Virtual Audio Cable 4[.]70[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Virtual Audio Cable 4.70.zip
Size

1.3MB
MD5

6f5f7b10c4d8d74795c5512e05df031d
SHA1

11eb237685a9c4f599f09b7bc33f8c700d38b478
SHA256

b423f1dc189716362e847dd17a09e6476df3e166863b663ab295aa2d8eb75026
SHA512

218750e66c380a7391bd800545e0da6d280bbd609e3e11e53aa55e698cc554beb0cb3e399312ae78c4436088cc3dc1cd1c8ce6c8febbb48f102fb9e3b153d28f
SSDEEP

24576:nWBmS1WhEIkgs6FvsAryS4khfrj446CYRriUoYYiDZveabji5gZLBtmlv4Kr6pz1:nWcWb2FvBhhfrjG7RrvpoabZLBKv4MMZ

Score

1^/10

Malware Config

Signatures

Files

Virtual Audio Cable 4.70.zip
.zip
arm64/audiorepeater.exe
arm64/audiorepeater_ks.exe
arm64/vcctlpan.exe
arm64/vrtaucbl.sys
homepage.url
license.txt
readme.txt
setup.exe
.exe windows:6 windows x86 arch:x86

349ba42284e937844d25d35c30786a3a

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:68:5e:4c:cd:1f:bf:97:26:23:e2:59:a1:e6:c2:96:7a:3d:31:6c:ef:9d:9e:7b:1e:74:fe:60:51:89:f9:9a
Signer

Actual PE Digest

72:68:5e:4c:cd:1f:bf:97:26:23:e2:59:a1:e6:c2:96:7a:3d:31:6c:ef:9d:9e:7b:1e:74:fe:60:51:89:f9:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup.pdb

Imports

advapi32

GetUserNameW
RegCloseKey
RegCreateKeyW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegFlushKey
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService
StartServiceW
QueryServiceStatus
ControlService
RegOpenKeyExW
RegQueryValueExW

kernel32

GetACP
ReadFile
GetFileSize
WriteFile
SetEndOfFile
DeleteFileW
SetFileAttributesW
GetFileAttributesW
MoveFileExW
RtlZeroMemory
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
SetLastError
GetPrivateProfileStringW
lstrcmpW
GetExitCodeProcess
lstrcmpiW
ExitProcess
CopyFileW
GetCurrentDirectoryW
ProcessIdToSessionId
GetCurrentProcessId
GetVersionExW
GetSystemInfo
GetLocalTime
MultiByteToWideChar
lstrcatW
GetWindowsDirectoryW
GetTempPathW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetProcAddress
FindVolumeClose
FindNextVolumeW
FlushFileBuffers
GetDriveTypeW
FindFirstVolumeW
GetCurrentProcess
GetSystemDirectoryW
OpenProcess
WaitForMultipleObjects
ExpandEnvironmentStringsW
LocalFree
CompareStringW
CreateEventW
OpenEventW
TerminateProcess
DuplicateHandle
GetProcessId
SetEvent
CreateThread
lstrlenW
lstrlenA
GetTickCount
Sleep
GetModuleHandleW
GetLastError
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
IsDebuggerPresent
FormatMessageW
GetCommandLineW
lstrcpyW
CreateFileW
CloseHandle
WaitForSingleObject
HeapFree

gdi32

SetTextColor
CreateSolidBrush
GetStockObject
DeleteObject
SetBkColor

user32

SendDlgItemMessageW
DialogBoxParamW
BroadcastSystemMessageW
ExitWindowsEx
CreateDialogParamW
wsprintfW
wsprintfA
IsDialogMessageW
TranslateMessage
DispatchMessageW
GetMessagePos
GetDesktopWindow
GetMessageW
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
ShowWindow
CheckDlgButton
GetDlgItem
SetDlgItemTextW
SetFocus
EndDialog
wvsprintfW
MessageBoxW
GetSystemMetrics
SetWindowTextW
CharUpperW
RegisterWindowMessageW

comctl32

ord17

ole32

CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW

shlwapi

SHGetValueW

setupapi

CM_Locate_DevNodeW
CM_Get_DevNode_Status

psapi

EnumProcesses
GetProcessImageFileNameW

rpcrt4

UuidCreate
UuidFromStringW

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup.ini
setup64.exe
.exe windows:6 windows x64 arch:x64

0cdadabf4a98616b7836303e269dd066

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:76:7b:ae:45:4d:cd:c5:27:77:1c:8b:0f:be:07:74:a3:f9:19:51:20:4f:67:2d:81:fc:95:fc:cd:24:31:00
Signer

Actual PE Digest

a9:76:7b:ae:45:4d:cd:c5:27:77:1c:8b:0f:be:07:74:a3:f9:19:51:20:4f:67:2d:81:fc:95:fc:cd:24:31:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

setup64.pdb

Imports

advapi32

GetUserNameW
RegCloseKey
RegCreateKeyW
RegEnumValueW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegFlushKey
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService
StartServiceW
QueryServiceStatus
ControlService
RegOpenKeyExW
RegQueryValueExW

kernel32

GetACP
ReadFile
GetFileSize
WriteFile
SetEndOfFile
DeleteFileW
SetFileAttributesW
GetFileAttributesW
MoveFileExW
RtlZeroMemory
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
SetLastError
GetPrivateProfileStringW
lstrcmpW
GetExitCodeProcess
lstrcmpiW
ExitProcess
CopyFileW
GetCurrentDirectoryW
ProcessIdToSessionId
GetCurrentProcessId
GetVersionExW
GetSystemInfo
GetLocalTime
MultiByteToWideChar
lstrcatW
GetWindowsDirectoryW
GetTempPathW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetProcAddress
FindVolumeClose
FindNextVolumeW
FlushFileBuffers
GetDriveTypeW
FindFirstVolumeW
GetSystemDirectoryW
OpenProcess
WaitForMultipleObjects
ExpandEnvironmentStringsW
GetCurrentProcess
LocalFree
CompareStringW
CreateEventW
OpenEventW
TerminateProcess
DuplicateHandle
GetProcessId
SetEvent
CreateThread
lstrlenW
lstrlenA
GetTickCount
Sleep
GetModuleHandleW
GetLastError
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
IsDebuggerPresent
FormatMessageW
GetCommandLineW
lstrcpyW
CreateFileW
CloseHandle
WaitForSingleObject
HeapFree

gdi32

SetTextColor
CreateSolidBrush
GetStockObject
DeleteObject
SetBkColor

user32

SendDlgItemMessageW
DialogBoxParamW
BroadcastSystemMessageW
ExitWindowsEx
CreateDialogParamW
wsprintfW
wsprintfA
TranslateMessage
DispatchMessageW
GetMessageW
GetMessagePos
GetDesktopWindow
IsDialogMessageW
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
ShowWindow
CheckDlgButton
GetDlgItem
SetDlgItemTextW
SetFocus
EndDialog
wvsprintfW
MessageBoxW
GetSystemMetrics
SetWindowTextW
CharUpperW
RegisterWindowMessageW

comctl32

ord17

ole32

CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW

shlwapi

SHGetValueW

setupapi

CM_Locate_DevNodeW
CM_Get_DevNode_Status

psapi

EnumProcesses
GetProcessImageFileNameW

rpcrt4

UuidCreate
UuidFromStringW

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 654B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup64a.exe
tools/delete_phantom.cmd
.cmd .vbs
tools/delete_service.cmd
tools/delete_settings.cmd
tools/open_audio_properties.cmd
tools/open_device_manager.cmd
tools/set_audiodg_instance_count_report.cmd
tools/set_cable_signal_level_disable.cmd
tools/set_check_level.cmd
tools/set_connected_source_lines_mask.cmd
tools/set_debug_level.cmd
tools/set_format_attribute_policy.cmd
tools/set_hiding_mode.cmd
tools/set_packet_mode.cmd
tools/set_port_type.cmd
tools/set_portcls_policy.cmd
tools/set_restrict_affinity.cmd
.cmd .vbs
tools/set_restrict_client_affinity.cmd
tools/set_restrict_kmixer_affinity.cmd
tools/set_source_line_types_mask.cmd
tools/set_split_dpc_processing.cmd
tools/set_stream_signal_level_disable.cmd
tools/set_timer_precision_percent.cmd
tools/set_timer_resolution_percent.cmd
tools/setregdword.cmd
.cmd .vbs
tools/setvars.cmd
.cmd .vbs
vac.chm
.chm
vrtaucbl.cat
vrtaucbl.inf
vrtaucbl6x.cat
vrtaucbl6x.inf
x64/audiorepeater.exe
.exe windows:6 windows x64 arch:x64

b468cea7d0132b993706be2769b525a0

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:0c:71:47:fa:96:24:fb:16:60:8c:1d:d4:6f:2d:cd:50:91:bb:16:29:78:f2:36:c9:12:55:92:f1:b7:f9:54
Signer

Actual PE Digest

51:0c:71:47:fa:96:24:fb:16:60:8c:1d:d4:6f:2d:cd:50:91:bb:16:29:78:f2:36:c9:12:55:92:f1:b7:f9:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

audiorepeater.pdb

Imports

kernel32

GetCurrentThread
lstrlenA
lstrcpyW
GetACP
SetLastError
ReadFile
GetFileSizeEx
lstrcatW
lstrcmpW
QueryPerformanceCounter
WriteFile
WaitForSingleObject
WaitForMultipleObjects
CreateThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetPriorityClass
RtlMoveMemory
GetStartupInfoW
SetThreadPriority
lstrlenW
CreateEventW
Sleep
SetEvent
GetCurrentThreadId
GetCurrentProcessId
OpenProcess
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExW
GetSystemInfo
FormatMessageW
GetCommandLineW
ExitProcess
GetModuleFileNameW
DeviceIoControl
CloseHandle
CreateFileW
lstrcmpiW
GetProcAddress
FreeLibrary
LoadLibraryW
GetLastError
RtlZeroMemory
RtlCaptureContext

gdi32

GetStockObject
SetDCBrushColor
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC

user32

EndDialog
GetDesktopWindow
ShowWindow
GetWindowLongPtrW
SetWindowLongPtrW
UpdateWindow
SetTimer
GetDlgItemTextW
SetWindowTextW
SendDlgItemMessageW
FillRect
GetClientRect
LoadIconW
LoadMenuW
GetCursorPos
wsprintfW
EnableWindow
GetDlgItem
GetSubMenu
TrackPopupMenuEx
SetDlgItemTextW
SetForegroundWindow
GetComboBoxInfo
GetWindowLongW
GetClassNameW
SendMessageW
MapWindowPoints
GetWindowRect
SetWindowPos
DestroyWindow
CreateWindowExW
PostMessageW
DialogBoxParamW
FindWindowW
HiliteMenuItem
MessageBoxW
SetDlgItemInt
InvalidateRect
KillTimer
CloseClipboard
SetClipboardData
GetWindowTextW
EmptyClipboard
OpenClipboard
GetDlgItemInt

comctl32

ord410
ord413
ord17

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

Shell_NotifyIconW
ShellExecuteW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

shlwapi

SHGetValueW

winmm

waveInMessage
waveOutMessage
waveInGetDevCapsW
waveOutGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs
waveOutGetErrorTextW
waveInPrepareHeader
waveOutPrepareHeader
waveInReset
waveOutOpen
waveInOpen
waveInStop
waveOutPause
waveInStart
waveOutRestart
waveInAddBuffer
waveOutWrite
waveInUnprepareHeader
waveOutUnprepareHeader
waveInClose
waveOutClose
waveOutReset

uxtheme

SetWindowTheme

advapi32

RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegCloseKey

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 642B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/audiorepeater_ks.exe
.exe windows:6 windows x64 arch:x64

c2c97241b958dbcb1b7c6a4912bab377

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

92:3f:48:bd:1b:c9:21:9c:69:3c:d1:1d:28:df:82:5a:28:df:dd:41:aa:8b:9e:e7:9b:db:e3:bd:b6:cd:34:4b
Signer

Actual PE Digest

92:3f:48:bd:1b:c9:21:9c:69:3c:d1:1d:28:df:82:5a:28:df:dd:41:aa:8b:9e:e7:9b:db:e3:bd:b6:cd:34:4b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW

kernel32

GlobalLock
GlobalAlloc
SetEvent
CloseHandle
WriteFile
CreateFileW
RtlMoveMemory
SetPriorityClass
WaitForSingleObject
WaitForMultipleObjects
Sleep
SetWaitableTimer
SetThreadPriority
GlobalUnlock
CreateWaitableTimerW
CreateEventW
GetStartupInfoW
CreateThread
SetLastError
DeviceIoControl
GetOverlappedResult
lstrlenA
lstrlenW
GetLastError
ReadFile
GetFileSizeEx
FreeLibrary
GlobalFree
QueryPerformanceCounter
lstrcmpiW
lstrcatW
lstrcpyW
GetModuleHandleW
GetModuleFileNameW
GetCurrentThread
QueryPerformanceFrequency
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GetVersionExW
GetSystemInfo
FormatMessageW
GetCommandLineW
ExitProcess
GetProcAddress
RtlCaptureContext
LoadLibraryW
GetCurrentProcessId
OpenProcess
RtlZeroMemory
GetACP

gdi32

SetDCBrushColor
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

user32

GetWindowLongW
GetClassNameW
MapWindowPoints
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
GetComboBoxInfo
TrackPopupMenuEx
DialogBoxParamW
SendMessageW
FindWindowW
GetClientRect
ShowWindow
MessageBoxW
SendDlgItemMessageW
CallWindowProcW
SetTimer
GetDesktopWindow
LoadIconW
HiliteMenuItem
LoadMenuW
SetWindowLongPtrW
EndDialog
FillRect
GetCursorPos
GetSubMenu
SetForegroundWindow
CloseClipboard
SetClipboardData
wsprintfW
SetWindowTextW
UpdateWindow
InvalidateRect
KillTimer
GetDlgItem
PostMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetDlgItemInt
CheckDlgButton
EnableWindow
GetDlgItemInt
OpenClipboard
EmptyClipboard
GetWindowTextW
SetDlgItemTextW

comctl32

ord17

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

Shell_NotifyIconW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

shlwapi

SHGetValueW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

uxtheme

SetWindowTheme

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/vcctlpan.exe
.exe windows:6 windows x64 arch:x64

f5454bf44d77e61fdc005390062c76ec

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:4d:b2:fa:80:f4:e8:bc:24:b0:f2:5d:d1:bf:5a:7f:4d:ea:7a:4d:0d:50:ab:c6:3a:1a:80:f0:9f:6f:98:54
Signer

Actual PE Digest

59:4d:b2:fa:80:f4:e8:bc:24:b0:f2:5d:d1:bf:5a:7f:4d:ea:7a:4d:0d:50:ab:c6:3a:1a:80:f0:9f:6f:98:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vcctlpan.pdb

Imports

advapi32

CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW

kernel32

RtlMoveMemory
QueryPerformanceFrequency
SetLastError
GetCurrentProcess
OpenProcess
LocalFree
GetProcAddress
DeviceIoControl
GetLocalTime
lstrcmpiW
lstrcmpW
GetModuleHandleW
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetTickCount
CreateFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryW
FreeLibrary
IsDebuggerPresent
lstrlenA
FormatMessageW
GetSystemInfo
GetCommandLineW
ExitProcess
ExpandEnvironmentStringsA
LoadLibraryA
WriteFile
GetVersionExW
CloseHandle
Sleep
RtlZeroMemory
GetModuleFileNameW
SetUnhandledExceptionFilter
GetLastError
lstrcatW
lstrcpyW
lstrlenW
CreateMutexW

gdi32

ExcludeClipRect
RectVisible
MoveToEx
LineTo
CreateSolidBrush
CreateRectRgn
SetDCBrushColor
FrameRgn
SetBkMode
SetTextColor
SelectObject
GetObjectW
GetStockObject
CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
SetBkColor

user32

GetFocus
GetClientRect
wsprintfW
IsWindowEnabled
EnableWindow
wvsprintfW
LoadIconW
DestroyIcon
GetSystemMetrics
FillRect
SetFocus
CreateWindowExW
IsWindow
SendDlgItemMessageW
MapWindowPoints
GetClassNameW
GetComboBoxInfo
GetShellWindow
GetWindowThreadProcessId
IsDlgButtonChecked
CheckDlgButton
GetDlgItemInt
GetWindowLongW
SetDlgItemInt
ShowWindow
SetTimer
GetMessagePos
GetDlgItemTextW
GetDesktopWindow
DialogBoxParamW
UpdateWindow
SetActiveWindow
SetWindowLongPtrW
GetDlgItem
ChildWindowFromPoint
SetCursor
GetWindowTextW
GetSysColorBrush
GetSysColor
SetWindowPos
EndDialog
SetWindowTextW
SystemParametersInfoW
LoadCursorW
GetParent
GetWindowRect
UnregisterClassW
GetPropW
RemovePropW
SetPropW
DefWindowProcW
MessageBoxW
DestroyWindow
CreateDialogParamW
SetWindowLongW
SetDlgItemTextW
SendMessageW

comctl32

ImageList_Create
ImageList_ReplaceIcon
ord17
ord413
ord16

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW
ShellExecuteExW

ole32

CoInitializeEx

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

SHGetValueW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/vrtaucbl.sys
.sys windows:6 windows x64 arch:x64

527610fb051b211daa88933ef8974e6f

Code Sign

33:00:00:00:56:35:88:7e:de:18:82:ef:76:00:00:00:00:00:56
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:bb:a5:97:55:6c:7d:a5:2d:0f:f1:e9:f9:05:17:d5:df:15:62:af:02:76:90:3a:0e:79:8f:a8:91:f6:82:41
Signer

Actual PE Digest

4c:bb:a5:97:55:6c:7d:a5:2d:0f:f1:e9:f9:05:17:d5:df:15:62:af:02:76:90:3a:0e:79:8f:a8:91:f6:82:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vrtaucbl.pdb

Imports

ntoskrnl.exe

MmFreePagesFromMdl
MmUnmapLockedPages
wcschr
IoGetCurrentProcess
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdl
KeInitializeEvent
KeWaitForSingleObject
RtlFreeUnicodeString
IoRegisterDeviceInterface
ZwClose
IoSetDeviceInterfaceState
__C_specific_handler
wcsncpy
_wcsnicmp
srand
IofCompleteRequest
ProbeForRead
ProbeForWrite
wcsrchr
MmGetSystemRoutineAddress
IoReleaseCancelSpinLock
ObfDereferenceObject
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwOpenKey
ZwCreateKey
__chkstk
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoOpenDeviceInterfaceRegistryKey
memcmp
KeCancelTimer
ExFreePool
KeSetTimer
KeSetEvent
KeInitializeDpc
KeInitializeTimerEx
_wcsicmp
wcsncmp
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlCompareUnicodeString
RtlZeroMemory
RtlMoveMemory
KeSetSystemAffinityThread
PsInitialSystemProcess
PsGetCurrentProcessId
MmGetPhysicalAddress
PsGetCurrentThreadId
ZwQueryInformationProcess
ZwQuerySystemInformation
MmUnmapViewInSystemSpace
MmMapViewOfSection
MmUnmapViewOfSection
MmMapViewInSystemSpace
MmCreateSection
RtlFillMemory
KdDebuggerEnabled
KeNumberProcessors
ExFreePoolWithTag
ExAllocatePool
KeClearEvent
KeWaitForMultipleObjects
ExSetTimerResolution
RtlInitUnicodeString
KeInitializeMutex
KeReleaseMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlGetVersion

hal

KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcRegisterPhysicalConnection
PcNewPort
PcRegisterSubdevice
PcInitializeAdapterDriver
PcAddAdapterDevice
PcDispatchIrp
PcRegisterAdapterPowerManagement

ks.sys

KsAcquireResetValue
KsProbeStreamIrp

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 178B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/audiorepeater.exe
.exe windows:6 windows x86 arch:x86

1fca9134ee29f825a9dc2035116cf878

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:c4:c0:ed:28:0d:0b:82:93:2d:eb:89:3a:83:54:f9:44:67:f5:0b:88:28:cf:72:b2:fc:f8:8f:50:7f:4d:d2
Signer

Actual PE Digest

57:c4:c0:ed:28:0d:0b:82:93:2d:eb:89:3a:83:54:f9:44:67:f5:0b:88:28:cf:72:b2:fc:f8:8f:50:7f:4d:d2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

audiorepeater.pdb

Imports

kernel32

GetCurrentThread
lstrlenA
lstrcpyW
GetACP
SetLastError
ReadFile
GetFileSizeEx
lstrcatW
lstrcmpW
QueryPerformanceCounter
WriteFile
SetThreadPriority
WaitForMultipleObjects
CreateThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetPriorityClass
RtlMoveMemory
GetModuleFileNameW
lstrlenW
CreateEventW
Sleep
GetModuleHandleW
SetEvent
GetCurrentThreadId
GetCurrentProcessId
OpenProcess
WaitForSingleObject
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExW
GetSystemInfo
FormatMessageW
GetCommandLineW
ExitProcess
DeviceIoControl
CloseHandle
CreateFileW
lstrcmpiW
GetProcAddress
FreeLibrary
LoadLibraryW
GetLastError
GetStartupInfoW
RtlZeroMemory
SetUnhandledExceptionFilter

gdi32

CreateCompatibleBitmap
GetStockObject
SetDCBrushColor
BitBlt
CreateCompatibleDC
SelectObject
DeleteObject
DeleteDC

user32

SetTimer
EndDialog
ShowWindow
LoadMenuW
LoadIconW
GetDesktopWindow
SetWindowLongW
GetCursorPos
GetDlgItemInt
OpenClipboard
EmptyClipboard
SendDlgItemMessageW
FillRect
GetClientRect
GetSubMenu
HiliteMenuItem
SetForegroundWindow
wsprintfW
EnableWindow
GetDlgItem
GetDlgItemTextW
UpdateWindow
SetWindowTextW
SetDlgItemTextW
GetComboBoxInfo
GetWindowLongW
GetClassNameW
SendMessageW
MapWindowPoints
GetWindowRect
SetWindowPos
DestroyWindow
CreateWindowExW
PostMessageW
TrackPopupMenuEx
DialogBoxParamW
FindWindowW
MessageBoxW
SetDlgItemInt
InvalidateRect
KillTimer
CloseClipboard
SetClipboardData
GetWindowTextW

comctl32

ord410
ord17
ord413

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

Shell_NotifyIconW
ShellExecuteW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

shlwapi

SHGetValueW

winmm

waveInMessage
waveOutMessage
waveInGetDevCapsW
waveOutGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs
waveOutGetErrorTextW
waveInPrepareHeader
waveOutPrepareHeader
waveInReset
waveOutReset
waveInOpen
waveInStop
waveOutPause
waveInStart
waveOutRestart
waveInAddBuffer
waveOutWrite
waveInUnprepareHeader
waveOutUnprepareHeader
waveInClose
waveOutClose
waveOutOpen

uxtheme

SetWindowTheme

advapi32

RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExW

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/audiorepeater_ks.exe
.exe windows:6 windows x86 arch:x86

91595a37ee45282843fff5cd18278c99

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:a5:6b:88:28:28:c1:4f:ff:b5:81:36:5f:7a:20:25:a4:18:03:6d:51:63:e0:9f:c4:36:7a:80:0b:4e:ff:0d
Signer

Actual PE Digest

f0:a5:6b:88:28:28:c1:4f:ff:b5:81:36:5f:7a:20:25:a4:18:03:6d:51:63:e0:9f:c4:36:7a:80:0b:4e:ff:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW

kernel32

GlobalLock
GlobalAlloc
SetEvent
CloseHandle
WriteFile
CreateFileW
RtlMoveMemory
SetPriorityClass
WaitForSingleObject
WaitForMultipleObjects
Sleep
SetWaitableTimer
SetThreadPriority
GlobalUnlock
CreateWaitableTimerW
CreateEventW
CreateThread
GetStartupInfoW
SetLastError
DeviceIoControl
GetOverlappedResult
lstrlenA
GetLastError
GetACP
ReadFile
GetFileSizeEx
FreeLibrary
GlobalFree
QueryPerformanceCounter
lstrcmpiW
lstrcatW
lstrcpyW
GetModuleHandleW
GetModuleFileNameW
GetCurrentThread
QueryPerformanceFrequency
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GetVersionExW
GetSystemInfo
FormatMessageW
GetCommandLineW
ExitProcess
GetProcAddress
LoadLibraryW
SetUnhandledExceptionFilter
GetCurrentProcessId
OpenProcess
RtlZeroMemory
lstrlenW

gdi32

SetDCBrushColor
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

user32

GetDesktopWindow
GetClientRect
GetComboBoxInfo
GetWindowLongW
GetClassNameW
MapWindowPoints
GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
FillRect
SetWindowTextW
UpdateWindow
DialogBoxParamW
SendMessageW
FindWindowW
LoadIconW
LoadMenuW
MessageBoxW
SendDlgItemMessageW
CallWindowProcW
wsprintfW
EndDialog
SetWindowLongW
SetTimer
GetCursorPos
GetSubMenu
HiliteMenuItem
SetForegroundWindow
TrackPopupMenuEx
CreateWindowExW
CloseClipboard
SetClipboardData
SetDlgItemTextW
InvalidateRect
GetDlgItem
PostMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetDlgItemInt
CheckDlgButton
EnableWindow
GetDlgItemInt
OpenClipboard
EmptyClipboard
GetWindowTextW
KillTimer

comctl32

ord17

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

Shell_NotifyIconW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

shlwapi

SHGetValueW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

uxtheme

SetWindowTheme

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/vcctlpan.exe
.exe windows:6 windows x86 arch:x86

5c0a9d0c9746a66e623fa59cc0521b03

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:b4:5a:55:3c:ee:dd:10:01:d4:6a:af:40:9c:21:58:5d:d1:85:55:c8:79:49:a1:c3:76:ae:6c:70:75:c9:08
Signer

Actual PE Digest

39:b4:5a:55:3c:ee:dd:10:01:d4:6a:af:40:9c:21:58:5d:d1:85:55:c8:79:49:a1:c3:76:ae:6c:70:75:c9:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vcctlpan.pdb

Imports

advapi32

CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExW

kernel32

RtlMoveMemory
SetLastError
QueryPerformanceFrequency
GetCurrentProcess
OpenProcess
LocalFree
GetProcAddress
DeviceIoControl
GetLocalTime
lstrcmpiW
lstrcmpW
GetModuleHandleW
TerminateProcess
GetStartupInfoW
GetTickCount
CreateFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryW
FreeLibrary
IsDebuggerPresent
lstrlenA
FormatMessageW
GetSystemInfo
GetCommandLineW
ExitProcess
LoadLibraryA
ExpandEnvironmentStringsA
WriteFile
GetVersionExW
CloseHandle
Sleep
RtlZeroMemory
SetUnhandledExceptionFilter
GetModuleFileNameW
UnhandledExceptionFilter
GetLastError
lstrcatW
lstrcpyW
lstrlenW
CreateMutexW

gdi32

SetBkColor
ExcludeClipRect
RectVisible
MoveToEx
LineTo
CreateRectRgn
SetDCBrushColor
FrameRgn
CreateSolidBrush
CreateFontIndirectW
GetStockObject
GetTextExtentPoint32W
SelectObject
SetTextColor
SetBkMode
DeleteObject
GetObjectW

user32

GetClientRect
SetDlgItemTextW
wsprintfW
IsWindowEnabled
EnableWindow
wvsprintfW
SendMessageW
GetMessagePos
GetFocus
FillRect
SetFocus
IsWindow
SendDlgItemMessageW
CreateWindowExW
MapWindowPoints
GetClassNameW
GetComboBoxInfo
GetShellWindow
GetWindowThreadProcessId
IsDlgButtonChecked
CheckDlgButton
LoadIconW
DestroyIcon
GetDlgItemInt
GetWindowLongW
SetWindowLongW
ShowWindow
SetTimer
GetDesktopWindow
DialogBoxParamW
UpdateWindow
SetActiveWindow
GetDlgItem
EndDialog
SetWindowTextW
SystemParametersInfoW
LoadCursorW
GetParent
GetWindowRect
SetWindowPos
GetSysColorBrush
GetSysColor
GetWindowTextW
ChildWindowFromPoint
SetCursor
UnregisterClassW
GetPropW
RemovePropW
SetPropW
DefWindowProcW
MessageBoxW
DestroyWindow
CreateDialogParamW
GetSystemMetrics
SetDlgItemInt
GetDlgItemTextW

comctl32

ImageList_Create
ImageList_ReplaceIcon
ord17
ord413
ord16

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW
ShellExecuteExW

ole32

CoInitializeEx

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

SHGetValueW

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/vrtaucbl.sys
.sys windows:6 windows x86 arch:x86

6269f0ba1f2ab5b934b8c93acc7c6685

Code Sign

33:00:00:00:56:35:88:7e:de:18:82:ef:76:00:00:00:00:00:56
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:c0:45:51:1e:eb:e9:fc:05:26:dd:a5:18:18:9e:c2:eb:6d:6a:30:bb:b0:75:83:a7:80:3a:4a:74:99:02:f4
Signer

Actual PE Digest

76:c0:45:51:1e:eb:e9:fc:05:26:dd:a5:18:18:9e:c2:eb:6d:6a:30:bb:b0:75:83:a7:80:3a:4a:74:99:02:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vrtaucbl.pdb

Imports

ntoskrnl.exe

MmFreePagesFromMdl
MmUnmapLockedPages
wcschr
IoGetCurrentProcess
memset
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdl
KeInitializeEvent
KeWaitForSingleObject
RtlFreeUnicodeString
IoRegisterDeviceInterface
ZwClose
IoSetDeviceInterfaceState
wcsncpy
_wcsnicmp
srand
IofCompleteRequest
ProbeForRead
ProbeForWrite
wcsrchr
MmGetSystemRoutineAddress
InterlockedExchange
IoReleaseCancelSpinLock
ObfDereferenceObject
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoOpenDeviceInterfaceRegistryKey
KeCancelTimer
ExSetTimerResolution
RtlCompareUnicodeString
ExFreePool
KeSetEvent
KeInitializeDpc
KeInitializeTimerEx
RtlFillMemory
_wcsicmp
wcsncmp
KeWaitForMultipleObjects
RtlZeroMemory
KeQueryPriorityThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitUnicodeString
RtlUnwind
KeSetSystemAffinityThread
PsInitialSystemProcess
PsGetCurrentProcessId
MmGetPhysicalAddress
PsGetCurrentThreadId
ZwQueryInformationProcess
ZwQuerySystemInformation
MmUnmapViewInSystemSpace
MmMapViewOfSection
MmUnmapViewOfSection
MmMapViewInSystemSpace
MmCreateSection
KdDebuggerEnabled
KeNumberProcessors
ExFreePoolWithTag
ExAllocatePool
KeBugCheckEx
KeClearEvent
memcpy
KeQueryInterruptTime
RtlMoveMemory
KeInitializeMutex
KeReleaseMutex
KeSetTimer
KeGetCurrentThread
RtlGetVersion

hal

KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KeQueryPerformanceCounter

portcls.sys

PcNewServiceGroup
PcRegisterPhysicalConnection
PcNewPort
PcRegisterSubdevice
PcInitializeAdapterDriver
PcAddAdapterDevice
PcDispatchIrp
PcRegisterAdapterPowerManagement

ks.sys

KsAcquireResetValue
KsProbeStreamIrp

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 161B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

349ba42284e937844d25d35c30786a3a

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

72:68:5e:4c:cd:1f:bf:97:26:23:e2:59:a1:e6:c2:96:7a:3d:31:6c:ef:9d:9e:7b:1e:74:fe:60:51:89:f9:9aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

ole32

shell32

shlwapi

setupapi

psapi

rpcrt4

Sections

.text Size: 106KB - Virtual size: 106KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

0cdadabf4a98616b7836303e269dd066

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

a9:76:7b:ae:45:4d:cd:c5:27:77:1c:8b:0f:be:07:74:a3:f9:19:51:20:4f:67:2d:81:fc:95:fc:cd:24:31:00Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

ole32

shell32

shlwapi

setupapi

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

72:68:5e:4c:cd:1f:bf:97:26:23:e2:59:a1:e6:c2:96:7a:3d:31:6c:ef:9d:9e:7b:1e:74:fe:60:51:89:f9:9a
Signer

.text
Size: 106KB - Virtual size: 106KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

a9:76:7b:ae:45:4d:cd:c5:27:77:1c:8b:0f:be:07:74:a3:f9:19:51:20:4f:67:2d:81:fc:95:fc:cd:24:31:00
Signer

.text
Size: 126KB - Virtual size: 125KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 654B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

51:0c:71:47:fa:96:24:fb:16:60:8c:1d:d4:6f:2d:cd:50:91:bb:16:29:78:f2:36:c9:12:55:92:f1:b7:f9:54
Signer

.text
Size: 71KB - Virtual size: 71KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 1024B - Virtual size: 642B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate