path32466[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

path32466.rar
Size

8.2MB
MD5

95e77bdf04b7031650d6c6db30407cbd
SHA1

e35af824924047ada641cc7a2a99b189273291e3
SHA256

0cdec19adb735aca908f217797e20640983530d126d56beb20fde22886234cf2
SHA512

b57b74404b74742ecad0b4d56f2f0cd6adac88b440a8ee438b8d38985f484751c2d3d44bc5f33de00fc1df4681cf693468d08139b718cbbc26356a38e92fd743
SSDEEP

196608:B0r0FPd7F7LlvUb5Ljz7993RREblHkt3bd3bJyEBqsMsQ0l7yw0:B02lIvz7bBREblEv3lyEY2RV0

Score

1^/10

Malware Config

Signatures

Files

path32466.rar
.rar

Password: 1234
AppFile.exe
.exe windows:5 windows x86 arch:x86

Password: 1234

bf95d1fc1d10de18b32654b123ad5e1f

Code Sign

40:4c:4c:82:ec:36:cb:93:79:60:06:88:51:7f:3d:c7
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

24/10/2023, 17:03

Not After

24/10/2024, 17:02

Subject

SERIALNUMBER=6703101,CN=Signal Messenger\, LLC,O=Signal Messenger\, LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:c8:db:f4:c3:9a:19:0f:0d:51:dc:0e:42:5b:ec:1e:dc:59:7d:92:85:fe:1f:98:e6:96:35:ee:f4:7d:08:f8
Signer

Actual PE Digest

fc:c8:db:f4:c3:9a:19:0f:0d:51:dc:0e:42:5b:ec:1e:dc:59:7d:92:85:fe:1f:98:e6:96:35:ee:f4:7d:08:f8

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 516KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
res/NvFBC.dll
.dll windows:6 windows x86 arch:x86

Password: 1234

601bb7a2c9da4e7ff43e5b557fc3742d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/10/2022, 00:00

Not After

15/10/2025, 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

04/10/2022, 17:21

Not After

01/01/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/01/2023, 19:14

Not After

15/12/2023, 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d
Signer

Actual PE Digest

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d

Digest Algorithm

sha256

PE Digest Matches

true

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d
Signer

Actual PE Digest

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_13\drivers\Monterey\NvFBC\_out\wddm2_x86_release\NvFBC.pdb

Imports

kernel32

CreateEventA
InitializeCriticalSectionEx
RaiseException
DecodePointer
Sleep
GetCurrentThreadId
GetSystemDirectoryW
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
OpenEventA
WaitForMultipleObjects
ReleaseMutex
UnmapViewOfFile
OpenMutexA
SetEvent
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetCurrentProcess
K32GetModuleBaseNameA
GetModuleFileNameA
SetLastError
GetFullPathNameW
ExpandEnvironmentStringsW
GetModuleFileNameW
LocalAlloc
FreeLibrary
DeleteCriticalSection
LocalFree
CreateProcessW
GetModuleHandleW
CreateProcessA
lstrcmpW
LoadLibraryExW
OutputDebugStringW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
HeapSize
ReadConsoleW
GetProcAddress
GetSystemTimeAsFileTime
CreateFileW
GetCurrentProcessId
CreateDirectoryW
ReadFile
FileTimeToSystemTime
GetEnvironmentVariableA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
CloseHandle
QueryPerformanceFrequency
QueryFullProcessImageNameA
GetLastError
OpenProcess
GetFileAttributesW
WaitForSingleObject
GetCurrentThread
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
InitializeSListHead
FormatMessageA
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
MultiByteToWideChar
LCMapStringEx
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapFree
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
SetEndOfFile

user32

EnumDisplayDevicesA
UnregisterClassA
GetMonitorInfoA
InvalidateRect
GetDesktopWindow
EnumDisplaySettingsA
EnumDisplaySettingsExA
GetWindowThreadProcessId
GetPhysicalCursorPos
GetDC
GetCursor
GetSystemMetrics
DrawIcon
GetCursorInfo
WindowFromPhysicalPoint
AttachThreadInput
ReleaseDC

gdi32

GetDeviceCaps
CreateDCA
BitBlt

d3d9

Direct3DCreate9Ex

advapi32

EventWriteTransfer
EventRegister
EventUnregister
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegGetValueA
RegCloseKey
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegOpenKeyExA
RegQueryValueExW

ole32

CoTaskMemFree

dxva2

DXVA2CreateVideoService

d3d11

D3D11CreateDevice

Exports

Exports

NvFBC_Create
NvFBC_CreateEx
NvFBC_Enable
NvFBC_GetSDKVersion
NvFBC_GetStatus
NvFBC_GetStatusEx
NvFBC_SetGlobalFlags
NvFBC_UnloadNvAPI
NvOptimusEnablement

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
res/NvFBC64.dll
.dll windows:6 windows x64 arch:x64

Password: 1234

75627fd73ff0e0a5466a76b4c841e71b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/10/2022, 00:00

Not After

15/10/2025, 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/01/2023, 19:14

Not After

15/12/2023, 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50
Signer

Actual PE Digest

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50

Digest Algorithm

sha256

PE Digest Matches

true

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50
Signer

Actual PE Digest

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_13\drivers\Monterey\NvFBC\_out\wddm2_amd64_release\NvFBC64.pdb

Imports

kernel32

CreateEventA
InitializeCriticalSectionEx
RaiseException
DecodePointer
Sleep
GetCurrentThreadId
GetSystemDirectoryW
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
OpenEventA
WaitForMultipleObjects
ReleaseMutex
UnmapViewOfFile
OpenMutexA
SetEvent
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetCurrentProcess
K32GetModuleBaseNameA
GetModuleFileNameA
SetLastError
GetFullPathNameW
GetModuleFileNameW
LocalAlloc
FreeLibrary
DeleteCriticalSection
LocalFree
CreateProcessW
GetModuleHandleW
CreateProcessA
LoadLibraryExW
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
HeapSize
GetProcAddress
GetSystemTimeAsFileTime
CreateFileW
GetCurrentProcessId
ReadConsoleW
CreateDirectoryW
FileTimeToSystemTime
GetEnvironmentVariableA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
CloseHandle
QueryPerformanceFrequency
QueryFullProcessImageNameA
GetLastError
OpenProcess
GetFileAttributesW
WaitForSingleObject
ReadFile
GetCurrentThread
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
InitializeSListHead
FormatMessageA
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
MultiByteToWideChar
LCMapStringEx
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapFree
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlUnwind

user32

EnumDisplayDevicesA
UnregisterClassA
GetMonitorInfoA
InvalidateRect
GetDesktopWindow
EnumDisplaySettingsA
EnumDisplaySettingsExA
GetWindowThreadProcessId
GetPhysicalCursorPos
GetDC
GetCursor
GetSystemMetrics
DrawIcon
GetCursorInfo
WindowFromPhysicalPoint
AttachThreadInput
ReleaseDC

gdi32

GetDeviceCaps
CreateDCA
BitBlt

d3d9

Direct3DCreate9Ex

advapi32

EventWriteTransfer
EventRegister
EventUnregister
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegGetValueA
RegCloseKey
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegOpenKeyExA
RegQueryValueExW

ole32

CoTaskMemFree

dxva2

DXVA2CreateVideoService

d3d11

D3D11CreateDevice

Exports

Exports

NvFBC_Create
NvFBC_CreateEx
NvFBC_Enable
NvFBC_GetSDKVersion
NvFBC_GetStatus
NvFBC_GetStatusEx
NvFBC_SetGlobalFlags
NvFBC_UnloadNvAPI
NvOptimusEnablement

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
res/nvopencl64.dll
.dll windows:6 windows x64 arch:x64

Password: 1234

c8c58351e5ca391763e8650fd0af4838

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/10/2022, 00:00

Not After

15/10/2025, 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/01/2023, 19:14

Not After

15/12/2023, 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:10:ed:c8:29:09:e8:61:16:47:36:a8:44:6b:7e:b5:e0:30:5c:62:9d:a3:bb:f0:cf:5c:10:83:37:0d:04:fb
Signer

Actual PE Digest

6d:10:ed:c8:29:09:e8:61:16:47:36:a8:44:6b:7e:b5:e0:30:5c:62:9d:a3:bb:f0:cf:5c:10:83:37:0d:04:fb

Digest Algorithm

sha256

PE Digest Matches

true

6d:10:ed:c8:29:09:e8:61:16:47:36:a8:44:6b:7e:b5:e0:30:5c:62:9d:a3:bb:f0:cf:5c:10:83:37:0d:04:fb
Signer

Actual PE Digest

6d:10:ed:c8:29:09:e8:61:16:47:36:a8:44:6b:7e:b5:e0:30:5c:62:9d:a3:bb:f0:cf:5c:10:83:37:0d:04:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r535\r537_13\drivers\gpgpu\_out\wddm2_amd64_release\nvopencl64.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

kernel32

WriteFile
GetModuleHandleExW
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
GetEnvironmentVariableA
CreateFileW
GetFileAttributesW
FreeLibraryAndExitThread
GetSystemDirectoryW
UnmapViewOfFile
GetModuleHandleA
Sleep
GetFileInformationByHandle
GetLastError
SetFileInformationByHandle
CloseHandle
CreateThread
GetProcAddress
VerSetConditionMask
GetModuleHandleW
FreeLibrary
VerifyVersionInfoW
GetSystemTimeAsFileTime
CreateFileMappingW
MapViewOfFileEx
OpenProcess
QueryFullProcessImageNameW
WaitNamedPipeA
CreateNamedPipeA
WaitForSingleObject
DisconnectNamedPipe
CreateFileA
SetEvent
ResetEvent
GetOverlappedResult
CreateEventA
GetTickCount
ConnectNamedPipe
LoadLibraryW
SwitchToThread
HeapCreate
HeapFree
HeapAlloc
HeapDestroy
SleepConditionVariableCS
GetCurrentProcess
SetThreadAffinityMask
InitializeSRWLock
GetFullPathNameW
TryEnterCriticalSection
CreateFileMappingNumaA
FindFirstFileA
TlsSetValue
VirtualProtect
EnterCriticalSection
VirtualFree
ReleaseSemaphore
TryAcquireSRWLockExclusive
VirtualAlloc
GetProcessAffinityMask
WakeAllConditionVariable
WakeConditionVariable
WaitForMultipleObjects
FindNextFileA
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
TryAcquireSRWLockShared
UnlockFileEx
GetLargePageMinimum
GetCommandLineW
FindClose
GetCurrentThreadId
OpenFileMappingW
GetCurrentDirectoryA
ReleaseSRWLockExclusive
GetNumaNodeProcessorMask
GetCurrentThread
AcquireSRWLockExclusive
TlsAlloc
QueryPerformanceFrequency
DeleteFileA
HeapReAlloc
GetFileAttributesExA
GetNativeSystemInfo
GetSystemInfo
GetLocalTime
GetFileSizeEx
CreateFileMappingA
LockFileEx
AcquireSRWLockShared
RemoveDirectoryA
GetTimeZoneInformation
SetEnvironmentVariableA
GetCurrentProcessId
GlobalMemoryStatusEx
TlsGetValue
TlsFree
CreateDirectoryA
CreateSemaphoreA
MapViewOfFile
QueryPerformanceCounter
VirtualQuery
GetComputerNameA
DeviceIoControl
PeekNamedPipe
ReadFile
LoadLibraryA
SetLastError
LocalAlloc
LocalFree
CreateProcessW
CreateProcessA
LoadLibraryExW
GetModuleHandleExA
LoadLibraryExA
GetModuleFileNameA
FormatMessageA
DuplicateHandle
SetCurrentDirectoryW
DeleteFileW
GetFileAttributesExW
GetWindowsDirectoryA
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
ExitProcess
SetStdHandle
GetFileType
ExitThread
ResumeThread
GetStdHandle
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
SetConsoleCtrlHandler
WideCharToMultiByte
HeapSize
HeapQueryInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetDriveTypeW
ReleaseSRWLockShared
FileTimeToSystemTime
DeleteCriticalSection
TerminateThread
CreateWaitableTimerA
SetFilePointer
GetExitCodeProcess
WaitForSingleObjectEx
CreateEventW
RtlUnwind
SystemTimeToTzSpecificLocalTime

advapi32

GetTokenInformation
RegOpenKeyExW
RegGetValueW
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
EqualSid
GetSecurityInfo
OpenProcessToken

user32

EnumDisplayDevicesA

gdi32

CreateDCA
DeleteDC

Exports

Exports

clGetExportTable
clGetExtensionFunctionAddress
clGetPlatformInfo
cuGetExportTable

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 976KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

bf95d1fc1d10de18b32654b123ad5e1f

Code Sign

40:4c:4c:82:ec:36:cb:93:79:60:06:88:51:7f:3d:c7Certificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

4a:53:8c:28Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

fc:c8:db:f4:c3:9a:19:0f:0d:51:dc:0e:42:5b:ec:1e:dc:59:7d:92:85:fe:1f:98:e6:96:35:ee:f4:7d:08:f8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 452KB

.ndata Size: - Virtual size: 516KB

.rsrc Size: 296KB - Virtual size: 296KB

Password: 1234

601bb7a2c9da4e7ff43e5b557fc3742d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:baCertificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1fCertificate

Extended Key Usages

Key Usages

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5dSigner

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

d3d9

advapi32

40:4c:4c:82:ec:36:cb:93:79:60:06:88:51:7f:3d:c7
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

4a:53:8c:28
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

fc:c8:db:f4:c3:9a:19:0f:0d:51:dc:0e:42:5b:ec:1e:dc:59:7d:92:85:fe:1f:98:e6:96:35:ee:f4:7d:08:f8
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 452KB

.ndata
Size: - Virtual size: 516KB

.rsrc
Size: 296KB - Virtual size: 296KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d
Signer

0a:30:9f:f2:db:10:f2:a3:fb:c7:86:16:46:05:ce:94:43:bf:79:9c:be:b6:b3:3b:35:24:e0:9d:8e:d3:15:5d
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 128KB - Virtual size: 128KB

.data
Size: 10KB - Virtual size: 25KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 82KB - Virtual size: 81KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50
Signer

fe:e2:bb:ab:7e:58:0d:f6:53:c4:1a:7d:bc:f7:53:45:1f:f9:7e:54:6a:5e:22:21:63:7c:c1:24:b3:87:83:50
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 323KB - Virtual size: 323KB

.data
Size: 12KB - Virtual size: 39KB

.pdata
Size: 124KB - Virtual size: 124KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 5KB - Virtual size: 4KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate