen
IsiSetIntelHybridDiskSubClassCode
IsiSetLpmStatus
IsiSetReadPatrolUnit
IsiToggleCoalescerPolicy
IsiUpdatePmInterfaceFields
IsiVdsHandlerMakeSpaceForMetadataOnSystemDisk
IsiVolumeCancelVerify
IsiVolumeConvertIrrtToRaid1
IsiVolumeConvertRaid1ToIrrt
IsiVolumeCreate
IsiVolumeCreateFromDisks
IsiVolumeDelete
IsiVolumeDestroyCache
IsiVolumeInitialize
IsiVolumeIrrtCreate
IsiVolumeIrrtMountPartner
IsiVolumeIrrtSetAutomaticSync
IsiVolumeIrrtSetManualSync
IsiVolumeIrrtSwapDisks
IsiVolumeIrrtSync
IsiVolumeIrrtUnMountPartner
IsiVolumeMarkAsNormal
IsiVolumeRebuild
IsiVolumeRename
IsiVolumeSetBufferFlush
IsiVolumeSetCacheMode
IsiVolumeSetCachePolicy
IsiVolumeSetCacheSpindownPolicy
IsiVolumeSetExportPolicy
IsiVolumeVerify

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 422KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/iaAHCIC.cat
Extract_This_Folder_On_To_Your_USB_INTEL/iaAHCIC.inf
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAC.cat
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAC.inf
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAC.sys
.sys windows:10 windows x64 arch:x64

73ba5067bdc85c8f295eb3530702faae

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:3e:4b:cf:7d:67:8b:8b:46:2a:64:9e:dd:9b:b3:33:42:f3:4b:84:3c:b7:12:fb:3e:1a:5f:48:4e:a2:ac:37
Signer

Actual PE Digest

dd:3e:4b:cf:7d:67:8b:8b:46:2a:64:9e:dd:9b:b3:33:42:f3:4b:84:3c:b7:12:fb:3e:1a:5f:48:4e:a2:ac:37

Digest Algorithm

sha256

PE Digest Matches

true

dd:3e:4b:cf:7d:67:8b:8b:46:2a:64:9e:dd:9b:b3:33:42:f3:4b:84:3c:b7:12:fb:3e:1a:5f:48:4e:a2:ac:37
Signer

Actual PE Digest

dd:3e:4b:cf:7d:67:8b:8b:46:2a:64:9e:dd:9b:b3:33:42:f3:4b:84:3c:b7:12:fb:3e:1a:5f:48:4e:a2:ac:37

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\7210\SSE_Storage_Common\build\iaStorA\x64\Release\iaStorAC.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

KeBugCheckEx
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeDeregisterBugCheckReasonCallback
KeQueryGroupAffinity
IoSetDevicePropertyData
KeRegisterBugCheckReasonCallback
MmIsAddressValid
RtlGetVersion
IoGetDevicePropertyData
_snwprintf_s
atol
ExGetFirmwareEnvironmentVariable
wcsnlen
MmGetPhysicalAddress
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
KeQueryDpcWatchdogInformation
ExSetFirmwareEnvironmentVariable
PsSetCreateProcessNotifyRoutineEx
strtok_s
strncmp
__chkstk
KeSetEvent
KeLowerIrql
KeInitializeEvent
KfRaiseIrql
KeWaitForSingleObject
IoAllocateWorkItem
IoFreeWorkItem
strncpy
IoGetIoPriorityHint
sprintf_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
_purecall
KeDelayExecutionThread
sprintf
_snprintf
ZwQueryKey
strcmp
ZwEnumerateKey
IoQueueWorkItem
ZwOpenKey
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
strstr
RtlCompareMemory
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
ZwQueryValueKey
ZwSetValueKey
ZwEnumerateValueKey
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
strnlen
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAfs.sys
.sys windows:10 windows x64 arch:x64

e01395211378fd402c2937fa1a923975

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:24:10:2a:9a:c1:04:16:97:b0:65:28:b3:6f:53:ea:36:15:b1:a6:07:85:25:fc:70:16:fe:d7:31:e1:46:4e
Signer

Actual PE Digest

3c:24:10:2a:9a:c1:04:16:97:b0:65:28:b3:6f:53:ea:36:15:b1:a6:07:85:25:fc:70:16:fe:d7:31:e1:46:4e

Digest Algorithm

sha256

PE Digest Matches

true

3c:24:10:2a:9a:c1:04:16:97:b0:65:28:b3:6f:53:ea:36:15:b1:a6:07:85:25:fc:70:16:fe:d7:31:e1:46:4e
Signer

Actual PE Digest

3c:24:10:2a:9a:c1:04:16:97:b0:65:28:b3:6f:53:ea:36:15:b1:a6:07:85:25:fc:70:16:fe:d7:31:e1:46:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfs.pdb

Imports

ntoskrnl.exe

ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
RtlIsNtDdiVersionAvailable
IoWMIRegistrationControl
__C_specific_handler
_local_unwind
KeSetEvent
ExInitializeNPagedLookasideList
ExInterlockedRemoveHeadList
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeBugCheckEx
KeClearEvent
ExInterlockedInsertTailList
ExpInterlockedPopEntrySList
KeInitializeEvent
RtlInitUnicodeString
IoThreadToProcess
PsGetProcessId
PsSetCreateProcessNotifyRoutineEx
IoGetTopLevelIrp
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
strcpy_s
KeWaitForMultipleObjects
_purecall

fltmgr.sys

FltObjectDereference
FltGetVolumeFromName
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseClientPort
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetFileContext
FltSupportsFileContexts
FltReleaseContext
FltSetFileContext
FltAllocateContext
FltQueryInformationFile
FltSendMessage

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAfsNative.exe
.sys windows:5 windows x64 arch:x64

4f22e599ba6ed8ce074e352a789948fe

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:b8:63:8d:49:ae:cd:1e:3d:b1:69:b8:70:20:9b:6c:55:cc:d9:b3:e7:0d:48:3b:97:61:01:f7:59:6b:34:42
Signer

Actual PE Digest

e8:b8:63:8d:49:ae:cd:1e:3d:b1:69:b8:70:20:9b:6c:55:cc:d9:b3:e7:0d:48:3b:97:61:01:f7:59:6b:34:42

Digest Algorithm

sha256

PE Digest Matches

true

e8:b8:63:8d:49:ae:cd:1e:3d:b1:69:b8:70:20:9b:6c:55:cc:d9:b3:e7:0d:48:3b:97:61:01:f7:59:6b:34:42
Signer

Actual PE Digest

e8:b8:63:8d:49:ae:cd:1e:3d:b1:69:b8:70:20:9b:6c:55:cc:d9:b3:e7:0d:48:3b:97:61:01:f7:59:6b:34:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsNative.pdb

Imports

ntdll

RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtDisplayString
NtQueryInformationFile
NtCreateFile
NtDeviceIoControlFile
NtWaitForSingleObject
NtFsControlFile
NtReadFile
RtlCreateHeap
RtlDestroyHeap
RtlAllocateHeap
RtlFreeHeap
NtClose
NtWriteFile
NtWaitForMultipleObjects
NtDelayExecution
RtlCreateUserThread
ZwTerminateThread
NtCancelIoFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtCreateEvent
NtSetEvent
NtClearEvent

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorAfsService.exe
.exe windows:6 windows x64 arch:x64

c6a6ae003a2168700f7a051640c02499

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

23/09/2020, 11:06

Not After

17/06/2021, 23:59

Subject

CN=Intel(R) Rapid Storage Technology,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

20/04/2018, 16:52

Not After

17/03/2021, 18:33

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:f6:06:48:83:1f:4f:c0:a4:cf:b0:d2:a5:f9:d5:73:a9:3d:45:7a:4b:34:ea:28:0a:f9:13:e5:c5:d8:31:78
Signer

Actual PE Digest

dd:f6:06:48:83:1f:4f:c0:a4:cf:b0:d2:a5:f9:d5:73:a9:3d:45:7a:4b:34:ea:28:0a:f9:13:e5:c5:d8:31:78

Digest Algorithm

sha256

PE Digest Matches

true

dd:f6:06:48:83:1f:4f:c0:a4:cf:b0:d2:a5:f9:d5:73:a9:3d:45:7a:4b:34:ea:28:0a:f9:13:e5:c5:d8:31:78
Signer

Actual PE Digest

dd:f6:06:48:83:1f:4f:c0:a4:cf:b0:d2:a5:f9:d5:73:a9:3d:45:7a:4b:34:ea:28:0a:f9:13:e5:c5:d8:31:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba1\workspace\7210\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

Imports

kernel32

FindNextFileNameW
LocalFree
GetCommandLineA
TlsSetValue
CreateEventW
ResetEvent
Sleep
WaitForMultipleObjects
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetModuleHandleW
GetProcAddress
CreateFileW
DeviceIoControl
GetCommandLineW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
OutputDebugStringW
QueryPerformanceCounter
ReadFile
WriteFile
DeleteFileW
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
GetTickCount64
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
GetSystemDirectoryW
FindFirstFileNameW
GetFinalPathNameByHandleW
OpenFileById
FindFirstFileW
FindNextFileW
GetCurrentProcess
SetPriorityClass
DeleteTimerQueueTimer
GetSystemPowerStatus
HeapFree
TryEnterCriticalSection
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSection
ExitProcess
TlsAlloc
TlsFree
HeapReAlloc
MoveFileW
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
DecodePointer
WaitForSingleObject
SetEvent
SetEnvironmentVariableW
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
TlsGetValue
CompareFileTime
ExpandEnvironmentStringsW
GetSystemTime
SystemTimeToFileTime
SuspendThread
ResumeThread
FindClose
lstrlenW
GetOverlappedResult
CancelIoEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
CreateThread
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
SetLastError
GetCurrentThreadId
HeapQueryInformation
GetSystemTimeAsFileTime
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WideCharToMultiByte
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
SetStdHandle
SetConsoleCtrlHandler
ReadConsoleW
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InterlockedFlushSList
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
InitOnceExecuteOnce
FormatMessageW
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
SetFilePointer
FileTimeToLocalFileTime
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
UnmapViewOfFile
FileTimeToSystemTime
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
LeaveCriticalSection
AreFileApisANSI
EnterCriticalSection
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetFileSize
LockFileEx
UnlockFile
HeapCompact
LoadLibraryW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetTimeZoneInformation

advapi32

DeregisterEventSource
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
QueryServiceStatusEx
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
OpenThreadToken
CopySid
EqualSid
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeSid
IsValidSid
ControlService
DeleteService
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ChangeServiceConfig2W
OpenSCManagerW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseServiceHandle
SetEntriesInAclW
CreateServiceW
RegDeleteTreeW
RegCreateKeyExW

shlwapi

PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathIsRelativeW
PathRemoveFileSpecW

rpcrt4

NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf
RpcBindingVectorFree
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
NdrAsyncServerCall
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcAsyncAbortCall
RpcAsyncCompleteCall
RpcServerTestCancel
RpcEpUnregister

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

oleaut32

SetErrorInfo
SysFreeString
VariantInit
SysAllocString
VariantClear
CreateErrorInfo
VariantChangeType
GetErrorInfo

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorVD.cat
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorVD.inf
Extract_This_Folder_On_To_Your_USB_INTEL/iaStorVD.sys
.sys windows:10 windows x64 arch:x64

04213e993af2eae5e4d6592ea1e8b7f4

Code Sign

34:77:0b:b5:30:21:48:0d:30:8f:5e:55:93:b4:9d:84
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/04/2021, 00:00

Not After

01/04/2023, 23:59

Subject

CN=Intel Corporation,OU=Intel(R) Connectivity Innovation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dd:dc:41:20:54:e2:76:c9:26:00:00:00:00:00:dd
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:84:33:08:8a:aa:3c:72:f4:af:34:c2:2d:e4:17:0e:b5:9f:fc:c0:26:a9:1d:87:1b:90:70:0f:91:53:ee:38
Signer

Actual PE Digest

64:84:33:08:8a:aa:3c:72:f4:af:34:c2:2d:e4:17:0e:b5:9f:fc:c0:26:a9:1d:87:1b:90:70:0f:91:53:ee:38

Digest Algorithm

sha256

PE Digest Matches

true

64:84:33:08:8a:aa:3c:72:f4:af:34:c2:2d:e4:17:0e:b5:9f:fc:c0:26:a9:1d:87:1b:90:70:0f:91:53:ee:38
Signer

Actual PE Digest

64:84:33:08:8a:aa:3c:72:f4:af:34:c2:2d:e4:17:0e:b5:9f:fc:c0:26:a9:1d:87:1b:90:70:0f:91:53:ee:38

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\qba2\workspace\6834\SSE_Storage_Common\build\iaStorVD\x64\Release\iaStorVD.pdb

Imports

storport.sys

StorPortExtendedFunction
StorPortResumeDevice
StorPortPause
StorPortPauseDevice
StorPortInitialize
StorPortDeviceBusy
StorPortResume
StorPortGetDeviceBase
StorPortReady
StorPortGetBusData
StorPortAllocateRegistryBuffer
StorPortRegistryWrite
StorPortGetUncachedExtension
StorPortQuerySystemTime
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortSetBusDataByOffset
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortNotification
StorPortSetDeviceQueueDepth
StorPortGetScatterGatherList

ntoskrnl.exe

strtok_s
ZwSetValueKey
KeQueryActiveProcessorCount
sscanf_s
IoRegisterBootDriverReinitialization
KeQueryGroupAffinity
IoSetDevicePropertyData
MmIsAddressValid
RtlIsServicePackVersionInstalled
KeDeregisterBugCheckReasonCallback
RtlGetVersion
IoGetDevicePropertyData
KeRegisterBugCheckReasonCallback
_snwprintf_s
ExSetFirmwareEnvironmentVariable
ExGetFirmwareEnvironmentVariable
MmGetPhysicalAddress
wcsnlen
_vsnwprintf
ZwOpenEvent
InitSafeBootMode
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLock
strncmp
_purecall
KeGetCurrentIrql
KeSetEvent
KeLowerIrql
__chkstk
KfRaiseIrql
KeWaitForSingleObject
strstr
atol
IoAllocateWorkItem
IoFreeWorkItem
KeQueryDpcWatchdogInformation
sprintf_s
strnlen
_itoa_s
strncat_s
strncpy_s
_snprintf_s
IoQueueWorkItemEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlAnsiStringToUnicodeString
KeAcquireSpinLockRaiseToDpc
RtlTimeToTimeFields
KeWaitForMultipleObjects
PsCreateSystemThread
_vsnprintf
KeReleaseSpinLock
RtlInitAnsiString
ObReferenceObjectByHandle
KeClearEvent
KeSetPriorityThread
ZwClose
PsTerminateSystemThread
ExSystemTimeToLocalTime
RtlCompareMemory
KeInitializeEvent
strncpy
KeDelayExecutionThread
strcmp
ZwOpenKey
ZwQueryKey
ZwEnumerateValueKey
ZwEnumerateKey
IoQueueWorkItem
ObfDereferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeInsertQueueDpc
KeInitializeDpc
KeQueryTimeIncrement
_wcsicmp
MmMapIoSpace
MmUnmapIoSpace
wcsstr
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoFreeIrp
IoBuildDeviceIoControlRequest
IoAllocateIrp
IofCallDriver
__C_specific_handler
sprintf
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
EtwUnregister
RtlIsNtDdiVersionAvailable
EtwRegister
KeBugCheck
KeFlushQueuedDpcs
vsprintf_s
KeSetSystemAffinityThread
strcpy_s
IoGetRequestorProcessId
IoGetIoPriorityHint
PsSetCreateProcessNotifyRoutineEx

hal

KeQueryPerformanceCounter

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 475KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS.html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/101967
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/13926.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/617
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/747b8b51-ec47-4dee-9823-b2b73124b71f
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/9.gif
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/CookieSync.html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/CookieSync.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/ImgSync
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/PugMaster
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/TemplatePool.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/Zj4z_1VbLTwAACX2BVLz4QAAFBoAAAAB
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/apstag.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/async_usersync.html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/aul
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/be96b820e5daac93.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/bootstrap.min.css
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/bootstrap.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/cm-notify
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/cmp(1).js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/cmp.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/cookiesync
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/cs.html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/dcm
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/favicon.ico
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/generic
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/generic(1)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/generic.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/getuid
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/getuid(1)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/getuid.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/hadron.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/ibs_dpid=23728&dpuuid=Zj4z-1VbLTwAACX2BVLz4QAA&5146
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/id5-api.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/isync.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/jquery.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/js
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/list
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/localstore.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/multi-sync(1).html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/multi-sync(2).html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/multi-sync(3).html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/multi-sync.html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/ortb_sync.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/partner.html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pd.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pixel
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pixel(1)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pixel(2)
.png
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pixel.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pixelSync.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/pubcid.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/publishertag.prebid.144.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/px(1).gif
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/px.gif
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/rentryco.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(1)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(10).html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(2)
.png
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(3)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(4)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(5)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(6).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(7).html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(8).html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource(9).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/saved_resource.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/setuid(1).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/setuid(2).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/setuid.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/ssync
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/ssync.html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(1)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(11).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(12).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(13).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(14).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(15).html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(2)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(3)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(4)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(5)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync(7)
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync-iframe
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync-iframe.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync.html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/sync.min.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/syncframe.html
.html .js polyglot
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/tag
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/tcf.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/um
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/um(1).html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/um.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/user_sync(1).html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/user_sync(2).html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/user_sync(3).html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/user_sync.html
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/usermatch.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/usersync.aspx
.gif
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/usync.html
.html
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/usync.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/MAGIK RAID0 TUTORIALS_files/vwpt.js.preuzmi
.js
CheapFTN Perm Updated/spoofing guide/spoofing guide/Raid Drivers.rar
.rar
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcbottom.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcbottom.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcbottom.sys
.sys windows:6 windows x64 arch:x64

c54fa5eefad4dcf82288a91bb2517fb7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:60:d5:1a:aa:8e:f0:03:7c:60:a6:a5:40:cf:0c:4d:6a:2f:fe:64:f7:cb:87:d7:a2:88:b3:de:4d:22:3e:25
Signer

Actual PE Digest

da:60:d5:1a:aa:8e:f0:03:7c:60:a6:a5:40:cf:0c:4d:6a:2f:fe:64:f7:cb:87:d7:a2:88:b3:de:4d:22:3e:25

Digest Algorithm

sha256

PE Digest Matches

true

b7:3c:81:10:ff:d9:8a:3e:a2:ae:99:e7:cb:9c:b7:88:1d:ba:fd:be
Signer

Actual PE Digest

b7:3c:81:10:ff:d9:8a:3e:a2:ae:99:e7:cb:9c:b7:88:1d:ba:fd:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00158\fulcrum\rc\platforms\rcbottom\rcbottom\windows\driver\obj_fre_winv10.0_amd64\amd64\rcbottom.pdb

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeSpinLock
ExGetFirmwareEnvironmentVariable
MmMapIoSpace
MmUnmapIoSpace
RtlUnicodeStringToInteger
KeReleaseInStackQueuedSpinLock
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlInitUnicodeString
RtlIntegerToUnicodeString
wcsncpy
wcsncmp
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
RtlCopyUnicodeString

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

storport.sys

StorPortDebugPrint
StorPortInitialize

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rccfg.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rccfg.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rccfg.sys
.sys windows:6 windows x64 arch:x64

52bcb8c680de4d0ae1fce317d0de33bd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:06:be:fd:30:91:30:66:eb:7b:bc:25:8a:4c:70:ab:d8:f0:b4:7b:89:d1:2c:61:9a:70:66:50:23:8e:bd:30
Signer

Actual PE Digest

d3:06:be:fd:30:91:30:66:eb:7b:bc:25:8a:4c:70:ab:d8:f0:b4:7b:89:d1:2c:61:9a:70:66:50:23:8e:bd:30

Digest Algorithm

sha256

PE Digest Matches

true

12:09:09:bf:fa:c8:64:47:6f:2b:d7:b7:30:89:3f:4a:d7:2c:7a:ca
Signer

Actual PE Digest

12:09:09:bf:fa:c8:64:47:6f:2b:d7:b7:30:89:3f:4a:d7:2c:7a:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00158\fulcrum\rc\platforms\rccfg\windows\driver\obj_fre_winv10.0_amd64\amd64\rccfg.pdb

Imports

ntoskrnl.exe

RtlInitString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeSetPriorityThread
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePool
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateErrorLogEntry
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfDereferenceObject
sprintf
_snwprintf
ExFreePoolWithTag
MmUnlockPages
IoAllocateIrp
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
KeBugCheckEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 855B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcraid.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcraid.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/NVMe_RAID/rcraid.sys
.sys windows:6 windows x64 arch:x64

4c57bee85137d05b1171a3ab3b067b3e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:06

Not After

03/06/2020, 18:06

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:47:eb:b7:81:ef:71:1d:1a:e2:ea:88:ec:66:da:35:8b:15:36:2d:42:ab:b3:d2:80:39:d5:e1:b9:ee:fd:3f
Signer

Actual PE Digest

e1:47:eb:b7:81:ef:71:1d:1a:e2:ea:88:ec:66:da:35:8b:15:36:2d:42:ab:b3:d2:80:39:d5:e1:b9:ee:fd:3f

Digest Algorithm

sha256

PE Digest Matches

true

1c:d4:8c:f8:66:57:8b:84:1f:29:2f:c8:b6:39:d6:99:31:d8:99:71
Signer

Actual PE Digest

1c:d4:8c:f8:66:57:8b:84:1f:29:2f:c8:b6:39:d6:99:31:d8:99:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00158\fulcrum\rc\platforms\rcraid\windows\driver\obj_fre_winv10.0_amd64\amd64\rcraid.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoReuseIrp
DbgBreakPoint
strncmp
strstr
_snprintf
strcmp
strncpy
RtlInitUnicodeString
KeInitializeEvent
KeInitializeDpc
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeSaveExtendedProcessorState
KeRestoreExtendedProcessorState
PsCreateSystemThread
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
KeBugCheckEx

hal

KeQueryPerformanceCounter

storport.sys

StorPortInitialize
StorPortNotification
StorPortLogError
StorPortExtendedFunction
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortGetScatterGatherList
StorPortStallExecution

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcbottom.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcbottom.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcbottom.sys
.sys windows:6 windows x64 arch:x64

4520d1114914143547e1eb10624e9b37

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:8e:fc:b9:0a:db:37:e2:1b:09:37:d2:7b:4f:76:77:80:1b:9a:8b:0b:52:68:5c:d8:31:77:c6:21:09:05:40
Signer

Actual PE Digest

03:8e:fc:b9:0a:db:37:e2:1b:09:37:d2:7b:4f:76:77:80:1b:9a:8b:0b:52:68:5c:d8:31:77:c6:21:09:05:40

Digest Algorithm

sha256

PE Digest Matches

true

31:59:5e:0a:1b:c5:4f:cf:22:a6:49:1d:b2:22:57:f3:c7:ec:57:4c
Signer

Actual PE Digest

31:59:5e:0a:1b:c5:4f:cf:22:a6:49:1d:b2:22:57:f3:c7:ec:57:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00266\fulcrum\rc\platforms\rcbottom\rcbottom\windows\driver\obj_fre_winv10.0_amd64\amd64\rcbottom.pdb

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlCompareMemory
KeInitializeSpinLock
ExGetFirmwareEnvironmentVariable
MmMapIoSpace
MmUnmapIoSpace
RtlInitUnicodeString
KeReleaseInStackQueuedSpinLock
KeInitializeEvent
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetAttachedDeviceReference
ObfDereferenceObject
KeBugCheckEx
RtlCopyUnicodeString
RtlUnicodeStringToInteger
RtlIntegerToUnicodeString
wcsncpy
wcsncmp
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
DbgPrintEx

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

storport.sys

StorPortDebugPrint
StorPortInitialize

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rccfg.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rccfg.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rccfg.sys
.sys windows:6 windows x64 arch:x64

52bcb8c680de4d0ae1fce317d0de33bd

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:23:8b:de:78:d7:dd:9d:18:a3:7d:77:ac:0f:1b:c8:42:92:25:2f:2d:0e:39:14:3b:b6:4f:19:2d:ec:31:a8
Signer

Actual PE Digest

0d:23:8b:de:78:d7:dd:9d:18:a3:7d:77:ac:0f:1b:c8:42:92:25:2f:2d:0e:39:14:3b:b6:4f:19:2d:ec:31:a8

Digest Algorithm

sha256

PE Digest Matches

true

24:92:76:43:d0:3c:66:09:93:ac:31:07:36:11:3f:f0:a8:c6:51:f3
Signer

Actual PE Digest

24:92:76:43:d0:3c:66:09:93:ac:31:07:36:11:3f:f0:a8:c6:51:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00266\fulcrum\rc\platforms\rccfg\windows\driver\obj_fre_winv10.0_amd64\amd64\rccfg.pdb

Imports

ntoskrnl.exe

RtlInitString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeSetPriorityThread
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePool
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateErrorLogEntry
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoDetachDevice
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfDereferenceObject
sprintf
_snwprintf
ExFreePoolWithTag
MmUnlockPages
IoAllocateIrp
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
KeBugCheckEx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 855B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcraid.cat
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcraid.inf
Raid Drivers/AMD RAID/Put this folder on USB! [AMD]/SATA_RAID/rcraid.sys
.sys windows:6 windows x64 arch:x64

4c57bee85137d05b1171a3ab3b067b3e

Code Sign

3a:95:e2:00:60:7a:8a:e0:1f:53:91:a1:37:7c:82:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/01/2020, 00:00

Not After

30/01/2023, 23:59

Subject

CN=Advanced Micro Devices INC.,O=Advanced Micro Devices INC.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:2c:34:21:56:56:53:8a:a1:70:9a:9b:e1:18:ce:c3:61:a7:2a:5f:25:2d:6d:36:12:4b:9d:e9:f9:bd:71:1e
Signer

Actual PE Digest

7c:2c:34:21:56:56:53:8a:a1:70:9a:9b:e1:18:ce:c3:61:a7:2a:5f:25:2d:6d:36:12:4b:9d:e9:f9:bd:71:1e

Digest Algorithm

sha256

PE Digest Matches

true

8a:1a:7b:8a:f9:fc:2e:30:d0:e2:5a:09:7a:8c:b9:d7:58:8b:f9:9b
Signer

Actual PE Digest

8a:1a:7b:8a:f9:fc:2e:30:d0:e2:5a:09:7a:8c:b9:d7:58:8b:f9:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Y:\RC-930\RC_930_00266\fulcrum\rc\platforms\rcraid\windows\driver\obj_fre_winv10.0_amd64\amd64\rcraid.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateIrp
IoBuildDeviceIoControlRequest
IofCallDriver
IoFreeIrp
IoReuseIrp
DbgBreakPoint
strncmp
strstr
_snprintf
strcmp
strncpy
RtlInitUnicodeString
KeInitializeEvent
KeInitializeDpc
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeSaveExtendedProcessorState
KeRestoreExtendedProcessorState
PsCreateSystemThread
IoBuildSynchronousFsdRequest
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
KeBugCheckEx

hal

KeQueryPerformanceCounter

storport.sys

StorPortInitialize
StorPortNotification
StorPortLogError
StorPortExtendedFunction
StorPortAllocateRegistryBuffer
StorPortFreeRegistryBuffer
StorPortRegistryRead
StorPortGetScatterGatherList
StorPortStallExecution

Sections

.text
Size: 489KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/AMD RAID/detectdrives.exe
.exe windows:6 windows x64 arch:x64

be3846957a78124ff6b97089005f26a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\sawaf\source\repos\bustype\x64\Release\bustype.pdb

Imports

kernel32

DeviceIoControl
CreateFileA
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlCaptureContext

msvcp140

?good@ios_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
__std_terminate
memmove
__std_exception_destroy
memcpy
memset
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_get_initial_narrow_environment
_cexit
_exit
exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
_set_app_type
_seh_filter_exe
__p___argc
terminate
_invalid_parameter_noinfo_noreturn
system

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Raid Drivers/INTEL RAID.txt
CheapFTN Perm Updated/spoofing guide/spoofing guide/spoofing guide.txt

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

4`DF<[H Size: 194KB - Virtual size: 193KB

4`DF<[H Size: 194KB - Virtual size: 193KB

.text Size: 2.8MB - Virtual size: 2.8MB

.rsrc Size: 112KB - Virtual size: 111KB

vDpMbr Size: 512B - Virtual size: 10B

Code Enc Size: 512B - Virtual size: 16B

.Xerin Size: 512B - Virtual size: 141B

.reloc Size: 512B - Virtual size: 12B

Headers

DLL Characteristics

File Characteristics

Sections

Size: 54KB - Virtual size: 142KB

Size: 12KB - Virtual size: 40KB

Size: 512B - Virtual size: 3KB

Size: 3KB - Virtual size: 4KB

Size: 49KB - Virtual size: 48KB

Size: 512B - Virtual size: 300B

.idata Size: 2KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 49KB - Virtual size: 49KB

.themida Size: - Virtual size: 5.9MB

.boot Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 16B - Virtual size: 4KB

6ed9069470e02e397bbe48349bdeacef

Code Sign

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91Certificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9fCertificate

Extended Key Usages

Key Usages

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:faSigner

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:faSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

advapi32

kernel32

user32

ole32

rpcrt4

api-ms-win-devices-config-l1-1-1

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 350KB - Virtual size: 349KB

.data Size: 35KB - Virtual size: 62KB

.pdata Size: 47KB - Virtual size: 47KB

_RDATA Size: 512B - Virtual size: 256B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

4`DF<[H
Size: 194KB - Virtual size: 193KB

4`DF<[H
Size: 194KB - Virtual size: 193KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rsrc
Size: 112KB - Virtual size: 111KB

vDpMbr
Size: 512B - Virtual size: 10B

Code Enc
Size: 512B - Virtual size: 16B

.Xerin
Size: 512B - Virtual size: 141B

.reloc
Size: 512B - Virtual size: 12B

.idata
Size: 2KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 49KB - Virtual size: 49KB

.themida
Size: - Virtual size: 5.9MB

.boot
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 16B - Virtual size: 4KB

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa
Signer

e5:f6:94:bd:7d:75:b5:95:fa:4a:ce:cd:21:35:2a:5e:4c:b3:15:97:c0:48:09:2f:bd:e3:35:c9:fc:9a:e3:fa
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 350KB - Virtual size: 349KB

.data
Size: 35KB - Virtual size: 62KB

.pdata
Size: 47KB - Virtual size: 47KB

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07
Signer

0a:19:68:95:b9:b1:f4:6d:4b:64:b8:12:06:8a:c2:7f:39:72:45:3a:57:6d:9b:9a:3f:6b:ff:81:4b:2b:7c:07
Signer

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

56:00:00:0c:91:74:93:87:7e:9d:b3:ce:38:00:00:00:00:0c:91
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76
Signer

44:7a:b9:0a:a0:4c:7d:16:7b:93:11:d8:fe:aa:d6:2b:02:9d:81:6c:7a:4f:8b:b1:8f:5c:49:e6:8e:bf:99:76
Signer

.rdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 3KB - Virtual size: 3KB