8dabe8af434fe110d74ca365ed3eeef33001aa26f1487afeb1a6f5d59e7e544c
- SHA256 8dabe8af434fe110d74ca365ed3eeef33001aa26f1487afeb1a6f5d59e7e544c
Overview
overview
10Static
static
10VDX.exe
windows7-x64
3VDX.exe
windows10-2004-x64
3VDX_x64.exe
windows7-x64
1VDX_x64.exe
windows10-2004-x64
1ViGEmBusDr...us.sys
windows10-2004-x64
1ViGEmBusDr...09.dll
windows7-x64
1ViGEmBusDr...09.dll
windows10-2004-x64
1ViGEmBusDr...us.sys
windows10-2004-x64
1ViGEmBusDr...09.dll
windows7-x64
3ViGEmBusDr...09.dll
windows10-2004-x64
3Carpetas d...ce.exe
windows7-x64
3Carpetas d...ce.exe
windows10-2004-x64
3Carpetas d...64.exe
windows7-x64
7Carpetas d...64.exe
windows10-2004-x64
1devcon.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
VDX.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
VDX.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
VDX_x64.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
VDX_x64.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.sys
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.sys
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Carpetas de Archivos/X360CE - 64 Bits/x360ce_x64.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Carpetas de Archivos/X360CE - 64 Bits/x360ce_x64.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
devcon.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 8dabe8af434fe110d74ca365ed3eeef33001aa26f1487afeb1a6f5d59e7e544c
- Size 5.3MB
- Sample240802-m5hlcswamn
- SHA256 8dabe8af434fe110d74ca365ed3eeef33001aa26f1487afeb1a6f5d59e7e544c
- MD5 13a8c7f593762d7d05d025358550367b
- SHA1 9bb7b8bafda58ea1f144eca202b26a8b4d939904
- SHA512 0492b3fd2cbf11f5a0b4630c985a55abcee0ce649089da22d81a35747cb8f45113c19713480f9cc3dda3d21048f985c1c523d29322919bdcf674cc3282843a65
- SSDEEP 98304:GuGNSE1YoL/GizoQO1iL54S3Fo2d+06CX4LBkWafq8oLPN/livrnD9GAs:X49yUGizoFi5d3Fov1+WeqjPN/+Fs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detected Ploutus loader 1 IoCs
resource yara_rule static1/unpack001/Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe family_ploutus - Ploutus family
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack002/VDX.exe unpack002/VDX_x64.exe unpack003/ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll unpack003/ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll unpack004/devcon.exe
File Explorer
-
8dabe8af434fe110d74ca365ed3eeef33001aa26f1487afeb1a6f5d59e7e544c.rar 5.3MB
-
Carpetas de Archivos/Comandos.txt121B
-
Carpetas de Archivos/VDX_v1.14.3.0_x64_x86_GPDWinEdition.zip.zip 578KB
-
VDX.exe.exe 571KB
-
VDX_x64.exe.exe 614KB
-
Carpetas de Archivos/ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0.zip.zip 3.0MB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.inf1KB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.sys.sys 52KB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll.dll 1.7MB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/vigembus.cat11KB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.inf1KB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.sys.sys 47KB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll.dll 1.4MB
-
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/vigembus.cat10KB
-
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe.exe 2.8MB
-
Carpetas de Archivos/X360CE - 64 Bits/x360ce_x64.exe.exe 2.8MB
-
Carpetas de Archivos/devcon.rar.rar 22KB
-
devcon.exe.exe 80KB
Carpetas de Archivos/Comandos.txt
- SHA256 aa0b4ba0f4396ad7ce5b9d5fdd2b9a8d0a9687733f6fa604cc36317b192339f0
- MD5 23a642874a79a5c48b5e138dc487484b
- SHA1 4d32e2981dc272139e74ba0e30a812d9fe6f9259
- SHA512 82f3dde291d2fd404a6b4e4af512c5799c4807e00bfdfb9a977bcb429e796ffcd5619b8e06ce3b1bbbe697e95ae9fcadd872bc5b1067ef4899de32bc3be04774
- MD5 SHA1 SHA512
Carpetas de Archivos/VDX_v1.14.3.0_x64_x86_GPDWinEdition.zip
- SHA256 4f1b7fe766b1b7f858a5bba5f76db62c9232031e65f7f8c3b7d80eb49ab3bc8b
- MD5 7b4975627f69de1970615f4fd8f6b13a
- SHA1 c5c4db10d0321fbbc16d0dbd68bab3e317a5be7a
- SHA512 48196091385e85eb53ec870d761a1f9fd1e84d3f2e93cc21823684c6ea0c6d4c39da3c5244a791469858d0e5fceff39f9640bb5a4076a8f2793b7aa5fc336f6a
- SSDEEP 12288:4H2tFDPyBC32eiVjoA2VUi/8nOkg08CdZW3sfxckF9MRdagHK74Rt5aB:44eBCGb0T2i8lNdZAAZAdagqsRtY
- MD5 SHA1 SHA512 SSDEEP
VDX.exe
- IMPHASH 0d7ce138016621680564e7a239ed04b9
- SHA256 d955ff9b4109095f65858989c68c226305d25e6148f63fecd10a850503fd0e17
- MD5 0ec433ebd5142b440a974b4872a1d1bd
- SHA1 92a802eb6db2cab4cd1d97000fb05d8d99c44a3c
- SHA512 ac68a264d4ccc198bcd2c96b45147eeafeb9b2274ef62522d55ddb96446a19d45bf4379ce9934212c3160602945a3a251fb709249aaf143dcf05c8df27403e7a
- SSDEEP 6144:48dOj0l/h2gzKtTFg6ICZgzEQ6+F1h3ZmkDiRFzD9Mxu32RFYKvq2MZ12cPz+P8:xOwlp2gz4Rg6LZ/+h3ZVit32RaKvgy8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
286432
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Development\C\ViGEm\Release\VDX.pdb
opengl32
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glIsEnabled
glGetString
glGetError
glClearColor
glClear
glTexSubImage2D
glGenTextures
glDeleteTextures
glTexParameteri
wglShareLists
glLoadMatrixf
glGetIntegerv
glFlush
glPushAttrib
glOrtho
glDisable
glViewport
glDrawElements
glColorPointer
glTexCoordPointer
glLoadIdentity
glBlendFunc
glMatrixMode
glScissor
glEnable
glVertexPointer
glBindTexture
glPopAttrib
glEnableClientState
glTexImage2D
winmm
joyGetDevCapsW
joyGetPosEx
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
gdi32
GetDeviceCaps
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
kernel32
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetVersion
QueryPerformanceFrequency
QueryPerformanceCounter
LocalFree
UnhandledExceptionFilter
FormatMessageW
GetModuleHandleW
GetModuleHandleA
GetLastError
GetProcAddress
LoadLibraryW
GlobalUnlock
GlobalLock
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
CreateEventW
CreateFileW
DeviceIoControl
SetUnhandledExceptionFilter
FreeLibrary
GetOverlappedResult
InitializeCriticalSection
GlobalAlloc
user32
GetWindowLongW
MapWindowPoints
ClipCursor
SetCursor
AdjustWindowRect
GetWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
SetWindowPos
FlashWindowEx
CreateWindowExW
UnregisterClassW
RegisterClassW
CallWindowProcW
DefWindowProcW
PeekMessageW
LoadCursorW
TranslateMessage
TrackMouseEvent
ReleaseDC
GetDC
ShowWindow
DestroyWindow
CreateWindowExA
SetWindowLongW
ScreenToClient
GetCursorPos
CreateIcon
DestroyIcon
LoadIconW
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
SendMessageW
MessageBoxW
GetAsyncKeyState
GetSystemMetrics
GetWindowThreadProcessId
ChangeDisplaySettingsW
DispatchMessageW
EnumDisplaySettingsW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcp140
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?narrow@?$ctype@_W@std@@QBED_WD@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
imm32
ImmSetCompositionWindow
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__std_exception_destroy
__std_exception_copy
_purecall
memset
memcpy
_CxxThrowException
strchr
strstr
memmove
__std_terminate
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fflush
fclose
feof
__p__commode
fwrite
_set_fmode
ferror
ftell
fseek
__stdio_common_vfprintf
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_invalid_parameter_noinfo_noreturn
terminate
_controlfp_s
api-ms-win-crt-math-l1-1-0
floor
_CIfmod
_except1
_libm_sse2_sin_precise
ceil
_libm_sse2_sqrt_precise
__setusermatherr
_libm_sse2_cos_precise
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
187KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=25810,
count=13, id=260, version=25810,
count=4, id=257, version=25810,
count=31, id=261, version=25810,
count=24, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=19, id=257, version=25203,
count=343, id=1, productName=Unmarked objects,
count=46, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=6, id=265, version=25831,
count=1, id=255, productName=VS2017 v15.5.2 build 25831, version=25831,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.5.2 build 25831, version=25831,
VDX_x64.exe
- IMPHASH ab36660eb81868c81197eadbcdc9178e
- SHA256 b39ceac62b08091d06811de9ba3542ffaca6e45fef79e918a4c24fdb2dcdbb6c
- MD5 21f0b42cdba178b58450899574380b18
- SHA1 189f0f6e23203575b8f59b8f74312605fc7197b7
- SHA512 d08e92a7d391250b74d6297c8c157c77279c17a605b3687c0f15d13a8a94f99ef17373216840de1e936ce621162645500202a1179a62269d9c5209d7dfffe5af
- SSDEEP 12288:klF0z4l8BnZ6V2JnPei7JfnmuN3xoI9Yq0gKvgy:klFuZ6V6nWi7JfnmuN3p990ho
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
281508
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Development\C\ViGEm\x64\Release\VDX_x64.pdb
opengl32
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglCreateContext
glIsEnabled
glGetString
glGetError
glClearColor
glClear
glTexSubImage2D
glGenTextures
glDeleteTextures
glTexParameteri
wglShareLists
glLoadMatrixf
glGetIntegerv
glFlush
glPushAttrib
glOrtho
glDisable
glViewport
glDrawElements
glColorPointer
glTexCoordPointer
glLoadIdentity
glBlendFunc
glMatrixMode
glScissor
glEnable
glVertexPointer
glBindTexture
glPopAttrib
glEnableClientState
glTexImage2D
winmm
joyGetPosEx
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
joyGetDevCapsW
gdi32
GetDeviceCaps
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
kernel32
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
Sleep
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetVersion
RtlCaptureContext
QueryPerformanceCounter
LocalFree
FreeLibrary
FormatMessageW
GetModuleHandleW
GetModuleHandleA
GetLastError
GetProcAddress
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
CreateEventW
CreateFileW
DeviceIoControl
RtlLookupFunctionEntry
QueryPerformanceFrequency
GetOverlappedResult
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryW
user32
SetWindowLongPtrW
GetWindowLongPtrW
GetWindowLongW
MapWindowPoints
ClipCursor
SetCursor
AdjustWindowRect
GetWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
SetWindowPos
FlashWindowEx
CreateWindowExW
UnregisterClassW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetWindowThreadProcessId
DispatchMessageW
TranslateMessage
TrackMouseEvent
ReleaseDC
GetDC
ShowWindow
DestroyWindow
SetWindowLongW
EnumDisplaySettingsW
LoadCursorW
CreateIcon
LoadIconW
OpenClipboard
CloseClipboard
SendMessageW
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
GetAsyncKeyState
GetSystemMetrics
GetCursorPos
DestroyIcon
ScreenToClient
ChangeDisplaySettingsW
PeekMessageW
CreateWindowExA
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@_W@std@@QEBAD_WD@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
imm32
ImmSetCompositionWindow
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
memcmp
__std_exception_destroy
__std_exception_copy
_purecall
memset
memcpy
_CxxThrowException
strchr
strstr
memmove
__std_terminate
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-stdio-l1-1-0
fflush
__acrt_iob_func
ferror
fclose
fseek
feof
fwrite
__p__commode
_set_fmode
ftell
__stdio_common_vfprintf
_wfopen
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
exit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
sqrt
ceil
sqrtf
floor
fmodf
sinf
cosf
__setusermatherr
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
Name
.text
Size
288KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
187KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
764B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=259, version=25810,
count=13, id=260, version=25810,
count=4, id=257, version=25810,
count=30, id=261, version=25810,
count=24, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=19, id=257, version=25203,
count=350, id=1, productName=Unmarked objects,
count=46, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=6, id=265, version=25831,
count=1, id=255, productName=VS2017 v15.5.2 build 25831, version=25831,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.5.2 build 25831, version=25831,
Carpetas de Archivos/ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0.zip
- SHA256 cbb6b0a9477b28fa5084d6897d6ea5b6cc9f5b2e442a5336a2b5cf583f3f6a80
- MD5 2e07721b6aee22e4cd4bfa0edb05c7ee
- SHA1 3bdcb2bdfe64240f3a57f71366aafd86c0d39ab4
- SHA512 5388d0b5046638083d3183b547c639947f4b4480e41044056fab90237f21f25d2e25bfa4aff4b20a920afc7d3bfe60e40dd418fff93420f4d38403bd0e0590f8
- SSDEEP 49152:+Aym8Xnprqw9z3YQaB1wXBL54qGOKaAMo2d2B1zo6fZoSjiX8XTfBoHWOfbfSYk:0/GizoQO1iL54S3Fo2d+06CX4LBkWafY
- MD5 SHA1 SHA512 SSDEEP
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.inf
- SHA256 e59b63c954577f3669dca610d9f4b6646421ee7bf51426b5262f8a93fa52ac87
- MD5 5ce31860fde25c806e953ab9fe96fc4a
- SHA1 d306aaf74fde33b2bc01b2d4d70d3704d796d07c
- SHA512 c28cd210401d3abbee6105fc9db05a1b2ab93567f380ed322df4a396eadaa478fc5610c059a1c08a3ee669e50c7ecdc45dfd32c0504847ab6d3a85f2eba23acf
- MD5 SHA1 SHA512
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.sys
- IMPHASH 9ab9f4fe017fb4cd073c7e7459a72428
- SHA256 cc2ee46d090e5fef4c87d13b370dca53b71c292186f845bb4afab5bc5539d1b4
- MD5 e4a203f7a9e7d8aa9bf00cc01d1aa9f9
- SHA1 f3ccd5cbbd7bcee4c6e18b543961a0e62f4fd1f2
- SHA512 eae943fbf2c20cb3ef4d0cd071996922e5b8506409190f1ddbb04f65001042b33368fd3691e575192b4530198ee2afe48cde281e877b41364aab3358b04e9b23
- SSDEEP 768:oDlFUmL5XjvV4r6YWQcVumZipPMJH0LpVnGXeGR5WFGcyWR13fM0jI2O33whGV:olt9TVoptM+9Vqea5WFGcyWR1EoHughw
- MD5 SHA1 SHA512 SSDEEP
Digest
66:97:04:44:bc:ee:ed:22:1c:a9:0c:f4:d0:7f:38:c5:bd:34:98:eb:5d:c4:bc:20:a0:76:63:6c:7e:b1:59:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Sep 3, 2017
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
PE Signature issue
Digest
66:97:04:44:bc:ee:ed:22:1c:a9:0c:f4:d0:7f:38:c5:bd:34:98:eb:5d:c4:bc:20:a0:76:63:6c:7e:b1:59:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 26, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 15, 2017 - May 9, 2018
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
52:b5:4b:4f:d5:c6:b3:02:8f:e4:35:1b
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 3, 2017 - Jan 4, 2020
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Development\C\ViGEm\x64\Release\ViGEmBus.pdb
ntoskrnl.exe
RtlAnsiCharToUnicodeChar
RtlRandomEx
RtlCopyUnicodeString
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentProcessId
KeBugCheckEx
RtlCompareMemory
hal
KeQueryPerformanceCounter
wdfldr.sys
WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=2, id=262, version=24610,
count=3, id=261, version=24610,
count=5, id=259, version=24610,
count=15, id=260, version=24610,
count=10, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll
- IMPHASH 70497fec79daa5f71de3b34faee686a5
- SHA256 289c93ccf3295ffdd546302a6688761f2c5f490c3b8240bde13696c242206258
- MD5 d394a3ae079564895ffac936c4b8f8cc
- SHA1 d008ed4c8aed6c2e1fd664ccfa4dd03a2bf7af73
- SHA512 197fca3bedebf124b2812352735b2de1a7e89fefa1b7263801d4d240ee1a251cd164fd4ada7db34f7aca41b7de4e5b65d11abfae732206d2f53bffff12971aa7
- SSDEEP 24576:wU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZW3:pFCsfZRZA6Xn388avVovfLd+Mo4iE3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
60084
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WdfCoInstaller01009.pdb
msvcrt
memset
memcpy
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_ultow
malloc
_wcsnicmp
free
_wtoi
_wcsicmp
_stricmp
_vsnwprintf
setupapi
SetupDiSetDeviceInstallParamsW
SetupCloseLog
SetupOpenInfFileW
SetupCloseInfFile
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupLogErrorW
SetupOpenLog
SetupDiGetActualSectionToInstallW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupDiGetDriverInfoDetailW
kernel32
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
LoadLibraryExW
ExpandEnvironmentStringsW
GetFileInformationByHandle
DeleteFileW
CloseHandle
FindNextFileW
RemoveDirectoryW
LockResource
GetLocalTime
FindClose
SetLastError
CreateFileW
FileTimeToSystemTime
TerminateProcess
GetExitCodeProcess
FormatMessageW
SizeofResource
WriteFile
OutputDebugStringW
WaitForSingleObject
CreateDirectoryW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
LoadLibraryW
WideCharToMultiByte
FreeLibrary
lstrlenA
LocalFree
GetWindowsDirectoryW
LocalAlloc
GlobalFree
GetProcAddress
GetLastError
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask
advapi32
DeleteService
OpenSCManagerW
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
crypt32
CertGetCertificateContextProperty
wintrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
shell32
CommandLineToArgvW
user32
LoadStringW
IsCharAlphaNumericW
IsCharAlphaW
ole32
CoTaskMemFree
WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/vigembus.cat
- SHA256 7269dfefb9d5c3a1876254caf038e69e04ffd201b174b1baa29de9485ac0bbb8
- MD5 339a567e6515a47edecbdaf040b7f0dd
- SHA1 141082c734ead76fd9756cdb35878e3ca342f307
- SHA512 0d8a7eeed7e6429600d7f4968cfdfe0615a6ec2a59edf5759a69e236c3ec9c2882427602080ca01732caa8d0765522785e8ae30ebc6531b531e9df7e6b6a41e1
- SSDEEP 192:vIpqoMQMGl7UKazgsxxmmKri9iHMyMLowH0JOqNG8Fp28Wh8n4nL:sMQM1K2XYmK+9TU5JNNzFwhhiIL
- MD5 SHA1 SHA512 SSDEEP
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.inf
- SHA256 2681e5edb0d49b556b1bc795daa4434ff8da7f7c6bc41494ad952010b9bf7152
- MD5 93c8fd5c4dc312dd336f33fa5fc0e910
- SHA1 fa8bf413566eeeaf07e80d3a42ea8a6d2d18d6f5
- SHA512 7aa632090e323deeca6a157bb714b4d37d95b21fe37361df6bc2f6d386da8d722df64736429dca92921c22a160ebd1a8632ee02d377a14c44f22bdc2f70af0cf
- MD5 SHA1 SHA512
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.sys
- IMPHASH 9ab9f4fe017fb4cd073c7e7459a72428
- SHA256 7acbf5c201a565122d06b9f9725720f745fb9cb309b73b633b7a97efee69cea6
- MD5 3dc219a6184096ad4dca69aee0012ab3
- SHA1 56d232daad01982fc53f42567fcc5a2cfc34cf93
- SHA512 9c07895382d5496176343d4b83c6f2369ed2b1c43ac915aedea3e2ac4bbeb26b25e065e04bbd9bcd52bfbbc02c59c5a233f9cc5d4a7c4ed0f2b515f57dcb869b
- SSDEEP 768:KrIXKjBN4rm/dcSKIcyleyLJGcyixAR13tqHBaMI2OYc3wheZ:KrCK1Grm0ylVLJGcypR1MFH8gheZ
- MD5 SHA1 SHA512 SSDEEP
Digest
5c:56:ab:61:d5:fe:f1:26:0b:97:e5:d8:99:e6:51:b9:9b:35:cf:64:bb:db:ce:4d:f7:da:fd:b2:e8:c2:24:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Sep 3, 2017
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
PE Signature issue
Digest
5c:56:ab:61:d5:fe:f1:26:0b:97:e5:d8:99:e6:51:b9:9b:35:cf:64:bb:db:ce:4d:f7:da:fd:b2:e8:c2:24:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 26, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 15, 2017 - May 9, 2018
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=457000i,CN=Wohlfeil.IT e.U.,O=Wohlfeil.IT e.U.,STREET=Westbahnstrasse 28,L=Linz,ST=Oberoesterreich,C=AT,1.3.6.1.4.1.311.60.2.1.1=#13044c696e7a,1.3.6.1.4.1.311.60.2.1.2=#130f4f6265726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
52:b5:4b:4f:d5:c6:b3:02:8f:e4:35:1b
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 3, 2017 - Jan 4, 2020
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
0
Major OS version
10
Entry point
4381
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Development\C\ViGEm\Release\ViGEmBus.pdb
ntoskrnl.exe
RtlAnsiCharToUnicodeChar
RtlRandomEx
RtlCopyUnicodeString
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentProcessId
KeBugCheckEx
RtlCompareMemory
hal
KeQueryPerformanceCounter
wdfldr.sys
WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=2, id=262, version=24610,
count=3, id=261, version=24610,
count=3, id=259, version=24610,
count=15, id=260, version=24610,
count=10, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll
- IMPHASH a17af54bf9d379152b9c377204b35eb9
- SHA256 31a38dd8d49eab4ac7eea4cb1d7930b0984bf780f0ab6d0576f40150842ef5bf
- MD5 cde6594380b7f27a109c274a51f86772
- SHA1 06ad9d024c25b58a5e88bec8b3f93e98b01a4d37
- SHA512 75b9e6910a397e66a32d80eb00a16bc058a49ad984b06e1bd945b089780e65775f74bf5d508b63cd21e299559c866eed3e2f405d04477518971a000212389552
- SSDEEP 24576:djG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRAl1:BGtN2h1120R7m4XShYVxfBwrC21fXSN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
56899
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WdfCoInstaller01009.pdb
msvcrt
_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf
setupapi
SetupCloseInfFile
SetupOpenInfFileW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
kernel32
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetWindowsDirectoryW
LocalAlloc
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree
advapi32
OpenSCManagerW
ChangeServiceConfigW
QueryServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
DeleteService
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey
crypt32
CertGetCertificateContextProperty
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
shell32
CommandLineToArgvW
user32
IsCharAlphaW
IsCharAlphaNumericW
LoadStringW
ole32
CoTaskMemFree
WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=170, id=1, productName=Unmarked objects,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=70, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/vigembus.cat
- SHA256 42c3332efd7a3b6862ff4ff56d027cf729897047e5a4a717dac29de3e87f81cd
- MD5 8b256522abf03790f9610a280442dd58
- SHA1 3c45eed98538a4285fe7bd5d4bcd4cc36dc42cd4
- SHA512 cf3f5d240c921dc38f21bfd909b8ba2589d7a0eaf795e3896d8f6c40e45cb060fe72bc1a2b3c501a9c6874bc2e17ac5c3b3323f7647b1c38ffe541d852021f6c
- SSDEEP 192:c84IojFMQMGl7UKazgsxxmmKri9iHMyMXoRwH0JOqNG8Fp28Wh8n2kVe:puFMQM1K2XYmK+9T65JNNzFwhhi2ae
- MD5 SHA1 SHA512 SSDEEP
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f54deb01f98614fd94eb2954e0c909b2518370d4286767cd265f77f6588bff9b
- MD5 04ae76f89c99b8a225771f3702b1c858
- SHA1 aff34cd0c77243e54b57ed2a55213159effb1f0e
- SHA512 985dad2372edf283e5c8068ee5c315b0e31f03bfe909a773cab31ceb1064308148f299008db488984853ca46fafdfe15abd1b2624ead8942425eb027737869e9
- SSDEEP 49152:ol7PbfJJb4/WGhvbBJJb4/WGmJJb4/WGi0wr+CTZtvwZOP7UCqEJJK4//Gz:oVPXbbGNRbbGubbGiBr+AK+Gz
- MD5 SHA1 SHA512 SSDEEP
-
Detected Ploutus loader
PE Signature issue
Digest
c0:50:05:82:1d:e3:04:e7:0c:b6:00:ff:20:ca:91:ae:b2:c1:54:f0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d
Chains
Oct 4, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2011 - Sep 20, 2026
Subject
CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d
Serial Number
1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9
Issuer
CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature, KeyUsageKeyEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 5, 2013 - Dec 5, 2015
Minor OS version
0
Major OS version
4
Entry point
2801186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\TocaEdit\x360ce.App\obj\x86\Debug\x360ce.pdb
mscoree
_CorExeMain
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Carpetas de Archivos/X360CE - 64 Bits/x360ce_x64.exe
- SHA256 b19cd47bdbdc061adef78ac0b624c9c3602bec8806a4541f67d0db08116766bb
- MD5 37793bbd313cfbc6b37054be4e2d6e32
- SHA1 67e4965c019f23847d20fa2e4cc3f9687d0d23de
- SHA512 6f91ebad942e25bcefdf0bdc1d2857ed8fb439f0709702ca5ca2bfa27734c889fa1caaad6c4da8935a86e3293a678a933025579f4209ad22ae618f5bb0c90578
- SSDEEP 49152:IhnPbfJJb4/WG/UbRJJb4/WGmJJb4/WGi0wr+CTZtOTQOYG7UCq3JJK4//GB:IVPXbbGshbbGubbGiBr+4NK+GB
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
93:15:9e:99:c2:3f:40:9b:87:52:48:4f:bd:b7:0d:6b:8e:3f:d6:94
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d
Chains
Oct 4, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2011 - Sep 20, 2026
Subject
CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d
Serial Number
1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9
Issuer
CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature, KeyUsageKeyEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 5, 2013 - Dec 5, 2015
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\TocaEdit\x360ce.App\obj\x64\Debug\x360ce.pdb
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Carpetas de Archivos/devcon.rar
- SHA256 dfe459f6590c7d561af7949fb88b4c9c76af00df2e53169105670f053ecc9517
- MD5 9f7e510a5527724ce499e65977d35269
- SHA1 41676b00113576be61a24b72e4107eeb5af2b5f7
- SHA512 b849d3618b8185022d35670186318752a9cd10d155930b620c3c0a6bda5a0329630d54089f51a30f04769b3e2f7edffe1d8481a7f57b5974060a3f1c07b8de2c
- SSDEEP 384:dB2JRWgpBEKSvxK/dFUQOUoExAFnYr0A76zC+cgHJ4k50nWN7qzm4:fqrBEt0/jTx6nW0DzC+dV0WJKh
- MD5 SHA1 SHA512 SSDEEP
devcon.exe
- IMPHASH 0baa2d4e550dc24f554ab947efabf698
- SHA256 6cdf9a5c39fc9e765cd7232bdb6aeaa3d2811bcbbf6875c4decc5d6c8bf308ea
- MD5 2f429a7437b47ee774f9c7318b99aa0c
- SHA1 0d130f602b69e533b75bc0b5ae6c735b3e7b1d1a
- SHA512 354abdf9d156636361665232abc2cae3eac731c3f50345804ab26aee619cb27c7e24b7493722e36e19df0bac122691e08db86753842c627a6b6325d26e22a407
- SSDEEP 1536:sGdmm1zdwlinYnyxH0GSrFc5VfkuF4O7Wf:sGdsqZxM5cXkoRW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
devcon.pdb
advapi32
RegQueryValueExW
InitiateSystemShutdownExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenServiceW
RegDeleteValueW
RegSetValueExW
OpenSCManagerW
CloseServiceHandle
kernel32
GetCurrentProcess
lstrlenW
FormatMessageW
GetLastError
CloseHandle
LocalFree
FileTimeToSystemTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetDateFormatW
FindFirstFileW
GetFullPathNameW
FindNextFileW
FindClose
GetFileAttributesW
GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
msvcrt
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset
__iob_func
_initterm
_XcptFilter
free
_callnewh
malloc
wprintf
towupper
wcsrchr
_wcsnicmp
fputs
wcschr
iswalpha
fputws
_wcsicmp
towlower
ole32
CLSIDFromString
setupapi
SetupDiClassNameFromGuidExW
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
CM_Connect_MachineW
SetupDiSetClassInstallParamsW
CM_Locate_DevNode_ExW
CM_Disconnect_Machine
CM_Reenumerate_DevNode_Ex
SetupDiSetDeviceRegistryPropertyW
SetupDiBuildClassInfoListExW
SetupDiCreateDeviceInfoW
SetupDiGetDriverInstallParamsW
SetupDiOpenClassRegKeyExW
CM_Free_Log_Conf_Handle
SetupFindFirstLineW
SetupDiSetDeviceInstallParamsW
CM_Free_Res_Des_Handle
SetupOpenInfFileW
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameExW
CM_Get_Device_ID_ExW
SetupDiGetClassDevsExW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupScanFileQueueW
SetupDiGetClassDescriptionExW
SetupOpenFileQueue
CM_Get_Next_Res_Des_Ex
CM_Get_DevNode_Status_Ex
SetupCloseInfFile
CM_Get_Res_Des_Data_Ex
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupCloseFileQueue
SetupDiGetDeviceInstallParamsW
SetupDiEnumDriverInfoW
SetupDiSetSelectedDriverW
CM_Get_First_Log_Conf_Ex
SetupDiGetDriverInfoDetailW
CM_Get_Res_Des_Data_Size_Ex
SetupDiBuildDriverInfoList
SetupGetStringFieldW
SetupDiCallClassInstaller
user32
CharPrevW
CharNextW
LoadStringW
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=23917,
count=18, id=260, version=23917,
count=4, id=261, version=23917,
count=13, id=257, version=23917,
count=124, id=1, productName=Unmarked objects,
count=3, id=265, version=23917,
count=1, id=255, version=23917,
count=1, id=258, version=23917,