hwid-changer-games-main.rar
- SHA256 e7dfdd41672ae6df679ac773862c96b5779013862aa1c2379821ce89fdc81764
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hwid-changer-games-main/AMIDEWINx64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
hwid-changer-games-main/HWID Checker.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
60 seconds
Behavioral task
behavioral3
Sample
hwid-changer-games-main/HardDiskSerialNumberChanger.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
60 seconds
Behavioral task
behavioral4
Sample
hwid-changer-games-main/MAC Address Changer.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
60 seconds
Behavioral task
behavioral5
Sample
hwid-changer-games-main/amifldrv64.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
60 seconds
Behavioral task
behavioral6
Sample
hwid-changer-games-main/cleaner.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
60 seconds
General
- Target hwid-changer-games-main.rar
- Size 361KB
- Sample260731-vesbwack71
- SHA256 e7dfdd41672ae6df679ac773862c96b5779013862aa1c2379821ce89fdc81764
- MD5 f1c1856f6a7e93cd2d3b0032a86365b7
- SHA1 4f5528a412269c00d2b48fcce55157ada65e8d15
- SHA512 a6a9106381b495b3fcc33b1e0ee282a855d31cf841f9924fa2110c123d5fc42a380ea801221ff43cf104b59a6f9619220c11651125486833f5b852f2fd53c7c1
- SSDEEP 6144:qVmD2IDne0WTlE+whKefuPCWuIKnpmdHVhufIgPTQuIKnpmdHVhufIgPTg:qVmDJeTJ5whV9xCiIgPfxCiIgP0
- TLSH T1B47423D5AF1E4E4DA2D34FCEB39305A915834DE17EAE12D8644921C343FE84E4AD87A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/hwid-changer-games-main/AMIDEWINx64.EXE unpack001/hwid-changer-games-main/HardDiskSerialNumberChanger.exe unpack001/hwid-changer-games-main/MAC Address Changer.exe
File Explorer
-
hwid-changer-games-main.rar.rar 361KB
-
hwid-changer-games-main/AMIDEWINx64.EXE.exe 455KB
-
hwid-changer-games-main/HWID Checker.bat.bat 492B
-
hwid-changer-games-main/HardDiskSerialNumberChanger.exe.exe 237KB
-
hwid-changer-games-main/MAC Address Changer.exe.exe 237KB
-
hwid-changer-games-main/README.md1KB
-
hwid-changer-games-main/amifldrv64.sys.sys 29KB
-
hwid-changer-games-main/cleaner.bat.bat .vbs 5KB
hwid-changer-games-main/AMIDEWINx64.EXE
- IMPHASH 272dae991c0311688a7a20faa5468b8e
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- TLSH T1B0A4084AEB5224E0D876D1B8C981521AF6B0BC7847349BDB729C41090F76AEC9E3DF58
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
GetVersionExA
LoadLibraryA
GetProcAddress
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
GetModuleFileNameA
GetModuleHandleA
SetThreadExecutionState
SetConsoleCtrlHandler
CreateFileA
DeviceIoControl
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
FreeLibrary
SetConsoleMode
shell32
ShellExecuteA
user32
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
CreateWindowExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
wsprintfA
GetMessageA
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
StartServiceA
OpenServiceA
AdjustTokenPrivileges
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=143, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=43, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
hwid-changer-games-main/HWID Checker.bat
- SHA256 2c88867fe0929b281ac86a0610119a09d773b94ecc4f63664f13f058f03602f1
- MD5 46040e2135e912f85c0cddb8b364d923
- SHA1 28bf68a37f0bf104b42427bdf9f661efbb2240a0
- SHA512 f154e9dd04f80b764129a6849ed33240c9d4684e36d0c25d4394278ff3a14c2e0b0876258da55d6e366bb69922d0b1e79725d6de5a7616031e3242c2bd8b3bfc
- TLSH T164F05E4BB65A86458D506E1036720491303D62A385D29DD87DB722385FD38DCB6DDF2F
- MD5 SHA1 SHA512 TLSH
hwid-changer-games-main/HardDiskSerialNumberChanger.exe
- IMPHASH f171bb6c6f6b1d6d32649a265a2ed44a
- SHA256 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00
- MD5 ecc630a923e295240c465000e939d897
- SHA1 d24ea1e7bc9b05312e31f05a26222ab4effd664b
- SHA512 d0425c7e69d5ba15903b40055ce0e72fc4b8fd59cf58018cc89fc2fe268739e3b470ca63db0b6fda7e0c87fbb70d207fbc9ae51ee607b33d494908437a825eb8
- SSDEEP 6144:QBTDgheuMo6jfztgkbwoWjG6aB3ZyCvrhF44bozBAMx1A7+gvo1:QZzjAhi6aB3ZyCvrhF44bozaMx1p
- TLSH T1F634D603BD9AC961C75CE432EC7F03DA806A259231EE185C8B1615CB793F7A05E3696F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CreateEventW
CreateMutexW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeConsole
FreeLibrary
GetCurrentProcessId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
ReleaseMutex
ResetEvent
SetEvent
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__getmainargs
__initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
hwid-changer-games-main/MAC Address Changer.exe
- IMPHASH f171bb6c6f6b1d6d32649a265a2ed44a
- SHA256 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00
- MD5 ecc630a923e295240c465000e939d897
- SHA1 d24ea1e7bc9b05312e31f05a26222ab4effd664b
- SHA512 d0425c7e69d5ba15903b40055ce0e72fc4b8fd59cf58018cc89fc2fe268739e3b470ca63db0b6fda7e0c87fbb70d207fbc9ae51ee607b33d494908437a825eb8
- SSDEEP 6144:QBTDgheuMo6jfztgkbwoWjG6aB3ZyCvrhF44bozBAMx1A7+gvo1:QZzjAhi6aB3ZyCvrhF44bozaMx1p
- TLSH T1F634D603BD9AC961C75CE432EC7F03DA806A259231EE185C8B1615CB793F7A05E3696F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CreateEventW
CreateMutexW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeConsole
FreeLibrary
GetCurrentProcessId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
ReleaseMutex
ResetEvent
SetEvent
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__getmainargs
__initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
hwid-changer-games-main/README.md
- SHA256 d695151be6ddf724e5f53bedc042722ed0adced75d2f41a1584a5246061ed3f7
- MD5 01bf6de552049c914e8b5480242f6759
- SHA1 28911a6395ee0b300dcbe7f60d514254364969b8
- SHA512 1be013958470d8429078565902b57bbf6120d6a2eed9f706959f5654abfe1e5b0604393bc463ec7f131f6b1cc5bac37080a0030754bfb2062848239ad972ceff
- TLSH T19F41512EB294A2D721E75E06324A3962ED15A4E4F3064B3F095CA0182375F76C2BD7D5
- MD5 SHA1 SHA512 TLSH
hwid-changer-games-main/amifldrv64.sys
- IMPHASH b05ee5c816a30bc52378c759486af0b9
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 13, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2019
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d3:d0:94:56:9d:0e:bd:83:06:00:00:00:00:00:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
394B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
hwid-changer-games-main/cleaner.bat
- SHA256 cab883b4ae93e77e06f51ea422591a06b945479174884270005ae67353272f43
- MD5 b3c21fa1ccda2feecefb69b327441642
- SHA1 1ca39a22c49557f0ac177658efa9674300599c85
- SHA512 a7145449b795c2386fb1a9c5e0b320811d557a47b408f444c90eab7ffbcff7216e939f47a3eb26eecfdad4fd00b7be79c3082803822226702fc8215cf70ee0ce
- SSDEEP 96:lbVenI8xeMz8mqtVtHf1fYhSfxE8QYbI4Kc:lVenInMhqzxf1fYhSfCYbVKc
- TLSH T1F0C1C043196FC1A42A43D05A61655425D0ACA5EF771D03D2373EAABE02C5CACE8CFE7B
- MD5 SHA1 SHA512 SSDEEP TLSH