Pac���ܵ绰�г���.zip
- SHA256 8ac69265577a3690a39dc067f99583e17d3a226c565c423ac6734dab8a90ece2
Overview
overview
9Static
static
3Pac�...rv.bat
windows10-2004-x64
3Pac�...rv.bat
windows11-21h2-x64
3Pac�...ge.dll
windows10-2004-x64
3Pac�...ge.dll
windows11-21h2-x64
3Pac�...64.sys
windows10-2004-x64
1Pac�...64.sys
windows11-21h2-x64
1Pac�...DM.sys
windows10-2004-x64
1Pac�...DM.sys
windows11-21h2-x64
1Pac�...64.exe
windows10-2004-x64
4Pac�...64.exe
windows11-21h2-x64
4Pac�...64.exe
windows10-2004-x64
Pac�...64.exe
windows11-21h2-x64
Pac�...86.exe
windows10-2004-x64
4Pac�...86.exe
windows11-21h2-x64
4Pac�...x.html
windows10-2004-x64
4Pac�...x.html
windows11-21h2-x64
4Pac�...it.exe
windows10-2004-x64
1Pac�...it.exe
windows11-21h2-x64
1Pac�...gr.exe
windows10-2004-x64
3Pac�...gr.exe
windows11-21h2-x64
3Pac�...rt.bat
windows10-2004-x64
8Pac�...rt.bat
windows11-21h2-x64
8Pac�...ll.bat
windows10-2004-x64
1Pac�...ll.bat
windows11-21h2-x64
1Pac�...ex.bat
windows10-2004-x64
9Pac�...ex.bat
windows11-21h2-x64
9Pac�...pc.bat
windows10-2004-x64
3Pac�...pc.bat
windows11-21h2-x64
3Pac�...��.bat
windows10-2004-x64
1Pac�...��.bat
windows11-21h2-x64
1Pac�...rv.exe
windows10-2004-x64
3Pac�...rv.exe
windows11-21h2-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Pacܵ绰г/lib/autosetupdrv.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pacܵ绰г/lib/autosetupdrv.bat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Pacܵ绰г/lib/bridge.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Pacܵ绰г/lib/bridge.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Pacܵ绰г/lib/driverfile/TelMateW64.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Pacܵ绰г/lib/driverfile/TelMateW64.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Pacܵ绰г/lib/driverfile/TelMateWDM.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Pacܵ绰г/lib/driverfile/TelMateWDM.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Pacܵ绰г/lib/driverfile/dpinstamd64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Pacܵ绰г/lib/driverfile/dpinstamd64.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Pacܵ绰г/lib/driverfile/dpinstia64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Pacܵ绰г/lib/driverfile/dpinstia64.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Pacܵ绰г/lib/driverfile/dpinstx86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Pacܵ绰г/lib/driverfile/dpinstx86.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Pacܵ绰г/lib/driverfile/html/index.html
Resource
win10v2004-20250619-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
Pacܵ绰г/lib/driverfile/html/index.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
Pacܵ绰г/lib/driverfile/spc/bcdedit.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Pacܵ绰г/lib/driverfile/spc/bcdedit.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Pacܵ绰г/lib/driverfile/spc/certmgr.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Pacܵ绰г/lib/driverfile/spc/certmgr.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Pacܵ绰г/lib/driverfile/spc/import.bat
Resource
win10v2004-20250619-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
Pacܵ绰г/lib/driverfile/spc/import.bat
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
Pacܵ绰г/lib/driverfile/spc/install.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Pacܵ绰г/lib/driverfile/spc/install.bat
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Pacܵ绰г/lib/driverfile/spc/installex.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
Pacܵ绰г/lib/driverfile/spc/installex.bat
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
Pacܵ绰г/lib/driverfile/spc/installspc.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Pacܵ绰г/lib/driverfile/spc/installspc.bat
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
Pacܵ绰г/lib/driverfile/spc/win7 64λǩ.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Pacܵ绰г/lib/driverfile/spc/win7 64λǩ.bat
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Pacܵ绰г/lib/installdrv.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
Pacܵ绰г/lib/installdrv.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Pac���ܵ绰�г���.zip
- Size 1.8MB
- Sample260506-gzmegaft6j
- SHA256 8ac69265577a3690a39dc067f99583e17d3a226c565c423ac6734dab8a90ece2
- MD5 7c13f821750d57ad07226033b3f87ad6
- SHA1 3286edba9dd13e6b6fe06591f4f2eaaee2d22832
- SHA512 db1f2ad4a95cd4921fde65610a0953ab17b6c07afe56aed7f20dddcc42c4f6e5a4bd2c1446c6ccfc5f25df4b9708d18e5feb0c394e932886ac7ef9a3e52ed243
- SSDEEP 49152:ig3MjS06A0OaBF6ZkBPnVr7UmpZ15eXB2lD:ig6S03eBbVVr7UGZ15wID
- TLSH T1868533572A51FC65F324B9F868BEAA0FA201518158AF3D07D4E431F7E697FCA78470A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Pacܵ绰г/lib/driverfile/spc/bcdedit.exe unpack001/Pacܵ绰г/lib/installdrv.exe unpack001/Pacܵ绰г/lib/phone.exe unpack001/Pacܵ绰г/lib/qnviccub.dll unpack001/Pacܵ绰г/lib/virtualaudiodriver/BriAudrv.dll unpack001/Pacܵ绰г/lib/virtualaudiodriver/TmSetupAuDrv.exe unpack001/Pacܵ绰г/˫ļװPac绰.exe - Untrusted Codesign Signers 6 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Pacܵ绰г/lib/bridge.dll unpack001/Pacܵ绰г/lib/driverfile/TelMateW64.SYS unpack001/Pacܵ绰г/lib/driverfile/TelMateWDM.sys unpack001/Pacܵ绰г/lib/driverfile/dpinstamd64.exe unpack001/Pacܵ绰г/lib/driverfile/dpinstx86.exe unpack001/Pacܵ绰г/lib/driverfile/spc/certmgr.exe
File Explorer
-
Pac���ܵ绰�г���.zip.zip 1.8MB
-
Pacܵ绰г/Pac绰װ.exe.config189B
-
Pacܵ绰г/Pac绰װ.pdb19KB
-
Pacܵ绰г/lib/autosetupdrv.bat32B
-
Pacܵ绰г/lib/bridge.dll.dll 367KB
-
Pacܵ绰г/lib/driverfile/TelMateI64.SYS58KB
-
Pacܵ绰г/lib/driverfile/TelMateW64.SYS.sys 33KB
-
Pacܵ绰г/lib/driverfile/TelMateWDM.sys.sys 27KB
-
Pacܵ绰г/lib/driverfile/TelmateWDM.INF3KB
-
Pacܵ绰г/lib/driverfile/dpinstamd64.exe.exe 1.0MB
-
Pacܵ绰г/lib/driverfile/dpinstia64.exe1.4MB
-
Pacܵ绰г/lib/driverfile/dpinstx86.exe.exe 900KB
-
Pacܵ绰г/lib/driverfile/html/Thumbs.db3KB
-
Pacܵ绰г/lib/driverfile/html/index.html.html 1KB
-
Pacܵ绰г/lib/driverfile/html/loading.gif.gif 1KB
-
Pacܵ绰г/lib/driverfile/icc301i64.cat10KB
-
Pacܵ绰г/lib/driverfile/icc301x64.cat10KB
-
Pacܵ绰г/lib/driverfile/icc301x86.cat10KB
-
Pacܵ绰г/lib/driverfile/spc/bcdedit.exe.exe 352KB
-
Pacܵ绰г/lib/driverfile/spc/certmgr.exe.exe 73KB
-
Pacܵ绰г/lib/driverfile/spc/icc301root.cer644B
-
Pacܵ绰г/lib/driverfile/spc/import.bat55B
-
Pacܵ绰г/lib/driverfile/spc/install.bat394B
-
Pacܵ绰г/lib/driverfile/spc/installex.bat140B
-
Pacܵ绰г/lib/driverfile/spc/installspc.bat55B
-
Pacܵ绰г/lib/driverfile/spc/remark.txt104B
-
Pacܵ绰г/lib/driverfile/spc/win7 64λǩ.bat398B
-
Pacܵ绰г/lib/install.ini3B
-
Pacܵ绰г/lib/installdrv.exe.exe 44KB
-
Pacܵ绰г/lib/phone.exe.exe 72KB
-
Pacܵ绰г/lib/qnviccub.dll.dll 604KB
-
Pacܵ绰г/lib/virtualaudiodriver/BriAudrv.dll.dll 60KB
-
Pacܵ绰г/lib/virtualaudiodriver/TmSetupAuDrv.exe.exe 220KB
-
Pacܵ绰г/lib/virtualaudiodriver/˵.txt37B
-
Pacܵ绰г/˫ļװPac绰.exe.exe 5KB
Pacܵ绰г/Pac绰װ.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/Pac绰װ.pdb
- SHA256 b9e47c032425c4d52178d8ebb815376ff0bcc06fecca7482e693ecfc7574e0b9
- MD5 65db6f4b5047e9601a29fe03dd4617f4
- SHA1 e52fb529aef15f54abb0c4ee45b10d811fa13ac3
- SHA512 beec5c282e41b8c0531809febd6c95f0767f43942314af0bfa8695201437e3aa2cff886bfd4f94549439dca160ffdce20cac2c0831a8aa671c6dbbcf2fdd92fa
- SSDEEP 96:zpPBAP3MSAP7AP3MSAP6kJaPxHPBbjy5BHo:lPBAP8SAP7AP8SAP6kJaVpjyTo
- TLSH T1CB9203023204D9B3C8841630358347A84670BE01DF9896D7BF35B71EFD76AE91D60ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/autosetupdrv.bat
- SHA256 9f156d3dc0e81141f1ac9edb310a0f999be998fc9333577f5db4690a392b5a5e
- MD5 2886fdfece5a4676be0ece49300f917c
- SHA1 67cd6cb65269f696f25cae2ff817994edb590dc2
- SHA512 94ad3f180d28ce6efa191af958cf593efe79f9cbee58b21859d0b5404bf4f01604f4897cac464ac4141065c3f5d3c768138a1fa22dfa8afa889daf2ecaf5bd37
- MD5 SHA1 SHA512
Pacܵ绰г/lib/bridge.dll
- IMPHASH 8719a2eadd51a4c909791abcfccd6dd0
- SHA256 2b316ce83a12b8d0a7fd3b5c7c753e5137879d6deb6dc218df97703cc0b00233
- MD5 7cfbe9e46ebcd8ac531b3606eee86ab2
- SHA1 ee0da5402f64caff677522986d7cfe66ccedc9f8
- SHA512 4626d96868190856783f3a48297e2303355ec719cc2a4c023c5652a1b3383f7a18f84db509ce029aeca9a27553e413ffe30fe193ac981cec48f10305a046e46a
- SSDEEP 6144:qcf2vZ6v8pb1h3YkwNRFtNWBG6SHW6dWlnSRXdTK5Ak8g+0aW6G71i6:3+h3pbrok8/WtSHW6Wl1b8/bG7P
- TLSH T1B4847C42F5A640F1EA5D2634216FBF36563A9BC98B015EC3D3E8EC394A7A4D2913350F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
58:0d:c3:06:c1:7d:32:6c:81:54:03:7a:5c:78:ae:b1:bb:3e:f1:ac
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ICC301 Call Center,1.2.840.113549.1.9.1=#0c113934323137363640676d61696c2e636f6d
Chains
Nov 25, 2011
CN=ICC301 Call Center,1.2.840.113549.1.9.1=#0c113934323137363640676d61696c2e636f6d
Subject
CN=ICC301 Call Center,1.2.840.113549.1.9.1=#0c113934323137363640676d61696c2e636f6d
Serial Number
6d:26:fe:56:6f:73:29:8c:45:ab:48:8f:e2:81:82:e2
Issuer
CN=ICC301 Call Center CA,1.2.840.113549.1.9.1=#0c113934323137363640676d61696c2e636f6d
Timespan
Nov 23, 2011 - Dec 31, 2039
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Minor OS version
0
Major OS version
4
Entry point
194213
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
CreateEventA
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
ResumeThread
CreateThread
GetSystemDirectoryA
LoadLibraryA
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetLocalTime
SetThreadPriority
HeapAlloc
GetProcessHeap
HeapFree
SuspendThread
GetVersionExA
GetSystemTimeAsFileTime
lstrcmpA
GetModuleHandleA
GetLastError
user32
PostMessageA
PeekMessageA
DefWindowProcA
SendMessageCallbackA
SetWindowLongA
CreateWindowExA
DestroyWindow
IsWindow
RegisterClassExA
GetWindowLongA
ws2_32
WSAStartup
WSACleanup
recvfrom
sendto
recv
send
connect
ioctlsocket
setsockopt
gethostbyname
getsockname
getpeername
WSASetEvent
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
socket
htonl
htons
bind
inet_ntoa
inet_addr
WSAGetLastError
ntohs
closesocket
winmm
waveInGetNumDevs
mixerGetNumDevs
timeSetEvent
timeKillEvent
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetLineInfoA
mixerClose
mixerOpen
waveOutGetErrorTextA
waveOutPrepareHeader
waveOutWrite
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
waveInGetErrorTextA
waveInReset
waveInClose
waveInOpen
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStart
msvcrt
_CIpow
exit
printf
_adjust_fdiv
_initterm
??3@YAXPAX@Z
??2@YAPAXI@Z
_mbscmp
time
__CxxFrameHandler
_atoi64
_i64toa
strchr
sprintf
free
malloc
rand
_ftol
calloc
strncpy
_ultoa
strpbrk
atol
atoi
_purecall
srand
fclose
fwrite
fread
fseek
fopen
strncmp
strrchr
_read
_tell
_lseek
_open
_close
_getpid
clock
_strdup
strstr
strlen
tolower
isupper
isxdigit
memcpy
memset
__dllonexit
_onexit
memmove
Bri_AcceptContact
Bri_AddConferencePart
Bri_AddContact
Bri_AppendSess2Conference
Bri_BlockContact
Bri_ClearContactList
Bri_CreateGroup
Bri_DeleteContact
Bri_DeleteGroup
Bri_DeleteGroupMember
Bri_Dll_Version
Bri_Dll_VersionL
Bri_GetConferenceId
Bri_GetContactInfo
Bri_GetContactStatus
Bri_GetDevice
Bri_GetGroupInfo
Bri_GetGroupList
Bri_GetGroupMemberInfo
Bri_GetGroupMemberList
Bri_GetGroupMemberStatus
Bri_GetID
Bri_GetOnlineCount
Bri_GetOwnerInfo
Bri_GetOwnerPublicIP
Bri_GetOwnerStatus
Bri_GetPassword
Bri_GetProxyInfo
Bri_GetSessionCount
Bri_GetSessionInfo
Bri_GetSessionMode
Bri_GetSessionStatus
Bri_GetSessionType
Bri_GetSessionVolume
Bri_GetVOIPAccount
Bri_GetVOIPAddr
Bri_GetVOIPDualVID
Bri_HoldSession
Bri_InitContactList
Bri_IsBuddy
Bri_IsLoggingIn
Bri_IsLogon
Bri_IsMobileIMAccount
Bri_IsMobileIMOnLine
Bri_IsStart
Bri_JoinGroup
Bri_LeaveGroup
Bri_LoadUser
Bri_Logon
Bri_Logout
Bri_PointsFunction
Bri_RefuseContact
Bri_Register
Bri_RegisterCallback
Bri_RegisterMessage
Bri_ReplyGroupInvite
Bri_ReplyReCallSession
Bri_ReplyReCallSessionEx
Bri_ReplySessionInvite
Bri_SearchUsersList
Bri_SendDialDTMFCmd
Bri_SendFileTransCmd
Bri_SendGroupInvite
Bri_SendGroupMessage
Bri_SendIM
Bri_SendMessage
Bri_SendMessageCmd
Bri_SendMobileIM
Bri_SendThroughServerData
Bri_SessionService
Bri_SetBkServerAddress
Bri_SetDevice
Bri_SetGroupInfo
Bri_SetGroupMemberInfo
Bri_SetGroupMemberStatus
Bri_SetJitterBufTime
Bri_SetNickNameEx
Bri_SetNickname
Bri_SetOwnerStatus
Bri_SetPassword
Bri_SetPasswordEx
Bri_SetProxyInfo
Bri_SetServerAddress
Bri_SetSessionRecord
Bri_SetSessionVolume
Bri_SetVOIPAccount
Bri_SetVOIPAddr
Bri_Start
Bri_StartConference
Bri_StartPlayFile
Bri_StartSessionInvite
Bri_Stop
Bri_StopConference
Bri_StopPlayFile
Bri_StopSession
Bri_StopSessionEx
Bri_UnblockContact
Bri_UpdateContact
Name
.text
Size
284KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=24, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=39, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=19, version=8034,
count=164, id=1, productName=Unmarked objects,
count=69, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Pacܵ绰г/lib/driverfile/TelMateI64.SYS
- SHA256 faef540a9599186d2124ba3a06b78f25fe57958def105c5fbf0ff2c891b30389
- MD5 89c2d17ebfd0447c8af5f6b2d35105bd
- SHA1 8fec60b311fe72a11ba5083492e17b7c91eff7d9
- SHA512 e02650659e617c21cbead5f3fa21d40e25c5e5d9661da8fab22afbdc6aef8d7de34801ea9d771f37b5bcdce6147a7290ed7a5a238efc163084b400cd6cec3b21
- SSDEEP 1536:RxiTAUxsijCTEUBcXleVHILlyMEDy4vCoyQ:+TAUGi2wxYKl/WZ
- TLSH T145432A465F46EA2BCA0E133142F78B3D2BE1E2947B53DB295371D7293E877853315620
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/driverfile/TelMateW64.SYS
- IMPHASH d9a90e60f18865bbf09def0cc612ffa9
- SHA256 8ea98a0ceb41f505c43c82ec940fd0eef810f229ddd5d4804c000be4c1e4423a
- MD5 d1e92dd51f3fe13e7fa8d521c5f99730
- SHA1 bdc8d8205d238b5be5bbd32b983775ebc90ea247
- SHA512 cde7a5791e95ca50e7a704638d6fd0fcf223f0a89158641fedbf1316c9340befff7e6c9b07a029a04780d8a76c72b14e2c3f5239013bd462ac52e688f6d1bae1
- SSDEEP 768:7vE1ayIo8Xb2HQ1b7zxCiImX2+4IILFmyX:7v/z1b7zoD62+AoyX
- TLSH T1ADF23B73CA591068D55AC535C7878997BEB170C43B24ABEF009096422E67FF21F7D21A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
e0:98:8b:17:f7:e3:c8:35:bb:dc:3e:c8:62:34:2c:a8:49:97:c7:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Chains
Sep 7, 2012
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Serial Number
23:cc:d2:cd:73:fa:96:df:7d:25:08:ae:8e:40:e3:4a
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 6, 2012 - Sep 6, 2013
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
23652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\project\bridge\bridevice\driversrc\wdm20101207\wdm\amd64\TelmateWDM.pdb
ntoskrnl.exe
IoSetDeviceInterfaceState
KeSetPriorityThread
IoDeleteDevice
KeSetEvent
KeInitializeEvent
KeReleaseSpinLock
IoDetachDevice
PoRequestPowerIrp
PoSetPowerState
KeDelayExecutionThread
RtlFreeUnicodeString
PsCreateSystemThread
ExAllocatePool
IoRegisterDeviceInterface
ExFreePool
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateDevice
IoReleaseCancelSpinLock
IofCallDriver
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoBuildDeviceIoControlRequest
PsTerminateSystemThread
KeClearEvent
__C_specific_handler
usbd.sys
USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=1, productName=Unmarked objects,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Pacܵ绰г/lib/driverfile/TelMateWDM.sys
- IMPHASH cfae2004d72a767e721c0835c94705ea
- SHA256 687616cf7cb4ee49f575876d8dce27d53a4a184b3a12ce12512922f6e4633ade
- MD5 d3fc1ca3844d10f45d6ab155bebf3e27
- SHA1 cc404706eea6aed09b9f13933380fdd06304e3e8
- SHA512 7776e10e47947adc887d8dcae310bed16b15a56c59189300bc941136a7277a3f2a43ecc3a77be5b19ab339cbeaaeb39cfdcbafc9e97f2bfa4edeeb03c7873198
- SSDEEP 384:CfHLp5CvygEqiuaNW+4dOOuFaghZsZFUNQQftarcPeFgzDIYmt3mirILca6jU0SJ:AeyqyoJTX/UoEb4Y3IILFmyNr
- TLSH T129C24B6257106876C8C64AF1856EBB2F283F7AE90F58B2D310B046D61D8A7E53F3811B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
fa:32:01:f2:8f:af:f2:be:61:75:00:8b:b1:0b:32:d0:d7:1b:7a:ce
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Chains
Sep 7, 2012
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Beijing Quanova Information Technical Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Beijing Quanova Information Technical Co.\,Ltd,O=Beijing Quanova Information Technical Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Serial Number
23:cc:d2:cd:73:fa:96:df:7d:25:08:ae:8e:40:e3:4a
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 6, 2012 - Sep 6, 2013
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
16446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\project\bridge\bridevice\driversrc\wdm20101207\wdm\i386\TelmateWDM.pdb
ntoskrnl.exe
IofCompleteRequest
InterlockedDecrement
InterlockedIncrement
ExFreePool
IoReleaseCancelSpinLock
IofCallDriver
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeSetEvent
IoSetDeviceInterfaceState
memcpy
ExAllocatePool
PoCallDriver
KeClearEvent
RtlFreeUnicodeString
KeSetPriorityThread
KeGetCurrentThread
KeQuerySystemTime
ZwClose
PsCreateSystemThread
IoRegisterDeviceInterface
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
memset
InterlockedExchange
PoRequestPowerIrp
PoStartNextPowerIrp
PoSetPowerState
KeTickCount
IoDetachDevice
RtlUnwind
IoDeleteDevice
PsTerminateSystemThread
KeDelayExecutionThread
KeBugCheckEx
hal
KfAcquireSpinLock
KfReleaseSpinLock
usbd.sys
USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
256B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
896B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Pacܵ绰г/lib/driverfile/TelmateWDM.INF
- SHA256 f06c60dadef2e184fa3751d9de2e977f1ebba32ad38bca296e81ff72a900b414
- MD5 f2dab77fca3d749955080777f79b6dfe
- SHA1 16cf48a4482d1c03cd3b5eea380e74223e7c3363
- SHA512 3f750c4f90aebd27b675109a189959d68c6ee468d212c423887806608a77a6d979c953cd406a4662d2e1d0ab969b8dade4eeaf315612961b321ae30deede0b85
- TLSH T1FA81C00BA94F66B96C13532A7F938CD76B8E2015C0C401F571DFBE54EBCA908522ECA7
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/dpinstamd64.exe
- IMPHASH 3eacb9638877275335da4b58e52824f8
- SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
- MD5 be3c79033fa8302002d9d3a6752f2263
- SHA1 a01147731f2e500282eca5ece149bcc5423b59d6
- SHA512 77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
- SSDEEP 12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
- TLSH T1FE258104E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bf:2c:50:54:a4:3a:a3:54:81:e2:9a:d4:b6:4d:5c:bc:8e:cd:ae:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:b5:29:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2010 - Jan 4, 2013
Subject
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Serial Number
79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 9, 2001 - May 9, 2021
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
379816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DpInst.pdb
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
IsTextUnicode
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
DeleteService
CloseServiceHandle
ControlService
StartServiceW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
QueryServiceStatus
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
CheckTokenMembership
kernel32
CreateMutexW
ReleaseMutex
SetFilePointer
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
GetProcAddress
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleOutputW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
FreeConsole
FreeLibrary
WriteConsoleOutputW
WriteConsoleW
IsValidLocale
VirtualProtect
Sleep
GetFileAttributesW
DeleteFileW
FormatMessageW
RaiseException
CopyFileW
SetFileAttributesW
GetTempFileNameW
FindClose
FindNextFileW
CompareStringW
lstrcmpW
FindFirstFileW
lstrlenW
UnmapViewOfFile
GetConsoleScreenBufferInfo
CreateFileMappingW
LCMapStringW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
SetEndOfFile
CreateEventW
SetEvent
LocalReAlloc
DeviceIoControl
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
GetShortPathNameW
RemoveDirectoryW
MoveFileExW
CreateDirectoryW
GetFullPathNameW
SetLastError
GetLocaleInfoW
LoadLibraryExW
GetSystemDefaultUILanguage
SearchPathW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
GetEnvironmentVariableW
lstrcmpiW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
GetFileSize
CreateThread
SetThreadLocale
GetThreadLocale
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetCurrentProcess
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
SetCurrentDirectoryW
GetUserDefaultUILanguage
EnumResourceLanguagesW
GetModuleFileNameW
GetExitCodeProcess
WaitForSingleObject
LocalFree
GlobalFree
LocalAlloc
GetLastError
GetCommandLineW
CloseHandle
MapViewOfFile
gdi32
CreateBitmap
CreateCompatibleBitmap
GetObjectW
DeleteDC
SetLayout
CreateCompatibleDC
EndPage
StartPage
EndDoc
StartDocW
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
DeleteObject
SelectObject
user32
DestroyIcon
CreateIconIndirect
DrawIconEx
GetIconInfo
LoadIconW
LoadBitmapW
CharLowerW
UnregisterClassA
PostQuitMessage
DefWindowProcW
RegisterClassExW
CreateWindowExW
ShowWindow
AllowSetForegroundWindow
DialogBoxParamW
SetDlgItemTextW
EndDialog
MessageBoxW
GetDlgItem
SendMessageW
GetProcessWindowStation
GetUserObjectInformationW
LoadImageW
SetWindowTextW
PostMessageW
GetParent
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
SendDlgItemMessageW
InvalidateRect
GetSystemMetrics
GetSysColor
DestroyWindow
SetWindowLongW
SystemParametersInfoW
GetDC
ReleaseDC
DrawTextExW
msvcrt
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_resetstkoflw
__C_specific_handler
memset
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
fread
_initterm
fclose
fwprintf
_wfopen
realloc
??2@YAPEAX_K@Z
wcsstr
_wcsicmp
_wtol
_vscwprintf
free
malloc
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
memcpy
memmove
_CxxThrowException
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
_wcsnicmp
_vsnwprintf
wcsncmp
bsearch
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
iswalpha
??_U@YAPEAX_K@Z
wcschr
wcspbrk
wcsrchr
iswdigit
feof
memcmp
ntdll
NtQueryInformationToken
RtlNtStatusToDosError
NtClose
NtOpenThreadToken
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenProcessToken
shell32
ord59
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
setupapi
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
pSetupSetGlobalFlags
SetupDefaultQueueCallbackW
pSetupGetGlobalFlags
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupGetFieldCount
SetupGetIntField
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupFindNextLine
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupPromptReboot
SetupDiGetDeviceInstanceIdW
SetupFindFirstLineW
SetupOpenAppendInfFileW
SetupGetLineCountW
SetupDiGetActualSectionToInstallW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetSelectedDriverW
SetupCommitFileQueueW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupQueueCopyW
CMP_WaitNoPendingInstallEvents
SetupCloseFileQueue
SetupOpenFileQueue
SetupDiGetDriverInfoDetailW
SetupDiSetClassInstallParamsW
SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupInstallFilesFromInfSectionW
SetupDiCallClassInstaller
SetupDiClassNameFromGuidW
SetupDiOpenClassRegKey
CM_Enumerate_Classes
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Query_And_Remove_SubTreeW
CM_Setup_DevNode
CM_Get_Device_IDW
SetupCopyOEMInfW
SetupGetTargetPathW
wintrust
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
VariantChangeType
comctl32
PropertySheetW
CreatePropertySheetPageW
ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor
comdlg32
PrintDlgExW
GetSaveFileNameW
crypt32
CertFreeCTLContext
CertFreeCertificateContext
CertGetCTLContextProperty
CryptQueryObject
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Name
.text
Size
510KB
Virtual Size
510KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
470KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=429, id=1, productName=Unmarked objects,
count=69, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=41, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Pacܵ绰г/lib/driverfile/dpinstia64.exe
- SHA256 54bdcdf491722899ec3b04ba12aafe1c0b989bd2444e6ae5bc82e78b18cd5b44
- MD5 f9d6c6f40dc8ad9d3fa526029b6066b3
- SHA1 ff542ef0bc96f7525c23758b04e40c65dda36ca9
- SHA512 3e8a39bbe4635217baef7c079e0c4234c43212ecec0769ff2308182726ee6955dc9269d6c73c1c8a8f62f04deb05aeee2328af88af43307343fc92a2e8298f57
- SSDEEP 12288:2wUQoJxgl86rfHbdLDfOnmU+5KlIPMaLiH:9UQWNgfSRiP2
- TLSH T18965A505DBE6E127E877177C59B3072917B2FA961BB2CB2D1220472C2CEB7509731B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/driverfile/dpinstx86.exe
- IMPHASH 3ab7cc62e4963955ad408cd420cd8ef1
- SHA256 d84149976bc94a21b21aa0bc99fcbdee9d1ad4f3387d8b62b90f805ac300ba05
- MD5 30a0afee4aea59772db6434f1c0511ab
- SHA1 5d5c2d9b7736e018d2b36963e834d1aa0e32af09
- SHA512 5e8a85e2d028ad351be255ae2c39bb518a10a4a467fd656e2472286fee504eed87afe7d4a728d7f8bc4261245c1db8577deeee2388f39eb7ee48298e37949f53
- SSDEEP 6144:EZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIU:EZxSpwmxvL/f3vCN1PMaLi6rAyIQjF
- TLSH T151159311E7FB8139F9F36F7C697952620A7ABCA19E38D64E1740055D08F4A90DA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
71:85:11:e5:d1:4c:f1:de:16:92:e6:78:64:21:75:0c:36:76:a6:9e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:03:dc:f6:00:00:00:00:00:0c
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
135530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
DpInst.pdb
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
IsTextUnicode
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetEntriesInAclW
DeleteService
StartServiceW
ControlService
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatus
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32
GetFileAttributesW
DeleteFileW
ReleaseMutex
SetFilePointer
HeapFree
GetProcessHeap
HeapAlloc
CreateMutexW
FreeConsole
SetConsoleMode
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
FreeLibrary
FillConsoleOutputCharacterW
ReadConsoleOutputW
GetConsoleMode
GetStdHandle
GetProcAddress
LoadLibraryW
WriteConsoleW
IsValidLocale
lstrlenW
lstrcmpW
CompareStringW
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
SetFileAttributesW
FormatMessageW
RaiseException
GetFileSize
CreateFileMappingW
MapViewOfFile
WriteConsoleOutputW
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
CreateFileW
WriteFile
CreateThread
WaitForMultipleObjectsEx
InterlockedCompareExchange
WaitForSingleObjectEx
SetEvent
CreateEventW
GetExitCodeProcess
DeviceIoControl
VerSetConditionMask
VerifyVersionInfoW
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetFullPathNameW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
MoveFileExW
SearchPathW
GetSystemDefaultUILanguage
LoadLibraryExW
CreateFileA
SetEndOfFile
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleCP
GetLocaleInfoA
Sleep
LoadLibraryExA
ReadFile
LCMapStringW
LCMapStringA
GetThreadLocale
SetThreadLocale
GetUserDefaultUILanguage
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameW
SetCurrentDirectoryW
WaitForSingleObject
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
ExitProcess
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetStartupInfoW
GetEnvironmentVariableW
lstrcmpiW
WideCharToMultiByte
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
LocalAlloc
GlobalFree
LocalFree
MultiByteToWideChar
GetCurrentProcess
GetLastError
CloseHandle
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceLanguagesW
LocalReAlloc
EnterCriticalSection
gdi32
SetLayout
DeleteDC
GetObjectW
CreateCompatibleBitmap
CreateBitmap
SelectObject
StartPage
EndPage
StartDocW
EndDoc
GetTextMetricsW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC
user32
AllowSetForegroundWindow
DefWindowProcW
PostQuitMessage
GetUserObjectInformationW
GetProcessWindowStation
GetIconInfo
DrawIconEx
CreateIconIndirect
LoadIconW
LoadBitmapW
DrawTextExW
LoadImageW
GetSystemMetrics
GetSysColor
DestroyWindow
GetWindowLongW
SendDlgItemMessageW
InvalidateRect
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowLongW
SetWindowTextW
GetParent
PostMessageW
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
DestroyIcon
DialogBoxParamW
SetDlgItemTextW
CharLowerW
GetDlgItem
SendMessageW
MessageBoxW
RegisterClassExW
CreateWindowExW
ShowWindow
UnregisterClassA
EndDialog
ntdll
RtlNtStatusToDosError
NtOpenThreadToken
NtQueryInformationToken
NtOpenProcessToken
RtlUnwind
NtClose
shell32
SHGetFolderPathW
ShellExecuteExW
ord59
CommandLineToArgvW
setupapi
SetupDiClassNameFromGuidW
SetupDiOpenClassRegKey
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupGetLineCountW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetStringFieldW
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupGetFieldCount
SetupGetIntField
SetupOpenAppendInfFileW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiGetSelectedDriverW
SetupDiGetDriverInfoDetailW
CM_Enumerate_Classes
CM_Get_DevNode_Status
SetupDiCreateDeviceInfoList
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupGetTargetPathW
SetupQueueCopyIndirectW
SetupQueueCopyW
SetupOpenFileQueue
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupTermDefaultQueueCallback
SetupCloseFileQueue
SetupCopyOEMInfW
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Setup_DevNode
SetupDiEnumDeviceInfo
CMP_WaitNoPendingInstallEvents
CM_Query_And_Remove_SubTreeW
wintrust
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
ole32
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
VariantInit
VariantClear
VariantChangeType
SysAllocString
SysFreeString
comctl32
CreatePropertySheetPageW
ImageList_ReplaceIcon
ImageList_SetBkColor
PropertySheetW
ImageList_Create
comdlg32
PrintDlgExW
GetSaveFileNameW
crypt32
CertFreeCertificateContext
CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Name
.text
Size
392KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
470KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=372, id=1, productName=Unmarked objects,
count=91, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Pacܵ绰г/lib/driverfile/html/Thumbs.db
- SHA256 6e956c52bce0a3408f884cdb6af627c4e510fcc2ef345899f675130b4596e943
- MD5 5e649938a37dcd6c416d69f698cb1f03
- SHA1 097973bd86f3806091841ffcc4efe242fd06503c
- SHA512 b372c9c2c7d689daec0baa150cf8505ac560a98a2f4b198aec37b1522001e9413bdb79c867cd805df62e7297fbff1be519d1094daf0fcf1ee76b13572742bff1
- TLSH T141717202A754C3E1FD220AB7CD62DE9952E7BE417C60660336D4379E98309C4C888B28
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/html/index.html
- SHA256 3b92ef48614237f0295d791206590e200ec21b993c4f96ef955dc84bb4fa05b1
- MD5 f92d3522ec085ba15fdcb9acf5961b1a
- SHA1 e96ace2056d954388b4da9f0137222a1e93b4395
- SHA512 f6f7f5d8d05bbc16d8ae2807341f0475a1275954ec1063ea13bd9b071e3189cb3eec0ce423bbac583ec66dd59e8aea13a426ddc2ae82c2374ce186252a1bd52a
- TLSH T17721ADBA75CBFB0966D5B7E1E2726640E01AAC01D35E4415B080707F6206668CDE7F68
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/html/loading.gif
- SHA256 16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925
- MD5 50c5e3e79b276c92df6cc52caeb464f0
- SHA1 c641615e851254111e268da42d72ae684b3ce967
- SHA512 06afb0ee97d49b23b8de5ccf940a95d8497fc0b19a169aacbe7924dd0a088df65c3d1f4ae7d73a31a1fc7b5a1569fedead1f1757c10c281a1dd61564b9cc39fa
- TLSH T186310B7EBD2352BFF98950B6C47C554C6BB638E4C0818286032D74A5BD3576D104D43C
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/icc301i64.cat
- SHA256 00b45c0e8bfd29770c1ed80f0fc9ae16dd62c5583cb3023fb54ad19f1f5d0062
- MD5 5925fad2e8cfe774af7e9c83ed233503
- SHA1 30e3386e77938c3ee12c982ef0bb93acbf52fa4f
- SHA512 2ed4396f308e13f3cfd2fa86cc122109d7edcced8d4a6260971e624d579e2ca0ea854e0c0fc3755a427f548491697392158fe7c531dd0dc8b51b13828b549d94
- SSDEEP 192:46/41RDZICEkP335/wJirNmL/cu7RZgjlIrN06+v48yQVr9ZCspE+TMcrzJWL:GL3mirILca6jU0SJeM6JWL
- TLSH T12922F7D70A191062ECCACF70C5EAD56BAC31B3967D84A46E507683C62E837B13B6941F
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/driverfile/icc301x64.cat
- SHA256 9c5374aa47c7e22638872e208c0aa0579bc9c3fe8f683c861468ba3e5e32f5fb
- MD5 b72db79f3892789e089fbd45d69a9ad4
- SHA1 480abf91b16ba8385c749c85a9d3f14cc774e38e
- SHA512 28d08473cbff68590df9b0d87fe8806a4fccc9ac1f9ef4e97ffd510b4d164e28a6686facbedc58fd6657b9bc52223cd22938ac05a78779458177724d998191ae
- SSDEEP 192:ejppe/rL99ZICEkP335/wJirNmL/cu7RZgjlIrN06+v48yQVr9ZCspE+TMcrzr9:2/e/dt3mirILca6jU0SJeM6r9
- TLSH T16D22F9E70A191463ECCBCE30C5EAD06BED31B3966D88656A407683C62D877F03B6951F
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/driverfile/icc301x86.cat
- SHA256 4fcfd9a6fa15573bd178df89ba51987b0cde06c6db3b91703e6cc4c3d68662df
- MD5 84a62bf1f5e38567423c2743ddd89dd1
- SHA1 828b3c6bf05f8354ad7840297a21a316fa675ed4
- SHA512 06dba9876500fe80ac2e78ad77eac7ff870761edb55745fbf5ad7143121892abc10aba7540a40700a16d9727b2cd312fa1223676679829f8f226c42bde99cc4f
- SSDEEP 192:VT0TW8TlTdd0ZICEkP335/wJirNmL/cu7RZgjlIrN06+v48yQVr9ZCspE+TMcrzj:dOWWtfg3mirILca6jU0SJeM6j
- TLSH T1E4321AE70A5D1092ECCACE31C5DAD46FAC31B396AD88956E107783C62D837B13B5950E
- MD5 SHA1 SHA512 SSDEEP TLSH
Pacܵ绰г/lib/driverfile/spc/bcdedit.exe
- IMPHASH 312fc7fd1e17a4ef9ec25deba51d7921
- SHA256 8e867d807a4e24b2ff8d40116b171d021dd2f2c7cbbc8d3ff4e6db70e9697d31
- MD5 2c4030b42488e8560a7a09eb582746ae
- SHA1 37e0a91d0eb93b1c336e93797902a9b7df07c212
- SHA512 271907319995081cf34cbfd7731856e0161c5fabf62989e6e658746bdd95de22a333c570ff8566fd1486f7f3e7bd360913db4e5965bd85c6df30e594ef00846e
- SSDEEP 3072:sew5yXrzPNwotc9qyhZXiMqnm8YB0umyJ4nFdD+YVIU7Fc8HDHTRhdNV/ysXo34u:aKrrNwotQrhZX5qnbdVyORznIk6
- TLSH T19974FA02A3E90205F0F77A759AB556718A77BC85AA39D68E129C004E0FF3F909D74B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
169248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcdedit.pdb
kernel32
GetFileType
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
WriteFile
CreateFileW
CloseHandle
DeviceIoControl
FormatMessageW
LocalFree
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
GetStdHandle
Sleep
SearchPathW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
OutputDebugStringA
GetLastError
QueryDosDeviceW
SetLastError
RtlCompareMemory
UnmapViewOfFile
GetSystemDefaultUILanguage
FindResourceExW
LoadResource
LoadLibraryExW
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
MapViewOfFile
msvcrt
_commode
_fmode
__set_app_type
memcpy
memset
memmove
__setusermatherr
?terminate@@YAXXZ
free
calloc
isdigit
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_iob
_snprintf
_itoa
wctomb
malloc
ferror
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
_lseeki64
_write
_isatty
ungetc
bsearch
wcsncmp
strncmp
wcsstr
wcsrchr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wcsupr
_wcslwr
_errno
_wsetlocale
towupper
iswspace
_vsnwprintf
wcschr
wcstoul
_wcsnicmp
_wcsicmp
memcmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtClose
NtOpenFile
RtlStringFromGUID
RtlGUIDFromString
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlFreeUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
NtQuerySystemInformation
NtDeviceIoControlFile
NtWaitForSingleObject
NtCreateEvent
NtQueryKey
NtEnumerateKey
NtQueryAttributesFile
NtOpenKey
RtlCreateAcl
NtSaveKey
NtUnloadKey
RtlFreeSid
RtlSetDaclSecurityDescriptor
NtDeleteValueKey
NtLoadKey
NtOpenThreadToken
NtCreateKey
NtCreateFile
RtlLengthSecurityDescriptor
RtlAddAccessAllowedAceEx
NtOpenProcessToken
NtSetSecurityObject
NtQueryValueKey
NtSetValueKey
NtAdjustPrivilegesToken
NtDeleteKey
RtlAllocateAndInitializeSid
RtlLengthSid
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
NtOpenSymbolicLinkObject
LdrGetProcedureAddress
NtQuerySymbolicLinkObject
NtQueryInformationFile
LdrGetDllHandle
NtQueryVolumeInformationFile
NtDeleteFile
NtResetEvent
NtAllocateUuids
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
Name
.text
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=185, id=1, productName=Unmarked objects,
count=65, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=137, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Pacܵ绰г/lib/driverfile/spc/certmgr.exe
- IMPHASH 7a7c6506fbb24dc5a3e42f717ca920c1
- SHA256 38fe38349068c264ff653c2d1d273f2a8154f0da485364d962b83f2a75bddb45
- MD5 d56b22e2495e4cb73aefe3faef046c93
- SHA1 383e9460d2426a98abfaad0e8dfca7dd436733c9
- SHA512 6d6213d6122d85171b910c392c717cd1a19d14f0b483accaf33f8677c841f92ccae4092fc47740a8a2a57098b68208416197c84b62ea41bd5790cf3c1b905dfa
- SSDEEP 1536:ZI4kDjGubbXp3aGePmImYw+WXsA9iYzv7AA18Cy/S:u4Ybbb5qxPmImt+WXsoD8Cy/S
- TLSH T11A73D80163FA4D26F9F726F1563A9A924F77BE911A30C64F06EC468D0E73B94C931326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
34:0e:3e:0d:72:8a:08:3d:70:a2:5c:a3:7b:78:d4:82:32:33:27:8a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 16, 2008
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0f:78:4d:00:00:00:00:00:03
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 23, 2007 - Feb 23, 2009
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:47:52:ba:00:00:00:00:00:04
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:49:7c:ed:00:00:00:00:00:05
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Minor OS version
0
Major OS version
6
Entry point
34488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CertMgr.pdb
advapi32
CryptAcquireContextA
CryptReleaseContext
kernel32
Sleep
InterlockedCompareExchange
RtlUnwind
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
MapViewOfFile
CreateFileMappingA
GetFileSize
WriteFile
WideCharToMultiByte
InterlockedExchange
GetSystemTime
SystemTimeToFileTime
CompareFileTime
MultiByteToWideChar
FileTimeToLocalFileTime
CreateFileW
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
GetLastError
SetLastError
GetModuleHandleA
msvcrt
_controlfp
?terminate@@YAXXZ
malloc
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
scanf
memcpy
_wasctime
memset
_wtol
printf
wprintf
towupper
realloc
free
strtok
_vsnwprintf
_wcsicmp
vwprintf
user32
LoadStringA
LoadStringW
crypt32
CryptInitOIDFunctionSet
CertFreeCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObject
CertFreeCRLContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertFreeCTLContext
CertAddCRLContextToStore
CertAddCTLContextToStore
CertEnumCTLsInStore
CertAddCertificateContextToStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertDeleteCTLFromStore
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CryptStringToBinaryW
CertCloseStore
CertAddEncodedCRLToStore
CertOpenStore
CertAddEncodedCertificateToStore
CertAddEncodedCTLToStore
CertRDNValueToStrW
CryptDecodeObject
CryptFindOIDInfo
CryptFreeOIDFunctionAddress
CryptGetOIDFunctionAddress
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CertGetCertificateContextProperty
CertEnumCertificateContextProperties
CertRDNValueToStrA
CertSaveStore
CertGetPublicKeyLength
CryptHashPublicKeyInfo
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CertGetCTLContextProperty
CertFindCTLInStore
CryptInstallOIDFunctionAddress
cryptui
CryptUIDlgCertMgr
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=176, id=1, productName=Unmarked objects,
count=20, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Pacܵ绰г/lib/driverfile/spc/icc301root.cer
- SHA256 37fee5315abfbef1957248714c0a6c931f4d3697c1c0e3e49797079f41445353
- MD5 976bb5a7e6bd0653bd2be6a84d2c55da
- SHA1 59f6caeff9b4a872c6953044fd9768cf7bea5e08
- SHA512 c771b1127cd0821dbbf6ceecb105afeab3276e60a6424f43c5b4496ce908807d3bc7bec918c7fe43069bd1430670db7e3a1ed8bbdd8576bd237bead43f0ef30c
- TLSH T139F09E132ADA129029A37FA13FB8766A651BAB504E39B0B26775B6C01D326E5701C2F4
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/import.bat
- SHA256 5c883568110c2ae4a4d4be437bad08d5b09c9dfabd81e5f3199ae2fac51aba4c
- MD5 236b3c8474160ef901623ffc48909057
- SHA1 72157dd376afa135b585a70758ad2251073b2790
- SHA512 5302d915c53cebc0f18efd1cb8082e64ef3653d14316d422b05ff2d5b78fea664ac7fd733a777e403cddcc602f64c5fa68f6b908a0565a88f924f88eceeb135a
- TLSH T1E8900200A53E6151830201609E54D34D2196A42B1505DF7149544C94365529121518AE
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/install.bat
- SHA256 ee014ff43e946542cfc447a283440e7e37f38c7d249a3618adbc11d1daa85704
- MD5 479b7e74065b1884260c81458c2c2b29
- SHA1 cc41aa15a795b723dc8b862bce671e2fffd81540
- SHA512 30129592757b69e505dd7670c7399a9515634964f38084acfcf258bb6fe0e43ce1f7e3aa73234f4c6e6c345a955fcb66aacda6f999459406dfe27d03982f103d
- TLSH T1ACE06151816D067AE3B30DEBC300310E690ECE8F3A55D5D9B37405B8358719459428FD
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/installex.bat
- SHA256 0597483486ad2692fc49e5ec386e557f15ba9ca41e1be19214130a47fc6faf87
- MD5 08452c90d65fd3791f99c07550b09196
- SHA1 09f1e90f70243cb297b46e17e2f795a1e0f6e981
- SHA512 d184a13f36a6a118388a709c9d502e15d380edeb08261368b01306f39eef6d21544f57cf096557092f152824d71528d3dd7d83835bbec988982c6f2ecec83b77
- TLSH T1A4C02B4145374FB0C347CCFA1100700C000ECE0F22B2C1C9D0260071786464EC533030
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/installspc.bat
- SHA256 b96a492f653d2b23811403ee10fc05d43d30ec3ffd492bd874449b13fb3f37a7
- MD5 14f95a843ee983588e5e9476095b5a9c
- SHA1 4d80c96bd1ad5bb5a9fa06ebad32bab7f5ccc73d
- SHA512 5f405a09527f0600d17f21941b65f6cb71cdea791633adfef742e357200216f29665d5bd9dbb245149630c4a8f925ca5aceee33d228508825488dd307422a548
- TLSH T162900240113217A19003CBD50D4961441188D44B404675472166043866343AE40150D5
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/remark.txt
- SHA256 6c329bf3cf6a68ef5c64d235c002d74c22926d3d4c6621c77b549df1777a1fc5
- MD5 4621d31a2a555b01f2f4e451c7f028ff
- SHA1 8deb5b25df14f0d7b324f0529f1fb3c3ea4a83f9
- SHA512 ce825c39eec56681e429852b7521410644e91e7619c91f05a712696efdc092fef4a89c3e1a8b2bd03d0224ef8e0f46487148a4dcce6d923de5d935bc9dc0a7ef
- TLSH T1F9B0120C1115B13E0434E8B1717875069DCC98002C442A0C0CD0758F3BDE1CC8605154
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/driverfile/spc/win7 64λǩ.bat
- SHA256 fc8c075b000a9ffeb8c6074d39f8d5cbb004f73d00705f9cd411aaacefd50db9
- MD5 80e98be75b72905f42944e81dab1d717
- SHA1 fdb9491de532769147291664f0a2a6ecda333ba5
- SHA512 4e5538d2363355503259f25c7fe0ef3cbd1a49bb5fcf4e929e2807df5ac5bb26e935d756b119e47aff379b144b3bae7e3da0fa2738f7cbda7c0acc3a8db5cba0
- TLSH T19FE02B51816D0A6AE3A30DEBC300310E690ECE8F3A55D599B37405B8798619459428F9
- MD5 SHA1 SHA512 TLSH
Pacܵ绰г/lib/install.ini
- SHA256 391552c099c101b131feaf24c5795a6a15bc8ec82015424e0d2b4274a369a0bf
- MD5 2f7bb230c70819aeb10b45a709bcf48f
- SHA1 52dc44c27cc6c0548199de71a6bce79e92d53f3c
- SHA512 d0f2d7af92dc8fb54e345ca42ca68987b91c18cce345b480cfa6d76a52784648e7c3954265061b23418845f31ec08b0b445fee173a3770a7ca191bc3b48d4ef7
- MD5 SHA1 SHA512
Pacܵ绰г/lib/installdrv.exe
- IMPHASH 0491ca18e2647c37c30932ecdf5c97ef
- SHA256 bd1cd51355457050bd8d55938e972b476b0417555d9d6cc9d5b1e8615d267082
- MD5 37f61f93a417a73e750825ec70e04e48
- SHA1 35df434bf4f0f6a77a0581ee2bc0afaf0295e75a
- SHA512 35add7812c0a7fdcca50aa7f77cf706b3624ee200db15e4a24495ef3ffc51cbd5937a5e36933206c5f1af19d3b0be728875d8c51453106669db3fc07cd3c6fe9
- SSDEEP 768:Gb1fdz+WnLqOdZq58NECealALL+LLg0nqquPo/FBB4:c1fdzD2OJNq2Ac7qquQ/FBB4
- TLSH T1A11329139A9341B0EEA4C130489F6BB99A77BC6A4B10A7BF13A0DE1D0D335D1EC7619D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19661
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord1776
ord4407
ord2385
ord5163
ord6374
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3748
ord5065
ord1725
ord2446
ord6614
ord5277
ord2982
ord3147
ord3259
ord4465
ord6691
ord3262
ord2985
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4432
ord6514
ord6478
ord825
ord4353
ord5260
ord5281
ord6453
ord6699
ord2379
ord6814
ord800
ord535
ord465
ord466
ord2241
ord1238
ord1601
ord537
ord823
ord540
ord1168
ord6197
ord3797
ord5037
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord4078
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3136
ord3081
ord4622
ord4424
ord3738
ord561
ord815
ord641
ord609
ord2514
ord2621
ord1134
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord1775
ord5241
ord5280
ord3749
ord1727
ord5261
ord2124
ord4425
ord3597
ord324
ord4234
ord2575
ord6055
ord4396
ord5290
ord3402
ord3574
ord1146
ord567
ord2302
ord924
ord6199
ord6215
ord2764
ord4202
ord4160
ord2863
ord755
ord470
ord4224
ord858
ord922
ord926
ord860
ord2642
ord801
ord541
ord6883
ord6054
ord4108
ord4960
ord4963
ord4524
ord4529
ord4526
ord4543
ord4545
ord4531
ord4889
ord4720
ord4347
ord4340
ord5076
ord6817
ord4892
ord4370
ord4899
ord4588
ord4589
ord6835
ord6856
ord6845
ord6812
ord6815
ord6816
ord6858
ord6846
ord6839
ord6847
ord6867
ord6859
ord6832
ord6855
ord6823
ord6857
ord6807
ord6591
ord6650
ord2486
ord6800
ord5300
ord6597
ord1576
msvcrt
_except_handler3
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_stricmp
_findclose
_findnexti64
_findfirsti64
gmtime
strstr
??1type_info@@UAE@XZ
_setmbcp
_CxxThrowException
__set_app_type
__CxxFrameHandler
_mbsnbicmp
strchr
strrchr
fclose
fprintf
fopen
sprintf
_mbscmp
kernel32
CreateThread
CloseHandle
WaitForSingleObject
CreateProcessA
Sleep
LocalFree
FormatMessageA
MultiByteToWideChar
TerminateProcess
GetSystemDirectoryA
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
lstrlenW
WideCharToMultiByte
lstrlenA
GetModuleFileNameA
user32
PostMessageA
IsIconic
GetSystemMetrics
DrawIcon
AppendMenuA
MessageBoxA
LoadIconA
IsWindow
GetClientRect
AdjustWindowRectEx
SendMessageA
GetSystemMenu
EnableWindow
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
oleaut32
SysStringLen
SysAllocStringLen
VariantInit
VariantCopy
VariantClear
SysFreeString
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
Name
.text
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=2, id=11, version=8798,
count=12, id=19, version=8022,
count=2, productName=Unmarked objects (old),
count=10, id=19, version=8034,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=3, id=4, version=9782,
count=299, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=18, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
Pacܵ绰г/lib/phone.exe
- IMPHASH 5ac2efb959a6b81cb44ba769e1474c7c
- SHA256 e5c6da9ff61929f698853a873d281d404965a1a0cc1f88115357c70f952f0c49
- MD5 20336aee04c3dab5853c2b279bac40ac
- SHA1 bbe9373f98cfa33a5ff9092481e793ffa9739b79
- SHA512 d0aa6a8821f4f5cad6668c3e30af325ab953490d46afc06187a476ef751387a619db3a35a89d375e157d48728b7dbb6c3a1b3da66c39d90036b6e5262ad1631b
- SSDEEP 1536:IIHOahpAjtn8NVliIgEDWPZZBgaqFIKa0NPsO3C0:IIHOahpAjUVlFfDmdgWKa0NP3C
- TLSH T122731A836E968471E61A8630297D5B7AC5BF9C994720DBC7A3D8ED2C1C27190EC3934F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36687
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
qnviccub
ord34
ord50
ord37
ord200
ord20
ord21
ord35
ord24
ord28
ord36
ord22
ord23
ord19
ord18
ord38
mfc42
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord800
ord641
ord860
ord540
ord324
ord825
ord2370
ord4234
ord6215
ord858
ord823
ord1871
ord3663
ord4160
ord537
ord4277
ord4129
ord5683
ord1791
ord5810
ord5481
ord2031
ord4411
ord4447
ord4863
ord4975
ord4919
ord5796
ord5478
ord1971
ord966
ord278
ord605
ord1638
ord6055
ord1776
ord5290
ord3402
ord4424
ord3742
ord818
ord567
ord1979
ord2393
ord6657
ord4078
ord2818
ord3507
ord6881
ord1074
ord5204
ord3229
ord3318
ord939
ord941
ord5186
ord690
ord665
ord4202
ord5710
ord354
ord389
ord535
ord4278
ord6663
ord2764
ord4335
ord610
ord6139
ord287
ord1158
ord5602
ord940
ord2614
ord6283
ord913
ord6282
ord1576
ord1615
ord922
ord2819
ord924
ord548
ord3337
ord2915
ord923
ord6877
ord6662
ord539
ord4204
ord2784
ord926
ord700
ord3811
ord398
ord4189
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1134
ord4853
ord1146
ord1168
ord2863
ord4287
ord6197
ord6378
ord2379
ord755
ord470
ord6334
ord2864
ord3092
ord1175
ord1200
ord2077
ord2086
ord6052
ord2514
ord4710
ord4998
ord4376
ord5265
ord5442
ord2763
msvcrt
rand
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
atol
memmove
atoi
_mbscmp
malloc
free
__CxxFrameHandler
_setmbcp
kernel32
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
Sleep
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
GetSystemTime
ReadFile
CloseHandle
user32
SetTimer
KillTimer
PostMessageA
GetParent
IsIconic
GetSystemMetrics
GetClientRect
EnableWindow
LoadIconA
SendMessageA
AppendMenuA
GetSystemMenu
DrawIcon
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
wsock32
listen
WSAGetLastError
shutdown
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=19, version=8034,
count=1, id=11, version=8047,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=269, id=1, productName=Unmarked objects,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Pacܵ绰г/lib/qnviccub.dll
- IMPHASH 9a3eba59af5b0f5ed3f339a850e3c33b
- SHA256 e8a2c90b3b6e53e64a5e27e08556a08f1bacf80abb790fb7cb5abd0f04dc0ac3
- MD5 015bf0c6095a61aaafec0372589b657d
- SHA1 538bdcc2e201c25a9a5aff58a2ab14f6d0f514a6
- SHA512 1c5649aa7e9682fc7e3cb0fa96b9c5020c1a1af1fddcfa80ca47d231e9b55607fd513417e985c53ff9f0ae9ac82a190dbb56db40c8b6f0c36328548cd522600a
- SSDEEP 12288:yp+n6jmzuBJAMn2FV18ECxh1cONqmz0+DBe7L6lAJzD3iELoaR:yY66MELoaR
- TLSH T1EDD40701FB8541B3C55A5B3518BF2B76F3B6D9881F2A87836754FA792C723C05E3224A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
320535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ResumeThread
FlushFileBuffers
ReleaseMutex
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
CreateMutexA
MapViewOfFile
WaitForMultipleObjects
GetTickCount
lstrcpyA
DeviceIoControl
SetThreadPriority
CreateDirectoryA
GetFileSize
CreateThread
ResetEvent
WaitForSingleObject
CreateEventA
SetEvent
Sleep
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
FreeLibrary
GetCurrentDirectoryA
SetCurrentDirectoryA
LoadLibraryA
GetProcAddress
SetPriorityClass
GetLocalTime
MoveFileA
WriteFile
LocalFree
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
SetFileAttributesA
GetLastError
CopyFileA
GetSystemDirectoryA
FindFirstFileA
DeleteFileA
MoveFileExA
FindNextFileA
FindClose
CreateFileA
SetFilePointer
ReadFile
CloseHandle
GetModuleFileNameA
SuspendThread
DeleteCriticalSection
user32
ShowWindow
GetClientRect
LoadImageA
DestroyWindow
GetFocus
MessageBoxA
SetFocus
IsChild
IsWindow
DefWindowProcA
BeginPaint
SetWindowLongA
GetParent
EndPaint
KillTimer
SetTimer
PeekMessageA
IsCharAlphaA
IsCharAlphaNumericA
GetDesktopWindow
PostMessageA
CreateWindowExA
CallWindowProcA
GetWindowLongA
InvalidateRect
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetKeyState
SendMessageA
gdi32
SetWindowExtEx
DeleteObject
CreateMetaFileA
StretchBlt
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
RestoreDC
CreateCompatibleDC
GetObjectA
DeleteDC
SelectObject
ole32
OleInitialize
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
CoTaskMemAlloc
oleaut32
SysStringLen
LoadRegTypeLi
VariantClear
OleCreatePropertyFrame
VariantInit
SysAllocString
SysFreeString
ws2_32
recvfrom
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAStartup
WSAGetLastError
WSACleanup
listen
WSAAccept
setsockopt
inet_addr
htons
inet_ntoa
ntohs
gethostbyname
gethostname
bind
socket
connect
shutdown
WSACloseEvent
WSASetEvent
closesocket
WSAEventSelect
WSACreateEvent
getsockname
send
recv
sendto
atl
ord58
ord27
ord26
ord32
ord30
ord18
ord15
ord16
ord46
ord51
ord31
ord50
ord44
ord43
ord21
ord57
ord23
msvcrt
fopen
localtime
_CIpow
rand
srand
_CIasin
calloc
_hypot
fwrite
__dllonexit
_onexit
_initterm
_adjust_fdiv
_except_handler3
?terminate@@YAXXZ
fseek
ftell
fread
fclose
strrchr
_mbsinc
_ismbcdigit
_mbsnbcmp
wcslen
_mbclen
vsprintf
_strnicmp
_stricmp
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_purecall
memcmp
memset
free
realloc
malloc
strlen
strcpy
__CxxFrameHandler
atol
atoi
sprintf
strstr
time
memmove
_ltoa
strchr
strncpy
strncmp
_ftol
imagehlp
MakeSureDirectoryPathExists
msvcirt
?openprot@filebuf@@2HB
?get@istream@@IAEAAV1@PADHH@Z
_mtlock
_mtunlock
?close@ifstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??_Difstream@@QAEXXZ
??0ifstream@@QAE@PBDHH@Z
winmm
waveInAddBuffer
waveInPrepareHeader
waveInStart
waveInOpen
waveInClose
waveInReset
waveOutUnprepareHeader
timeKillEvent
timeSetEvent
timeEndPeriod
waveOutPrepareHeader
waveOutWrite
waveOutReset
waveOutOpen
waveOutRestart
waveOutPause
waveOutSetVolume
waveOutClose
msacm32
acmStreamSize
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
acmDriverClose
acmStreamReset
acmStreamOpen
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
QNV_Attach
QNV_Audrv
QNV_Broadcast
QNV_CCCtrl
QNV_CCCtrl_CCInfo
QNV_CCCtrl_Call
QNV_CCCtrl_Contact
QNV_CCCtrl_File
QNV_CCCtrl_Msg
QNV_CallLog
QNV_CloseDevice
QNV_Conference
QNV_Detach
QNV_DevInfo
QNV_Event
QNV_Fax
QNV_General
QNV_GetDevCtrl
QNV_GetLastError
QNV_GetParam
QNV_OpenDevice
QNV_PlayBuf
QNV_PlayFile
QNV_PlayMultiFile
QNV_PlayString
QNV_RecordBuf
QNV_RecordFile
QNV_Remote
QNV_SetDevCtrl
QNV_SetParam
QNV_Socket_Client
QNV_Socket_Server
QNV_Socket_UDP
QNV_Speech
QNV_Storage
QNV_Tool
Name
.text
Size
344KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
132KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=3, id=12, version=7291,
count=2, id=11, version=8047,
count=5, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=21, productName=Unmarked objects (old),
count=9, id=19, version=8022,
count=27, id=19, version=8034,
count=297, id=1, productName=Unmarked objects,
count=144, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Pacܵ绰г/lib/virtualaudiodriver/BriAudrv.dll
- IMPHASH a0d5317a763f4c1293d6dd39c6ffd9bc
- SHA256 85a04a047c4f4651aff93e9feb53b68849a9310cee01e9fc3ed96b90b4b2f3b8
- MD5 d5b4c5dba45c18eaffee0e9a899418bb
- SHA1 93f0e8a6a63005f83a2f390833a344ce3222c9a8
- SHA512 47515b190159f39f6f34623ba04003c1827540c98cb319ab0f5e5e116031179899c71e3985ab71b2e363808d4a43b45ca703fd5fd9411906ce2ec2f7bbbb78ad
- SSDEEP 1536:hmK24W3smm9puvdoL1d26ZAnyaE1gfCZ8yxmEDLENk97:hmKM3smm9puvdoJkSaUZ8dM7
- TLSH T1FF533A117AD004F3EA46163039BB37369276FDAB0BE297DB9F60DA6D0C321919937316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
EnterCriticalSection
WideCharToMultiByte
lstrlenW
LeaveCriticalSection
LocalFree
LocalAlloc
Sleep
InitializeCriticalSection
GetTickCount
DeleteCriticalSection
ResumeThread
WaitForMultipleObjects
ResetEvent
MapViewOfFile
CreateMutexA
CreateEventA
WaitForSingleObject
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
GetLastError
SetEvent
ReleaseMutex
CloseHandle
SuspendThread
CreateThread
LoadLibraryA
GetProcAddress
SetThreadPriority
FreeLibrary
advapi32
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyW
winmm
DefDriverProc
DriverCallback
msvcrt
_except_handler3
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
?terminate@@YAXXZ
memmove
??2@YAPAXI@Z
__CxxFrameHandler
wcscpy
sprintf
fclose
??3@YAXPAX@Z
msacm32
acmStreamSize
acmStreamPrepareHeader
acmStreamUnprepareHeader
acmDriverClose
acmStreamReset
acmStreamOpen
DllMain
DriverProc
mxdMessage
widMessage
wodMessage
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=2, id=14, version=7299,
count=2, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=11, id=19, version=8034,
count=78, id=1, productName=Unmarked objects,
count=21, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Pacܵ绰г/lib/virtualaudiodriver/TmSetupAuDrv.exe
- IMPHASH f12626d05fc56ec225828de9e4b9497b
- SHA256 69a207bd88b8985bc9f8858a507443884ce01797461fad7787e7cc555b36aeed
- MD5 1ae55ac3c62ec73575c251b5a3855ac6
- SHA1 0e63ab98f460f38232e2048ce23f421bd8d338c9
- SHA512 5187f3a06601e71a0169eeff64d234a8e3e184e4928d9d0111ea810584a816bd761de6f96babbacd4e2f56469ad398e515073ba81c9f3209804dd4e1ab3dafcb
- SSDEEP 6144:rJ4FNBYaMjbo8L+ZSe1QJkGZyB2D1v2pTnh:1Y+/o8qZPUvuTh
- TLSH T15024D123BA210741C6B791FF63BEC838B1A86AC94BC1568B17E4DF4CDA5B943ED11394
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord2379
ord3571
ord3626
ord3663
ord2414
ord640
ord2754
ord5785
ord1641
ord1640
ord323
ord823
ord1146
ord2575
ord5290
ord3402
ord6055
ord1776
ord4396
ord4424
ord3574
ord609
ord567
ord4275
ord4284
ord2405
ord5053
ord5981
ord2864
ord800
ord3874
ord540
ord5875
ord6880
ord4160
ord6197
ord283
ord1168
ord858
ord535
ord5710
ord2764
ord860
ord3081
ord537
ord3619
ord3721
ord795
ord3573
ord4234
ord6170
ord3797
ord2452
ord470
ord3089
ord6199
ord6779
ord4287
ord2243
ord2860
ord5787
ord1200
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1134
ord2302
ord668
ord1980
ord3178
ord2781
ord2770
ord924
ord356
ord3181
ord6215
ord2645
ord2863
ord6380
ord4224
ord941
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord324
ord825
ord641
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord755
ord2976
ord4407
ord1775
ord4078
ord6052
ord2514
ord4710
ord4998
ord4853
ord4376
ord5265
ord1576
msvcrt
_setmbcp
__CxxFrameHandler
sprintf
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
kernel32
GetModuleHandleA
SetFileAttributesA
GetLastError
CopyFileA
GetCommandLineA
GetSystemDirectoryA
MoveFileExA
DeleteFileA
GetModuleFileNameA
GetStartupInfoA
user32
GetClientRect
GetWindowRect
EnableWindow
InvalidateRect
GetSystemMetrics
DrawIcon
GetSystemMenu
AppendMenuA
FindWindowA
LoadIconA
KillTimer
SetTimer
RedrawWindow
UpdateWindow
PostMessageA
IsIconic
SetWindowRgn
SendMessageA
GetSysColor
FillRect
OffsetRect
GetSubMenu
TrackPopupMenuEx
ClientToScreen
WindowFromPoint
GetActiveWindow
SetCursor
GetParent
GetNextDlgTabItem
gdi32
GetStockObject
CreateSolidBrush
CreateFontIndirectA
SetViewportOrgEx
GetViewportOrgEx
Rectangle
SetBkMode
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
GetBkColor
SelectObject
BitBlt
DeleteObject
StretchBlt
advapi32
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegDeleteValueA
shell32
ShellExecuteExA
ShellExecuteA
comctl32
_TrackMouseEvent
winmm
PlaySoundA
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
184KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=3, productName=Unmarked objects (old),
count=12, id=19, version=8034,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=4, version=9782,
count=326, id=1, productName=Unmarked objects,
count=13, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Pacܵ绰г/lib/virtualaudiodriver/˵.txt
- SHA256 dd3671d63c3f541a9a7651104472a01794086d7c33c9e1132db6c4bd8f1eecff
- MD5 0592a555733938457e217abdefc71c59
- SHA1 fa9e8e831caa3b124481d2ac0ed22ea61c8c5ee9
- SHA512 38ff36d1c62bda5a7f2d234a04367bda9679c2f7e8a15682fe1d644ac33b2f32a997a4ae4220e3f69db37e36796463e958fe4f5614bf0da7fba18ded9244c7ec
- MD5 SHA1 SHA512
Pacܵ绰г/˫ļװPac绰.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1ced94bbefabb7337593c605cfa03ef33f9beb0b056b7d361640d5c26b2575c0
- MD5 84b40723cc30ae17144a2a986f8ed1e2
- SHA1 ff650080c2ac027f1d846144dee06edca0cfce85
- SHA512 77c3ad887da46a18352e89de4ca77235924a1035ffd079bbd0e4169c4863d235d7f56dbd1c88f48c88206f6baec80487318d06ef4db0bb17e517f126b61de359
- SSDEEP 48:6FuKWfi6ibeYnI5qHVh6yk7YNMa42c+B6YUui8lnm/GbL54tMilXJZKFCpfbNtm:yVPecDr7kG42KYpJcGYlJnzNt
- TLSH T16CC1931153E48B3AE6334775BDB383520B74FA61CF57DBBD288872176E32A490922A61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\xiaok\source\repos\LH2020\Pac打电话安装程序\obj\Debug\Pac打电话安装程序.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ