Realtek RTL8188FTV Wireless LAN 802[.]11n USB 2[.]0 Network Adapter Driver[.]iso

Resubmissions

12-10-2024 17:12

241012-vq8g8swcpm 7

12-10-2024 16:31

241012-t1vtfsthnm 3

Sharing

Copy URL

Twitter E-mail

General

Target

Realtek RTL8188FTV Wireless LAN 802.11n USB 2.0 Network Adapter Driver.iso
Size

106.9MB
MD5

5d41d31989031fe2b9a59748e5794033
SHA1

14c3c57b189ca5d04e2b47fa63a2ef89169b18b9
SHA256

679e6deb1db26875ce535070cea846796bebc99c0817be8785e9465ee5f3be22
SHA512

afd6c43fe3da2d0270415d97c65b57e3628fb0af5adf75c02648b7ea2024a4a71ca8392f4866dc7499265dd090c05c3a5ed34cb931e1f9295217709d87c4bd59
SSDEEP

1572864:o2BAV+zMkDUZWQxsyzrY439kcUhThhFufadueEAGUFU4TUPQZLWDrnc:jR5GUFFIIo

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/IM/WINXP/32/TWOPORT/XPTWOPORT.sys
unpack002/IM/WINXP/64/TWOPORT/XPTWOPORT.sys
unpack002/ISSetup.dll

Files

Realtek RTL8188FTV Wireless LAN 802.11n USB 2.0 Network Adapter Driver.iso
.iso
out.iso
.iso
0x0402.ini
0x0403.ini
0x0404.ini
0x0405.ini
0x0406.ini
0x0407.ini
0x0408.ini
0x0409.ini
0x040a.ini
0x040b.ini
0x040c.ini
0x040e.ini
0x0410.ini
0x0411.ini
0x0412.ini
0x0413.ini
0x0414.ini
0x0415.ini
0x0416.ini
0x0418.ini
0x0419.ini
0x041a.ini
0x041b.ini
0x041d.ini
0x041e.ini
0x041f.ini
0x0421.ini
0x0424.ini
0x042d.ini
0x0804.ini
0x0816.ini
0x0c0c.ini
0x0c1a.ini
DATA/8188EU.ini
DATA/8192CU.ini
DATA/8192DU.ini
DATA/8192EU.ini
DATA/8723AU.ini
DATA/8723BU.ini
DATA/8723U.ini
DATA/8811AU.ini
DATA/8812AU.ini
DATA/8812AU_VX.ini
DATA/8814AU.ini
DATA/8821AU.ini
DATA/RtWLan.ico
DATA/RtlService.ini
DATA/Thumbs.db
DATA/TrayIcon.bmp
DATA/Vista/8188EU.ini
DATA/Vista/8192CU.ini
DATA/Vista/8192DU.ini
DATA/Vista/8192EU.ini
DATA/Vista/8723AU.ini
DATA/Vista/8723BU.ini
DATA/Vista/8811AU.ini
DATA/Vista/8812AU.ini
DATA/Vista/8812AU_VX.ini
DATA/Vista/8814AU.ini
DATA/Vista/8821AU.ini
DATA/WPS
DATA/Win10/8188EU.ini
DATA/Win10/8192CU.ini
DATA/Win10/8192DU.ini
DATA/Win10/8192EU.ini
DATA/Win10/8723AU.ini
DATA/Win10/8723BU.ini
DATA/Win10/8811AU.ini
DATA/Win10/8812AU.ini
DATA/Win10/8812AU_VX.ini
DATA/Win10/8814AU.ini
DATA/Win10/8821AU.ini
DATA/Win10/RtlService.ini
DATA/Win7/8188EU.ini
DATA/Win7/8192CU.ini
DATA/Win7/8192DU.ini
DATA/Win7/8192EU.ini
DATA/Win7/8723AU.ini
DATA/Win7/8723BU.ini
DATA/Win7/8811AU.ini
DATA/Win7/8812AU.ini
DATA/Win7/8812AU_VX.ini
DATA/Win7/8814AU.ini
DATA/Win7/8821AU.ini
DATA/Win7/RtlService.ini
DATA/Win8/8188EU.ini
DATA/Win8/8192CU.ini
DATA/Win8/8192DU.ini
DATA/Win8/8192EU.ini
DATA/Win8/8723AU.ini
DATA/Win8/8723BU.ini
DATA/Win8/8811AU.ini
DATA/Win8/8812AU.ini
DATA/Win8/8812AU_VX.ini
DATA/Win8/8814AU.ini
DATA/Win8/8821AU.ini
DATA/Win8/RtlService.ini
DATA/Win81/8188EU.ini
DATA/Win81/8192CU.ini
DATA/Win81/8192DU.ini
DATA/Win81/8192EU.ini
DATA/Win81/8723AU.ini
DATA/Win81/8723BU.ini
DATA/Win81/8811AU.ini
DATA/Win81/8812AU.ini
DATA/Win81/8812AU_VX.ini
DATA/Win81/8814AU.ini
DATA/Win81/8821AU.ini
DATA/Win81/RtlService.ini
DATA/background.jpg
.jpg
DATA/background2.jpg
.jpg
DATA/setup.ico
DATA/text.file
EAP/x64/EAP-FAST.msi
.msi
EAP/x64/EAP-LEAP.msi
.msi
EAP/x64/EAP-PEAP.msi
.msi
EAP/x86/EAP-FAST.msi
.msi
EAP/x86/EAP-LEAP.msi
.msi
EAP/x86/EAP-PEAP.msi
.msi
IHV/X64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IHV/X86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IM/WINXP/32/TWOPORT/XPTWOPORT.INF
IM/WINXP/32/TWOPORT/XPTWOPORT.sys
.sys windows:6 windows x86 arch:x86

55a4f81470875775cc73de399276eb6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\realtek\wlan_code\twoportimdrv\xp\objfre_wxp_x86\i386\XPTWOPORT.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
KeTickCount
RtlUpcaseUnicodeString
MmMapLockedPagesSpecifyCache
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy

hal

KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisCloseAdapter
NdisOpenAdapter
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisIMInitializeDeviceInstanceEx
NdisInitializeReadWriteLock
NdisOpenProtocolConfiguration
NdisResetEvent
NdisMIndicateStatusComplete
NdisReturnPackets
NdisFreePacket
NdisAllocatePacket
NdisRequest
NdisReleaseReadWriteLock
NdisAcquireReadWriteLock
NdisCancelSendPackets
NdisIMDeregisterLayeredMiniport
NdisDeregisterProtocol
NdisSetEvent
NdisMSetAttributesEx
NdisCloseConfiguration
NdisReadConfiguration
NdisReadNetworkAddress
NdisOpenConfiguration
NdisIMGetDeviceContext
NdisIMCopySendPerPacketInfo
NdisMIndicateStatus
NdisMSleep
NdisMDeregisterDevice
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisFreeMemory
NdisIMCopySendCompletePerPacketInfo
NdisDprAllocatePacket
NdisFreePacketPool
NdisAllocateMemoryWithTag
NdisWaitEvent
NdisInitializeEvent
NdisGetReceivedPacket
NdisAllocatePacketPoolEx

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 768B - Virtual size: 690B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IM/WINXP/32/TWOPORT/XPTWOPORT_MP.INF
IM/WINXP/32/TWOPORT/xptwoport.cat
IM/WINXP/64/TWOPORT/XPTWOPORT.INF
IM/WINXP/64/TWOPORT/XPTWOPORT.sys
.sys windows:6 windows x64 arch:x64

ef98bfbce84b22ba4e18405658c2855e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\realtek\wlan_code\twoportimdrv\xp64\objfre_wnet_amd64\amd64\XPTWOPORT.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
RtlUpcaseUnicodeString
MmMapLockedPagesSpecifyCache
IofCompleteRequest
RtlInitUnicodeString
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc

ndis.sys

NdisIMDeregisterLayeredMiniport
NdisOpenProtocolConfiguration
NdisIMDeInitializeDeviceInstance
NdisIMCancelInitializeDeviceInstance
NdisFreePacketPool
NdisAllocatePacketPoolEx
NdisIMInitializeDeviceInstanceEx
NdisDprAllocatePacket
NdisIMGetDeviceContext
NdisOpenConfiguration
NdisReadNetworkAddress
NdisReadConfiguration
NdisCloseConfiguration
NdisMSetAttributesEx
NdisSetEvent
NdisAllocatePacket
NdisIMCopySendPerPacketInfo
NdisFreePacket
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisReturnPackets
NdisMSleep
NdisRequest
NdisAcquireReadWriteLock
NdisReleaseReadWriteLock
NdisCancelSendPackets
NdisDeregisterProtocol
NdisInitializeWrapper
NdisIMRegisterLayeredMiniport
NdisMRegisterUnloadHandler
NdisRegisterProtocol
NdisIMAssociateMiniport
NdisTerminateWrapper
NdisMRegisterDevice
NdisMDeregisterDevice
NdisAllocateMemoryWithTag
NdisInitializeEvent
NdisInitializeReadWriteLock
NdisOpenAdapter
NdisWaitEvent
NdisResetEvent
NdisCloseAdapter
NdisFreeMemory
NdisIMCopySendCompletePerPacketInfo
NdisGetReceivedPacket

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IM/WINXP/64/TWOPORT/XPTWOPORT_MP.INF
IM/WINXP/64/TWOPORT/xptwoport.cat
ISLangUni.ini
ISSetup.dll
.dll regsvr32 windows:6 windows x86 arch:x86

af93d22cb4944e6dc29e33177a19eda0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rpcrt4

UuidCreate

winmm

sndPlaySoundW

user32

DestroyWindow

gdi32

CreatePalette

advapi32

IsValidSecurityDescriptor

shell32

SHGetFolderPathW

ole32

CoCreateInstance

oleaut32

GetErrorInfo

shlwapi

SHStrDupW

version

VerQueryValueW

gdiplus

GdipDeleteGraphics

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProductSKU
GetScriptEngine
InstallEngineTypelib
RemoveEngineTypelib
SuiteIsFeatureInstalled
SuiteStartupInstall

Sections

.text
Size: 640KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Install.bat
IsConfig.ini
RTWLANU_Driver/VistaX64/RtlExtUI.dll
.dll regsvr32 windows:6 windows x64 arch:x64

2bf7f4adb8ae5e2b654042681a7120d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40
Signer

Actual PE Digest

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40

Digest Algorithm

sha256

PE Digest Matches

true

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2
Signer

Actual PE Digest

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_amd64\amd64\RtlExtUI.pdb

Imports

msvcrt

fflush
vsprintf_s
strcat_s
_fsopen
??3@YAXPEAX@Z
fclose
fputs
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcschr
wcstoul
_wtoi
_wcsnicmp
_itow_s
??2@YAPEAX_K@Z
_vsnprintf_s
wcsncpy_s
_vsnwprintf
_purecall
free
malloc
_vsnprintf
strncmp
strcpy_s
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
memset
sprintf_s
swprintf_s
memcpy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString

user32

IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
MessageBoxA
EnableWindow
GetDialogBaseUnits
GetPropW
SetWindowTextW
GetDlgItemTextA
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItem
ReleaseDC
GetDC
SetPropW
CallNextHookEx
GetParent
PostMessageW
RemovePropW
DestroyWindow
GetWindowTextW
GetWindowTextA
SetWindowTextA
SendMessageW

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
Sleep
CreateFileMappingW
GetLastError
FileTimeToSystemTime
GetDateFormatA
UnmapViewOfFile
MapViewOfFile
CreateFileA
VerifyVersionInfoW
MultiByteToWideChar
VerSetConditionMask
CloseHandle
GetLocalTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateMutexW
GetSystemTime
ReleaseMutex
OutputDebugStringA
GetCurrentThreadId
WaitForSingleObject

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegSetValueExW
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

comctl32

CreatePropertySheetPageW

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertCompareCertificateName
CertGetNameStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord626
ord2846
ord1040
ord1812
ord4557

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f
Signer

Actual PE Digest

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f

Digest Algorithm

sha256

PE Digest Matches

true

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX64/netrtwlanu.cat
RTWLANU_Driver/VistaX64/netrtwlanu_Vista.inf
RTWLANU_Driver/VistaX64/rtlCoInst.dat
RTWLANU_Driver/VistaX64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX64/rtwlanu_Vista.sys
.sys windows:6 windows x64 arch:x64

1dcd8512f3b95e029679a795a46dcde1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:bb:20:7d:ab:85:a4:96:3c:a8:53:87:25:fb:6b:2e:07:5f:4b:e3:06:62:f0:6a:ab:27:b5:80:81:16:31:79
Signer

Actual PE Digest

b6:bb:20:7d:ab:85:a4:96:3c:a8:53:87:25:fb:6b:2e:07:5f:4b:e3:06:62:f0:6a:ab:27:b5:80:81:16:31:79

Digest Algorithm

sha256

PE Digest Matches

true

27:b4:9e:f0:d6:56:4d:ad:24:76:30:ae:31:e6:49:23:46:04:4e:d5
Signer

Actual PE Digest

27:b4:9e:f0:d6:56:4d:ad:24:76:30:ae:31:e6:49:23:46:04:4e:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\windows_server\v1030.6\platform\ndis6\usb\objfre_wlh_amd64\amd64\rtwlanu.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
RtlCopyUnicodeString
KeFlushQueuedDpcs
DbgPrint
KeBugCheckEx
RtlGUIDFromString
KeAcquireSpinLockRaiseToDpc
_vsnprintf
strncpy
ExNotifyCallback
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToInteger
RtlFreeUnicodeString
RtlInitString
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
PsCreateSystemThread
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
KeInitializeSemaphore
KeReleaseSemaphore
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInsertIrp
IoCsqInitialize
IoCsqRemoveNextIrp
MmMapLockedPagesSpecifyCache
RtlInitUnicodeString
KeReleaseSpinLock

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

ndis.sys

NdisMIndicateReceiveNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMdl
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisAllocateMemoryWithTagPriority
NdisFreeMdl
NdisMGetDeviceProperty
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisGetVersion
NdisAllocateTimerObject
NdisMSleep
NdisFreeNetBufferList
NdisQueueIoWorkItem
NdisWaitEvent
NdisResetEvent
NdisRegisterDeviceEx
NdisMSendNetBufferListsComplete
NdisDeregisterDeviceEx
NdisMSetMiniportAttributes
NdisInitializeString
NdisOpenFile
NdisMapFile
NdisUnmapFile
NdisCloseFile
NdisFreeMemory
NdisWriteConfiguration
NdisMRemoveMiniport
NdisMIndicateStatusEx
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisReadConfiguration
NdisReadNetworkAddress
NdisInitializeEvent
NdisMOidRequestComplete
NdisSetTimerObject
NdisCancelTimerObject
NdisFreeTimerObject
NdisAllocateIoWorkItem
NdisFreeIoWorkItem
NdisSetEvent

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX86/RtlExtUI.dll
.dll regsvr32 windows:6 windows x86 arch:x86

f3b2dd92c703d59ebb05c6dc9bacf48e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07
Signer

Actual PE Digest

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07

Digest Algorithm

sha256

PE Digest Matches

true

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05
Signer

Actual PE Digest

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_x86\i386\RtlExtUI.pdb

Imports

msvcrt

fputs
sprintf_s
vsprintf_s
strcat_s
fflush
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
strcpy_s
strncmp
memcpy
free
malloc
_vsnprintf
_purecall
wcsncpy_s
_vsnwprintf
_itow_s
_wtoi
swprintf_s
wcschr
wcstoul
_wcsnicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_fsopen
fclose
_vsnprintf_s

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

user32

SetWindowsHookExW
SetWindowTextW
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
SetPropW
RemovePropW
GetPropW
CallNextHookEx
GetDlgItem
GetWindowTextW
GetDlgItemTextA
GetParent
PostMessageW
GetDC
GetDialogBaseUnits
ReleaseDC
EnableWindow
MessageBoxW
DialogBoxParamW
IsDlgButtonChecked
EndDialog
CheckDlgButton
SetWindowTextA
GetWindowTextA
SendMessageW

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
SetUnhandledExceptionFilter
GetLastError
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameW
LoadLibraryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
CreateMutexW
GetLocalTime
CloseHandle
OutputDebugStringA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA

comctl32

CreatePropertySheetPageW

ws2_32

send

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertCompareCertificateName
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringA
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord800
ord2810
ord540
ord1808
ord4229

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd
Signer

Actual PE Digest

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd

Digest Algorithm

sha256

PE Digest Matches

true

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX86/netrtwlanu.cat
RTWLANU_Driver/VistaX86/netrtwlanu_Vista.inf
RTWLANU_Driver/VistaX86/rtlCoInst.dat
RTWLANU_Driver/VistaX86/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/VistaX86/rtwlanu_Vista.sys
.sys windows:6 windows x86 arch:x86

8b803b70028cbae52f1b436c08490521

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:27:ed:16:5b:a1:69:96:2d:98:e8:d6:ea:aa:7c:84:38:e8:fe:a6:78:03:ad:2c:6b:f3:74:6b:63:1a:1b:35
Signer

Actual PE Digest

29:27:ed:16:5b:a1:69:96:2d:98:e8:d6:ea:aa:7c:84:38:e8:fe:a6:78:03:ad:2c:6b:f3:74:6b:63:1a:1b:35

Digest Algorithm

sha256

PE Digest Matches

true

cf:89:de:d3:e2:49:cf:90:51:62:0f:ca:f9:b0:af:2f:26:2d:e4:d9
Signer

Actual PE Digest

cf:89:de:d3:e2:49:cf:90:51:62:0f:ca:f9:b0:af:2f:26:2d:e4:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\windows_server\v1030.6\platform\ndis6\usb\objfre_wlh_x86\i386\rtwlanu.pdb

Imports

ntoskrnl.exe

KeTickCount
KeWaitForSingleObject
KeClearEvent
RtlCopyUnicodeString
KeSetEvent
KeInitializeEvent
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
_alldiv
KeFlushQueuedDpcs
KeBugCheckEx
DbgPrint
_aulldiv
_allmul
KeQuerySystemTime
memcpy
RtlGUIDFromString
strncpy
_allshl
_aullrem
_vsnprintf
_aullshr
ExNotifyCallback
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
ZwClose
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
ExCreateCallback
KeInitializeSemaphore
KeReleaseSemaphore
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
RtlInitString
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoCsqInitialize
memset
RtlInitUnicodeString
MmMapLockedPagesSpecifyCache

hal

KeQueryPerformanceCounter
KeStallExecutionProcessor
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

ndis.sys

NdisGetVersion
NdisMGetDeviceProperty
NdisMDeregisterMiniportDriver
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeMdl
NdisMRegisterMiniportDriver
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisFreeIoWorkItem
NdisAllocateTimerObject
NdisMSleep
NdisAllocateMemoryWithTagPriority
NdisMIndicateReceiveNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMdl
NdisSetEvent
NdisSetTimerObject
NdisCancelTimerObject
NdisFreeNetBufferList
NdisFreeMemory
NdisCloseFile
NdisUnmapFile
NdisMapFile
NdisOpenFile
NdisInitializeString
NdisWriteConfiguration
NdisResetEvent
NdisWaitEvent
NdisMSendNetBufferListsComplete
NdisMSetMiniportAttributes
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMRemoveMiniport
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisReadNetworkAddress
NdisReadConfiguration
NdisInitializeEvent
NdisMIndicateStatusEx
NdisMOidRequestComplete
NdisFreeTimerObject

wdfldr.sys

WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X64/RtlExtUI.dll
.dll regsvr32 windows:6 windows x64 arch:x64

2bf7f4adb8ae5e2b654042681a7120d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40
Signer

Actual PE Digest

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40

Digest Algorithm

sha256

PE Digest Matches

true

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2
Signer

Actual PE Digest

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_amd64\amd64\RtlExtUI.pdb

Imports

msvcrt

fflush
vsprintf_s
strcat_s
_fsopen
??3@YAXPEAX@Z
fclose
fputs
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcschr
wcstoul
_wtoi
_wcsnicmp
_itow_s
??2@YAPEAX_K@Z
_vsnprintf_s
wcsncpy_s
_vsnwprintf
_purecall
free
malloc
_vsnprintf
strncmp
strcpy_s
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
memset
sprintf_s
swprintf_s
memcpy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString

user32

IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
MessageBoxA
EnableWindow
GetDialogBaseUnits
GetPropW
SetWindowTextW
GetDlgItemTextA
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItem
ReleaseDC
GetDC
SetPropW
CallNextHookEx
GetParent
PostMessageW
RemovePropW
DestroyWindow
GetWindowTextW
GetWindowTextA
SetWindowTextA
SendMessageW

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
Sleep
CreateFileMappingW
GetLastError
FileTimeToSystemTime
GetDateFormatA
UnmapViewOfFile
MapViewOfFile
CreateFileA
VerifyVersionInfoW
MultiByteToWideChar
VerSetConditionMask
CloseHandle
GetLocalTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateMutexW
GetSystemTime
ReleaseMutex
OutputDebugStringA
GetCurrentThreadId
WaitForSingleObject

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegSetValueExW
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

comctl32

CreatePropertySheetPageW

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertCompareCertificateName
CertGetNameStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord626
ord2846
ord1040
ord1812
ord4557

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f
Signer

Actual PE Digest

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f

Digest Algorithm

sha256

PE Digest Matches

true

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X64/netrtwlanu.cat
RTWLANU_Driver/Win10X64/netrtwlanu.inf
RTWLANU_Driver/Win10X64/rtlCoInst.dat
RTWLANU_Driver/Win10X64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X64/rtwlanu.sys
.sys windows:10 windows x64 arch:x64

40ec54811195a65071a344dbd6181bde

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:18:e0:91:91:58:49:f4:9e:35:c7:5f:95:1b:9e:03:f8:c7:7d:49:3b:36:18:d4:b5:42:f7:bd:e4:a6:e0:45
Signer

Actual PE Digest

95:18:e0:91:91:58:49:f4:9e:35:c7:5f:95:1b:9e:03:f8:c7:7d:49:3b:36:18:d4:b5:42:f7:bd:e4:a6:e0:45

Digest Algorithm

sha256

PE Digest Matches

true

ea:b7:f4:64:4c:00:f7:8a:ef:67:ec:e7:2c:fc:8d:dc:72:ff:87:e1
Signer

Actual PE Digest

ea:b7:f4:64:4c:00:f7:8a:ef:67:ec:e7:2c:fc:8d:dc:72:ff:87:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x64\rtwlanu.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
EtwWriteTransfer
EtwSetInformation
EtwUnregister
EtwRegister
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
KeFlushQueuedDpcs
KeBugCheckEx
KfRaiseIrql
KeLowerIrql
DbgPrint
RtlGUIDFromString
_vsnprintf
MmMapLockedPagesSpecifyCache
__chkstk
strncpy
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
strcmp
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeInitializeSpinLock
DbgPrintEx
RtlInitUnicodeString

hal

KeQueryPerformanceCounter
KeStallExecutionProcessor

ndis.sys

NdisReadNetworkAddress
NdisCloseConfiguration
NdisAllocateMemoryWithTag
NdisMDeregisterWdiMiniportDriver
NdisMRegisterWdiMiniportDriver
NdisMIndicateReceiveNetBufferLists
NdisAllocateMdl
NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisInitializeEvent
NdisSetOptionalHandlers
NdisMFreePort
NdisMAllocatePort
NdisMNetPnPEvent
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisAllocateTimerObject
NdisAllocateMemoryWithTagPriority
NdisReadConfiguration
NdisGetVersion
NdisMOidRequestComplete
NdisOpenConfigurationEx
NdisAllocateNetBufferListPool
NdisSetEvent
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisMIndicateStatusEx

wdfldr.sys

WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X86/RtlExtUI.dll
.dll regsvr32 windows:6 windows x86 arch:x86

f3b2dd92c703d59ebb05c6dc9bacf48e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07
Signer

Actual PE Digest

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07

Digest Algorithm

sha256

PE Digest Matches

true

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05
Signer

Actual PE Digest

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_x86\i386\RtlExtUI.pdb

Imports

msvcrt

fputs
sprintf_s
vsprintf_s
strcat_s
fflush
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
strcpy_s
strncmp
memcpy
free
malloc
_vsnprintf
_purecall
wcsncpy_s
_vsnwprintf
_itow_s
_wtoi
swprintf_s
wcschr
wcstoul
_wcsnicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_fsopen
fclose
_vsnprintf_s

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

user32

SetWindowsHookExW
SetWindowTextW
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
SetPropW
RemovePropW
GetPropW
CallNextHookEx
GetDlgItem
GetWindowTextW
GetDlgItemTextA
GetParent
PostMessageW
GetDC
GetDialogBaseUnits
ReleaseDC
EnableWindow
MessageBoxW
DialogBoxParamW
IsDlgButtonChecked
EndDialog
CheckDlgButton
SetWindowTextA
GetWindowTextA
SendMessageW

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
SetUnhandledExceptionFilter
GetLastError
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameW
LoadLibraryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
CreateMutexW
GetLocalTime
CloseHandle
OutputDebugStringA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA

comctl32

CreatePropertySheetPageW

ws2_32

send

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertCompareCertificateName
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringA
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord800
ord2810
ord540
ord1808
ord4229

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd
Signer

Actual PE Digest

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd

Digest Algorithm

sha256

PE Digest Matches

true

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X86/netrtwlanu.cat
RTWLANU_Driver/Win10X86/netrtwlanu.inf
RTWLANU_Driver/Win10X86/rtlCoInst.dat
RTWLANU_Driver/Win10X86/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win10X86/rtwlanu.sys
.sys windows:10 windows x86 arch:x86

c47b7fe14e8cb50892da1c427422207b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:09:32:a5:3c:f7:11:8e:71:22:5f:ab:29:d9:62:09:f6:4a:a8:49:a6:0a:03:d3:a8:a0:a4:b4:89:e9:f3:3e
Signer

Actual PE Digest

0c:09:32:a5:3c:f7:11:8e:71:22:5f:ab:29:d9:62:09:f6:4a:a8:49:a6:0a:03:d3:a8:a0:a4:b4:89:e9:f3:3e

Digest Algorithm

sha256

PE Digest Matches

true

5e:ed:8d:2b:af:60:6c:e9:4d:dc:6f:b8:90:b6:bf:9f:16:13:5d:24
Signer

Actual PE Digest

5e:ed:8d:2b:af:60:6c:e9:4d:dc:6f:b8:90:b6:bf:9f:16:13:5d:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x86\rtwlanu.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
EtwWriteTransfer
EtwSetInformation
EtwUnregister
EtwRegister
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
memcmp
_alldiv
KeFlushQueuedDpcs
memcpy
_aulldiv
KeQuerySystemTime
KeBugCheckEx
DbgPrint
RtlGUIDFromString
memset
_vsnprintf
_aullshr
strncpy
_allshl
_aullrem
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
_alloca_probe
MmMapLockedPagesSpecifyCache
KeInitializeSpinLock
DbgPrintEx
RtlInitUnicodeString
_allmul

hal

KeQueryPerformanceCounter
KfRaiseIrql
KfLowerIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor

ndis.sys

NdisMRegisterWdiMiniportDriver
NdisMIndicateReceiveNetBufferLists
NdisAllocateMdl
NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisSetOptionalHandlers
NdisMFreePort
NdisMAllocatePort
NdisMDeregisterWdiMiniportDriver
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisAllocateTimerObject
NdisAllocateMemoryWithTagPriority
NdisSetEvent
NdisGetVersion
NdisMOidRequestComplete
NdisOpenConfigurationEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisReadConfiguration
NdisCloseConfiguration
NdisMNetPnPEvent
NdisMIndicateStatusEx
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisReadNetworkAddress

wdfldr.sys

WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X64/RtlExtUI.dll
.dll regsvr32 windows:6 windows x64 arch:x64

2bf7f4adb8ae5e2b654042681a7120d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40
Signer

Actual PE Digest

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40

Digest Algorithm

sha256

PE Digest Matches

true

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2
Signer

Actual PE Digest

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_amd64\amd64\RtlExtUI.pdb

Imports

msvcrt

fflush
vsprintf_s
strcat_s
_fsopen
??3@YAXPEAX@Z
fclose
fputs
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcschr
wcstoul
_wtoi
_wcsnicmp
_itow_s
??2@YAPEAX_K@Z
_vsnprintf_s
wcsncpy_s
_vsnwprintf
_purecall
free
malloc
_vsnprintf
strncmp
strcpy_s
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
memset
sprintf_s
swprintf_s
memcpy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString

user32

IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
MessageBoxA
EnableWindow
GetDialogBaseUnits
GetPropW
SetWindowTextW
GetDlgItemTextA
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItem
ReleaseDC
GetDC
SetPropW
CallNextHookEx
GetParent
PostMessageW
RemovePropW
DestroyWindow
GetWindowTextW
GetWindowTextA
SetWindowTextA
SendMessageW

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
Sleep
CreateFileMappingW
GetLastError
FileTimeToSystemTime
GetDateFormatA
UnmapViewOfFile
MapViewOfFile
CreateFileA
VerifyVersionInfoW
MultiByteToWideChar
VerSetConditionMask
CloseHandle
GetLocalTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateMutexW
GetSystemTime
ReleaseMutex
OutputDebugStringA
GetCurrentThreadId
WaitForSingleObject

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegSetValueExW
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

comctl32

CreatePropertySheetPageW

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertCompareCertificateName
CertGetNameStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord626
ord2846
ord1040
ord1812
ord4557

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f
Signer

Actual PE Digest

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f

Digest Algorithm

sha256

PE Digest Matches

true

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X64/netrtwlanu.cat
RTWLANU_Driver/Win7X64/netrtwlanu.inf
RTWLANU_Driver/Win7X64/rtlCoInst.dat
RTWLANU_Driver/Win7X64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X64/rtwlanu.sys
.sys windows:6 windows x64 arch:x64

eb4ba908f02bf34c6cab069f7922db10

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:b4:84:db:f3:52:c4:a5:41:e3:f6:22:c8:10:b5:fb:33:62:f5:33:b7:dc:13:25:d4:b8:66:60:58:34:04:e4
Signer

Actual PE Digest

37:b4:84:db:f3:52:c4:a5:41:e3:f6:22:c8:10:b5:fb:33:62:f5:33:b7:dc:13:25:d4:b8:66:60:58:34:04:e4

Digest Algorithm

sha256

PE Digest Matches

true

7f:42:90:16:69:68:7d:50:bb:63:3d:df:9e:fa:a4:28:46:db:bf:ea
Signer

Actual PE Digest

7f:42:90:16:69:68:7d:50:bb:63:3d:df:9e:fa:a4:28:46:db:bf:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\windows_server\v1030.6\platform\ndis6\usb\objfre_win7_amd64\amd64\rtwlanu.pdb

Imports

ntoskrnl.exe

KeClearEvent
KeWaitForSingleObject
KeSetEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
RtlCopyUnicodeString
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
MmGetSystemRoutineAddress
ExFreePoolWithTag
IoWMIWriteEvent
ExAllocatePoolWithTag
KeInitializeEvent
KeFlushQueuedDpcs
KeBugCheckEx
DbgPrint
strncpy
_vsnprintf
ExNotifyCallback
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToInteger
RtlFreeUnicodeString
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
PsCreateSystemThread
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
KeInitializeSemaphore
KeReleaseSemaphore
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
RtlInitString
IoCsqInsertIrp
IoCsqInitialize
IoCsqRemoveNextIrp
RtlGUIDFromString
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
MmMapLockedPagesSpecifyCache
RtlInitUnicodeString

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

ndis.sys

NdisSetTimerObject
NdisAllocateTimerObject
NdisMIndicateReceiveNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMdl
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferList
NdisFreeMdl
NdisFreeTimerObject
NdisMGetDeviceProperty
NdisMRegisterMiniportDriver
NdisGetVersion
NdisMFreePort
NdisMNetPnPEvent
NdisMAllocatePort
NdisMSleep
NdisAllocateMemoryWithTagPriority
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMDeregisterMiniportDriver
NdisCancelTimerObject
NdisInitializeString
NdisOpenFile
NdisMapFile
NdisUnmapFile
NdisCloseFile
NdisFreeMemory
NdisWriteConfiguration
NdisWaitEvent
NdisResetEvent
NdisMSendNetBufferListsComplete
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisReadConfiguration
NdisReadNetworkAddress
NdisInitializeEvent
NdisMIndicateStatusEx
NdisMOidRequestComplete
NdisSetEvent
NdisFreeIoWorkItem

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X86/RtlExtUI.dll
.dll regsvr32 windows:6 windows x86 arch:x86

f3b2dd92c703d59ebb05c6dc9bacf48e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07
Signer

Actual PE Digest

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07

Digest Algorithm

sha256

PE Digest Matches

true

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05
Signer

Actual PE Digest

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_x86\i386\RtlExtUI.pdb

Imports

msvcrt

fputs
sprintf_s
vsprintf_s
strcat_s
fflush
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
strcpy_s
strncmp
memcpy
free
malloc
_vsnprintf
_purecall
wcsncpy_s
_vsnwprintf
_itow_s
_wtoi
swprintf_s
wcschr
wcstoul
_wcsnicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_fsopen
fclose
_vsnprintf_s

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

user32

SetWindowsHookExW
SetWindowTextW
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
SetPropW
RemovePropW
GetPropW
CallNextHookEx
GetDlgItem
GetWindowTextW
GetDlgItemTextA
GetParent
PostMessageW
GetDC
GetDialogBaseUnits
ReleaseDC
EnableWindow
MessageBoxW
DialogBoxParamW
IsDlgButtonChecked
EndDialog
CheckDlgButton
SetWindowTextA
GetWindowTextA
SendMessageW

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
SetUnhandledExceptionFilter
GetLastError
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameW
LoadLibraryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
CreateMutexW
GetLocalTime
CloseHandle
OutputDebugStringA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA

comctl32

CreatePropertySheetPageW

ws2_32

send

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertCompareCertificateName
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringA
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord800
ord2810
ord540
ord1808
ord4229

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd
Signer

Actual PE Digest

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd

Digest Algorithm

sha256

PE Digest Matches

true

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X86/netrtwlanu.cat
RTWLANU_Driver/Win7X86/netrtwlanu.inf
RTWLANU_Driver/Win7X86/rtlCoInst.dat
RTWLANU_Driver/Win7X86/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win7X86/rtwlanu.sys
.sys windows:6 windows x86 arch:x86

c7bc2ce933aa88dc89c446e0ba516a74

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:b5:0c:51:07:08:6b:9b:33:40:5d:18:17:f8:85:3a:2f:ca:da:39:ca:4d:bc:56:38:d6:39:72:15:fe:47:d0
Signer

Actual PE Digest

bc:b5:0c:51:07:08:6b:9b:33:40:5d:18:17:f8:85:3a:2f:ca:da:39:ca:4d:bc:56:38:d6:39:72:15:fe:47:d0

Digest Algorithm

sha256

PE Digest Matches

true

f5:63:26:35:96:39:56:b1:88:f8:04:24:aa:1e:86:8a:af:db:06:fc
Signer

Actual PE Digest

f5:63:26:35:96:39:56:b1:88:f8:04:24:aa:1e:86:8a:af:db:06:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\windows_server\v1030.6\platform\ndis6\usb\objfre_win7_x86\i386\rtwlanu.pdb

Imports

ntoskrnl.exe

KeTickCount
KeWaitForSingleObject
KeClearEvent
RtlCopyUnicodeString
KeSetEvent
PoRegisterPowerSettingCallback
PoUnregisterPowerSettingCallback
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
IoWMIWriteEvent
ExFreePoolWithTag
KeInitializeEvent
_alldiv
KeFlushQueuedDpcs
KeBugCheckEx
DbgPrint
_aulldiv
_allmul
KeQuerySystemTime
strncpy
_allshl
_aullrem
_vsnprintf
_aullshr
ExNotifyCallback
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
ZwClose
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
ExCreateCallback
KeInitializeSemaphore
KeReleaseSemaphore
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
RtlInitString
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoCsqInitialize
memcpy
RtlGUIDFromString
memset
RtlInitUnicodeString
MmMapLockedPagesSpecifyCache

hal

KfReleaseSpinLock
KeQueryPerformanceCounter
KeStallExecutionProcessor
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock

ndis.sys

NdisMIndicateReceiveNetBufferLists
NdisMRegisterMiniportDriver
NdisGetVersion
NdisMGetDeviceProperty
NdisMDeregisterMiniportDriver
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeMdl
NdisFreeNetBufferList
NdisMFreePort
NdisAllocateNetBufferAndNetBufferList
NdisMAllocatePort
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisFreeIoWorkItem
NdisAllocateTimerObject
NdisMSleep
NdisAllocateMemoryWithTagPriority
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisSetEvent
NdisAllocateMdl
NdisReadNetworkAddress
NdisReadConfiguration
NdisInitializeEvent
NdisMIndicateStatusEx
NdisMNetPnPEvent
NdisFreeMemory
NdisCloseFile
NdisUnmapFile
NdisMapFile
NdisOpenFile
NdisInitializeString
NdisWriteConfiguration
NdisResetEvent
NdisWaitEvent
NdisMSendNetBufferListsComplete
NdisMSetMiniportAttributes
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMRemoveMiniport
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisMOidRequestComplete

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X64/RtlExtUI.dll
.dll regsvr32 windows:6 windows x64 arch:x64

2bf7f4adb8ae5e2b654042681a7120d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40
Signer

Actual PE Digest

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40

Digest Algorithm

sha256

PE Digest Matches

true

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2
Signer

Actual PE Digest

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_amd64\amd64\RtlExtUI.pdb

Imports

msvcrt

fflush
vsprintf_s
strcat_s
_fsopen
??3@YAXPEAX@Z
fclose
fputs
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcschr
wcstoul
_wtoi
_wcsnicmp
_itow_s
??2@YAPEAX_K@Z
_vsnprintf_s
wcsncpy_s
_vsnwprintf
_purecall
free
malloc
_vsnprintf
strncmp
strcpy_s
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
memset
sprintf_s
swprintf_s
memcpy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString

user32

IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
MessageBoxA
EnableWindow
GetDialogBaseUnits
GetPropW
SetWindowTextW
GetDlgItemTextA
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItem
ReleaseDC
GetDC
SetPropW
CallNextHookEx
GetParent
PostMessageW
RemovePropW
DestroyWindow
GetWindowTextW
GetWindowTextA
SetWindowTextA
SendMessageW

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
Sleep
CreateFileMappingW
GetLastError
FileTimeToSystemTime
GetDateFormatA
UnmapViewOfFile
MapViewOfFile
CreateFileA
VerifyVersionInfoW
MultiByteToWideChar
VerSetConditionMask
CloseHandle
GetLocalTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateMutexW
GetSystemTime
ReleaseMutex
OutputDebugStringA
GetCurrentThreadId
WaitForSingleObject

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegSetValueExW
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

comctl32

CreatePropertySheetPageW

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertCompareCertificateName
CertGetNameStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord626
ord2846
ord1040
ord1812
ord4557

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f
Signer

Actual PE Digest

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f

Digest Algorithm

sha256

PE Digest Matches

true

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X64/netrtwlanu.cat
RTWLANU_Driver/Win81X64/netrtwlanu.inf
RTWLANU_Driver/Win81X64/rtlCoInst.dat
RTWLANU_Driver/Win81X64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X64/rtwlanu.sys
.sys windows:10 windows x64 arch:x64

b8a14eb65c1565b50cd7e80c375b21d9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:b8:b3:88:a1:6d:fd:81:66:d8:8e:b7:a1:69:3c:6f:43:f6:83:e1:a1:2e:1b:27:f8:77:94:cf:de:9a:d3:30
Signer

Actual PE Digest

7f:b8:b3:88:a1:6d:fd:81:66:d8:8e:b7:a1:69:3c:6f:43:f6:83:e1:a1:2e:1b:27:f8:77:94:cf:de:9a:d3:30

Digest Algorithm

sha256

PE Digest Matches

true

b3:c2:78:31:6d:8e:ed:6b:ed:35:c5:73:bd:ea:07:40:a9:5c:8e:f0
Signer

Actual PE Digest

b3:c2:78:31:6d:8e:ed:6b:ed:35:c5:73:bd:ea:07:40:a9:5c:8e:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x64\rtwlanu.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
KeFlushQueuedDpcs
KeBugCheckEx
KfRaiseIrql
KeLowerIrql
DbgPrint
RtlGUIDFromString
strncpy
_vsnprintf
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
strcmp
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
MmMapLockedPagesSpecifyCache
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeInitializeSpinLock
RtlInitUnicodeString

hal

KeQueryPerformanceCounter
KeStallExecutionProcessor

ndis.sys

NdisMOidRequestComplete
NdisMIndicateStatusEx
NdisMIndicateReceiveNetBufferLists
NdisAllocateMdl
NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisGetVersion
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisSetOptionalHandlers
NdisMFreePort
NdisMAllocatePort
NdisMNetPnPEvent
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisSetEvent
NdisFreeNetBufferList
NdisAllocateTimerObject
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisReadConfiguration
NdisCloseConfiguration
NdisReadNetworkAddress
NdisInitializeEvent
NdisOpenConfigurationEx
NdisAllocateMemoryWithTagPriority

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X86/RtlExtUI.dll
.dll regsvr32 windows:6 windows x86 arch:x86

f3b2dd92c703d59ebb05c6dc9bacf48e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07
Signer

Actual PE Digest

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07

Digest Algorithm

sha256

PE Digest Matches

true

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05
Signer

Actual PE Digest

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_x86\i386\RtlExtUI.pdb

Imports

msvcrt

fputs
sprintf_s
vsprintf_s
strcat_s
fflush
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
strcpy_s
strncmp
memcpy
free
malloc
_vsnprintf
_purecall
wcsncpy_s
_vsnwprintf
_itow_s
_wtoi
swprintf_s
wcschr
wcstoul
_wcsnicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_fsopen
fclose
_vsnprintf_s

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

user32

SetWindowsHookExW
SetWindowTextW
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
SetPropW
RemovePropW
GetPropW
CallNextHookEx
GetDlgItem
GetWindowTextW
GetDlgItemTextA
GetParent
PostMessageW
GetDC
GetDialogBaseUnits
ReleaseDC
EnableWindow
MessageBoxW
DialogBoxParamW
IsDlgButtonChecked
EndDialog
CheckDlgButton
SetWindowTextA
GetWindowTextA
SendMessageW

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
SetUnhandledExceptionFilter
GetLastError
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameW
LoadLibraryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
CreateMutexW
GetLocalTime
CloseHandle
OutputDebugStringA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA

comctl32

CreatePropertySheetPageW

ws2_32

send

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertCompareCertificateName
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringA
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord800
ord2810
ord540
ord1808
ord4229

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd
Signer

Actual PE Digest

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd

Digest Algorithm

sha256

PE Digest Matches

true

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X86/netrtwlanu.cat
RTWLANU_Driver/Win81X86/netrtwlanu.inf
RTWLANU_Driver/Win81X86/rtlCoInst.dat
RTWLANU_Driver/Win81X86/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win81X86/rtwlanu.sys
.sys windows:10 windows x86 arch:x86

08aee6b5945e92f1f494b6e543ebb166

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:9d:03:f0:7e:4a:9c:c6:24:7c:ef:8a:77:65:14:a6:d4:28:b2:a4:e5:9f:a0:86:ea:56:a4:b1:e3:be:98:1a
Signer

Actual PE Digest

7a:9d:03:f0:7e:4a:9c:c6:24:7c:ef:8a:77:65:14:a6:d4:28:b2:a4:e5:9f:a0:86:ea:56:a4:b1:e3:be:98:1a

Digest Algorithm

sha256

PE Digest Matches

true

f6:3c:17:ac:7e:97:c8:6e:21:8d:e8:00:6f:b4:e1:73:e6:2d:8e:65
Signer

Actual PE Digest

f6:3c:17:ac:7e:97:c8:6e:21:8d:e8:00:6f:b4:e1:73:e6:2d:8e:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x86\rtwlanu.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
memcmp
_alldiv
KeFlushQueuedDpcs
memcpy
_aulldiv
KeQuerySystemTime
KeBugCheckEx
DbgPrint
memset
_aullshr
strncpy
_allshl
_aullrem
_vsnprintf
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
RtlGUIDFromString
MmMapLockedPagesSpecifyCache
KeInitializeSpinLock
RtlInitUnicodeString
_allmul

hal

KeQueryPerformanceCounter
KfRaiseIrql
KfLowerIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor

ndis.sys

NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisSetOptionalHandlers
NdisAllocateMdl
NdisMAllocatePort
NdisMNetPnPEvent
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisAllocateTimerObject
NdisAllocateMemoryWithTagPriority
NdisSetEvent
NdisMIndicateReceiveNetBufferLists
NdisReadNetworkAddress
NdisInitializeEvent
NdisOpenConfigurationEx
NdisMIndicateStatusEx
NdisMFreePort
NdisGetVersion
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisReadConfiguration
NdisCloseConfiguration
NdisMOidRequestComplete

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X64/RtlExtUI.dll
.dll regsvr32 windows:6 windows x64 arch:x64

2bf7f4adb8ae5e2b654042681a7120d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40
Signer

Actual PE Digest

a0:a1:f5:19:3c:16:76:29:10:18:39:07:02:c0:cf:b0:ee:82:6a:42:6d:0e:dd:7a:aa:96:23:fb:d1:bf:0f:40

Digest Algorithm

sha256

PE Digest Matches

true

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2
Signer

Actual PE Digest

57:47:b4:11:fb:a4:b7:dc:3e:df:77:61:92:e7:fd:6b:c6:f0:71:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_amd64\amd64\RtlExtUI.pdb

Imports

msvcrt

fflush
vsprintf_s
strcat_s
_fsopen
??3@YAXPEAX@Z
fclose
fputs
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcschr
wcstoul
_wtoi
_wcsnicmp
_itow_s
??2@YAPEAX_K@Z
_vsnprintf_s
wcsncpy_s
_vsnwprintf
_purecall
free
malloc
_vsnprintf
strncmp
strcpy_s
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
memset
sprintf_s
swprintf_s
memcpy

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocString

user32

IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
MessageBoxA
EnableWindow
GetDialogBaseUnits
GetPropW
SetWindowTextW
GetDlgItemTextA
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItem
ReleaseDC
GetDC
SetPropW
CallNextHookEx
GetParent
PostMessageW
RemovePropW
DestroyWindow
GetWindowTextW
GetWindowTextA
SetWindowTextA
SendMessageW

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
Sleep
CreateFileMappingW
GetLastError
FileTimeToSystemTime
GetDateFormatA
UnmapViewOfFile
MapViewOfFile
CreateFileA
VerifyVersionInfoW
MultiByteToWideChar
VerSetConditionMask
CloseHandle
GetLocalTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateMutexW
GetSystemTime
ReleaseMutex
OutputDebugStringA
GetCurrentThreadId
WaitForSingleObject

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegSetValueExW
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

comctl32

CreatePropertySheetPageW

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertCompareCertificateName
CertGetNameStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord626
ord2846
ord1040
ord1812
ord4557

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X64/Rtlihvs.dll
.dll windows:6 windows x64 arch:x64

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f
Signer

Actual PE Digest

06:d7:c1:13:f9:ea:4e:d8:d7:85:7d:bf:6c:a9:e3:01:1c:6a:29:52:96:b5:49:20:fd:be:a8:27:0e:7b:64:3f

Digest Algorithm

sha256

PE Digest Matches

true

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

Actual PE Digest

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_amd64\amd64\Rtlihvs.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
CryptUnprotectData

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocString
VariantClear

kernel32

FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
WriteFile
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringW
GetFileAttributesA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetStringTypeW
SetLastError
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
HeapReAlloc
GetExitCodeProcess
CreateProcessA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LocalFree
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateEventA
GetPrivateProfileStringW
FlsFree
DecodePointer
EncodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlLookupFunctionEntry
HeapFree
HeapAlloc
RtlUnwindEx
GetVersionExW
GetCommandLineA
FlsSetValue
VerSetConditionMask
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
DisableThreadLibraryCalls
OutputDebugStringA
CreateFileA
HeapSize
LoadLibraryW
GlobalMemoryStatus
GetVersion
GetModuleHandleA
GetSystemDefaultLocaleName
GetComputerNameW
GetUserDefaultLocaleName
GetComputerNameA
GetTickCount64
GetVersionExA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
DuplicateToken
GetTokenInformation
RegDeleteValueA
RegGetValueA
CryptAcquireContextA
CryptGenRandom
RegCreateKeyExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
LookupAccountNameA
RegQueryValueExA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal

ws2_32

WSACleanup
getaddrinfo
inet_addr
htons
ntohs
WSAStartup

rpcrt4

UuidCreate
RpcStringFreeA
UuidToStringA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetSystemMetrics
MsgWaitForMultipleObjects

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanDisconnect
WlanConnect
WlanGetProfile
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpNetTable2
IcmpCreateFile
IpReleaseAddress
IpRenewAddress
Icmp6SendEcho2
Icmp6CreateFile
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
GetAdaptersInfo
GetIpAddrTable
GetIfTable
CancelIPChangeNotify
GetInterfaceInfo
NotifyAddrChange

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X64/netrtwlanu.cat
RTWLANU_Driver/Win8X64/netrtwlanu.inf
RTWLANU_Driver/Win8X64/rtlCoInst.dat
RTWLANU_Driver/Win8X64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X64/rtwlanu.sys
.sys windows:10 windows x64 arch:x64

b8a14eb65c1565b50cd7e80c375b21d9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:b8:b3:88:a1:6d:fd:81:66:d8:8e:b7:a1:69:3c:6f:43:f6:83:e1:a1:2e:1b:27:f8:77:94:cf:de:9a:d3:30
Signer

Actual PE Digest

7f:b8:b3:88:a1:6d:fd:81:66:d8:8e:b7:a1:69:3c:6f:43:f6:83:e1:a1:2e:1b:27:f8:77:94:cf:de:9a:d3:30

Digest Algorithm

sha256

PE Digest Matches

true

b3:c2:78:31:6d:8e:ed:6b:ed:35:c5:73:bd:ea:07:40:a9:5c:8e:f0
Signer

Actual PE Digest

b3:c2:78:31:6d:8e:ed:6b:ed:35:c5:73:bd:ea:07:40:a9:5c:8e:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x64\rtwlanu.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
KeFlushQueuedDpcs
KeBugCheckEx
KfRaiseIrql
KeLowerIrql
DbgPrint
RtlGUIDFromString
strncpy
_vsnprintf
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
strcmp
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
MmMapLockedPagesSpecifyCache
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeInitializeSpinLock
RtlInitUnicodeString

hal

KeQueryPerformanceCounter
KeStallExecutionProcessor

ndis.sys

NdisMOidRequestComplete
NdisMIndicateStatusEx
NdisMIndicateReceiveNetBufferLists
NdisAllocateMdl
NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisGetVersion
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisSetOptionalHandlers
NdisMFreePort
NdisMAllocatePort
NdisMNetPnPEvent
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisSetEvent
NdisFreeNetBufferList
NdisAllocateTimerObject
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisReadConfiguration
NdisCloseConfiguration
NdisReadNetworkAddress
NdisInitializeEvent
NdisOpenConfigurationEx
NdisAllocateMemoryWithTagPriority

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X86/RtlExtUI.dll
.dll regsvr32 windows:6 windows x86 arch:x86

f3b2dd92c703d59ebb05c6dc9bacf48e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07
Signer

Actual PE Digest

70:88:08:f3:7b:99:e6:ab:14:be:8a:d2:c3:a5:d0:f3:4e:a6:4b:b7:d4:0c:d7:e2:00:c5:e9:32:29:4a:7b:07

Digest Algorithm

sha256

PE Digest Matches

true

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05
Signer

Actual PE Digest

47:bc:ab:5b:ef:7e:93:6b:d5:1b:22:d6:82:f7:67:6b:32:d2:9e:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlextui\objfre_win7_x86\i386\RtlExtUI.pdb

Imports

msvcrt

fputs
sprintf_s
vsprintf_s
strcat_s
fflush
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
strcpy_s
strncmp
memcpy
free
malloc
_vsnprintf
_purecall
wcsncpy_s
_vsnwprintf
_itow_s
_wtoi
swprintf_s
wcschr
wcstoul
_wcsnicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_fsopen
fclose
_vsnprintf_s

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

user32

SetWindowsHookExW
SetWindowTextW
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
SetPropW
RemovePropW
GetPropW
CallNextHookEx
GetDlgItem
GetWindowTextW
GetDlgItemTextA
GetParent
PostMessageW
GetDC
GetDialogBaseUnits
ReleaseDC
EnableWindow
MessageBoxW
DialogBoxParamW
IsDlgButtonChecked
EndDialog
CheckDlgButton
SetWindowTextA
GetWindowTextA
SendMessageW

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
FileTimeToSystemTime
GetDateFormatA
GetCurrentProcess
SetUnhandledExceptionFilter
GetLastError
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameW
LoadLibraryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
CreateMutexW
GetLocalTime
CloseHandle
OutputDebugStringA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA

comctl32

CreatePropertySheetPageW

ws2_32

send

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertCompareCertificateName
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringA
CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewContext

comdlg32

GetOpenFileNameA

gdi32

GetDeviceCaps

mfc42u

ord800
ord2810
ord540
ord1808
ord4229

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X86/Rtlihvs.dll
.dll windows:6 windows x86 arch:x86

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd
Signer

Actual PE Digest

43:72:a7:c1:01:ab:ab:5a:21:71:3c:a4:25:c6:c1:51:c9:6f:51:14:ca:e6:f2:f1:f0:d8:c8:5c:c3:93:62:fd

Digest Algorithm

sha256

PE Digest Matches

true

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

Actual PE Digest

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

k:\ylb\wapi_ihv_win8\rtlihvs\objfre_win7_x86\i386\Rtlihvs.pdb

Imports

crypt32

CryptUnprotectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantClear
VariantInit

kernel32

SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetDriveTypeA
LCMapStringA
LCMapStringW
GetFileAttributesA
FreeLibrary
InterlockedExchange
LoadLibraryExA
GetStringTypeA
GetStringTypeW
InterlockedIncrement
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
VerSetConditionMask
SetEnvironmentVariableA
VerifyVersionInfoA
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalAlloc
GetLastError
FormatMessageW
GetModuleFileNameA
CreateMutexA
GetPrivateProfileIntW
GetPrivateProfileStringW
TerminateThread
GetLocalTime
ReleaseMutex
CreateThread
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringA
CompareStringW
CreateEventA
InitializeCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
ExitProcess
GetModuleHandleA
GetProcAddress
RaiseException
GetFullPathNameW
GetCurrentDirectoryW
CreateDirectoryW
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
Sleep
WideCharToMultiByte
LocalFree
ResetEvent
WaitForSingleObject
SetEvent
HeapSize
GlobalMemoryStatus
GetVersion
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetComputerNameW
InterlockedCompareExchange
GetTickCount64
GetComputerNameA
SetThreadPriority
GetSystemTime
LoadLibraryA

advapi32

CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA
RegSetValueExA
FreeSid
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
RegGetValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCloseKey
GetTokenInformation
DuplicateToken
RegDeleteValueA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

ws2_32

WSACleanup
getaddrinfo
ntohs
WSAStartup
inet_addr
htons

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

user32

GetSystemMetrics
MsgWaitForMultipleObjects
GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsA
WTSQuerySessionInformationA
WTSFreeMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wlanapi

WlanRegisterVirtualStationNotification
WlanScan
WlanFreeMemory
WlanGetNetworkBssList
WlanRegisterNotification
WlanOpenHandle
WlanCloseHandle
WlanReasonCodeToString
WlanConnect
WlanGetProfile
WlanDisconnect
WlanQueryInterface
WlanGetAvailableNetworkList
WlanGetProfileList
WlanSetSecuritySettings

xmllite

CreateXmlReader

iphlpapi

GetIpAddrTable
CancelIPChangeNotify
NotifyAddrChange
GetAdaptersInfo
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
Icmp6SendEcho2
Icmp6CreateFile
GetIpNetTable2
IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetIfTable

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
Dot11ExtIhvInitVirtualStation

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X86/netrtwlanu.cat
RTWLANU_Driver/Win8X86/netrtwlanu.inf
RTWLANU_Driver/Win8X86/rtlCoInst.dat
RTWLANU_Driver/Win8X86/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/Win8X86/rtwlanu.sys
.sys windows:10 windows x86 arch:x86

08aee6b5945e92f1f494b6e543ebb166

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:9d:03:f0:7e:4a:9c:c6:24:7c:ef:8a:77:65:14:a6:d4:28:b2:a4:e5:9f:a0:86:ea:56:a4:b1:e3:be:98:1a
Signer

Actual PE Digest

7a:9d:03:f0:7e:4a:9c:c6:24:7c:ef:8a:77:65:14:a6:d4:28:b2:a4:e5:9f:a0:86:ea:56:a4:b1:e3:be:98:1a

Digest Algorithm

sha256

PE Digest Matches

true

f6:3c:17:ac:7e:97:c8:6e:21:8d:e8:00:6f:b4:e1:73:e6:2d:8e:65
Signer

Actual PE Digest

f6:3c:17:ac:7e:97:c8:6e:21:8d:e8:00:6f:b4:e1:73:e6:2d:8e:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Windows_Server\v1030.6\PLATFORM\NDIS6\USB\obj\x86\rtwlanu.pdb

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeClearEvent
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoReuseIrp
IoFreeIrp
IoCancelIrp
IofCallDriver
IoAllocateIrp
ExFreePoolWithTag
ExAllocatePool
KeSetEvent
RtlCompareMemory
RtlCopyUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
memcmp
_alldiv
KeFlushQueuedDpcs
memcpy
_aulldiv
KeQuerySystemTime
KeBugCheckEx
DbgPrint
memset
_aullshr
strncpy
_allshl
_aullrem
_vsnprintf
ExNotifyCallback
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlInitString
KeInitializeMutex
KeReleaseMutex
KeInitializeSemaphore
KeReleaseSemaphore
KeSetPriorityThread
ExCreateCallback
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
IofCompleteRequest
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveNextIrp
RtlGUIDFromString
MmMapLockedPagesSpecifyCache
KeInitializeSpinLock
RtlInitUnicodeString
_allmul

hal

KeQueryPerformanceCounter
KfRaiseIrql
KfLowerIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor

ndis.sys

NdisAllocateNetBufferAndNetBufferList
NdisMIdleNotificationComplete
NdisMIdleNotificationConfirm
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisMGetDeviceProperty
NdisFreeMdl
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisSetOptionalHandlers
NdisAllocateMdl
NdisMAllocatePort
NdisMNetPnPEvent
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisAllocateIoWorkItem
NdisMSleep
NdisFreeTimerObject
NdisCancelTimerObject
NdisSetTimerObject
NdisAllocateTimerObject
NdisAllocateMemoryWithTagPriority
NdisSetEvent
NdisMIndicateReceiveNetBufferLists
NdisReadNetworkAddress
NdisInitializeEvent
NdisOpenConfigurationEx
NdisMIndicateStatusEx
NdisMFreePort
NdisGetVersion
NdisWriteConfiguration
NdisFreeMemory
NdisResetEvent
NdisWaitEvent
NdisOpenFile
NdisCloseFile
NdisMapFile
NdisUnmapFile
NdisInitializeString
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisMSetMiniportAttributes
NdisMRemoveMiniport
NdisMSendNetBufferListsComplete
NdisReadConfiguration
NdisCloseConfiguration
NdisMOidRequestComplete

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/WinX64/netrtwlanu.cat
RTWLANU_Driver/WinX64/netrtwlanu_XP.inf
RTWLANU_Driver/WinX64/rtlCoInst.dat
RTWLANU_Driver/WinX64/rtlCoInst.dll
.dll windows:5 windows x64 arch:x64

49861fc8b24187bb146a41202e5ab2c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba
Signer

Actual PE Digest

16:88:3f:3a:a8:77:b2:3c:c0:8b:a7:7b:0c:1b:97:40:e8:ad:f7:5d:9e:5a:99:9f:f8:8d:4e:20:ef:6e:2d:ba

Digest Algorithm

sha256

PE Digest Matches

true

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82
Signer

Actual PE Digest

0a:37:73:40:21:86:22:e8:a7:9f:54:7f:61:6d:21:cc:a1:23:51:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wnet_AMD64\amd64\rtlCoInst.pdb

Imports

msvcrt

free
_strnicmp
strncmp
fclose
malloc
sprintf
_initterm
memset
fopen
fgets
strtok

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetLastError
OutputDebugStringA
GetSystemDirectoryA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/WinX64/rtwlanu_XP.sys
.sys windows:5 windows x64 arch:x64

a93027a20d8f2b98a35fde53ddaccd66

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:05:b4:d1:6c:5c:75:29:fe:b6:3d:a4:e5:4c:19:2c:31:f5:26:e7:d5:db:e3:c8:5d:bf:9c:ed:cf:1e:46:51
Signer

Actual PE Digest

c0:05:b4:d1:6c:5c:75:29:fe:b6:3d:a4:e5:4c:19:2c:31:f5:26:e7:d5:db:e3:c8:5d:bf:9c:ed:cf:1e:46:51

Digest Algorithm

sha256

PE Digest Matches

true

08:8d:6a:8c:59:55:d9:7e:39:34:36:50:87:bc:48:55:4e:8a:f7:3b
Signer

Actual PE Digest

08:8d:6a:8c:59:55:d9:7e:39:34:36:50:87:bc:48:55:4e:8a:f7:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\windows_server\v1030.6\platform\ndis5\usb\objfre_wnet_AMD64\amd64\rtwlanu.pdb

Imports

ntoskrnl.exe

PoRequestPowerIrp
KeInitializeEvent
IoBuildDeviceIoControlRequest
KeWaitForSingleObject
KeClearEvent
IoFreeMdl
IoFreeIrp
KeSetEvent
IoReuseIrp
ExFreePoolWithTag
IoCancelIrp
IoAllocateIrp
IofCallDriver
DbgPrint
RtlGUIDFromString
MmMapLockedPages
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeBugCheckEx
ExAllocatePoolWithTag
_vsnprintf
ExNotifyCallback
strncpy
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
ZwClose
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
ExCreateCallback
KeInitializeSemaphore
KeReleaseSemaphore
MmMapLockedPagesSpecifyCache
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
RtlInitString
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoCsqInitialize
RtlInitUnicodeString

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

ndis.sys

NdisAllocateBuffer
NdisInitializeWrapper
NdisMRegisterMiniport
NdisMRegisterUnloadHandler
NdisMGetDeviceProperty
NdisMSetAttributesEx
NdisGetVersion
NdisMRegisterAdapterShutdownHandler
NdisMDeregisterAdapterShutdownHandler
NdisAllocatePacket
NdisFreePacketPool
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisUnchainBufferAtFront
NdisMRemoveMiniport
NdisMSleep
NdisMInitializeTimer
NdisAllocateMemoryWithTag
NdisScheduleWorkItem
NdisFreeBufferPool
NdisFreePacket
NdisFreeMemory
NdisCloseFile
NdisUnmapFile
NdisMapFile
NdisOpenFile
NdisInitializeString
NdisInitializeEvent
NdisWaitEvent
NdisMRegisterDevice
NdisMDeregisterDevice
NdisCloseConfiguration
NdisReadNetworkAddress
NdisReadConfiguration
NdisOpenConfiguration
NdisResetEvent
NdisSetEvent
NdisSetTimer
NdisMCancelTimer

usbd.sys

USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 2.5MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/WinXP/netrtwlanu.cat
RTWLANU_Driver/WinXP/netrtwlanu_XP.inf
RTWLANU_Driver/WinXP/rtlCoInst.dat
RTWLANU_Driver/WinXP/rtlCoInst.dll
.dll windows:5 windows x86 arch:x86

b56ee6cf404c5405eeff689c530d7c80

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82
Signer

Actual PE Digest

b4:8b:6b:ff:2b:cd:83:f9:21:7b:4d:c7:84:39:a2:8c:f9:17:d8:f4:2d:42:30:73:d4:fd:1f:3d:48:9d:c8:82

Digest Algorithm

sha256

PE Digest Matches

true

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a
Signer

Actual PE Digest

05:8a:47:dc:06:4a:06:bb:0a:1f:09:35:bb:17:53:3f:6f:bf:40:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\utility\coinstaller\objfre_wxp_x86\i386\rtlCoInst.pdb

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
fopen
fgets
strtok
fclose
strncmp
_strnicmp
sprintf

setupapi

SetupDiOpenDevRegKey
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCallClassInstaller

kernel32

DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocaleInfoA
GetSystemDirectoryA
GetLastError
OutputDebugStringA

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

Exports

Exports

rtlCoInst

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RTWLANU_Driver/WinXP/rtwlanu_XP.sys
.sys windows:5 windows x86 arch:x86

3e0062be27a3b83d38ed18ed68be4d15

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2d:4e:7a:ec:99:b0:f0:5f:73:00:00:00:00:00:2d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-01-2016 19:41

Not After

06-04-2017 19:41

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:b9:2d:cf:df:6c:98:c5:e4:0e:4c:c7:df:eb:59:4c:99:e4:77:6a:1d:f1:c7:3f:cd:0b:c7:f0:f7:77:0e:e7
Signer

Actual PE Digest

d2:b9:2d:cf:df:6c:98:c5:e4:0e:4c:c7:df:eb:59:4c:99:e4:77:6a:1d:f1:c7:3f:cd:0b:c7:f0:f7:77:0e:e7

Digest Algorithm

sha256

PE Digest Matches

true

ee:13:4f:5f:f3:49:6a:13:67:5f:5c:82:f3:f5:7c:3f:88:b3:8a:63
Signer

Actual PE Digest

ee:13:4f:5f:f3:49:6a:13:67:5f:5c:82:f3:f5:7c:3f:88:b3:8a:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\windows_server\v1030.6\platform\ndis5\usb\objfre_wxp_x86\i386\rtwlanu.pdb

Imports

ntoskrnl.exe

IoReuseIrp
PoRequestPowerIrp
InterlockedExchange
InterlockedDecrement
KeInitializeEvent
IoBuildDeviceIoControlRequest
KeWaitForSingleObject
KeClearEvent
KeTickCount
KeSetEvent
ExAllocatePoolWithTag
ExFreePool
IoCancelIrp
IoAllocateIrp
IofCallDriver
_alldiv
KeInitializeSpinLock
DbgPrint
KeBugCheckEx
IoFreeIrp
_allshl
_vsnprintf
_aullshr
_aullrem
ExNotifyCallback
strncpy
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlAnsiStringToUnicodeString
RtlInitAnsiString
InterlockedCompareExchange
KeInitializeMutex
KeReleaseMutex
PsTerminateSystemThread
ZwClose
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
ExCreateCallback
RtlInitUnicodeString
KeInitializeSemaphore
KeReleaseSemaphore
MmMapLockedPagesSpecifyCache
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
RtlInitString
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoCsqInitialize
_aulldiv
_allmul
RtlGUIDFromString

hal

KeStallExecutionProcessor
KeGetCurrentIrql
KfLowerIrql
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter

ndis.sys

NdisMRegisterUnloadHandler
NdisMGetDeviceProperty
NdisMSetAttributesEx
NdisGetVersion
NdisMRegisterAdapterShutdownHandler
NdisMDeregisterAdapterShutdownHandler
NdisFreeBufferPool
NdisMRegisterMiniport
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisUnchainBufferAtFront
NdisFreeBuffer
NdisFreePacket
NdisMInitializeTimer
NdisInterlockedIncrement
NdisAllocateMemoryWithTag
NdisInitializeWrapper
NdisAllocateBuffer
NdisAllocatePacket
NdisMRemoveMiniport
NdisInterlockedDecrement
NdisFreePacketPool
NdisMSleep
NdisFreeMemory
NdisCloseFile
NdisUnmapFile
NdisMapFile
NdisOpenFile
NdisInitializeString
NdisInitializeEvent
NdisWaitEvent
NDIS_BUFFER_TO_SPAN_PAGES
NdisQueryBufferOffset
NdisMRegisterDevice
NdisInitUnicodeString
NdisMDeregisterDevice
NdisQueryBuffer
NdisCloseConfiguration
NdisReadNetworkAddress
NdisReadConfiguration
NdisOpenConfiguration
NdisGetCurrentSystemTime
NdisResetEvent
NdisSetEvent
NdisSetTimer
NdisMCancelTimer
NdisScheduleWorkItem

usbd.sys

USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Release notes/ISS_Release.txt
Release notes/Utility_Release.txt
Setup.exe
.exe windows:5 windows x86 arch:x86

c56467cb733da5d0dc212a96a41dcb6c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13-05-2013 00:00

Not After

11-07-2016 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f9:d5:f2:fd:28:e2:09:e9:a5:99:24:80:1f:bd:11:78:fe:30:94:d5
Signer

Actual PE Digest

f9:d5:f2:fd:28:e2:09:e9:a5:99:24:80:1f:bd:11:78:fe:30:94:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

Imports

comctl32

ord17

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

lz32

LZOpenFileW
LZCopy
LZClose

msi

ord88
ord17
ord137
ord141
ord8
ord125
ord171
ord169

kernel32

CreateDirectoryW
FindClose
FindFirstFileW
GetDiskFreeSpaceW
GetDriveTypeW
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
RaiseException
SetErrorMode
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
CreateMutexW
CreateEventW
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FindResourceExW
FreeLibrary
LoadLibraryExW
lstrcmpiW
lstrcpynW
lstrcatW
LoadLibraryW
GetPrivateProfileIntW
IsBadReadPtr
CompareStringW
CompareStringA
GetSystemDefaultLangID
GetUserDefaultLangID
ExpandEnvironmentStringsW
GetCurrentDirectoryW
FileTimeToLocalFileTime
GetFileTime
SetFileAttributesW
HeapAlloc
VerLanguageNameW
GetProcessHeap
CopyFileW
IsValidLocale
GetLocaleInfoW
WideCharToMultiByte
lstrcpyA
GetTickCount
ExitThread
CreateThread
GetExitCodeProcess
ReadFile
GetCommandLineW
FormatMessageW
LocalFree
GetVersionExW
GetWindowsDirectoryW
InterlockedDecrement
InterlockedIncrement
GetTempPathW
CreateFileW
FindResourceW
GlobalFree
GlobalUnlock
FreeResource
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcatA
lstrcmpiA
MulDiv
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
HeapReAlloc
GetStringTypeW
GetCurrentThreadId
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
AreFileApisANSI
GetModuleHandleExW
GetStdHandle
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
MoveFileExW
WriteProcessMemory
VirtualProtectEx
GetSystemDirectoryW
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
TerminateProcess
ExitProcess
GetCurrentProcess
WaitForSingleObject
SetLastError
GetLastError
DuplicateHandle
RemoveDirectoryW
HeapFree
DeleteFileW
SetCurrentDirectoryW
lstrlenW
lstrcpyW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
Sleep
CloseHandle
GetACP
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
InterlockedExchange
lstrcpynA
ReadConsoleW
LocalAlloc
FindNextFileW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
lstrcmpW
GetShortPathNameW
GetCurrentThread
QueryPerformanceCounter
SearchPathW
lstrcmpA
SystemTimeToFileTime
ResetEvent
SetEvent
VirtualProtect
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetDateFormatW
GetTimeFormatW
GetTempFileNameW
GetEnvironmentVariableW
CompareFileTime
SetFileTime
OpenProcess
GetProcessTimes
lstrlenA
GetLocalTime
GetCurrentProcessId
GetVersion
LCMapStringW
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection

user32

wsprintfW
CharUpperBuffW
SendMessageW
MoveWindow
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetDlgItemTextW
SetActiveWindow
SetForegroundWindow
SetWindowTextW
GetWindowRect
MessageBoxW
GetWindowLongW
WaitForInputIdle
SetWindowLongW
LoadIconW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
SystemParametersInfoW
GetWindow
FillRect
GetSysColor
MapWindowPoints
RemovePropW
GetPropW
SetPropW
EndPaint
BeginPaint
EnableMenuItem
GetSystemMetrics
SetFocus
DefWindowProcW
GetMessageW
LoadStringW
LoadImageW
ReleaseDC
GetDC
CreateDialogParamW
GetParent
GetWindowTextW
CharNextW
GetDesktopWindow
GetClientRect
IsWindowEnabled
CreateDialogIndirectParamW
IsWindowVisible
IsDialogMessageW
FindWindowExW
ScreenToClient
EnableWindow
MsgWaitForMultipleObjects
SendDlgItemMessageW
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
ExitWindowsEx
CharUpperW
wsprintfA
CallWindowProcW
CreateWindowExW
DrawIcon
DrawTextW
UpdateWindow
GetWindowDC
InvalidateRect
DrawFocusRect
CopyRect
InflateRect
EnumChildWindows
GetClassNameW
MapDialogRect
RegisterClassExW
GetDlgItemTextW
IntersectRect
MonitorFromPoint

gdi32

SetTextColor
SetBkMode
SetBkColor
SaveDC
RestoreDC
CreateSolidBrush
UnrealizeObject
CreateHalftonePalette
GetDIBColorTable
SelectPalette
SelectObject
RealizePalette
GetSystemPaletteEntries
GetDeviceCaps
DeleteDC
CreatePalette
CreateCompatibleDC
BitBlt
GetObjectW
TranslateCharsetInfo
DeleteObject
CreateFontIndirectW
CreateCompatibleBitmap
CreateDCW
CreatePatternBrush
GetStockObject
GetTextExtentPoint32W
DeleteMetaFile
CreateDIBitmap
CreateBitmap
CreateRectRgn
PatBlt
PlayMetaFile
SelectClipRgn
SetMapMode
SetMetaFileBitsEx
SetPixel
StretchBlt
SetStretchBltMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
TextOutW

advapi32

RegCreateKeyExW
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
RegEnumKeyW
RegCreateKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteExW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
ProgIDFromCLSID
CreateStreamOnHGlobal
GetRunningObjectTable
CreateItemMoniker
CoLoadLibrary
CoCreateGuid
StringFromGUID2

oleaut32

LoadTypeLi
SetErrorInfo
SysReAllocStringLen
GetErrorInfo
CreateErrorInfo
VarBstrCmp
SysAllocStringLen
RegisterTypeLi
VariantClear
SysAllocString
SysFreeString
SysStringByteLen
SysStringLen
SysAllocStringByteLen
VariantInit
VariantChangeType
VarBstrCat
VarUI4FromStr

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

gdiplus

GdipGetImageWidth
GdipCreateFromHDC
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromResource
GdipDrawImageRectI
GdipSetInterpolationMode
GdiplusStartup
GdipGetImageHeight
GdipDeleteGraphics

Sections

.text
Size: 682KB - Virtual size: 682KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Setup.ini
UnInstall.bat
.bat .vbs
Uninstall.iss
data1.cab
data1.hdr
data2.cab
layout.bin
setup.ico
setup.inx
setup.iss

Resubmissions

Sharing

General

Malware Config

Signatures

Files

3e964113e03f48d6bb97e573641473e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

oleaut32

kernel32

advapi32

ole32

ws2_32

rpcrt4

user32

wtsapi32

version

wlanapi

xmllite

iphlpapi

Exports

Exports

Sections

.text Size: 973KB - Virtual size: 972KB

.data Size: 85KB - Virtual size: 108KB

.pdata Size: 32KB - Virtual size: 31KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 19KB - Virtual size: 18KB

6004db2032b32bb8de53233f01f973a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

oleaut32

kernel32

advapi32

ole32

ws2_32

rpcrt4

user32

wtsapi32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

69:37:71:1e:02:90:a5:d7:ed:11:6d:79:cd:61:07:ef:dd:7c:f0:64
Signer

.text
Size: 973KB - Virtual size: 972KB

.data
Size: 85KB - Virtual size: 108KB

.pdata
Size: 32KB - Virtual size: 31KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 19KB - Virtual size: 18KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1c:fe:89:c8:1d:d3:b7:3e:6a:04:9b:5a:ff:23:b1:75:71:a8:7c:bb
Signer

.text
Size: 866KB - Virtual size: 866KB

.data
Size: 55KB - Virtual size: 76KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 53KB - Virtual size: 52KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 384B - Virtual size: 363B

.data
Size: 384B - Virtual size: 284B

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 768B - Virtual size: 690B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 596B

.pdata
Size: 512B - Virtual size: 420B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 640KB - Virtual size: 2.2MB

.rsrc
Size: 131KB - Virtual size: 132KB

.reloc
Size: 512B - Virtual size: 512B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate