free_perm.zip
- SHA256 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
free_perm.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
18 signatures
150 seconds
General
- Target free_perm.zip
- Size 10.5MB
- Sample260802-p679hstbmd
- SHA256 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505
- MD5 c9263541fb9de3a9a0b6bf0861c658f5
- SHA1 957ab55de8c56487178f09324887cef5e58d98cc
- SHA512 0669d7e0afca7fb1fb7fc71313fb2e5db8194982fc70ebc91c6b9cb42b848e9b12c37168a1d068c3f8686ced1afa0c2bf989f520e173254e46de17032e0c28b6
- SSDEEP 196608:lpDSiMGYRZ3gvggT1FjdK7yN4b+eiCtULc9PCylSrroKVmGx8HcdJqaTWqkHKEP5:lpDnZmKnLZBSb+eimSc9P/ic7Gicdgam
- TLSH T111B63385BBE06D9D353C0AD3DB98E9C58EBEC04447EFE930B85D25BD2DC5204E2187A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/free_perm/Sawaf_1.exe unpack001/free_perm/rtkiow10x64.sys unpack001/free_perm/sawaf.exe unpack001/free_perm/sawafio64.dll unpack001/free_perm/winxsrcsv64.exe unpack001/free_perm/z.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/free_perm/SawafV1X64_1.sys unpack001/free_perm/ntgetfucked.sys
File Explorer
-
free_perm.zip.zip 10.5MB
-
free_perm/SawafV1X64_1.sys.sys 15KB
-
free_perm/Sawaf_1.exe.exe 365KB
-
free_perm/ntgetfucked.sys.sys 483KB
-
free_perm/rtkiow10x64.sys.sys 54KB
-
free_perm/sawaf.exe.exe 3.7MB
-
free_perm/sawaf64e.sys.sys 61KB
-
free_perm/sawafio64.dll.dll 144KB
-
free_perm/spoof.bat.bat 5KB
-
free_perm/winxsrcsv64.exe.exe 377KB
-
free_perm/winxsrcsv64.exe.i644.6MB
-
free_perm/winxsrcsv64.sys.sys 25KB
-
free_perm/z.exe.exe 5.2MB
free_perm/SawafV1X64_1.sys
- IMPHASH 9943d029b8ce940ac6c9a8ab0737bf35
- SHA256 26ba58c9af9c8a7aebf222f491f786daa0626be44d34f170fea3623d92828e63
- MD5 73fc2954829a49fc8eb178b000d10120
- SHA1 4040f6974119ff2486f9a0cbd749ce240cbee2aa
- SHA512 d4d6529633ffef9c6ce381db44dd4a568514e5d4f5118de1bea76e74c56fd1f4758a3fd3cabe215cbd651296fb818e88529c95270db00452c4dc07b372953137
- SSDEEP 384:OfkmSN6aOu0HMt8RMy+Ld3mirILpiV8UHeMjnBjm:Of3S8yCMtuMtLcIILpkY
- TLSH T192622A9746246457DD878E34D396DB37AE70B3A62FC452DB4070C1866E87BF02B3930A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
40:60:3c:72:30:d7:4f:f3:35:24:a1:1c:0b:09:f9:45:9e:7a:fe:91
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US
Chains
Jul 23, 2012
CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US
Serial Number
5b:a2:90:5d:11:f5:cf:bb:c5:3a:b2:1b:fd:39:de:fe
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 26, 2012 - Jun 26, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
r:\work\driver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
MmMapIoSpace
MmGetPhysicalAddress
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
IoFreeMdl
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
926B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
free_perm/Sawaf_1.exe
- IMPHASH 26be15245910d74758aa31681e690852
- SHA256 715eb7d445114e944ec249f98ae4c1d7e324e59fc1f06fb1105206b7cbf4eee8
- MD5 2572e90286b5bce7673fa8aa8bbba8c5
- SHA1 89649f27d5d9fdb77fa5bab2b3d90fa298d388aa
- SHA512 9a2016b0146ff8d380bd56a631a1d6ea91e6109d7d3af61bbf259a1aa7b6ecc25ef61d9903976fc34378bddfd33279c40ebd3801724756e93f6795d75398583d
- SSDEEP 6144:b/GYAqo8g19xZwO+y57PLquh7eSO2bK5Pqs91ZW+EFrLQYe:6Y71ax+y57jquVKEK5P/Wc/
- TLSH T13984F946EFA270FAD8B6D03C91921226F4B038A443259BD3B25D592A4F23BF5ED3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
253952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
RegisterClassExA
ExitWindowsEx
BlockInput
SystemParametersInfoA
wsprintfA
MessageBoxA
kernel32
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetCurrentDirectoryA
CreateFileA
GetModuleFileNameA
GetModuleHandleA
SetConsoleCtrlHandler
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
GetFullPathNameA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
CreateMutexA
GetLastError
SetThreadExecutionState
SetEndOfFile
GetProcessHeap
ReadConsoleInputA
SetConsoleMode
CloseHandle
FlsSetValue
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
RtlPcToFileHeader
EncodePointer
DecodePointer
FlsGetValue
GetFileAttributesA
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSize
RtlUnwindEx
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
advapi32
RegSetValueExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
RegQueryValueExA
shell32
ShellExecuteA
Name
.text
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=115, id=131, productName=VS2008 build 21022, version=21022,
count=11, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=135, id=1, productName=Unmarked objects,
count=191, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
free_perm/ntgetfucked.sys
- IMPHASH 0bf4fee05400b7ed71345a830ee20323
- SHA256 4331b869b6c44e31ddd1e346fcc9cb4c880bc64b37c39d8b58796b52e62bdf06
- MD5 6e0c28abce1069d15734f7a9495c874e
- SHA1 5066cbcbe3638207aedcc75f563dacf0b8b45c82
- SHA512 96d1eb3acd15ceff844a57be5cc717af0060a01dd39c6dafa8344f3af7f9bf493859299a52a508618f75bd735f952cdae11ff91b7658eae2a3f81b8c6d4ba055
- SSDEEP 12288:31ydpi7bAWjkREVbEyfrlpl9XpArw9I33NdNGq3byoG:lUpeLjkREVb55P5pA09I3ddQEOoG
- TLSH T19EB47C65B3946AD8CE76C1F59B46DA03DAF27C0523145EE742E08CD62F739E0AB39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ec:69:a7:95:ae:80:cc:98:6e:cd:a0:78:1b:27:59:22:3e:f6:2c:77
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=AnFu NetShield Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AnFu NetShield Technology Co.\, Ltd.,L=Ji'an,ST=Jiangxi,C=CN
Chains
Jul 31, 2026
CN=AnFu NetShield Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AnFu NetShield Technology Co.\, Ltd.,L=Ji'an,ST=Jiangxi,C=CN
Subject
CN=AnFu NetShield Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AnFu NetShield Technology Co.\, Ltd.,L=Ji'an,ST=Jiangxi,C=CN
Serial Number
0c:ea:5c:41:b4:b3:56:60:b8:83:ba:06:de:f5:a0:53
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 25, 2014 - Mar 25, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
10
Entry point
420096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Network.pdb
cng.sys
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
ntoskrnl.exe
KfRaiseIrql
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
IoOpenDeviceRegistryKey
ZwQueryKey
IoEnumerateDeviceObjectList
ZwOpenDirectoryObject
_vsnwprintf
ZwQueryDirectoryObject
__C_specific_handler
__chkstk
Name
.text
Size
416KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.enc
Size
512B
Virtual Size
357B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.enclist
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=7, id=259, version=35215,
count=5, id=260, version=35215,
count=5, id=257, version=35215,
count=24, id=1, productName=Unmarked objects,
count=2, id=261, version=36248,
count=1, id=258, version=36248,
free_perm/rtkiow10x64.sys
- IMPHASH 6faad89adbfc9d5448bb1bd12e7714cd
- SHA256 32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993
- MD5 b5ada7fd226d20ec6634fc24768f9e22
- SHA1 947db58d6f36a8df9fa2a1057f3a7f653ccbc42e
- SHA512 ea01c746840acc513eeb2df472239fc9931939d545535e0836e7318f034a33a9a7f96eeabd5ddff3a2d777e88fa1a2c105ed198e76ac3340697b7a39666e727e
- SSDEEP 768:gqgoGuqKHysIsocsxHXjB0ki00yNfSULIOuJTdgMKgux86A3qph9R13c2pIur:gqKlX180XScIOuJTd5f6A6pR1MxA
- TLSH T1A4435B90C3A80C92ED6AC97575F4E523ED71B9455B74CAEF1218C2818B53BC1FA3836E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
41504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\rtkio\SRC\sysw10x64\Release\x64\rtkiow10x64.pdb
ntoskrnl.exe
KfRaiseIrql
MmUnmapIoSpace
MmMapIoSpaceEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareMemory
KeSetSystemAffinityThreadEx
KeQueryActiveProcessors
ExAllocatePoolWithTag
ExFreePoolWithTag
ExCreateCallback
ExRegisterCallback
ExUnregisterCallback
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
KeLowerIrql
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
IoWMIRegistrationControl
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
__C_specific_handler
MmUnmapLockedPages
_vsnprintf
hal
KeStallExecutionProcessor
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=3, id=262, version=24610,
count=5, id=259, version=24610,
count=3, id=260, version=24610,
count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=4, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
free_perm/sawaf.exe
- SHA256 7c6057273903aa7e9b998a36d14cf9a15be175dd0863a3509cf87dafbc4c876b
- MD5 14e50882b56cf18565db83ddb0f88ed0
- SHA1 ff30f305ac85b6518fb962c569e72cb10c483101
- SHA512 17019421a09b96b8ed2e5b79340a689eefe9ba5f727094b070541f3e3ef5dcc4c89b0664c3f597b2b3d337e18d9ade731a66ff0825ee1d2c46c07acc402f0f74
- SSDEEP 49152:RnutQ3bGqBQlkvF3KDkR5mR4z5p1/8nEEuu2QWyJLFI5FWUlPrnwlq+iJP6ZbGI:Rr2a3KDkR5BInLn2IzI3d9+iqbGI
- TLSH T16E06331BA42AFD40D4EEEA319A31FD12F5C2FEC54BA187EB444FD82864A3317A95071C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6725808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
275KB
Virtual Size
563KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
56KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
9KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
sawaf
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26715,
count=7, id=259, version=26715,
count=170, id=261, version=26715,
count=47, id=261, version=27316,
count=17, id=260, version=27316,
count=8, id=259, version=27316,
count=1, id=262, version=26715,
count=14, id=257, version=26715,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=148, id=1, productName=Unmarked objects,
count=28, id=265, version=27404,
count=1, id=255, version=27404,
count=1, id=151,
count=1, id=258, version=27404,
free_perm/sawaf64e.sys
- IMPHASH 11f988f5957aeb7baa8193fae423958c
- SHA256 a1c886d0e3b8dae271940d6c366f10fa54aff9582ee571394d7b0ead60f9c609
- MD5 a04fa610c631055c3c7b11df5887fbab
- SHA1 b37916fb4a764aa82cff5faba997437d3d93fb30
- SHA512 4fecdb2de280cd251421e3f09188b62fa95732db19488846677e75277f0a271d06f5ae2d38b62b65b359c03d715ece14cc5ff11aab0f7c4520bdd10904740f92
- SSDEEP 1536:LfeG1kQWHBqSfyAXy5IFCxxoPt1Q+8iAS2w2zB:LfwFftuQCr5D3t
- TLSH T1255349C72BB420C4F8FB9575869AC66BEFB0B19A17324BEB06A5C0550E533D1873D683
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:10:85:ac:23:70:2f:49:af:ce:03:b9:58:9b:4b:18:e0:70:45:04:ab:73:4d:e1:b5:c0:4f:30:75:7c:ee:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 4, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
6b:10:85:ac:23:70:2f:49:af:ce:03:b9:58:9b:4b:18:e0:70:45:04:ab:73:4d:e1:b5:c0:4f:30:75:7c:ee:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Chains
Jan 28, 2022
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Serial Number
51:d1:95:74:21:63:07:a3:45:b1:50:aa:98:c4:27:03
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 2, 2021 - Apr 2, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2021 - Jun 16, 2022
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:DD8C-E337-2FAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9c:0f:a6:4d:61:d2:9e:4b:28:00:01:00:00:01:9c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
20947360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\sandbox\999444\sdk\nal\driver\x64\Release\iqvsw64e.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmMapIoSpace
MmUnmapIoSpace
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
IoGetDmaAdapter
MmGetPhysicalAddress
MmIsAddressValid
_vsnprintf
strstr
wcsncmp
wcsncpy
wcsstr
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeEvent
KeWaitForSingleObject
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoGetDeviceInterfaces
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwEnumerateValueKey
wcscmp
RtlGetVersion
ProbeForWrite
ExAllocatePool
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
__C_specific_handler
MmGetSystemRoutineAddress
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
ExAllocatePoolWithTag
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
RtlFreeUnicodeString
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
DbgPrint
IofCompleteRequest
strncpy
hal
KeQueryPerformanceCounter
KeStallExecutionProcessor
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
19.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=262, version=24610,
count=76, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=260, version=24610,
count=5, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
free_perm/sawafio64.dll
- IMPHASH 625a9a2139046104e37e4654c9a0a63d
- SHA256 1efe8000403087761944b4ec2eadd19e3ca3cfcec71106038c9110dfddf4d589
- MD5 7986e653dfea1eefd5e567c3e0e505df
- SHA1 a326377e0b043e27d905a8df7f669099fdf33ccd
- SHA512 c3efdba80faeef6f965f1ede50d4a5023681a4c6fb5c8dda1d656d9c9a3485dfdbae919ce99f95050d9fba93a8d3be8abbd7cc2168f70e35225861293ab1d97f
- SSDEEP 3072:SMmIcRC1BP5gn6ENjoJszSKxmLdWTZILJMu99:hURC1yvm2fAdWYM
- TLSH T103E32A91719200F4C6FA953889E64A16F3E178244316A7CF267086270F33BE9FE7E795
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
CreateFileW
OpenProcess
DeviceIoControl
DuplicateHandle
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
Sleep
GetLastError
GetVersionExW
GetCurrentProcess
GetProcAddress
CloseHandle
GetModuleHandleW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
HeapSize
WriteFile
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
advapi32
StartServiceW
DeleteService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ControlService
GetIoBase
LoadPhyMemDriver
MapPhyMem
ReadPortByte
ReadPortLong
ReadPortWord
RtIoInformFWS3S4S5
RtIoReadAsfUchar
RtIoReadAsfUlong
RtIoReadAsfUshort
RtIoReadCPUUchar
RtIoReadCPUUlong
RtIoReadCPUUshort
RtIoReadCSIUchar
RtIoReadCSIUlong
RtIoReadCSIUshort
RtIoReadChannel
RtIoReadEEPROMUshort
RtIoReadEfuseByte
RtIoReadExtGMACUchar
RtIoReadExtGMACUlong
RtIoReadExtGMACUshort
RtIoReadMacByte
RtIoReadMacDword
RtIoReadMacWord
RtIoReadMcuAccessRegWord
RtIoReadOCPUchar
RtIoReadOCPUlong
RtIoReadOCPUshort
RtIoReadPCIUchar
RtIoReadPCIUlong
RtIoReadPCIUshort
RtIoReadPciEPhyUshort
RtIoReadPhyOcpRegWord
RtIoReadPhyUshort
RtIoReadUSBUchar
RtIoReadUSBUlong
RtIoReadUSBUshort
RtIoReadVPD
RtIoWriteAsfUchar
RtIoWriteAsfUlong
RtIoWriteAsfUshort
RtIoWriteCPUUchar
RtIoWriteCPUUlong
RtIoWriteCPUUshort
RtIoWriteCSIUchar
RtIoWriteCSIUlong
RtIoWriteCSIUshort
RtIoWriteChannel
RtIoWriteEEPROMUshort
RtIoWriteEfuseByte
RtIoWriteExtGMACUchar
RtIoWriteExtGMACUlong
RtIoWriteExtGMACUshort
RtIoWriteMacByte
RtIoWriteMacDword
RtIoWriteMacWord
RtIoWriteMcuAccessRegWord
RtIoWriteOCPUchar
RtIoWriteOCPUlong
RtIoWriteOCPUshort
RtIoWritePCIUchar
RtIoWritePCIUlong
RtIoWritePCIUshort
RtIoWritePciEPhyUshort
RtIoWritePhyOcpRegWord
RtIoWritePhyUshort
RtIoWriteUSBUchar
RtIoWriteUSBUlong
RtIoWriteUSBUshort
RtIoWriteVPD
SendSMI
UnloadPhyMemDriver
UnmapPhyMem
WritePortByte
WritePortLong
WritePortWord
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Shared
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
free_perm/spoof.bat
- SHA256 0de01907c1429908a71e9035ccf40c3da02d95db0110a34c1fa87cceb12a554c
- MD5 2f50b6a80b36a7a9731f7544cfb88d5e
- SHA1 fad1a76e1791d780b3c38ac94c187445f19d3aa8
- SHA512 ce11144b83dc96ce4dba6ca1e0e99aa0e3baf6309d4e66366bfa87c81d8494099250ef5eb32ae261aec03643a3d689768b26e6243b5c7f02b532358806381c71
- SSDEEP 96:a4PhZT9kKkC6sMGfSjoMIOz1RkUSNqoiAdIPhHKbmKPZ4JZczqGq6G+BnkIS8kw4:aahZT97L6sMGa0MII1RNSjxcRKRPZ4J9
- TLSH T1D9C18326BF4B8C18C49525D9A1AFA067BB56361B1AB2FBE037C36158E10340C57F8CDD
- MD5 SHA1 SHA512 SSDEEP TLSH
free_perm/winxsrcsv64.exe
- IMPHASH e3d5de629e09ae6898196a1418661d7f
- SHA256 5e66ba6e5dc98c65fb5d6a0c4bef4a090aad01386ef44643c416b613bdb70a38
- MD5 7ecdca11caff02f9c463bed663740788
- SHA1 def46a8b7f168bdb0ca8e25dd8d02cf3f77b226e
- SHA512 4d97b57a99a80617e829994a756fac4e14ee7b9f205d1cd25dfe0268255417f673f9887e862f75425a5b5c0cd2529c3c79391938f9c6fe5c2251529397660d62
- SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr94ZRecY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5Bfu
- TLSH T1E084F62AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
CreateServiceA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
212KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=77, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
free_perm/winxsrcsv64.exe.i64
- SHA256 e8087f7013a26e64c043cc67efa0d6ea6426b8019815c1dc883d983509fb4303
- MD5 c5672651a2ef0ad4dcdd86a9be97df90
- SHA1 7b0cf63dd658b16b19030a2be84128886db5e493
- SHA512 42c08a814f58e384befdb967753c3e5a312514f4902499d40e357d8134c8bb44d0fe77f23b0fc3b377e79e8296741779b399cd4efb2db2bb6b9540c2f517d3bb
- SSDEEP 12288:9bOYdIyggnOOWt9A2TLw00XS2iq0ZsnPfHI/OcnVmru0XMaD4pJKyDME0olbS0xw:fw8bXVyKWSzBjn+oUvw1eLi
- TLSH T10D264076BBC72D64C0D40A31166E873777E9D58A452EDB1362622A00BCBF6C25F30BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
free_perm/winxsrcsv64.sys
- IMPHASH 35ce4f00ca063f6bffa0759d88c3a148
- SHA256 692afddcd14a26a38da1150dbc0df9486999d9bc3efee51695f9f9eb2eb00952
- MD5 1249bd33f387ed0571624e1de9d24419
- SHA1 2d28dc65658d4894f0924e1e9248ac6c4646b94b
- SHA512 2fcb607ed43599153070a250b2582947d4221bb896372e11ae47a9ca32d3a0f6200b8c70857591e114275ca6a1cdb215ccee11856f0a18570ee6975858fb344b
- SSDEEP 384:qrzqfCQlZluZfnktrQsHGh1jlyh3gkELRPR9zhTeiHU:KdCluVG0G37Q9zi
- TLSH T1DFC26C82A3781096F49E957083E9DAB37D7CB7863711A7DB12A0D0101E63BC9A23436E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
69:ec:ee:5d:c6:96:72:bc:b8:ad:ce:12:99:01:f1:3a:fd:c4:21:b7:e9:99:89:91:3b:f4:8a:57:a7:bf:15:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 22, 2025
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6d:aa:07:2f:95:82:18:c9:e3:00:00:00:00:00:6d
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2024 - Oct 8, 2025
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f6:83:2f:26:6a:54:5d:22:c1:00:01:00:00:01:f6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\AMI_Code\Flash\00_AFUDriver\AFUDriverSourceCode_Build\AFUDriverSourceCode_5.6_20230321\AmiFlashDriverSrc\sys\x64\Release\amigendrv64.pdb
ntoskrnl.exe
ZwUnmapViewOfSection
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmMapIoSpace
MmUnmapIoSpace
RtlCompareMemory
ZwClose
ZwOpenSection
ZwMapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
ObReferenceObjectByHandle
RtlGetVersion
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
850B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
free_perm/z.exe
- SHA256 2bbd482267c97d49be95314057b56415d784d69aedcd9947b0124fb1f81baf93
- MD5 ea00cc3145f5ce2810ed9c5dffe93f47
- SHA1 9a9184b3921b4e6b3e95d2c3be83e256d4667ad0
- SHA512 3d469e0b35472c6911e5c340b57ca551958c4819cfd5180302781991e2461152af83d2cbdd33182153d3a87c4cf1b004964643a63cb4cc5d7f2fde3b15313bd0
- SSDEEP 98304:arO3bsxE3YaMGYUWdsDmLG6RPRSpT97Qwm5rPxff4soOpNLBx7JBBY0p:rIaTYUosmauSF97Hm5rtf4soQrJBm6
- TLSH T10B4633AA6BF02CDBCD365BF23F8945C55CB354728D40D7646B2B006A1598BCEE7B6380
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11706456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
1.1MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
65KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
175KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
63KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
sawaf
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=174, id=243, version=40116,
count=1, id=244, version=40116,
count=6, id=259, version=23013,
count=31, id=261, version=23013,
count=20, id=260, version=23013,
count=8, id=241, version=40116,
count=17, id=242, version=40116,
count=178, id=1, productName=Unmarked objects,
count=11, id=239, version=40116,
count=185, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,