d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
- SHA256 d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
Overview
overview
4Static
static
3Primo-Ramd...or.exe
windows10-2004-x64
3Primo-Ramd...or.exe
windows11-ltsc_2024-x64
3Primo-Ramd...rd.sys
windows10-2004-x64
3Primo-Ramd...rd.sys
windows10-2004-x64
3Primo-Ramd...ll.bat
windows10-2004-x64
3Primo-Ramd...ll.bat
windows11-ltsc_2024-x64
3Primo-Ramd....0.exe
windows10-2004-x64
4Primo-Ramd....0.exe
windows11-ltsc_2024-x64
4Behavioral task
behavioral1
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
Primo-Ramdisk-Server-Edition-6.6.0/Primo.Ramdisk.Srv.Mui.Setup.6.6.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
- Size 6.7MB
- Sample260805-d47dnach37
- SHA256 d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c
- MD5 b437e34aa20e75a35b1492374e29157f
- SHA1 b52b9e591d530f130abdca2e97b990001bf7fea2
- SHA512 429cdf148c2fbee3f22e5e5911dc4c7055a2e22e62a3a166945308fd7f586dd70d9710930a774328ebd5ad7cfa6ef4d4a35c06f40b315d2e76b2427a3a1807f2
- SSDEEP 196608:KydAoaJlwjo4EsD1H/jcsfD4/l6KyDp7yIfeUv73GT:KyrkKc4EsDJJ4xA75feUzW
- TLSH T1BC6633349959072B9BAB2B7CEE3731E8FD39F1FA264AEC0C7E45119613842EDC452358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.sys unpack001/Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.sys - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/Primo-Ramdisk-Server-Edition-6.6.0/Primo.Ramdisk.Srv.Mui.Setup.6.6.0.exe innosetup
File Explorer
-
d0db85922ba0fb3e7a1a3380406ce20cde377c82119e6905b0468ddd0a30375c.zip 6.7MB
-
Primo-Ramdisk-Server-Edition-6.6.0/.DS_Store6KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/.DS_Store6KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe.exe 96KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/PrDSrv56crk.reg1KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/TestCertificate.cer1KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.cat9KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.inf1KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.sys.sys 200KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.cat9KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.inf1KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.sys.sys 214KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat.bat 3KB
-
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/使用说明.txt33B
-
Primo-Ramdisk-Server-Edition-6.6.0/Primo.Ramdisk.Srv.Mui.Setup.6.6.0.exe.exe 6.7MB
Primo-Ramdisk-Server-Edition-6.6.0/.DS_Store
- SHA256 faf0b254d00cf9ff1ad8cb6c6a77435685a5f82d7b8bdf6adc6a442953b1a01e
- MD5 a5ccc0dcb21fb58f936b8424fae32e93
- SHA1 f4fb54ad570a721bfeaa8b7e0b49503bce97cb9b
- SHA512 fecf6d9eb4dba012eabd1af3b2fd176f10788346da982d1f5c86e75181bc4db6dcfa2d2393e7c4ac4868ec2853538be907998e6c3f4502a67414a80d6eced4e1
- SSDEEP 6:VWB8lWP0l5RG3+i6XkEslX/9ldlXSPnrtHP8//kIE6PulXSPnrtHP8//k:QKlWP0l5gui9EEX/HnXw6X1E6PqXw6X
- TLSH T17BC16743931424EAD93D1B3155D30B21BB66C0B263B24B4B1A11126DBC277811EA7BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/.DS_Store
- SHA256 e71228ec72f29d85f986307b16850b1c1e423f67e008e7d508e7d4fdf7dab90b
- MD5 e49965ff668fcdbe51cb65857fe48f00
- SHA1 5f4d5968a407772e8481cebda900b10acba349e5
- SHA512 9c3a3ae6f4410fe30e2afd38c015eaf6a1d3ee6fee6848034f5f1f2724793f3b1e691755e20b66843733d097106af10ce447adb8d7a7cb575bfd0a98590db21e
- SSDEEP 6:VW1exxl61wxxlDexxlq6XkEslX/9ldlXSPnrtHP8//kIE6PulXSPnrtHP8//k:Q1ekU9EEX/HnXw6X1E6PqXw6X
- TLSH T11EC14243C30164ABE938173264D30B207BBAC0B193A25B4B191251697C273405E63BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/CmdColor.exe
- IMPHASH 7bf6ee7f997d9058a8fa5739c928c0b5
- SHA256 e46befb51126a087f69603c92083d1f76dcbf97a598d604b9784dc3ac64ffaf1
- MD5 6e54e2184be6bd8f45635a527f7eecd3
- SHA1 e67328040eb9b6729017f2acb3203b2c42fcd156
- SHA512 7f750551dba011066eddc6a3d454531c7df08128086e1e68cc74e5a7c1ca0273d9c9a666d30eb3b433f3c113e40c45142a341888d61450cae3c311397553acc8
- SSDEEP 1536:JEFfH/RpufYadbDyWEJrCZT5aCt9W2CpN8h7Kk7ord:JqffkYcbD1E9CZTr9rsSKEoh
- TLSH T115A39D1274D2CCF3E81106300CE5AF7AEB7EE6680F116AC79358EA4D4E799D2CA37146
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17621
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
SetErrorMode
RaiseException
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetLastError
SetConsoleCtrlHandler
HeapFree
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
WriteFile
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
FlushFileBuffers
CloseHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
ReadFile
SetStdHandle
GetLocaleInfoW
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=10, id=11, version=8047,
count=6, id=10, version=8047,
count=25, id=14, version=7299,
count=112, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=19, version=8034,
count=64, id=1, productName=Unmarked objects,
count=13, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/PrDSrv56crk.reg
- SHA256 d0e3cf476c7323e2c08798abeb9b043fdb9aa2a3f72de54b2b55feb1648112f4
- MD5 08371b835fbfa5214308bbf20193a992
- SHA1 94b60e92d1ca7ea40d7e403b29462dca67548ca1
- SHA512 01268d328056bf08e43ca20e16e1c5544088ab85f238c9e0f44e03f93ee661b0c4373b45b3af8c90f0f0f9bab597661aa27f412633faf2a20441c61721945e29
- TLSH T10B31E03ADFE5112A927389B9CDF645A3DE277803323CD84E04C72B850D93E896C9625F
- MD5 SHA1 SHA512 TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/TestCertificate.cer
- SHA256 01a0d786d26177629a6e9ebfce1e87dee9a112325fbf9c7cc124409207588b72
- MD5 e3ac2988d35dd17bb186ac1c84984ab5
- SHA1 d39680ed59502209941759c74229f7e2fac72749
- SHA512 196f05eab3d082536fb3932979f792ba4fc88d56c85e4664f14d3eff851e4d70515ed2524af0ce4c956bed749dddb3d8f6c1610564a491d4b9fba77724d6a571
- TLSH T1E821C8E3E2E17C517520AC1158449A281C4EBBE979931F359C5EB0C094A7F7CD729288
- MD5 SHA1 SHA512 TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.cat
- SHA256 fc5b748976c5b4d4431c6bf53becb8387cab3fbace9e58747f8ad63947ea7746
- MD5 232d7d2400062037ea05f6545429e2d3
- SHA1 2ebde2bc6ab78738d6ee56749022dfdbbb5168c2
- SHA512 0f6e6937ba8dfb0aa6c7348778fc2e07ab5b6500b7fe9a83b40d95de8aa8d495c054e1ba778083937c8b11e89a3598495bb76791f476e781a72f64b4923d3f3e
- SSDEEP 192:9HQF79Kv7vyVgWJfsHR9y2sE9jBF0Ny9pa++Dv:Nya4i/8E9VF0Ny9m
- TLSH T1C0123AB281992C45FC63AC1134D0A52F9D693BCA6C8086E7221ED3250BB1755F7ED2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.inf
- SHA256 e762144ede831fa9814d0bce7e8b906cbc85572769b162b655ed14d404a0b6c9
- MD5 4b6f7476c30ef1494e25f9a0910d8801
- SHA1 8061b801f770505a4f8c65216a88aef6e06a817a
- SHA512 aa53f7372c49427b5d12f8249becbf50f1bebbd55a79de1c9359fe0b4067febf612bb9c3f08b18a54a988e36b8e45ca408bc906e03231ab581c4ffb088bac66c
- TLSH T16F411E054D908C387163E227DB5BB960E624700500B2102A359DB5B3CF41FCE73AC2DA
- MD5 SHA1 SHA512 TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv10/fancyrd.sys
- IMPHASH 6941dff5e013a237f1620c4cff1d8b89
- SHA256 93672c23a5bb6f67ee215e26b9d34f62129a39a4e17c1408498745c318acecdf
- MD5 9dc34e5a3512e120cdf5593533e98ba9
- SHA1 6ed1388184d9b68fe0e9b34b328a1bc36c7045b6
- SHA512 de91c794676c6afc053c2921775e93359a7e8cfcb78e607e2b75edc76b182f5f1f536ff1d0bae4f76371be76bcc54e26549acf9b1776da3fb886c8d68c85ddf8
- SSDEEP 3072:0W4sgcIgJl+ENc/FIHi2fTDMaJ7NCIiiRv2F/GuoW9Bu8I1cSno:0wgVocIHNTYw7sIuFvun1c
- TLSH T106149D41A2E519E4D9BFC175C6F5443AE7F3B4061762CBCF0268C6651B23BE0BA393A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
44:93:7a:17:7e:39:1a:06:76:44:0d:ea:2f:8f:9e:91:94:74:24:d4:0b:a4:11:5e:c5:f2:eb:dd:9c:a4:7a:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TestCertificate
Chains
Aug 16, 2022
CN=TestCertificate
PE Signature issue
Digest
85:50:78:7b:86:47:63:2f:9c:d7:54:05:9a:49:83:06:7a:bc:7c:fb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TestCertificate
Chains
Aug 16, 2022
CN=TestCertificate
Subject
CN=TestCertificate
Serial Number
19:3d:d9:e9:6e:2d:1d:84:47:5e:67:8b:47:a9:e7:9e
Issuer
CN=TestCertificate
Timespan
Dec 31, 1899 - Dec 31, 3000
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Minor OS version
0
Major OS version
10
Entry point
201456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\PROJECT\FancyRamdisk\release\drv\win10\amd64\fancyrd_srv.pdb
rxbsknl.sys
RxbsCreateHyperDevice
RxbsCloseHyperDevice
RxbsConnectHyperSystem
RxbsDisconnectHyperSystem
RxbsStartHyperSystem
RxbsEnableDumpClient
RxbsSetParamHyperSystem
RxbsGetParamHyperSystem
RxbsGetHyperSystemState
RxbsDisableDumpClient
RxbsFreezeHyperClient
RxbsReviveHyperClient
ntoskrnl.exe
KeInitializeEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
MmUnmapLockedPages
PsTerminateSystemThread
ZwReadFile
ZwClose
RtlCompareMemory
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwWriteFile
RtlInitUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoBuildPartialMdl
IoFreeMdl
IoGetTopLevelIrp
IoSetTopLevelIrp
ZwCreateFile
ZwOpenFile
ZwQueryInformationFile
ZwDeleteFile
ZwFsControlFile
RtlCopyUnicodeString
RtlFreeUnicodeString
RtlIsNtDdiVersionAvailable
KeDelayExecutionThread
KdDisableDebugger
KdEnableDebugger
IoAttachDeviceToDeviceStack
IofCallDriver
IofCompleteRequest
IoDeleteDevice
IoDetachDevice
IoRegisterShutdownNotification
IoInvalidateDeviceRelations
IoRegisterDeviceInterface
ObfDereferenceObject
ZwCreateDirectoryObject
ZwMakeTemporaryObject
IoGetConfigurationInformation
IoRegisterBootDriverReinitialization
IoRegisterDriverReinitialization
_vsnwprintf
KdDebuggerEnabled
InitSafeBootMode
PoSetPowerState
RtlIntegerToUnicodeString
RtlUnicodeStringToInteger
IoOpenDeviceRegistryKey
ZwOpenKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
RtlUnicodeStringToAnsiString
RtlCompareUnicodeString
RtlFreeAnsiString
RtlGenerate8dot3Name
RtlIsNameLegalDOS8Dot3
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoGetAttachedDeviceReference
IoRequestDeviceEject
KeGetCurrentIrql
IoBuildSynchronousFsdRequest
KeInsertQueue
_vsnprintf
IoGetAttachedDevice
RtlUnicodeStringToCountedOemString
RtlUpcaseUnicodeStringToCountedOemString
KeQueryActiveProcessorCountEx
IoCreateDevice
IoCreateSymbolicLink
IoDeleteSymbolicLink
ZwOpenSymbolicLinkObject
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeWaitForMultipleObjects
IoUnregisterShutdownNotification
IoSetDeviceInterfaceState
ObfReferenceObject
KeEnterCriticalRegion
KeLeaveCriticalRegion
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
ObReferenceObjectByHandle
ZwCreateKey
ZwQueryKey
ZwOpenEvent
ZwQueryVolumeInformationFile
RtlRandomEx
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetOwnerSecurityDescriptor
ZwCreateEvent
ZwSetSecurityObject
ObReferenceObjectByName
SeExports
IoDriverObjectType
KeAreAllApcsDisabled
IoGetStackLimits
RtlInitAnsiString
RtlAnsiStringToUnicodeString
IoGetDeviceInterfaces
ZwDeviceIoControlFile
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoAllocateIrp
IoFreeIrp
IoCsqInitializeEx
IoCsqInsertIrpEx
IoCsqRemoveNextIrp
KeRemoveQueue
MmGetSystemRoutineAddress
KeSetSystemGroupAffinityThread
KeRevertToUserGroupAffinityThread
KeQueryNodeActiveAffinity
KeQueryHighestNodeNumber
MmAllocatePagesForMdlEx
MmFreePagesFromMdl
MmCreateMdl
ZwQuerySystemInformation
RtlEqualUnicodeString
KeClearEvent
IoAllocateErrorLogEntry
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
IoWriteErrorLogEntry
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
PsIsSystemThread
PsCreateSystemThread
KeInitializeQueue
KeRundownQueue
ZwSetInformationFile
LpcPortObjectType
RtlQueryRegistryValues
MmMapIoSpace
MmUnmapIoSpace
IoGetRelatedDeviceObject
IoFileObjectType
PsGetVersion
ExAllocatePoolWithQuotaTag
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
EXTRA
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
CPATA
Size
512B
Virtual Size
401B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
308B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=6, id=259, version=29395,
count=9, id=260, version=29395,
count=3, id=257, version=30141,
count=188, id=1, productName=Unmarked objects,
count=8, id=260, productName=VS2019 v16.11.8 build 30138, version=30138,
count=1, id=262, version=29395,
count=2, id=259, version=30141,
count=44, id=260, version=30141,
count=1, id=255, version=30141,
count=1, id=258, version=30141,
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.cat
- SHA256 0eaceb6881237696f806f873ed22dd4b146a4f3a5cd9d4f624706f35c0195999
- MD5 29eef73ad259387c8e440373013ea914
- SHA1 5263be76c83df76ce5ff63e2410ab14a1e15df7e
- SHA512 5486f8e485fa4c7e71c8e234481c40fd1063cc23ccf4ec820d8056d9f63b40f3b03c985aabfcc5b3214e66efec457c92d550e6a0f06e311b4fdcc9d10a2e8116
- SSDEEP 192:Ms1TrT+b9YKv7fSUHz+noPOJB3hy2sE9jBF0NyNLvlWg:7HkjePxh8E9VF0Ny5dWg
- TLSH T1D4123A3782D82C42FC67DC10B6D4A427B970BBC2AC8486E7525EC3924BA1345F7D92BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.inf
- SHA256 e762144ede831fa9814d0bce7e8b906cbc85572769b162b655ed14d404a0b6c9
- MD5 4b6f7476c30ef1494e25f9a0910d8801
- SHA1 8061b801f770505a4f8c65216a88aef6e06a817a
- SHA512 aa53f7372c49427b5d12f8249becbf50f1bebbd55a79de1c9359fe0b4067febf612bb9c3f08b18a54a988e36b8e45ca408bc906e03231ab581c4ffb088bac66c
- TLSH T16F411E054D908C387163E227DB5BB960E624700500B2102A359DB5B3CF41FCE73AC2DA
- MD5 SHA1 SHA512 TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/drv7/fancyrd.sys
- IMPHASH 052e5c912ca7ada7ef76924673232acf
- SHA256 117b378b14b10959b7a556f6f57c94f52ca1cd4bf640a9109d3734d690deaafd
- MD5 351e28df5e39fffa2853cbde182ac3d9
- SHA1 ee9ce60ff708d32791688cdb9aaf100c331f1796
- SHA512 536f5b59d214238c66a9b9763d505fd3a0fade92e15d74ca8642af1da2a8ed7d88537b230774c8f834a1f7bb8c0e41e8eed210e243477de021b0b718b5f7c0f7
- SSDEEP 3072:gSt8wNsgxarSONbYWN0H0TnZBmMallbqRKfpl0A0A4RrrW9UuIKVO2LC67cxV:gSVenVlqH8YlbbP0V7RuIKsuCf
- TLSH T1CF24AF42A2A519D5E9BF8135C6F6443BE7B3B4061761C7CF02A8C7A51B13BE07A393E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
83:83:7b:aa:23:9e:52:15:6e:77:24:04:30:e3:ea:69:0c:d8:f4:3b:d4:d1:12:05:26:73:46:57:d3:36:f5:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TestCertificate
Chains
Jan 21, 2023
CN=TestCertificate
PE Signature issue
Digest
c7:9c:e4:db:7f:fc:33:c9:c9:3b:cd:08:9f:d8:47:c9:21:6a:0f:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Fuqing Yuntan Network Tech Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Fuqing Yuntan Network Tech Co.\,Ltd.,L=Fuqing,ST=Fuzhou,C=CN
Chains
Apr 9, 2013
CN=Fuqing Yuntan Network Tech Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Fuqing Yuntan Network Tech Co.\,Ltd.,L=Fuqing,ST=Fuzhou,C=CN
Subject
CN=Test Timestamp Service
Serial Number
0c:eb:81:01:02:f3:02:3f:d0:50:1c:85:e1:2f:9f:df:8a:44:3d:1f
Issuer
CN=TestCertificate
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 1970 - Dec 31, 2999
Subject
CN=Fuqing Yuntan Network Tech Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Fuqing Yuntan Network Tech Co.\,Ltd.,L=Fuqing,ST=Fuzhou,C=CN
Serial Number
51:6c:eb:03:f1:7e:10:c2:4b:45:ff:b6:33:6e:59:15
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 9, 2013 - Apr 9, 2014
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=TestCertificate
Serial Number
19:3d:d9:e9:6e:2d:1d:84:47:5e:67:8b:47:a9:e7:9e
Issuer
CN=TestCertificate
Timespan
Dec 31, 1899 - Dec 31, 3000
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
10
Entry point
205184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\PROJECT\FancyRamdisk\release\drv\win7\amd64\fancyrd_srv_raw.pdb
rxbsknl.sys
RxbsCreateHyperDevice
RxbsCloseHyperDevice
RxbsConnectHyperSystem
RxbsDisconnectHyperSystem
RxbsStartHyperSystem
RxbsEnableDumpClient
RxbsSetParamHyperSystem
RxbsGetParamHyperSystem
RxbsGetHyperSystemState
RxbsDisableDumpClient
RxbsFreezeHyperClient
RxbsReviveHyperClient
ntoskrnl.exe
KeInitializeEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
MmUnmapLockedPages
PsTerminateSystemThread
ZwReadFile
ZwClose
RtlCompareMemory
KeInitializeGuardedMutex
KeAcquireGuardedMutex
KeReleaseGuardedMutex
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwWriteFile
RtlInitUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoBuildPartialMdl
IoFreeMdl
IoGetTopLevelIrp
IoSetTopLevelIrp
ZwCreateFile
ZwOpenFile
ZwQueryInformationFile
ZwDeleteFile
ZwFsControlFile
RtlCopyUnicodeString
RtlFreeUnicodeString
RtlIsNtDdiVersionAvailable
KeDelayExecutionThread
IoAttachDeviceToDeviceStack
IofCallDriver
IofCompleteRequest
IoDeleteDevice
IoDetachDevice
IoRegisterShutdownNotification
IoInvalidateDeviceRelations
IoRegisterDeviceInterface
ObfDereferenceObject
ZwCreateDirectoryObject
ZwMakeTemporaryObject
IoGetConfigurationInformation
IoRegisterBootDriverReinitialization
IoRegisterDriverReinitialization
_vsnwprintf
InitSafeBootMode
PoSetPowerState
RtlIntegerToUnicodeString
RtlUnicodeStringToInteger
IoOpenDeviceRegistryKey
ZwOpenKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
RtlUnicodeStringToAnsiString
RtlCompareUnicodeString
RtlFreeAnsiString
RtlGenerate8dot3Name
RtlIsNameLegalDOS8Dot3
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoGetAttachedDeviceReference
IoRequestDeviceEject
KeGetCurrentIrql
IoBuildSynchronousFsdRequest
KeInsertQueue
_vsnprintf
IoGetAttachedDevice
RtlUnicodeStringToCountedOemString
RtlUpcaseUnicodeStringToCountedOemString
KeQueryActiveProcessorCountEx
IoCreateDevice
IoCreateSymbolicLink
IoDeleteSymbolicLink
ZwOpenSymbolicLinkObject
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeWaitForMultipleObjects
IoUnregisterShutdownNotification
IoSetDeviceInterfaceState
ObfReferenceObject
KeEnterCriticalRegion
KeLeaveCriticalRegion
RtlAppendUnicodeStringToString
KdDisableDebugger
KdEnableDebugger
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
KdDebuggerEnabled
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
ObReferenceObjectByHandle
ZwCreateKey
ZwQueryKey
ZwOpenEvent
ZwQueryVolumeInformationFile
RtlRandomEx
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetOwnerSecurityDescriptor
ZwCreateEvent
ZwSetSecurityObject
ObReferenceObjectByName
SeExports
IoDriverObjectType
KeAreAllApcsDisabled
IoGetStackLimits
RtlInitAnsiString
RtlAnsiStringToUnicodeString
IoGetDeviceInterfaces
ZwDeviceIoControlFile
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoAllocateIrp
IoFreeIrp
IoCsqInitializeEx
IoCsqInsertIrpEx
IoCsqRemoveNextIrp
KeRemoveQueue
KeBugCheckEx
MmGetSystemRoutineAddress
KeSetSystemGroupAffinityThread
KeRevertToUserGroupAffinityThread
KeQueryNodeActiveAffinity
KeQueryHighestNodeNumber
MmAllocatePagesForMdlEx
MmFreePagesFromMdl
MmCreateMdl
ZwQuerySystemInformation
RtlEqualUnicodeString
KeClearEvent
IoAllocateErrorLogEntry
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
IoWriteErrorLogEntry
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
PsIsSystemThread
PsCreateSystemThread
KeInitializeQueue
KeRundownQueue
ZwSetInformationFile
LpcPortObjectType
RtlQueryRegistryValues
MmMapIoSpace
MmUnmapIoSpace
IoGetRelatedDeviceObject
IoFileObjectType
PsGetVersion
ExAllocatePoolWithQuotaTag
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
EXTRA
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPATA
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=3, id=257, version=30141,
count=193, id=1, productName=Unmarked objects,
count=8, id=260, productName=VS2019 v16.11.8 build 30138, version=30138,
count=1, id=262, version=29395,
count=6, id=259, version=29395,
count=8, id=260, version=29395,
count=2, id=259, version=30141,
count=44, id=260, version=30141,
count=1, id=255, version=30141,
count=1, id=258, version=30141,
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat
- SHA256 2b6f5f6737b1eddf6ea7eac1b19d5fa69e40605d9e2cff11a2a1b9648d544f2f
- MD5 3933b86b62a093fbef6d7c9c750ec53d
- SHA1 517148b96beb6bd63f3f40b295b5a4ed0f9fdbe6
- SHA512 9e41e6a0e3a11319a5c3d4d54c7849726fd7b1a80bf5b4e2250825e4ce0db86646ba321e265946bf935beb8f7f93a99ee0a220744bcffdb806fc8e209e545168
- TLSH T105514140B008043702B567FF84BAE1EBBADD118F8B742BF0B1E311B5571B39875AE196
- MD5 SHA1 SHA512 TLSH
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/使用说明.txt
- SHA256 b0458817e7c28c2890893fcb6a91f5df2f6d92c5b8eb0251d56165bc0fefb683
- MD5 9d39fc3a9eec61ee887e702855c266c9
- SHA1 78e003afa2c03ac9e5a7621f8949f9d206a5d8cb
- SHA512 635b36ac5a4f13df03d11f73129f03cd311ae498868e29a5f681b2a8925703bca2f712d654b69d4af54f377f1b80d158893c307d859f230bf708eedcbeff2884
- MD5 SHA1 SHA512
Primo-Ramdisk-Server-Edition-6.6.0/Primo.Ramdisk.Srv.Mui.Setup.6.6.0.exe
- IMPHASH 20dd26497880c05caed9305b3c8b9109
- SHA256 dffb6ffec6dcf7d7be5f9aaa92b5a78a11f5dc1ff706cf84cd0579ab3251b725
- MD5 31093d2fbb45902799b0fc74832d714e
- SHA1 1e2aacbb73029d7ce3975cf4fd9cbfb1e9b4c8e6
- SHA512 5aac80540df8984acb4f95558f13167a2e4c7c118f470f0a8939e2017f7fb14cbe41d6a6fa0df97f736b9df823b6d2ca0a8b7396a6b99ad22bf99b74b3897738
- SSDEEP 196608:DbRgoOj7wbuQqq1tl5NwsBzY9B48t76q7wcBDX:3F2saQqq11nYTt7F7wcp
- TLSH T1ED6633218B468036E66519BCC032F5705D7AAFF069F4544AACF4FC1F32B56B6A4362EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
6d:8c:f2:6a:f1:26:2c:51:98:77:2a:f5:be:26:80:e3:42:36:65:9a:5d:10:52:4f:8d:21:7d:00:0e:0a:23:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Mar 15, 2022
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
ca:ea:24:0a:04:51:5e:f3:9d:de:96:ea:96:f5:ac:33:a2:a3:61:71
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Mar 15, 2022
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
01:29:27:90:28:8b:00:e3:b5:3d:86:04:76:4d:ff:4b
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 30, 2019 - Sep 1, 2022
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
SERIALNUMBER=913101105574930924,CN=Shanghai Romex Information Technology Co.\,Ltd.,O=Shanghai Romex Information Technology Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
05:af:de:7b:07:6f:79:b9:01:e3:5b:38:d6:7e:a6:27
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 29, 2019 - Sep 1, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
5
Entry point
71708
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
333KB
Virtual Size
333KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ