HWID Spoofer Final.zip
- SHA256 3d5a0cda5722cdefdceb86e511e191c1c9d147c9aadf964f792d63e5aacfbeb8
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target HWID Spoofer Final.zip
- Size 10.2MB
- Sample260416-cdc7fsd12j
- SHA256 3d5a0cda5722cdefdceb86e511e191c1c9d147c9aadf964f792d63e5aacfbeb8
- MD5 c20d2c8ee0bbd890999aea5df5be143c
- SHA1 1cab8a73e8ed5a97020433968c677dff28e83bc1
- SHA512 7266c093b5abf9dd499ac9dea676eacdb7ac632e9cbab777321c23a066a5f2f394e742138e4ee494200689ccfba1021c49d55e812d62df7ac2c767a652fbe010
- SSDEEP 196608:hc3hXnsdFvEOCwiDed/xvrqHpp5lgLn/lXbBC/nWGOUCD:gNsL0wFdEpvlgLn/Z6W+CD
- TLSH T1AAB6331602F0C532C94A2E76958C27E4B37A2B7C02F156AD3A1AFDBC358F5F5452AEC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TraceX Final/tools/AMIDEWINx64.EXE - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/TraceX Final/tools/RevoUninstaller.exe
File Explorer
-
HWID Spoofer Final.zip.zip 10.2MB
-
TraceX Final/READ ME BEFORE YOU START.txt4KB
-
TraceX Final/Run-TraceX-HWID-Spoofer.bat.bat 6KB
-
TraceX Final/scripts/TraceX-Helpers.ps1.ps1 929B
-
TraceX Final/scripts/change_disk_ids.ps1.ps1 18KB
-
TraceX Final/scripts/change_hardware_ids.ps1.ps1 27KB
-
TraceX Final/scripts/change_mac_address.ps1.ps1 33KB
-
TraceX Final/scripts/change_monitor_hwid.ps1.ps1 35KB
-
TraceX Final/scripts/change_registry_hwids.ps1.ps1 14KB
-
TraceX Final/scripts/create_restore_point.ps1.ps1 3KB
-
TraceX Final/scripts/hide_peripheral_serials.ps1.ps1 24KB
-
TraceX Final/scripts/setup_vpn.ps1.ps1 28KB
-
TraceX Final/scripts/tracex_cleaner.ps1.ps1 12KB
-
TraceX Final/scripts/uninstall_game.ps1.ps1 4KB
-
TraceX Final/templates/nordvpn_template.ovpn3KB
-
TraceX Final/tools/AMIDEWINx64.EXE.exe 455KB
-
TraceX Final/tools/HWID-Spoofer.ps1.ps1 12KB
-
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi.msi 5.5MB
-
TraceX Final/tools/RevoUninstaller.exe.exe 20.8MB
-
TraceX Final/tools/VolumeID.exe.exe 228KB
-
TraceX Final/tools/VolumeID64.exe.exe 165KB
-
TraceX Final/tools/amifldrv64.sys.sys 29KB
TraceX Final/READ ME BEFORE YOU START.txt
- SHA256 d8866f892b595753a400a63ad157715c3abbfa11bd05a2de09c1f2da1fa3ba8a
- MD5 bcb6e28d5890e32dc0fd8b647cd85f78
- SHA1 c821b0fc390be7eea69ae9cfea2a89c313aa7625
- SHA512 73ff9748f3b0d229ad407d74b3da3c9ba31f7635d84afa1f455421a5cbb79349a0dc25592d5895399733f1e3e57ee986091222d0f5a2bf8e6fe9672534e5724a
- SSDEEP 96:0J37HSCaEXVu4TcUrZUtfVToQgTEtQAuc9rEL6hzYDbITLpey:W7yGVLUtfVToTotFhBEL6hzYDsTJ
- TLSH T1C091832F6E429E324E97D112610F21E8F71191AC734564AE742E301D03BCB6B61FD2CD
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/Run-TraceX-HWID-Spoofer.bat
- SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
- MD5 4f98523504c362ef51a4c82768e8b51a
- SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
- SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
- SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
- TLSH T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/TraceX-Helpers.ps1
- SHA256 06cc3e5cd3fafc24da12db08934cb700fceb5ea61b448b94f0aaf2e656c0a125
- MD5 373620513b4d0f6f687841413ce2321d
- SHA1 3e36e0f9c4cd77375ce405818da04158fea3cc57
- SHA512 873ca999d7b2c99ab77269e440df0af9da9f47f678f326e71ee1c5d1e6ed53374defe3dbb1fcc91b6aaa5d4d85e9cb36c8e1138e9be7598e9f7723a7bc6b6a84
- TLSH T13511C058C240DF5C5CF71BE43446B43C89DC012BF2186A6CF4DE53D16B7C29C5216A4C
- MD5 SHA1 SHA512 TLSH
TraceX Final/scripts/change_disk_ids.ps1
- SHA256 1f8d5f2b9f325c5ff76f2dee89b58e87a14a8a63099faadf67dc8c4e9c79b4f5
- MD5 2e9153edc202d577555609c1d85c25b5
- SHA1 91826b9d6ecfe05c22963137ae77a43e451e33f9
- SHA512 8c70b8caa9afdd7ecd2fdd34216ee4e24b246042493ab48fe7e4625b8b567d47cd896121cdeee86aac6a184d7f5a6c44f2032e49a2ed3630393610dd5c7cba5a
- SSDEEP 384:Efwi30WJSZ/RUxpVanrk5cGhbdR2DwXuV:EfnkWJSZ/RUx3agxHeV
- TLSH T19F82511DAA086D984AB35FFD89C36620FC8700BFC19B7490F95C81D12F7921ED255EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/change_hardware_ids.ps1
- SHA256 45acb80d0e7018581549dd2151c9a5e7fb790010ada6cc1bf68a1bde2c6874e4
- MD5 8933162333b954f8b77cdc3899b8b9e6
- SHA1 71209a7de51692f06e19553b73c478c991572848
- SHA512 99645c9f6caefc60545ce4bdbb50741fd040a0485cab9b2c88a167ea118a2cf996d218113af8e181fe6172e865f79827e3682d550d3a9db3ceffb8f9bf0ec3b3
- SSDEEP 192:Z4E0fUddycoIrI3zJumighSP3Pl2IA9ZuMYwK5iQS5iQ4Z4JoiQKCoQoMR5RqRoz:zGIgLt62fYfX1dXSxWOxk
- TLSH T1E8C2132CF945191E565300BE0404A204BD97917B91AD6EC0FA4C81E47FCA73E9B72AFF
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/change_mac_address.ps1
- SHA256 ed8decb95bca85a67a7b561c13bd620aea4435f6eb0f7281ecb9c978c659adc4
- MD5 7c30e9dbc601ce74f051783907893ce7
- SHA1 145e8b26e07f995734cd9f9a0a9fbdcb5ba18e07
- SHA512 35487cd0ad32fad87bf5898568339ccbd778773507d6e9b38557568916fc42e824bff2325b8f9be8261caf18f7d4e6ab69c878e51f04b8db07d21dbf053a1d13
- SSDEEP 384:vQFbkas42hanB7OznU4zgvBYAdqLZlAa9ktBfm04yqRXuNU5skkAKnOE7vFxcQU8:f4wsGuPLoa
- TLSH T1DCE2FC1DAD49155E9AB382BE4881A104FDD2457B918F1DC0B50CC0E87FFB36E8A26DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/change_monitor_hwid.ps1
- SHA256 96dbe729cfd2342479c2f701a9bb579bcf28f18970fd2d8c9790b39c54ab3e78
- MD5 8a64b6da7004cf0d74de77f82f0ffecf
- SHA1 544ad208d462a0fb5abd0b7a5ff739106a0e50ee
- SHA512 b61f2ee03334866d5b1978ade865ad078658a187c165c54544fb12ea4e7b42c25527a4889bee2652d3d2de7ca71b239392a3bffe1f676710231c7fe7c334fb1e
- SSDEEP 192:T4ERilehRb65VQiAGtvU34/n4nvDorldfTUifRQwNEyTnEOPVUmXxuDRCjBptcn6:EkQUiAGqI/ckTfTb6ViV6MjVcRM
- TLSH T116F29A2CAC05051B16B3B37E08429614F996452BA29B1EC0B60CD0F47FFB75ED729DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/change_registry_hwids.ps1
- SHA256 bac1e6d032ada2b0d5dc5d96205f3b09e9bce2698c2cea7655e7220bdd5bd471
- MD5 47a5eb9db7b6329b47cf0837ca058ec2
- SHA1 a14df46167467a7186b441a8783a0ba2972d1cfc
- SHA512 bf2bd4445a5b42bdff0cd9c0b96c0879a159fb62840d5a7559daf66bc79e94112da16b58c03623c224c5091da55b7f876d3c4128f9ee37cd49a489711bccb03c
- SSDEEP 192:EL4EQDo8qxg0Beccd3gfq275UYtYMhLiV3tCfvfKSC:Ejnxhec03KUmYkirCi
- TLSH T13C62531EAD8E011771F3573D4AA15124EC87417F922A2EC0768C80E87FF915CD6A1EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/create_restore_point.ps1
- SHA256 6c03eaf50c6e371bd73c802dac178f90071ba4061cf05106cfd94a6017b67b3a
- MD5 ff5f49ac8f6047e9d084035065841c06
- SHA1 cb5f3eaf9b1b7af0898245cadda3257797ee902e
- SHA512 b88004fce63a95be93e67cd15d649ae82b50cd291d17e06a9583a8caf7743bfd4f2913cb36c19561672f884fcc3ed568045818fd728a0cb8682bc14c5c63fdfa
- TLSH T194818418A904721647F34B2F5959E114F81E003B538A529078ACD458BFF07AE4B37FF0
- MD5 SHA1 SHA512 TLSH
TraceX Final/scripts/hide_peripheral_serials.ps1
- SHA256 81ae14285af2a980166306f6a70b951d24b9713b5c75f7ca546540bbd3c0eb65
- MD5 e49d58c9df1c9fde9d11607a72cc4639
- SHA1 cf553e3964b943afb272d0b878bf85a35b2e6d1c
- SHA512 9ba67566732a9dbc957734bbcfa93fbf06fcab0174a72a43568674faafd40fa0cfcbb984bcc0af47a59af50e95e297c26e031bc9eecd086a69bf7170e89390a1
- SSDEEP 192:424Efv+RwCV2Bgc2OlDsyrfzkB5mJzImorzg6IsxZbtMDEv8tWk5Clk8PyP6Okzn:4CIwE2BKyrYB5XfQHsxZtMYktWfdmc
- TLSH T18BB21E1DAC05492E06B3C7BE4D919114F997403B81D61AC0BA8CD0E43FF671D9A6EEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/setup_vpn.ps1
- SHA256 36f7cca326f67cacf24d63facafa92e4300527946b590280da30e99e65ab4752
- MD5 56fa01e2df8c9952a5c18531cb080d88
- SHA1 4ec595d5822d9ee61cb0d3c695b63c98a5a65373
- SHA512 acf641ef78b5c0ce372a33985914b35edf3639abca397aa62d95f64a577cd6a2e33703c808f0964e68d3bb3c0fd6c95a675f7fb913da5764679c9108d1a1afd9
- SSDEEP 384:4XH2dunqF8g9Ch21nTfViwZNJ41ZDaTcaQUJBYxt4sdh7EarMjKwjlecW2z:K2JrViY7qaYaQUsh7Wleiz
- TLSH T1D7D2C71E9E01172EAABB877FC8406064FD4A553B038A1582729CD1D53FF052EC3B9D97
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/tracex_cleaner.ps1
- SHA256 4e1d8acd1573d5aaf3f0a3ba2643ff4ae2c21198bc6a5088d6676a6c0646d4b4
- MD5 a82c7d9876943fb05ef4aff598db1534
- SHA1 50be648a119eee18fbf7aa2729ccfd656288b90e
- SHA512 c5ff1a2a5949c130b1c99cb2cc65a4098c6c4f2ec8f5d159c0c3c1467167999e63ec92881213ffc16c828743057d1a42392ae505b95e9a215c7062e3351a7d1e
- SSDEEP 384:dy69x12/x5uR/xYNt1kd2rpFVtses+5neOK+ZFSKkjgAUpJX:9iCc1eOK+ZFSKkjgAUpJX
- TLSH T159425F0A85486929C6970A7F5942E2056BE591BB534F2DE0B94C817CBF8271DCF32DF3
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/scripts/uninstall_game.ps1
- SHA256 5a24c4f14337ed42ee7f332ae660ee3f67015ac02f7c715e9c81d9171439e0a9
- MD5 2070d2561ba7261571524153f6762160
- SHA1 4a804edd1b0e75a3979036e8a3d870132a0484c8
- SHA512 6ddc8760efead4855dfb7b4801b7c07fcc7ce8142ed74a06625734a26570c854b9bacfda4eb32f1063d7276ad73af840114fe12132d8529a3913c91e450ec025
- SSDEEP 48:Tu71aYmPROiy3vDF8Q5qGsb4c1l2840/s/mDObKLg9BTzsfjpqw+3/GYl1hTU1FC:qhmPEMQ5qB4c28A0O1dPJ5UQTMd9G
- TLSH T1EC9111087D0522266FF3477F4A52F418FE46A43F424A16A0759D80E47FBA06C4F66EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/templates/nordvpn_template.ovpn
- SHA256 dc5fb348842414378120af10fcff87eb5a8489b94ab30881886c132e41ed20a3
- MD5 c335b8fe68132fe72d8550500641bbfe
- SHA1 6eb7963651800a38e249f54fc07e8948d0ad75e7
- SHA512 149bbe6b1c19a0749cc5e43a995565c114466bd9e95c75eca3b243325ba6779c64c91537079658b579f5ed8ef63578246604cb20b7ac19081540ba614c984b72
- TLSH T1AE611A1DCF167C0CD1BEC1AD84B091728F9A60C6169932539173F0511D2AF26E3DFB56
- MD5 SHA1 SHA512 TLSH
TraceX Final/tools/AMIDEWINx64.EXE
- IMPHASH 272dae991c0311688a7a20faa5468b8e
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- TLSH T1B0A4084AEB5224E0D876D1B8C981521AF6B0BC7847349BDB729C41090F76AEC9E3DF58
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
GetVersionExA
LoadLibraryA
GetProcAddress
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
GetModuleFileNameA
GetModuleHandleA
SetThreadExecutionState
SetConsoleCtrlHandler
CreateFileA
DeviceIoControl
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
FreeLibrary
SetConsoleMode
shell32
ShellExecuteA
user32
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
CreateWindowExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
wsprintfA
GetMessageA
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
StartServiceA
OpenServiceA
AdjustTokenPrivileges
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=143, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=43, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
TraceX Final/tools/HWID-Spoofer.ps1
- SHA256 03d965268dc89f7682ddccae23fbe71f9b267b68b30f6904fe3fb2a348b3e02f
- MD5 006f527f082850b8a0466b89f51cce16
- SHA1 122a7470708fdf9e560055ee3489396514520bb1
- SHA512 df3933190d7d78c92c6131a9b713c79f678945158872c6acb2d4bd4352a46c216e383fab24777c91311697f5d572958d469d9cd547cd8a04e473f33333ec1202
- SSDEEP 192:p54EonSIV+ZYZ0F0HewZVRxZ1YnMZngWZUZYZ5iZ6CBZ8RxZdYnMZtgWZO2HJgFG:uVImS0+w37j2mri7BILBw2pl
- TLSH T1F352FF08B948256EA5F3577F89819244FCD6983F818A1A80754D80A97FF137ECF62DF2
- MD5 SHA1 SHA512 SSDEEP TLSH
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c457e614df9e3cb5d499625ce7571e8764bde0b87143f7e0f3f2e74c26e65b06
Digest Algorithm
sha256
Digest Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 2, 2025
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0c:d4:c6:76:93:8c:c9:bd:bf:1a:74:ff:b7:d6:7b:1a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 2, 2022 - Dec 2, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
TraceX Final/tools/RevoUninstaller.exe
- IMPHASH 5fd4d9ae5586d86c5f3e12ff7adba0f1
- SHA256 17fa74b386cd22e47ceb8f48b958cf99865985ec6bbb1786f1c62fc3f804bccb
- MD5 a48a4f7ced6fb636ec62eca2eab90678
- SHA1 c26e2d0f3d984187a1a8d05772dae7f243a7f84b
- SHA512 248fe9084aaa7e00865699fd089060348a14d803e5bc121f3fad3b41693f8620eaebae6805a9ecdd547211919c831ae0521e360b3f55e2b551fff6345243c50e
- SSDEEP 196608:4RYn3XUAe1ELJhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIef:4RYn3XUA/JhlqPWpyR1pxf
- TLSH T13C2719B2DA1584CCEE6C6675CE1D89FDDEA26C1AAFA089AF41043D11ED732C09D3D24D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f7:bd:04:e3:6b:17:20:8f:29:56:52:48:35:8a:f5:51:f0:b5:ea:b4:2f:a1:62:c2:e0:97:a8:d7:e0:50:26:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Chains
Jan 1, 0001
PE Signature issue
Digest
b8:d3:f2:2e:8d:a3:95:bb:a3:2b:39:aa:05:a3:c4:44:f4:50:a4:e7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Chains
Jan 1, 0001
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Serial Number
0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 7, 2024 - Aug 13, 2027
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
6
Entry point
3508880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Work\VSRevo\Windows\Projects\VSProjectFree\x64\Release Portable\RevoUnin.pdb
shlwapi
StrCmpIW
ord29
PathIsUNCW
PathUnExpandEnvStringsW
PathIsRootW
ord487
StrStrW
PathRemoveExtensionW
PathMatchSpecW
PathAddBackslashW
PathQuoteSpacesW
StrToIntW
PathStripToRootW
SHDeleteKeyW
SHDeleteValueW
PathRemoveArgsW
PathGetArgsW
PathUnquoteSpacesW
StrFormatKBSizeW
StrCmpW
PathIsDirectoryEmptyW
StrStrIW
PathIsDirectoryW
StrFormatByteSizeW
PathFindFileNameW
PathAppendW
PathFindExtensionW
PathFileExistsW
StrCatW
PathRemoveBackslashW
PathRemoveFileSpecW
StrCpyW
SHQueryValueExW
psapi
GetProcessImageFileNameW
EnumProcesses
GetModuleFileNameExW
msi
ord217
ord173
advapi32
RegQueryValueW
RegGetKeySecurity
RegFlushKey
RegEnumKeyExW
RegCreateKeyExW
RegConnectRegistryW
RegDeleteKeyW
RegEnumKeyW
GetUserNameW
RegNotifyChangeKeyValue
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityInfo
SetEntriesInAclW
OpenProcessToken
RegDeleteKeyExW
FreeSid
SetNamedSecurityInfoW
AllocateAndInitializeSid
ConvertSidToStringSidW
LookupAccountNameW
RegUnLoadKeyW
RegSetValueExW
RegSetKeySecurity
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
DeleteService
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegLoadKeyW
wininet
FindNextUrlCacheEntryW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
kernel32
VirtualFree
GetVersion
GetModuleHandleW
ExitProcess
GetUserDefaultLCID
GetLocaleInfoW
GetLongPathNameW
GetLogicalDriveStringsW
QueryDosDeviceW
VerSetConditionMask
VerifyVersionInfoW
GetLocalTime
GetUserDefaultLangID
GetCommandLineW
GetShortPathNameW
GlobalSize
GlobalFree
CopyFileW
SetLastError
SetThreadPriority
EncodePointer
GetSystemDirectoryW
FreeResource
GetModuleHandleExW
LoadLibraryExW
GlobalDeleteAtom
GlobalAddAtomW
VirtualFreeEx
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
lstrcmpA
GlobalGetAtomNameW
GetVolumeInformationW
GetThreadLocale
ReleaseSemaphore
GetCurrentThread
GetPrivateProfileIntW
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GlobalFlags
CompareStringW
GetSystemDefaultUILanguage
VirtualProtect
SetErrorMode
GetCurrentDirectoryW
FindResourceExW
GetProfileIntW
SearchPathW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
VirtualAllocEx
DecodePointer
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
GetCurrentProcessId
UnregisterWaitEx
QueryDepthSList
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteConsoleW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
SetEnvironmentVariableA
GetACP
GetStdHandle
HeapQueryInformation
GetCommandLineA
SetStdHandle
PeekNamedPipe
GetFileType
FreeLibraryAndExitThread
ExitThread
VirtualQuery
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
LCMapStringW
QueryPerformanceFrequency
SetFilePointerEx
FindFirstFileExW
GetExitCodeThread
GetStringTypeW
IsBadWritePtr
IsBadReadPtr
WinExec
CreateThread
GetVersionExA
GetCurrencyFormatW
GetNumberFormatW
GetTimeFormatW
GetDateFormatW
GetModuleHandleA
GetPriorityClass
SetPriorityClass
GetThreadPriority
GetFileSize
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
RaiseException
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
CreateMutexW
SuspendThread
WriteProcessMemory
InterlockedPopEntrySList
ReadProcessMemory
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
FreeLibrary
GetProcAddress
LoadLibraryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetComputerNameW
WaitForMultipleObjects
CreateEventW
GetTempFileNameW
WideCharToMultiByte
DuplicateHandle
LocalFree
GetCurrentProcess
GetEnvironmentVariableW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
TerminateProcess
GetModuleFileNameW
GetVersionExW
CompareFileTime
GetTempPathW
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceExW
GetFileAttributesW
DeviceIoControl
lstrcmpiW
lstrlenW
InitializeCriticalSectionEx
GetUserDefaultUILanguage
GetBinaryTypeW
GetDriveTypeW
GetLogicalDrives
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
TlsAlloc
SetEvent
ResumeThread
ResetEvent
SetFileAttributesW
RemoveDirectoryW
OpenProcess
WriteFile
CreateFileW
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
CreateProcessW
MoveFileW
lstrcatW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
lstrcmpW
lstrcpyW
GetFullPathNameW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetLastError
CreateDirectoryW
Sleep
MoveFileExW
WaitForSingleObject
FindResourceW
LoadResource
LockResource
SizeofResource
MulDiv
GlobalFindAtomW
user32
DestroyCursor
GetWindowRgn
WindowFromDC
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffW
ModifyMenuW
SetMenuDefaultItem
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
GetComboBoxInfo
MonitorFromPoint
UpdateLayeredWindow
FrameRect
CopyIcon
SetCursorPos
DrawStateW
SetClassLongPtrW
EnumDisplayMonitors
NotifyWinEvent
InvertRect
HideCaret
GetIconInfo
DrawIconEx
DrawFocusRect
GetMenuDefaultItem
MessageBeep
GetNextDlgGroupItem
PostThreadMessageW
GetDCEx
CopyAcceleratorTableW
UnionRect
InvalidateRgn
CreateMenu
GetTabbedTextExtentW
TrackMouseEvent
GetAsyncKeyState
CopyImage
RealChildWindowFromPoint
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatW
PostQuitMessage
DeleteMenu
GetWindowRect
GetClientRect
IsWindow
EndDeferWindowPos
DeferWindowPos
CharNextW
MapVirtualKeyW
GetKeyNameTextW
MsgWaitForMultipleObjectsEx
CharUpperW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
BringWindowToTop
SetParent
DrawEdge
SendDlgItemMessageA
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
GetMenuItemInfoW
WinHelpW
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetLastActivePopup
GetTopWindow
ScreenToClient
BeginDeferWindowPos
IsChild
GetWindowLongPtrW
LoadCursorW
DefWindowProcW
IsCharAlphaNumericW
GetClipboardData
GetCursor
SystemParametersInfoA
CreateIconIndirect
LoadMenuIndirectW
GetClassInfoW
SetTimer
GetFocus
GetSystemMetrics
GetSystemMenu
InvalidateRect
EnableWindow
GetDlgItem
GetSysColor
LoadImageW
DestroyIcon
UpdateWindow
GetParent
SendMessageW
ClientToScreen
LoadAcceleratorsW
CopyRect
SetCursor
PostMessageW
CreateWindowExW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
TranslateAcceleratorW
wsprintfW
KillTimer
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetRectEmpty
SetFocus
RedrawWindow
SetWindowPos
ShowWindow
SetScrollPos
GetDC
ReleaseDC
GetCursorPos
OffsetRect
InflateRect
LoadStringW
LoadIconW
RegisterHotKey
UnregisterHotKey
DestroyMenu
LoadMenuW
MonitorFromWindow
GetMonitorInfoW
EqualRect
GetClassNameW
GetDesktopWindow
SetScrollRange
GetScrollRange
GetScrollPos
LockWindowUpdate
GetWindowLongW
SetWindowLongW
IsZoomed
IsRectEmpty
FillRect
DrawFrameControl
GetMessagePos
UnregisterClassW
SetRect
GetSysColorBrush
LoadBitmapW
SetWindowRgn
SystemParametersInfoW
GetForegroundWindow
SetForegroundWindow
GetWindowDC
FindWindowW
EnumChildWindows
SetLayeredWindowAttributes
PtInRect
IsIconic
DrawIcon
SetCapture
ReleaseCapture
WindowFromPoint
GetClassLongPtrW
SetWindowLongPtrW
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
ScrollWindow
SetActiveWindow
SetMenu
GetMenu
GetCapture
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsMenu
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
RegisterWindowMessageW
IsDialogMessageW
GetWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
IsWindowEnabled
GetDlgCtrlID
SendDlgItemMessageW
CheckDlgButton
SetDlgItemTextW
MoveWindow
EndPaint
BeginPaint
IntersectRect
CallNextHookEx
SetWindowsHookExW
ValidateRect
GetKeyState
GetWindowThreadProcessId
PeekMessageW
CreatePopupMenu
InsertMenuW
TrackPopupMenu
IsWindowVisible
GetMenuItemCount
GetMenuItemID
GetSubMenu
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
MessageBoxW
IsCharAlphaW
GetDoubleClickTime
GetActiveWindow
GetMenuStringW
GetMenuState
AppendMenuW
RemoveMenu
EnableScrollBar
gdi32
ExcludeClipRect
GetClipBox
GetCurrentPositionEx
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PlayMetaFile
RestoreDC
SaveDC
CreateSolidBrush
CreateHatchBrush
SetRectRgn
SetBkColor
PatBlt
SelectClipRgn
ExtSelectClipRgn
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetTextFaceW
SelectPalette
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
CreateEllipticRgn
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
CreatePalette
EnumFontFamiliesExW
GetRgnBox
StretchDIBits
GetCharWidthW
OffsetRgn
GetViewportOrgEx
GetTextAlign
GetTextColor
DeleteMetaFile
CreateMetaFileW
CloseMetaFile
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
MoveToEx
GetTextMetricsW
GetDeviceCaps
GetTextExtentPoint32W
CreateFontIndirectW
DeleteObject
GetObjectW
GetBkColor
BitBlt
DPtoLP
GetMapMode
CreateCompatibleBitmap
CreateDIBSection
CreateBitmap
LPtoDP
CreateCompatibleDC
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteDC
SelectObject
SetDIBColorTable
CreateFontW
GetStockObject
Ellipse
Rectangle
CreatePen
GetStretchBltMode
SetStretchBltMode
CreateRectRgn
SetROP2
SetTextColor
SetTextAlign
StartDocW
CombineRgn
GetDIBits
StretchBlt
CopyMetaFileW
CreateDCW
CreatePatternBrush
CreateRectRgnIndirect
GetWindowOrgEx
GetDCOrgEx
GetMetaFileW
CloseEnhMetaFile
CreateEnhMetaFileW
DeleteEnhMetaFile
GetEnhMetaFileW
PlayEnhMetaFile
GetTextCharset
CreateEllipticRgnIndirect
ExtCreatePen
EndDoc
msimg32
TransparentBlt
AlphaBlend
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
shell32
SHEmptyRecycleBinW
SHAddToRecentDocs
DragFinish
DragQueryFileW
Shell_NotifyIconW
SHGetKnownFolderPath
CommandLineToArgvW
SHGetSpecialFolderLocation
SHFileOperationW
SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
ExtractIconW
SHGetFolderPathW
ord92
comctl32
ord17
_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_Remove
ImageList_GetImageCount
ImageList_GetIcon
ImageList_AddMasked
ImageList_Duplicate
ImageList_GetImageInfo
uxtheme
GetThemeSysColor
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeText
DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData
ole32
IsAccelerator
OleTranslateAccelerator
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
StgOpenStorageOnILockBytes
CoGetClassObject
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CoDisconnectObject
CLSIDFromProgID
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoCreateGuid
OleSaveToStream
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
WriteClassStm
DoDragDrop
oleaut32
VarDiv
VarR8FromStr
VarMul
VarI4FromStr
VarBstrFromR8
OleCreatePictureIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysFreeString
SysAllocString
VariantInit
VariantClear
VarDateFromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
OleCreateFontIndirect
SysStringLen
SafeArrayDestroy
VariantCopy
VarCyFromStr
LoadTypeLi
oledlg
OleUIBusyW
urlmon
URLDownloadToFileW
gdiplus
GdipBitmapUnlockBits
GdipGetImagePaletteSize
GdipBitmapLockBits
GdipAlloc
GdipFree
GdipGetImagePalette
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageHeight
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCreateBitmapFromStream
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
oleacc
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
winmm
PlaySoundW
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
Name
.text
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
140KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.giats
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11.5MB
Virtual Size
11.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=203, id=243, version=40116,
count=34, id=242, version=40116,
count=23, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=47, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=2, id=261, version=23013,
count=16, id=206, version=65501,
count=1, id=207, version=65501,
count=1, id=199, version=41118,
count=43, id=260, version=24123,
count=12, id=259, version=24123,
count=466, id=261, version=24123,
count=3, id=208, version=65501,
count=53, id=203, version=65501,
count=1043, id=1, productName=Unmarked objects,
count=106, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
TraceX Final/tools/VolumeID.exe
- IMPHASH 196b8047c609ccadce7fd294c9a3e6a2
- SHA256 22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3
- MD5 4d867033b27c8a603de4885b449c4923
- SHA1 f1ace1a241bab6efb3c7059a68b6e9bbe258da83
- SHA512 b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702
- SSDEEP 3072:OgfbRmDIHA98kK2WndTslNac+dA6YdqhsXCNZpp4GIoHZUFozD3zgJwDmr9u76v9:OSCgkKdcg9vCoaoMpcto
- TLSH T160347C11B2E48030E0F3167256B4D7620A7FBD729D36DA9EA7D84D4E4A74AC0E635B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
31:e8:46:24:b9:5c:81:15:5d:a7:f1:1a:ab:8f:86:bc:b4:c8:0e:61:43:9d:61:34:48:d8:23:fc:f3:c1:26:44
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
0b:59:24:99:54:12:f4:c9:d5:03:9a:1b:01:0c:88:29:cd:1c:f0:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:21:d7:96:01:93:57:8b:a4:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 27, 2016 - Jul 27, 2017
Minor OS version
1
Major OS version
5
Entry point
24400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Builds\13810\Tools\Volumeid_master\bin\Win32\Release\volumeid.pdb
kernel32
FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
CompareStringW
GetFileType
ReadConsoleW
RtlUnwind
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FatalAppExitA
FlushFileBuffers
GetConsoleCP
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetCurrentThreadId
GetProcessHeap
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
user32
SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=225, productName=VS2013 build 21005, version=21005,
count=16, id=223, productName=VS2013 build 21005, version=21005,
count=130, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=123, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
TraceX Final/tools/VolumeID64.exe
- IMPHASH 735aed1002ee8ff1be0e1dee668e8b0d
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- TLSH T1A8F34A5233E410F9E1F3AB7089B55515EB36BCA65B34C78E162041AD5E72BD0EE38B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:99:ba:af:8b:e3:04:38:6b:88:00:00:00:00:00:99
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 27, 2016 - Jul 27, 2017
Minor OS version
2
Major OS version
5
Entry point
23260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetFileType
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
user32
SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=225, version=20806,
count=125, id=224, version=20806,
count=9, id=223, version=20806,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=126, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
TraceX Final/tools/amifldrv64.sys
- IMPHASH b05ee5c816a30bc52378c759486af0b9
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 13, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2019
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d3:d0:94:56:9d:0e:bd:83:06:00:00:00:00:00:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
394B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,