FPTGUI-WINx64[.]rar

resource
unpack001/AMIBCP5/AMIBCP5.exe
unpack001/FPTGUI-WINx64.exe
unpack001/UEFITool/UEFITool.exe
unpack001/idrvdll32e.DLL
unpack001/mmtool/mmtool_a5.exe
unpack001/pmxdll32e.DLL

FPTGUI-WINx64.rar

SHA256 b6859db12ed94fbb47114d87a49653a7dd203d33be1cadd38751258919c99be2
MD5 124964f4acd1d68c44954bff8da82de9
SHA1 e4d468c591003273a7f42f8dcc805756d87e1fe5
SHA512 5a09d7fcfc9bb9a9d9635454f9fe7f59eeacedb9959ec44255783207a06947c85575f69b66a723a283d152ddd9a3f6aa268e79d49641642d1bdc735a3c35840d
SSDEEP 393216:qeORKGzgv5JVYHn17h1cs3ia9wwRfPRsTj4eC9f/Sum3mHEm66cBGDjsjgIGic58:1OkemVYH178oSwRf8j0N/SDmEm1cg/yR
MD5 SHA1 SHA512 SSDEEP

AMIBCP5/AMIBCP5.exe

IMPHASH 8f33b8e3f17abf9dbb148477ede548f6
SHA256 c7ade67fe0e8f4c22f73ce3168ff6e718086f1eda83cce4c065b4fe49bd5ad99
MD5 c15e0801502a6ad896476e64b93d6924
SHA1 31d6eed2bd461a5517d06ddcba8218f3b50af37e
SHA512 9d6e408682b7fc66e3884288122516a111bfc706da6a9bab626266b3934f3f85d38dbbd747e2b90e79005114f2a063cdfad2e3d9d81f2777fb4e514f3e189976
SSDEEP 196608:S/JOp6cMeBadwqRMYfjBpOiEVkX4fT1lGXN:SBOptbBafRD9p8kX4jGXN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

480540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException ExitProcess HeapReAlloc HeapSize VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree RtlUnwind GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW Sleep SetStdHandle GetConsoleCP GetConsoleMode SetEnvironmentVariableA SetEnvironmentVariableW GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStartupInfoW GetProcessHeap HeapAlloc HeapFree GetTickCount SetErrorMode FindResourceExW LocalFileTimeToFileTime FileTimeToLocalFileTime SystemTimeToFileTime FileTimeToSystemTime GlobalFlags InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalGetAtomNameW GetShortPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize UnlockFile LockFile FlushFileBuffers SetFilePointer ReadFile lstrcmpiW GetThreadLocale GetStringTypeExW MoveFileW VirtualProtect GetDiskFreeSpaceW GetFullPathNameW GetFileAttributesW GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange WritePrivateProfileStringW GetPrivateProfileIntW InterlockedDecrement GetVersionExW GetCurrentProcessId GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom FreeLibrary CompareStringW LoadLibraryA lstrcmpW GetVersionExA FreeResource GlobalFree GlobalAlloc FormatMessageW LocalFree lstrlenW MulDiv FindFirstFileA RemoveDirectoryA FindNextFileA FindClose GetCurrentDirectoryA GetModuleHandleA FindResourceA SetEndOfFile DeleteFileA CreateProcessA GetExitCodeProcess GetTempPathA CreateFileA WriteFile CreateDirectoryA GetFileTime SetFileTime FindFirstFileW GlobalLock GlobalUnlock GetTempPathW GetTempFileNameW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW lstrlenA DeleteFileW GetPrivateProfileStringW GetModuleFileNameW GetLastError SetLastError GetProcAddress GetModuleHandleW LoadLibraryW CreateFileW CloseHandle GetEnvironmentVariableW SetCurrentDirectoryW WideCharToMultiByte GetCurrentDirectoryW MultiByteToWideChar FindResourceW LoadResource LockResource QueryPerformanceCounter SizeofResource

user32

CopyAcceleratorTableW CreateMenu PostThreadMessageW GetTabbedTextExtentA GetDCEx LockWindowUpdate RegisterClipboardFormatW EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnpackDDElParam ReuseDDElParam InsertMenuItemW CreatePopupMenu SetRectEmpty SetMenu RedrawWindow TranslateMDISysAccel BringWindowToTop DrawMenuBar DefMDIChildProcW DefFrameProcW GetDC ReleaseDC DestroyCursor SetRect CharUpperW MapDialogRect GetAsyncKeyState SetCapture SetWindowRgn DrawIcon FillRect IsRectEmpty FindWindowW SystemParametersInfoW LoadMenuW DestroyMenu ShowOwnedPopups PostQuitMessage GetMessageW ValidateRect GetWindowThreadProcessId ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageW WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetForegroundWindow GetLastActivePopup UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu SetScrollRange GetScrollRange SetForegroundWindow ShowScrollBar IsWindowVisible GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetScrollInfo SetScrollInfo CopyRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetActiveWindow SetActiveWindow GetSystemMetrics CreateDialogIndirectParamW DestroyWindow IsWindow IsWindowEnabled GetNextDlgTabItem EndDialog GetWindowTextLengthW GetWindowTextW GetScrollPos SetScrollPos GetWindow SetFocus GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu LoadCursorW SetCursor GetClassNameW SetWindowLongW BeginDeferWindowPos DeferWindowPos EndDeferWindowPos InvalidateRect EqualRect DestroyIcon UnregisterClassW GetMenuItemInfoW GetSysColorBrush SetParent GetSystemMenu DeleteMenu IsZoomed InflateRect SendDlgItemMessageA GetClipboardData CloseClipboard OpenClipboard TranslateMessage DispatchMessageW GetDlgItem GetKeyState ReleaseCapture GetCursorPos GetSysColor GetWindowLongW WindowFromPoint GetDesktopWindow GetFocus KillTimer SetTimer ScreenToClient ClientToScreen PostMessageW PtInRect GetParent GetWindowRect MessageBoxW MessageBeep GetClientRect LoadAcceleratorsW TranslateAcceleratorW UpdateWindow EnableWindow SendMessageW GetTopWindow UnregisterClassA

gdi32

BitBlt GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx IntersectClipRect CreatePatternBrush CreateSolidBrush GetWindowExtEx CreateRectRgnIndirect SetRectRgn CombineRgn GetCharWidthW CreateFontW StretchDIBits GetTextMetricsW GetTextExtentPoint32W EnumFontFamiliesExW GetNearestColor GetBkColor GetBkMode GetPolyFillMode GetROP2 GetStretchBltMode GetTextColor GetTextAlign GetTextFaceW GetTextExtentPoint32A GetWindowOrgEx ExcludeClipRect SetMapMode SetStretchBltMode SetROP2 SetPolyFillMode GetViewportExtEx CreateRectRgn SelectClipRgn DeleteObject SetTextAlign MoveToEx LineTo CreateFontIndirectW SetBkMode RestoreDC SaveDC GetStockObject PatBlt Rectangle GetViewportOrgEx CreatePen DeleteDC EndDoc AbortDoc SetAbortProc EndPage StartPage StartDocW Ellipse LPtoDP DPtoLP CreateEllipticRgn CreateBitmap SetBkColor SetTextColor GetClipBox CreateDCW GetDeviceCaps GetCurrentObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW

comdlg32

GetFileTitleW GetSaveFileNameW

winspool.drv

GetJobW ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

GetFileSecurityW SetFileSecurityW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegOpenKeyW RegSetValueW RegCloseKey RegOpenKeyExA RegCreateKeyW

shell32

DragFinish DragQueryFileW SHGetFileInfoW ExtractIconW DragAcceptFiles

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

ole32

OleDestroyMenuDescriptor OleCreateMenuDescriptor IsAccelerator OleTranslateAccelerator CoCreateGuid

oleaut32

VariantInit VariantChangeType VariantClear SysAllocStringLen

FPTGUI-WINx64-1.bin

SHA256 dfc49a3f56e77541aa4e1aedb0ea92893028583122be85a1fe483d0e45d35b4c
MD5 ae70e5897ddbca801f1d97df7fc40a95
SHA1 2fc353208218621e3326c57f6ac82c3b292ce4e2
SHA512 0e2046bfe14d51449f3840c97fd0624f5aa8e34ac04cf206989f5b434120700dd0b5ebe1a89589fbcafcf953ed97f67452b20ec50fba4a5f032016a466f77621
SSDEEP 98304:F54yw98RILyf0zGYJMxV49er95LDjCddDnPoSCz0r7WFyI9JvaLEmWpzqtCI:FenmmLyf0BMDDjCHDnPgIrqUIPppmt9
MD5 SHA1 SHA512 SSDEEP

FPTGUI-WINx64-2.bin

SHA256 4a7433902d538dd927d15cd199a4bdeb2e60ce3cccba65341892237cae11e507
MD5 a331b1425764081f0666075a4ba6cf4c
SHA1 0ca7ef5e6faeb3338364b7caec4b3c42abff7ebc
SHA512 6723d472179a9128e18fece24342339117131e6644a8f0c75f480781b9f1380ecb03ee3850d89e328ab52a525b70969072de160b1e64a14c3ee76333a483f9ae
SSDEEP 98304:+WRTgww0JS7kJNuZO6QNOjamePuP+IOKiFQNvBHWzA+zl:+K5w0K6NFIjamwuPs6Ghzl
MD5 SHA1 SHA512 SSDEEP

FPTGUI-WINx64.exe

IMPHASH e569e6f445d32ba23766ad67d1e3787f
SHA256 ccde784513454a21570e6f9cdb479dbdb5af4175fd0a396b3a8d5cec7b6fad20
MD5 f510096d558b4d4acdf987824a684924
SHA1 9ee20f19bc16a159b182f8a2ca07f08c38b6948a
SHA512 aa7e1387334a8e35f404bb31daa4e47f68fd326e9ad343dbfca267142e90cad67933e177b9de6c3fecc01608ed14a643b0d61edd85368b0ff5debb890d67720a
SSDEEP 49152:nBuZrEU3Qm+3JK/pRnN4XGibUCOY6C0ki:BkL3G4pRnN2zN62i
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

745196

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetACP GetExitCodeProcess LocalFree CloseHandle SizeofResource VirtualProtect VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime GetEnvironmentVariableW WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CreateWindowExW TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW AdjustTokenPrivileges GetTokenInformation ConvertSidToStringSidW LookupPrivilegeValueW RegCloseKey OpenProcessToken RegOpenKeyExW

Name

.text

Size

718KB

Virtual Size

718KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

UEFITool/UEFITool.exe

IMPHASH 237926d25b6ee694a3400bdc5eb5da43
SHA256 abb5c38ca3ccdb26da0df23c317e9e81f3927b4bae554ad1966cf8115511094b
MD5 251c8cf7c20e9fc34c205282f2a1cf02
SHA1 8368f1b3de6558738c70c3bb9b90172656d25bf7
SHA512 400d7f220ea0323028ead2ee064315c7ab442f21ea9a35fe2e7b3ec2d80e10ffd179cfa6cfa63cffed53a83fc5e1da5902327c434ccfda63639a334f3eabc9e6
SSDEEP 196608:WQUKx4ribgWQra2M924WT1QmR/JTr6HeZFCF7QgK6Vjea9oJO5z7XCtmGDpJsv6D:SKSXCUJ3Qeulb9RgDpJsv6tWKFdu9CP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CopySid FreeSid GetLengthSid GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

gdi32

AddFontMemResourceEx AddFontResourceExW BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW ExtTextOutW GdiFlush GetBitmapBits GetCharABCWidthsFloatW GetCharABCWidthsW GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetObjectW GetOutlineTextMetricsW GetPixelFormat GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW OffsetRgn RemoveFontMemResourceEx RemoveFontResourceExW SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetPixelFormat SetTextAlign SetTextColor SetWorldTransform SwapBuffers

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CancelIo CheckRemoteDebuggerPresent CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileType GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessId GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetUserGeoID GetVolumeInformationW GlobalAlloc GlobalLock GlobalSize GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLanguageGroup IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReleaseMutex ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteFileEx lstrcmpW

msvcrt

___mb_cur_max_func __argc __argv __doserrno __getmainargs __initenv __lconv_init __p__acmdln __p__fmode __pioinfo __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _clearfp _close _control87 _endthreadex _environ _errno _exit _filelengthi64 _fileno _get_osfhandle _getdrive _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _putenv _read _setjmp3 _snwprintf _strdup _strdup _timezone _tzname _tzset _ultoa _unlock _vsnprintf _waccess _wchmod _wgetdcwd _write _write abort acos asin atan atof atoi atol bsearch calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free gmtime frexp fseek fsetpos ftell fwprintf fwrite getc getenv islower isspace isupper isxdigit localeconv localtime log10 longjmp malloc memchr mktime memcmp memcpy memmove memset printf puts qsort raise rand realloc remove setlocale signal sprintf srand sscanf strcat strchr strcmp strcpy strerror strlen strncmp strncpy strrchr strstr strtol strtoul tan tolower toupper ungetc vfprintf wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr

ole32

CoCreateGuid CoCreateInstance CoGetMalloc CoInitialize CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

oleaut32

SysAllocStringLen VariantInit

opengl32

glBindTexture glBlendFunc glClear glClearColor glClearDepth glClearStencil glColorMask glCopyTexImage2D glCopyTexSubImage2D glCullFace glDeleteTextures glDepthFunc glDepthMask glDepthRange glDisable glDrawArrays glDrawElements glEnable glFinish glFlush glFrontFace glGenTextures glGetBooleanv glGetError glGetFloatv glGetIntegerv glGetString glGetTexParameterfv glGetTexParameteriv glHint glIsEnabled glIsTexture glLineWidth glPixelStorei glPolygonOffset glReadPixels glScissor glStencilFunc glStencilMask glStencilOp glTexImage2D glTexParameterf glTexParameterfv glTexParameteri glTexParameteriv glTexSubImage2D glViewport

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetFileInfoW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteW

user32

AdjustWindowRectEx BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint EnumDisplayMonitors EnumWindows FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageExtraInfo GetMonitorInfoW GetParent GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InvalidateRect IsChild IsIconic IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MessageBeep MessageBoxW MoveWindow MsgWaitForMultipleObjectsEx NotifyWinEvent PeekMessageW PostMessageW PostThreadMessageW RealGetWindowClassW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenuItemInfoW SetParent SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW

winmm

PlaySoundW

ws2_32

WSAAsyncSelect WSACleanup WSAStartup gethostname

Name

.text

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

UEFITool/v3_payne_0_0.ffs

SHA256 17e216d7eb8026c38dd38547279bdb48ed8c74126ce2fd9204098c4f06b0d0ec
MD5 7e504d33f80f2eea7298c5123afbd413
SHA1 e6a9d9de3ea20536e2ae58f1cc440294fd9f4c54
SHA512 f01a8e4632201be2ac2d01ebf33655ef519c4282073d91411eb5a15ebde750c02a4cec7a38d4ab163243c2d61a7b2d680a3e35d57678069878bd51c5941e46ab
MD5 SHA1 SHA512

UEFITool/v3_payne_30_30.ffs

SHA256 5eb8187c9b26768bb99f45a5d65434a1de4c0c23e2b9dbc8baee8c7676114c27
MD5 15ea74fb26c968d793c10686a67c157c
SHA1 3125847e2bb495e993c8d119274618d1ae28f43f
SHA512 39a005a62e709e6cdfffd680cecb2cd8a3268b95acd981dd60d5997edf9593b3a478f3ac8f6d20acbaedc1044b1fa4bd0a0b389a74cce6e4e2c067cbe692aef1
MD5 SHA1 SHA512

UEFITool/v3_payne_70_50.ffs

SHA256 a78399c6938417908c538e613a61560a8e84b8ad213b42c84685948bb86da1f4
MD5 cf7c548cc2e4d12a91a5c5de1e82078c
SHA1 69f3d2780805315f01962dc1bd22b91c51a2bc2e
SHA512 817d90e712e6745cc52fa4b68508952e1a76a02b326eb6f4dcfd7a68bac672b35fa5c30e1d8fe04535cfedfcfb644530dc6228d0ed5b358f7acf79cd98241c0a
MD5 SHA1 SHA512

fparts.txt

SHA256 bdfa0e3bcb17185892978d563055ae3e3f2cb3548b080cc7ef78e06b92363c96
MD5 5db816980d2544868d6ce050d62a67e7
SHA1 d0740e8f6de1734e65f475b21d31f40461eb7a33
SHA512 896bf9230f4e9faf379cf87beccc21b1f217ccfbcc68c8c5e89679918f558bb60f33d2e8d62d53feb68ce4639fdd08e42b94e503d7fb9c717ed6619a99b01762
SSDEEP 96:JOydDqcnK9Ggbp93Kzb1Wy3xBjomqTOwTw8w1wwwKwAwCwy5T8DhhvtJMOfZzN94:kydDqiaGcAbrGJi0nLv/FD0z/
MD5 SHA1 SHA512 SSDEEP

idrvdll32e.DLL

IMPHASH e2a594a09003b63a6b5406d3dbf1a45f
SHA256 65a34921ede066338d9717ddfa134b54294bb81509d40061d2f4bc441fc392c5
MD5 daf7e1330087bf1093bd307a4bffd36f
SHA1 0ac170fff553339e9b1779e70e7eb05a43eced07
SHA512 d7cfd50158a4e92005424dc5c4deba78d78e3bd4cc92a4b985445fff5e75e05a5b3400ebe786a509f5b37ff5138a1dd9cc2e606148a0a6c99ac5dd70e916c501
SSDEEP 1536:E99+ctgZLtKBXfiyxhtLBRGW/arsCh24:a9vtrB6orvB/arsCh24
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

mmtool/mmtool_a5.exe

IMPHASH 8d82ba7579d02f97b6cd1a4aa8efd710
SHA256 51a85a663b1cb819508e48fd650180e6c79afd06fb458dd1357508fd9578fc23
MD5 c6fc1435cbde2636b33e4f7ee444a079
SHA1 8e54ac68de355e1031527b89c0560ae1c9c8c508
SHA512 7bbd44d9bacbb9fe8622675b6931222697536363ff4c0b5157660a8b8e790d64eceab911f63610a89ebdc36430ebb69b11db3903c723928663bc46b04c25a498
SSDEEP 196608:q96C3QaBOp6cMeBatwqRMYfjBpOREVkX4fT1lGX:03QaBOptLBaPRD9pDkX4jGX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1191408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AllocConsole LocalFree SetCurrentDirectoryA GetEnvironmentVariableA GetCurrentDirectoryA GetCommandLineW CloseHandle CreateFileA FindResourceA SizeofResource LockResource LoadResource WideCharToMultiByte GetEnvironmentVariableW GetVersion OpenEventA FileTimeToLocalFileTime UnmapViewOfFile MapViewOfFile CreateFileMappingA OpenFileMappingA ReadConsoleInputA SetConsoleMode PeekConsoleInputA GetNumberOfConsoleInputEvents InterlockedExchange MultiByteToWideChar GetTimeZoneInformation GetLocaleInfoW CreateFileW GetConsoleOutputCP WriteConsoleA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetDateFormatA GetTimeFormatA SetEnvironmentVariableW SetEnvironmentVariableA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP LoadLibraryW SetConsoleCtrlHandler HeapCreate HeapDestroy HeapReAlloc IsValidCodePage GetACP FatalAppExitA SetHandleCount SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess OutputDebugStringW WriteConsoleW OutputDebugStringA ExitThread CreateThread ExitProcess GetStartupInfoA GetProcessHeap HeapAlloc HeapFree GetCommandLineA VirtualQuery GetSystemInfo IsDebuggerPresent DebugBreak RaiseException IsBadReadPtr HeapValidate GetFileType SetStdHandle RtlUnwind GetDiskFreeSpaceA GetTempFileNameA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA FileTimeToSystemTime SetFileAttributesA SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesA TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedIncrement GetOEMCP GetCPInfo GlobalFlags GetProfileIntA SetErrorMode FindResourceExA InterlockedDecrement GetModuleFileNameW GetAtomNameA CreateEventA SetEvent WaitForSingleObject lstrcmpA GetCurrentThread GetLocaleInfoA ConvertDefaultLocale EnumResourceLanguagesA MulDiv CopyFileA GlobalSize FormatMessageA GetShortPathNameA GetThreadLocale GetFullPathNameA GetVolumeInformationA MoveFileA GetFileSize UnlockFile LockFile FlushFileBuffers SetFilePointer ReadFile GetCurrentProcess DuplicateHandle GetHandleInformation GetCurrentProcessId GetModuleFileNameA SuspendThread ResumeThread GetThreadPriority SetThreadPriority GetStdHandle FreeResource lstrcmpW FreeLibrary GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetVersionExA SetLastError LoadLibraryA GlobalAlloc VirtualProtect GlobalLock GlobalUnlock GlobalFree GetProcAddress VirtualFree VirtualAlloc FindFirstFileA RemoveDirectoryA FindNextFileA FindClose GetModuleHandleA SetEndOfFile DeleteFileA CreateProcessA GetExitCodeProcess GetTempPathA WriteFile CreateDirectoryA GetFileTime SetFileTime GetLastError lstrlenA lstrcmpiA lstrcmpiW GetStringTypeExA GetStringTypeExW lstrlenW CompareStringA CompareStringW

user32

GetSubMenu GetMenuState GetMenuStringA AppendMenuA InsertMenuA GetMenuItemID GetWindowThreadProcessId MoveWindow SetWindowTextA IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton OpenIcon CloseWindow LoadCursorA PostThreadMessageA GetWindowContextHelpId SetWindowContextHelpId SendNotifyMessageA GetForegroundWindow SetForegroundWindow ShowCaret HideCaret SetCaretPos GetCaretPos CreateCaret GetClipboardViewer GetClipboardOwner GetOpenClipboardWindow OpenClipboard SetClipboardViewer ChangeClipboardChain FlashWindow WindowFromPoint SetParent GetLastActivePopup FindWindowExA FindWindowA ChildWindowFromPointEx ChildWindowFromPoint ShowScrollBar GetNextDlgTabItem GetNextDlgGroupItem DlgDirSelectComboBoxExA DlgDirSelectExA DlgDirListComboBoxA DlgDirListA GetDesktopWindow SetCapture KillTimer SetTimer DrawCaption DrawAnimatedRects EnableScrollBar RedrawWindow LockWindowUpdate GetDCEx ShowOwnedPopups IsWindowVisible ValidateRgn ValidateRect InvalidateRgn InvalidateRect GetUpdateRgn GetUpdateRect UpdateWindow ReleaseDC GetWindowDC GetDC EndPaint BeginPaint ClientToScreen BringWindowToTop GetWindowRgn SetWindowRgn ArrangeIconicWindows IsZoomed HiliteMenuItem GetSystemMenu DrawMenuBar SetMenu GetMenu DragDetect GetMenuCheckMarkDimensions LoadBitmapA GetMenuItemCount RegisterWindowMessageA MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA LoadIconA SendDlgItemMessageA GetClientRect MapWindowPoints GetSysColor PeekMessageA DispatchMessageA AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo GetScrollRange SetScrollRange GetScrollPos SetScrollPos GetTopWindow IsChild GetWindow WinHelpA TrackPopupMenuEx TrackPopupMenu SetWindowPlacement GetWindowTextLengthA GetWindowTextA GetKeyState DestroyWindow GetDlgCtrlID SetWindowsHookExA CallNextHookEx GetClassLongA GetClassNameA UnhookWindowsHookEx CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos SetWindowLongA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics CharLowerW MsgWaitForMultipleObjects IsWindowUnicode GetMessageW DispatchMessageW TabbedTextOutA GetWindowRect MapDialogRect SetWindowPos ShowWindow PostMessageA SetPropA EnableWindow GetCapture GetActiveWindow SetActiveWindow GetPropA SendMessageA RemovePropA GetAsyncKeyState IsMenu RemoveMenu CreateDialogIndirectParamA EndDialog PostQuitMessage TranslateMessage GetMessageA SubtractRect UnionRect InflateRect SetRect PtInRect IsRectEmpty CharLowerA CharUpperW CharUpperA IsWindow IsWindowEnabled GetDlgItem GetParent SetFocus GetFocus GetWindowLongA GetCursorPos SetCursor GetKeyNameTextA MapVirtualKeyA WindowFromDC GetSysColorBrush ExcludeUpdateRgn FrameRect InvertRect DrawIcon DrawStateA DrawEdge DrawFrameControl DrawFocusRect DrawTextA DrawTextExA GetTabbedTextExtentA GrayStringA ScrollDC CreateMenu CreatePopupMenu DeleteMenu CheckMenuItem EnableMenuItem SetMenuDefaultItem GetMenuDefaultItem GetMenuItemInfoA SetMenuItemInfoA InsertMenuItemA ModifyMenuA LoadMenuA LoadMenuIndirectA SetMenuContextHelpId GetMenuContextHelpId CheckMenuRadioItem GetDialogBaseUnits SetRectEmpty ReleaseCapture GetClipboardFormatNameA UnpackDDElParam DestroyMenu LoadAcceleratorsA TranslateAcceleratorA ReuseDDElParam WaitMessage DestroyIcon UnregisterClassA SetMenuItemBitmaps FillRect

gdi32

StrokePath CloseMetaFile CreateEnhMetaFileA CloseEnhMetaFile ExtTextOutA GetDCOrgEx GetClipBox SetTextColor SetBkColor GetObjectA CreateBitmap CopyMetaFileA CreateDCA GetDeviceCaps DeleteDC SaveDC RestoreDC SelectObject GetStockObject SelectPalette SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetGraphicsMode SetWorldTransform ModifyWorldTransform SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo DeleteObject GetClipRgn CreateRectRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt UnrealizeObject CreatePenIndirect CreateBrushIndirect CreateFontIndirectA CreateFontA CreateBitmapIndirect SetBitmapBits GetBitmapBits SetBitmapDimensionEx GetBitmapDimensionEx CreateCompatibleBitmap CreateDiscardableBitmap CreatePalette CreateHalftonePalette GetPaletteEntries SetPaletteEntries AnimatePalette GetNearestPaletteIndex ResizePalette CreateRectRgnIndirect CreateEllipticRgn CreateEllipticRgnIndirect CreatePolygonRgn CreatePolyPolygonRgn CreateRoundRectRgn PathToRegion ExtCreateRegion GetRegionData SetRectRgn CombineRgn EqualRgn OffsetRgn GetRgnBox PtInRegion RectInRegion CreateICA CreateCompatibleDC GetBrushOrgEx SetBrushOrgEx EnumObjects GetNearestColor RealizePalette UpdateColors GetBkColor GetBkMode GetPolyFillMode GetROP2 GetStretchBltMode GetTextColor GetMapMode GetGraphicsMode GetWorldTransform GetViewportOrgEx GetViewportExtEx GetWindowOrgEx GetWindowExtEx DPtoLP LPtoDP FillRgn FrameRgn InvertRgn PaintRgn PtVisible RectVisible Arc Polyline Chord Ellipse Pie Polygon PolyPolygon Rectangle RoundRect PatBlt BitBlt StretchBlt GetPixel SetPixel FloodFill ExtFloodFill TextOutA GetTextExtentPoint32A GetTextAlign GetTextFaceA GetTextMetricsA GetTextCharacterExtra GetCharWidthA GetFontLanguageInfo GetCharacterPlacementA GetAspectRatioFilterEx Escape SetBoundsRect GetBoundsRect ResetDCA GetOutlineTextMetricsA GetCharABCWidthsA GetFontData GetKerningPairsA GetGlyphOutlineA StartDocA StartPage EndPage SetAbortProc AbortDoc EndDoc MaskBlt PlgBlt SetPixelV AngleArc GetArcDirection PolyPolyline GetColorAdjustment GetCurrentObject PolyBezier DrawEscape ExtEscape GetCharABCWidthsFloatA GetCharWidthFloatA AbortPath BeginPath CloseFigure EndPath FillPath FlattenPath StretchDIBits EnumFontFamiliesExA PlayEnhMetaFile GdiComment WidenPath CreateMetaFileA StrokeAndFillPath SetMiterLimit GetPath GetMiterLimit

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

OpenThreadToken RegOpenKeyExA RegCloseKey RegQueryValueExA RegOpenKeyA RegSetValueA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegCreateKeyA SetFileSecurityA GetFileSecurityA SetThreadToken RevertToSelf

shell32

ExtractIconA DragAcceptFiles SHGetFileInfoA DragFinish DragQueryFileA CommandLineToArgvW

ole32

OleRun CLSIDFromProgID CLSIDFromString CoCreateInstance CoDisconnectObject ReleaseStgMedium CoTaskMemAlloc CoTreatAsClass StringFromCLSID CoRegisterClassObject ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemFree OleDuplicateData CoCreateGuid StringFromGUID2 CoRevokeClassObject CoReleaseMarshalData CoMarshalInterface CreateStreamOnHGlobal CoUnmarshalInterface ReadClassStg

oleaut32

DosDateTimeToVariantTime SysAllocString VarBstrFromDate VarDateFromStr VarDecFromStr VarBstrFromDec SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData SafeArrayCopy VarBstrFromCy VarCyFromStr SysReAllocStringLen VariantCopy SafeArrayCreate SafeArrayRedim SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElemsize SafeArrayGetDim SysFreeString SysStringByteLen SysAllocStringByteLen SysStringLen SysAllocStringLen VariantInit VariantChangeType VariantClear VariantTimeToSystemTime VarUdateFromDate VarDateFromUdate SystemTimeToVariantTime LoadTypeLi

shlwapi

PathFindFileNameA PathRemoveExtensionA PathFindExtensionA PathIsUNCA PathStripToRootA

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

728KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

4KB

Virtual Size

793B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12.6MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

pmxdll32e.DLL

IMPHASH cc23bafd7af21ee60b382503894c3948
SHA256 1882c65036142fee6b89042e2b7bf383aaa8e151b65942f5b74c03ab5cc4e5f9
MD5 1891b27af49e866e290a0441c7dc00e9
SHA1 dc009ce0a6ba77f19790c0b667fa4db5d742eda4
SHA512 80db43def83c270b0a61195f1f526339bff27b0d6474728de19e34c8631e44ceee4620569ea869ea7627d0d7174ae3e9a91c7b6e725a5d36a0ffc18515f51f30
SSDEEP 1536:aBv5WVyTPAj0W2Zg1iBfuc1sgRTbHDQCu7ho0Eoqenw:aBIoDA8BWaswfHDQCu7hFel
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForMultipleObjects SetEvent GetLastError Sleep SetThreadAffinityMask GetCurrentThread _local_unwind CreateEventA CreateSemaphoreA CloseHandle GetCurrentProcess GetWindowsDirectoryA GetVersionExA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject ReleaseSemaphore __C_specific_handler GetProcessAffinityMask DeviceIoControl ExitThread GetCurrentThreadId CreateThread HeapAlloc HeapFree GetCommandLineA GetProcessHeap WriteFile FlushFileBuffers DeleteCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA ExitProcess GetProcAddress GetModuleHandleA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue UnhandledExceptionFilter HeapSetInformation HeapCreate HeapDestroy GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW SetFilePointer RaiseException SetStdHandle GetACP GetOEMCP GetCPInfo LoadLibraryA LCMapStringA MultiByteToWideChar LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW VirtualProtect GetSystemInfo VirtualQuery

idrvdll32e

IDRVGetLastError IDRVInstallDriver IDRVRemoveDriver IDRVInit

winmm

timeGetTime timeEndPeriod timeBeginPeriod

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FPTGUI-WINx64.rar

AMIBCP5/AMIBCP5.exe

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic

FPTGUI-WINx64-1.bin

FPTGUI-WINx64-2.bin

FPTGUI-WINx64.exe

kernel32

comctl32

version

user32

oleaut32

netapi32

advapi32

generic

UEFITool/UEFITool.exe

advapi32

gdi32

imm32

kernel32

msvcrt

ole32

oleaut32

opengl32

shell32

user32

winmm

ws2_32

generic

UEFITool/v3_payne_0_0.ffs

UEFITool/v3_payne_30_30.ffs

UEFITool/v3_payne_70_50.ffs

fparts.txt

idrvdll32e.DLL

kernel32

advapi32

generic

mmtool/mmtool_a5.exe

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

ole32

oleaut32

shlwapi

generic

pmxdll32e.DLL

kernel32

idrvdll32e

winmm

generic