win_2k3_2k8-14.4.8.4.zip
- SHA256 a2d2aa319f6ffd83c816e1d9fb2b0c7e2b3786dffde5fdfcc84fce7e4cddd702
Overview
overview
7Static
static
3Server/W2K...06.msi
windows10-2004-x64
7Server/W2K...06.msi
windows11-ltsc_2024-x64
7bxndcox.dll
windows10-2004-x64
3bxndcox.dll
windows11-ltsc_2024-x64
3bxndcox.dll1.dll
windows10-2004-x64
3bxndcox.dll1.dll
windows11-ltsc_2024-x64
3bxndcox.dll2.dll
windows10-2004-x64
3bxndcox.dll2.dll
windows11-ltsc_2024-x64
3bxndcox.dll3.dll
windows10-2004-x64
3bxndcox.dll3.dll
windows11-ltsc_2024-x64
3bxoisco.dll
windows10-2004-x64
3bxoisco.dll
windows11-ltsc_2024-x64
3wdfcoinsta...7..dll
windows10-2004-x64
3wdfcoinsta...7..dll
windows11-ltsc_2024-x64
3wdfcoinsta....1.dll
windows10-2004-x64
3wdfcoinsta....1.dll
windows11-ltsc_2024-x64
3Server/W2K...ia.exe
windows10-2004-x64
7Server/W2K...ia.exe
windows11-ltsc_2024-x64
7Server/W2K...iw.exe
windows10-2004-x64
7Server/W2K...iw.exe
windows11-ltsc_2024-x64
7Server/W2K...up.exe
windows10-2004-x64
7Server/W2K...up.exe
windows11-ltsc_2024-x64
7Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
bxndcox.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bxndcox.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
bxndcox.dll1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
bxndcox.dll1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
bxndcox.dll2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
bxndcox.dll2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
bxndcox.dll3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
bxndcox.dll3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
bxoisco.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
bxoisco.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
wdfcoinstaller01007..dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
wdfcoinstaller01007..dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
wdfcoinstaller01007.1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
wdfcoinstaller01007.1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral22
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target win_2k3_2k8-14.4.8.4.zip
- Size 8.2MB
- Sample260809-wvsg9atbnb
- SHA256 a2d2aa319f6ffd83c816e1d9fb2b0c7e2b3786dffde5fdfcc84fce7e4cddd702
- MD5 955a409896a43b7a500bc1115c309328
- SHA1 61ca44408c78ea4dcb088c01c6259be93f050605
- SHA512 ccb88fe02242ac67d197383b012ee4af18b3a968af2f7e91a7d8f8f0f7a4ab63a604402c749cc0ed5c11b72612267ba773e7a5bd464529927e62fa9b2dac77a5
- SSDEEP 196608:wxqp9u9aQd7JK6eo5yzjGEN7eqA441TkZBNxNc2P2eNY:wopSd746eo5yzjne5VJYBLNc2P2eNY
- TLSH T143863385F61E4E68273B1FD3A227669FBC8C354CE5742488EF850B2A472D5D50CA0EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Server/W2K3_W2K8/DrvInst/BDrv5706.msi - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack002/bxndcox.dll.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxndcox.dll1.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxndcox.dll2.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxndcox.dll3.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxoisco.dll.F935445C_34D7_444E_8A17_CD3E66853B72 - Untrusted Codesign Signers 13 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/bnxcdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxdiagx.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxnd50x.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxnd52x.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxnd60x.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxois.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/bxvbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/evbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/wdfcoinstaller01007..F935445C_34D7_444E_8A17_CD3E66853B72 unpack002/wdfcoinstaller01007.1.F935445C_34D7_444E_8A17_CD3E66853B72 unpack001/Server/W2K3_W2K8/DrvInst/instmsia.exe unpack001/Server/W2K3_W2K8/DrvInst/instmsiw.exe unpack001/Server/W2K3_W2K8/DrvInst/setup.exe
File Explorer
-
win_2k3_2k8-14.4.8.4.zip.zip 8.2MB
-
Server/W2K3_W2K8/DrvInst/0x0409.ini13KB
-
Server/W2K3_W2K8/DrvInst/BDrv5706.msi.msi 2.2MB
-
Server/W2K3_W2K8/DrvInst/DrvFiles.cab.cab 3.7MB
-
bnxcdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 226KB
-
bxdiag.cat.F935445C_34D7_444E_8A17_CD3E66853B7214KB
-
bxdiag.inf.F935445C_34D7_444E_8A17_CD3E66853B7225KB
-
bxdiagx.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 75KB
-
bxnd.cat.F935445C_34D7_444E_8A17_CD3E66853B7215KB
-
bxnd.cat1.F935445C_34D7_444E_8A17_CD3E66853B7214KB
-
bxnd.cat3.F935445C_34D7_444E_8A17_CD3E66853B7215KB
-
bxnd.inf.F935445C_34D7_444E_8A17_CD3E66853B72109KB
-
bxnd.inf1.F935445C_34D7_444E_8A17_CD3E66853B72145KB
-
bxnd.inf3.F935445C_34D7_444E_8A17_CD3E66853B72155KB
-
bxnd50x.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 38KB
-
bxnd52x.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 69KB
-
bxnd60x.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 80KB
-
bxndcox.dll.F935445C_34D7_444E_8A17_CD3E66853B72.dll 37KB
-
bxndcox.dll1.F935445C_34D7_444E_8A17_CD3E66853B72.dll 37KB
-
bxndcox.dll2.F935445C_34D7_444E_8A17_CD3E66853B72.dll 37KB
-
bxndcox.dll3.F935445C_34D7_444E_8A17_CD3E66853B72.dll 37KB
-
bxois.cat.F935445C_34D7_444E_8A17_CD3E66853B729KB
-
bxois.inf.F935445C_34D7_444E_8A17_CD3E66853B729KB
-
bxois.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 421KB
-
bxoisco.dll.F935445C_34D7_444E_8A17_CD3E66853B72.dll 69KB
-
bxvbd.cat.F935445C_34D7_444E_8A17_CD3E66853B728KB
-
bxvbd.inf.F935445C_34D7_444E_8A17_CD3E66853B7222KB
-
bxvbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 470KB
-
evbd.cat.F935445C_34D7_444E_8A17_CD3E66853B7213KB
-
evbd.inf.F935445C_34D7_444E_8A17_CD3E66853B72118KB
-
evbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72.sys 2.2MB
-
wdfcoinstaller01007..F935445C_34D7_444E_8A17_CD3E66853B72.dll 1.1MB
-
wdfcoinstaller01007.1.F935445C_34D7_444E_8A17_CD3E66853B72.dll 1.1MB
-
Server/W2K3_W2K8/DrvInst/Release.txt157KB
-
Server/W2K3_W2K8/DrvInst/Setup.ini2KB
-
Server/W2K3_W2K8/DrvInst/Silent.txt1KB
-
Server/W2K3_W2K8/DrvInst/Version.txt14KB
-
Server/W2K3_W2K8/DrvInst/instmsia.exe.exe 1.6MB
-
Server/W2K3_W2K8/DrvInst/instmsiw.exe.exe 1.7MB
-
Server/W2K3_W2K8/DrvInst/setup.exe.exe 621KB
Server/W2K3_W2K8/DrvInst/0x0409.ini
- SHA256 bad3b2e854149df9413f06e6c1c7b7c875545393877f59b59907f6b083ce5825
- MD5 758747727e96a23c7c5a5bbb011656e4
- SHA1 51cc637e7eb3451d6dfa9465d949d6dfb2cd65c9
- SHA512 21ff9d365beb1b7809b89d540f41bf330515f05f6211c8327be43baf1f050e46ecc1654b0696e7c82a2a803267e38d780ffd83dea7448861f6e3b84838685627
- SSDEEP 192:4QGTmyunVn//BTelD/SQI1xVwCtH8LXAd2k9Kf61Ua:PGTmyuV//BTED/9Ad77Ga
- TLSH T18452A95A67F80218F6F37F50BDB842716E76BC96AC38D65C1280488D09F1E54D8B1B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
- SHA256 c93bf45510ebc3512320152d0608c4bddecd14dfc0da952f8ef4372875f9d75d
- MD5 20c1120f086918b8eb821cb01ef73a96
- SHA1 03f926e0eb8eca903fb3469141be27ee9ad4c76e
- SHA512 c8fabec5c7a82c9ceb394a52e8d0b9a4318298a89b28935889e01727933879c75d2ef0c0d0adc28f51454327803bd85b0ee154d3658a487ef4543409f15ba99b
- SSDEEP 24576:K3y6blFNjiH1QsQrGdvqFE7fombxrKwE7XCTmeFdYydp71:K3yClFNjiH1QxamKxWwgWYyZ
- TLSH T1F1A58D21F281CC71E1861AB4186A87F649347840AF7186D3B7DDEFEDAB7AD44923E704
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
Server/W2K3_W2K8/DrvInst/DrvFiles.cab
- SHA256 df2d82aa7db87c127633fb72aa644563a16bd6a99d1c4769d6fea692870d836e
- MD5 ae5877d0f6dc49d37d9ae1b5651d1cee
- SHA1 3a0f9ff48af746058702c5ce608309de96b4139b
- SHA512 5bdedaec41dee44c7badef949c973b5d9fd2559912e5022371155573024b7eec0c6cd2770b8efc9b6e10d261a64f970b25ed3415eaaf1579acac5ef15d886629
- SSDEEP 98304:G9AJOjHphzjxpSgYqDTPgo9ZhNvd2k7JA9jNnE:G99rphzjxvYkYOhd9i9C
- TLSH T18D063362A31DDDDC33B72091916BBB5F265E2C8C24F126AFEE4D4D146B2C560B860EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
bnxcdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 41650ae4e299935b0d5377275fa57ac3
- SHA256 0ce604152eab5478d87211927b436104f54a0f663febabbcc0038c10b3c3052d
- MD5 a3e81931ad2f99f016c550e6d340a39d
- SHA1 7d4836fe0e7cf06044cbbf17bce4f8729e861888
- SHA512 4d0f6b03caa5eebd105a2433279b3f2f3017c43754e82eb5aa947b7b179f0f4188234f08ed4ff8faea33ca52bb7656ef917bcfd69521d73b8434b67df52e5148
- SSDEEP 3072:+4GEui8XgQueELb+fI9yBw5V8g/JfzoomtnIE4mcuXn5T67AdV:Th8XgXrtVhfsnnI2zdV
- TLSH T12D340A03D6C19235CCA635F987BAB4785B3C6B44070428CB27D87AF69B26FD82E3155B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
1f:ec:ab:38:48:40:ad:43:39:11:bf:03:52:e5:57:f5:f9:ce:03:b3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Dec 24, 2010
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
44:7d:65:1c:cc:06:93:47:61:4f:94:9c:61:e6:75:df
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 21, 2009 - Oct 21, 2012
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
524596
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\release\cdv6.2.1\crash_dump\objchk_wnet_x86\i386\bnxcdx.pdb
storport.sys
StorPortStallExecution
StorPortCompleteRequest
StorPortNotification
StorPortGetUncachedExtension
StorPortGetPhysicalAddress
StorPortInitialize
ntoskrnl.exe
KeBugCheckEx
KeTickCount
DbgPrint
strncmp
RtlCompareMemory
hal
HalGetBusDataByOffset
HalSetBusDataByOffset
KeQueryPerformanceCounter
Name
.text
Size
202KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
1015B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1024B
Virtual Size
854B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=14, id=1, productName=Unmarked objects,
count=3, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=34, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bxdiag.cat.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 f8ea41fb8f21fc80a30d2817673275c31117c3999d37033f60c610d4cd3d8360
- MD5 aefa181b3c0c1ac5cd2ccbbf3464e256
- SHA1 6158a030ac33d3c2c38937b3cd3bbe978d3d2dce
- SHA512 45f8e6a17b13ccb87579e0fd9cef191c9b02511361e0b0b9931879f9ca00bcdda13373fbb58806cd814d8a1031bcc852d99ed38d58815b104d58cadbc1225a78
- SSDEEP 192:WTmTLyrd8nxBJzMz7QcJCjz1tsk/NpEQlQtP9l/xyK0nQqeT+xsD4X/LSjsIIPOj:0EUGjpvjAGLa3v9
- TLSH T14362FFB926AD4597FDBF8D3202B616967CFE76C3BC10452C9A57E7209C42780FAB000E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxdiag.inf.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 8de63311632e82f45ee45b0114df0b658a85161b87f1168ab37081a6cbc14fdb
- MD5 1340a889865024496ed8d9f35a94f4dc
- SHA1 2d0c3e3fcb66d904b098067afb9eca6379891107
- SHA512 1a404d6c640e8de631938851c3517bce911197acb8b8f01344a3abc701df9874770aa4ec9e9e6b41fe323b87cd353144b52aa842bd0a44b1d5f8fc835855ed1a
- SSDEEP 192:WaiDugiQPugiQkR6YunWe3cp55RxtN8ydgTtx123WEY1s/fzqxKBU7PgZHf3Luxh:3RTeJj
- TLSH T115C22879260B7D19B5060CB5380D64CAAC1C984BD7D099E8FBD33DE9E9ADD0D9206F38
- MD5 SHA1 SHA512 SSDEEP TLSH
bxdiagx.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 322a0f8273c4e30f5abd7b5f178c0655
- SHA256 8851e3e63235b345ca193ec96f135aed86c7866b9da56f162d1c10742e28d31f
- MD5 260965b13b51b112f365fc11dd3c429a
- SHA1 1249e9a6979097f0e52193cce86fbabe9f07c492
- SHA512 9d7b52d53cac8772848c18887e358af743fc80fc524c92d04613652567b71d6ef30bd15183eaf1f216e136c03f389af8a11e2fcf9dd098ebd47bfa803fdebf5f
- SSDEEP 1536:FKYQzdsRUYW1H5g1wichkESRVeGiLlbuw:FQYgH+1wxhkE0VeGc
- TLSH T1E773C74ABE42AD31F460433A597BDACF12EC7AC84E311343B0954BEEEC799B51D60786
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0b:bf:01:5d:7c:62:46:37:3f:8a:39:be:f8:0b:22:33:f6:3b:b9:7c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Dec 16, 2010
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
73878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\work\branch\t6.2_nx2_1g\bxdiag\Obj\i386\bxdiagx.pdb
ntoskrnl.exe
IofCompleteRequest
IofCallDriver
PoCallDriver
KeSetEvent
PoStartNextPowerIrp
PoRequestPowerIrp
PoSetPowerState
KeDelayExecutionThread
IoWriteErrorLogEntry
memmove
IoAllocateErrorLogEntry
RtlInitUnicodeString
KeWaitForSingleObject
RtlUnicodeStringToInteger
memset
IoGetDeviceProperty
RtlAppendUnicodeToString
IoFreeIrp
IoAllocateIrp
IoSetDeviceInterfaceState
IoDetachDevice
ExFreePoolWithTag
MmFreeContiguousMemory
MmGetPhysicalAddress
MmAllocateContiguousMemory
ExAllocatePoolWithTag
KeTickCount
KeBugCheckEx
IoCreateDevice
IoRegisterDeviceInterface
IoDeleteDevice
IoAttachDeviceToDeviceStack
RtlQueryRegistryValues
KeInitializeEvent
hal
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeStallExecutionProcessor
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1024B
Virtual Size
705B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bxnd.cat.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 d1bb0ccc8b7c769758f859a923c83a45afea2c8f7c82124c48d2aa579a98761b
- MD5 8ac9f443ab2dbac74f5547f062521d12
- SHA1 f2b49e4cc16bf5628a0ecce2341c872eabfe0230
- SHA512 3f954e76bcae17566699a453b5faad2b7f494d3c4a38eab73821c902cb4fc50a926044ca9bf2e6d1435d0d1bdc4e4714644054ee8e8b9ef9c9b2794a952d1ae9
- SSDEEP 192:m083urqGFY5OIOOWczzUfT2tsMaSjkI1Zr/6vifxlbLiI3LF3l3+uK1HYQktsTID:morvjXHUyAGLa30+
- TLSH T1C96211BD269D05A3BE6FCC3216B517AA7CFE3AC36C10052CA697A7205C41780FAB445E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd.cat1.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 37ecc08f5545192a3a43966edb597c5345c7e045a29cd17b389e2354c83603c5
- MD5 70ba3eac04979ea60d1350674aebd036
- SHA1 9bd521485d80b98139ab208919e7d67463c77ee1
- SHA512 61bb1437f79039d888573fa36d700aef8ffd6ca48199685e0a2c87a1984583285041d3ca44b44711fcc735c55b976669fc1d99484506c19890d9f560a09dbc5b
- SSDEEP 192:UXwBKE4v2+d8OIOOWczzUfT2tsMaSjkI1Zr/6vifxlbLiI3LF3l3+uK1HYQktsTK:5OnjXHUyAGLa3MW6cB
- TLSH T1E36200AD269905A3BE6FCC3216B5569A7CFE7AC37C10052CA797A7205C41780FAB046E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd.cat3.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 d1bb0ccc8b7c769758f859a923c83a45afea2c8f7c82124c48d2aa579a98761b
- MD5 8ac9f443ab2dbac74f5547f062521d12
- SHA1 f2b49e4cc16bf5628a0ecce2341c872eabfe0230
- SHA512 3f954e76bcae17566699a453b5faad2b7f494d3c4a38eab73821c902cb4fc50a926044ca9bf2e6d1435d0d1bdc4e4714644054ee8e8b9ef9c9b2794a952d1ae9
- SSDEEP 192:m083urqGFY5OIOOWczzUfT2tsMaSjkI1Zr/6vifxlbLiI3LF3l3+uK1HYQktsTID:morvjXHUyAGLa30+
- TLSH T1C96211BD269D05A3BE6FCC3216B517AA7CFE3AC36C10052CA697A7205C41780FAB445E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd.inf.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 36019b1f15d6a827f13071a3838d6ca499f6ce63295be1fb9d04e84890763f1c
- MD5 874f1453c8361f070f54c5e18a6ff428
- SHA1 339666b4a37f2fdfdee0467a1bd1b7c8b86658a1
- SHA512 b8749bfc7fa3c6991ae973ae848d43e0c897df9f514bc96bfcef709b33fe3c89f3da04edcc45dd181b08c30a44466923c19a32709fa7ba689bf299d52ca96f4c
- SSDEEP 1536:Nb8hf+/G83wPKImvV12hpirTdvDo7vPmiGmmL761DDIZ7qD2z2GnXVziDOwY2D4C:DVk
- TLSH T1A0B3AC78A10A9D12228B5EE86E6148E3ED041444BA719DD07BEE3FEDF38DF4D525DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd.inf1.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 a9109b84827bb06e11233698447911ae9d63682158cdb65c2f8862a95457f69b
- MD5 b68fddccfe66086c225f741d56646161
- SHA1 0433850e1aaa2576a8eebcc7660405b2b92e1aa2
- SHA512 9a40dfc13c5fc6480f0657510bb4f6f670c49e17c3baf52c610a33c445728a8efb4928d63231ac844cd7f4bf373f699bf6d6461bb31168b15f8b9218f82c0c77
- SSDEEP 384:91KU7g5dSESBQMQgu2upuiu7unuouTuVumuouQuEuIuau5uDuluSuRu+uauKu7uY:CJlN/q2lD2qBerH
- TLSH T11EE3F0346209AE396AC75ED4BA0D44F3DE045440FAB5D8E07B9E2FECA38CE0C569DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd.inf3.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 49cd9d5f1f5fccf6e989a00fa76cf1ed431a6ca6b874c730470fc5ed69cd62c5
- MD5 b227417404dcf327eaece2e1aea1a529
- SHA1 dbe9c5b841b083fab541b373fe080119843e1dcb
- SHA512 8c19f01ceac62af9568c1d518cf82a86dfab7001f288b91d484d8801b6a711d825da5c17803c84dd3cb7ea6d1c2d49ea1e5e5e3c87bafa19295827662ae45a3c
- SSDEEP 1536:Qb8hf+/G83wPKImvV12hpirTdvDo7vPmiGmmL761DDIZ7qD2z2GnXVziDOwY2345:mmk
- TLSH T13CF3BB78A10A5D52228B5EE87E6148E3ED041444BB719DE07BEE2FE9F38CF4D525DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
bxnd50x.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH bebafea7263746ad545b3bde7470915a
- SHA256 15b4995c15bdce05a636c01652b7fd6768ab59531a06641ff092aadcab759624
- MD5 80db33660e38a93363091b3e0bc09c4c
- SHA1 c508f896afc5601150bba8f65da15b8acc7805ba
- SHA512 b6e686679154ce6579aabbe4cdbf688cef99e6b2e2fa51b08084e2889a1bc99aaa1b55df142fc43c45f9c20384bda5197f104db0e8ca5b01d1bc3091c5db5a91
- SSDEEP 768:1YF4BrxizJr8CyV4yDJLEIPtW7hb45D2AOwNg319L7bj95+tXWMLAmdbbS:1YF4JKYkRJIa9Ag31194LlbS
- TLSH T1A2032A526BE01425F4E37B70A8BE6235183BF9A21B3491CF215045AA1DA4FF0BF31B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a9:41:47:1b:0f:62:bd:40:b0:0b:75:52:c4:73:9d:4b:5a:f9:d5:33
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Jan 14, 2011
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
25753
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\work\branch\t6.2_nx2_1g\nd3x\Obj\i386\bxnd50x.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
KeSetEvent
ExDeleteNPagedLookasideList
IoFreeMdl
memcpy
MmMapLockedPagesSpecifyCache
memset
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
RtlUnicodeStringToAnsiString
IoAllocateIrp
IoFreeIrp
hal
KfReleaseSpinLock
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
ndis.sys
NdisFreeBufferPool
NdisFreePacket
NdisMCancelTimer
NdisMSleep
NdisMDeregisterAdapterShutdownHandler
NdisMFreeSharedMemory
NdisMStartBufferPhysicalMapping
NdisInitializeWrapper
NdisMRegisterMiniport
NdisTerminateWrapper
NdisMInitializeTimer
NdisMFreeMapRegisters
NdisFreePacketPool
NdisMAllocateSharedMemory
NdisSetEvent
NdisMCompleteBufferPhysicalMapping
NdisAllocateBuffer
NdisWriteEventLogEntry
NdisSetTimer
NdisMGetDeviceProperty
NdisReadConfiguration
NdisReadNetworkAddress
NdisCloseConfiguration
NdisOpenConfiguration
NdisAllocateMemoryWithTag
NdisAllocateBufferPool
NdisMAllocateMapRegisters
NdisFreeMemory
NdisMQueryAdapterInstanceName
NdisWaitEvent
NdisInitializeEvent
NdisAllocatePacket
NdisAllocatePacketPool
NdisSystemProcessorCount
NdisMRegisterAdapterShutdownHandler
NdisMSetAttributesEx
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
641B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=57, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=15, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxnd52x.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH e9c25c17e2c6b929cce2d4b3759ec57e
- SHA256 a34ed398a039ad9fcc30b3b88d0510f23fbcef26d4cc990289b6fa6513b49e97
- MD5 1fe17aa3f8f9e232b2a4359fd61688f7
- SHA1 db3fa45e7f31fc564c5ca238049b815dea616b20
- SHA512 1f40339d2a904fe3cae069bd5b378a3a60d78fb2fe399f368fd048fd0543af090448471d3fdc35503b622b94dfa748dc8480509ac181c041f0f809db69ea4531
- SSDEEP 1536:wG2j+Q3MoHK49my4JBCuz8Ro5FNeD679VQLlG:wG2jbMohmy4JBC/ide+799
- TLSH T1A9633A5272F05035E4F32AB068FE61394A3BB6A21B3891DF115106EA9D74BD0BF317A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9d:2d:73:13:77:4f:b8:6d:d7:f4:54:37:bc:f1:6d:d6:16:97:ad:68
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Jan 14, 2011
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
65830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\work\branch\t6.2_nx2_1g\nd3x\Obj\i386\bxnd52x.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
RtlInitUnicodeString
memmove
ExAllocatePoolWithTag
MmAllocateMappingAddress
IoBuildPartialMdl
MmMapLockedPagesWithReservedMapping
RtlCompareMemory
MmUnmapReservedMapping
MmFreeMappingAddress
ExFreePoolWithTag
InterlockedPushEntrySList
InterlockedPopEntrySList
IoAllocateMdl
MmBuildMdlForNonPagedPool
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
KeSetEvent
ExDeleteNPagedLookasideList
IoFreeMdl
memcpy
MmMapLockedPagesSpecifyCache
memset
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
ExInitializeNPagedLookasideList
RtlUnicodeStringToAnsiString
IoAllocateIrp
IoFreeIrp
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
KeStallExecutionProcessor
ndis.sys
NdisFreeBufferPool
NdisFreePacket
NdisMCancelTimer
NdisMSleep
NdisMCompleteBufferPhysicalMapping
NdisMStartBufferPhysicalMapping
NdisInitializeWrapper
NdisMRegisterMiniport
NdisTerminateWrapper
NdisMInitializeTimer
NdisMSetAttributesEx
NdisSystemProcessorCount
NdisFreePacketPool
NdisAllocatePacket
NdisInitializeEvent
NdisWaitEvent
NdisMQueryAdapterInstanceName
NdisFreeMemory
NdisMInitializeScatterGatherDma
NdisMAllocateMapRegisters
NdisAllocateBufferPool
NdisAllocateMemoryWithTag
NdisAllocateBuffer
NdisOpenConfiguration
NdisCloseConfiguration
NdisMFreeMapRegisters
NdisMFreeSharedMemory
NdisMAllocateSharedMemory
NdisSetEvent
NdisGetRoutineAddress
NdisAllocatePacketPool
NdisWriteEventLogEntry
NdisSetTimer
NdisMGetDeviceProperty
NdisReadConfiguration
NdisReadNetworkAddress
NdisGetVersion
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
764B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxnd60x.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 9e5bb96703fbdafe593cf6a763841a76
- SHA256 205a38d1494eddc5cb98b3fa46978c06bf2f316990c32b61afa4f3b6019dd815
- MD5 66d2d3e1daedaa7bafe6d3b95f92acc8
- SHA1 a678fadd08ab3768cb7ab229f0751772130d4040
- SHA512 0ffb8284e4fa3bacf6f5f2922a8e89ecf69d8050c92824936e3cec500d7ee7b7c48d0b7eb5d64c86e8f3fed73bbb7a80063a3bbf995d78e8d870f14e62f75786
- SSDEEP 1536:mBTYIGZrsi/rySUcCzDZ/Ff+eY8V5H/VORZ0sL2RvL9+Ll4:kTYM6OFjzDZ/F205fVOj9L2RvL9f
- TLSH T155835B52B6D04632D4E222F06AAFF671573EEAE1273751CB114006E69CA0BE14F35B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9d:56:33:c8:0d:f4:5f:64:fa:b7:4c:ca:41:85:6e:25:a4:b9:35:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Feb 5, 2011
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
77886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\work\branch\t6.2_nx2_1g\nd6x\Obj\i386\bxnd60x.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
MmAllocateMappingAddress
IoBuildPartialMdl
MmMapLockedPagesWithReservedMapping
RtlCompareMemory
MmUnmapReservedMapping
MmFreeMappingAddress
InterlockedPushEntrySList
InterlockedPopEntrySList
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
ExDeleteNPagedLookasideList
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
KeSetEvent
memcpy
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag
memmove
RtlInitUnicodeString
RtlQueryRegistryValues
ExFreePoolWithTag
ExInitializeNPagedLookasideList
RtlUnicodeStringToAnsiString
IoAllocateIrp
IoFreeIrp
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
_allrem
memset
hal
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeStallExecutionProcessor
ndis.sys
NdisFreeFragmentNetBufferList
NdisMUpdateOffloadComplete
NdisMInvalidateOffloadComplete
NdisMTerminateOffloadComplete
NdisAllocateFragmentNetBufferList
NdisMDeregisterScatterGatherDma
NdisFreeNetBufferPool
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisMFreeSharedMemory
NdisMCancelTimer
NdisMSleep
NdisRetreatNetBufferListDataStart
NdisMFreeNetBufferSGList
NdisQueueIoWorkItem
NdisFreeIoWorkItem
NdisMAllocateNetBufferSGList
NdisAdvanceNetBufferDataStart
NdisGetDataBuffer
NdisRetreatNetBufferDataStart
NdisGetVersion
NdisMRegisterMiniportDriver
NdisAllocateMemoryWithTag
NdisMInitializeTimer
NdisAllocateNetBufferAndNetBufferList
NdisAllocateMdl
NdisFreeMdl
NdisMInitiateOffloadComplete
NdisMAllocateSharedMemory
NdisSetEvent
NdisMIndicateReceiveNetBufferLists
NdisAdvanceNetBufferListDataStart
NdisMSendNetBufferListsComplete
NdisReadNetworkAddress
NdisWriteEventLogEntry
NdisSetTimer
NdisMResetComplete
NdisMIndicateStatusEx
NdisMOidRequestComplete
NdisMSetMiniportAttributes
NdisMGetDeviceProperty
NdisReadConfiguration
NdisSystemProcessorCount
NdisCloseConfiguration
NdisOpenConfigurationEx
NdisAllocateNetBufferPool
NdisAllocateNetBufferListPool
NdisMGetOffloadHandlers
NdisMRegisterScatterGatherDma
NdisFreeMemory
NdisGetRoutineAddress
NdisInitializeString
NdisMDeregisterMiniportDriver
NdisSetOptionalHandlers
NdisMQueryAdapterInstanceName
NdisWaitEvent
NdisAllocateIoWorkItem
NdisInitializeEvent
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
549B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bxndcox.dll.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 12b1034bdead6a9905aceaaf21562bf5
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
21840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bxndcox.pdb
mfc42
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord609
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord692
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord616
ord3610
ord4407
ord656
ord3719
ord793
ord1907
ord800
ord768
ord860
ord540
ord489
ord4425
ord4835
ord5287
ord1775
ord6052
ord3402
ord4998
ord4854
ord4377
ord5265
ord3798
ord4976
ord4905
ord5160
ord5162
ord5161
ord2370
ord2302
ord6467
ord4258
ord2818
ord6334
ord2642
ord6215
ord4710
ord5981
ord4224
ord4160
ord2817
ord6028
ord4123
ord4742
ord4358
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord269
ord826
ord1168
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3574
ord567
ord823
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord4948
ord2976
ord2514
ord825
msvcrt
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
sprintf
_ultoa
memset
malloc
atoi
free
_stricmp
comctl32
CreatePropertySheetPageA
setupapi
SetupDiSetDeviceInstallParamsA
SetupDiChangeState
SetupDiSetClassInstallParamsA
CM_Set_DevNode_Problem
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiOpenDevRegKey
CM_Get_Parent
SetupDiGetClassInstallParamsA
SetupDiGetClassDevsA
shlwapi
SHDeleteKeyA
SHCopyKeyA
kernel32
CloseHandle
CreateFileA
GetLastError
LocalFree
LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
advapi32
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegFlushKey
user32
SendMessageA
SetWindowLongA
GetWindowLongA
EnableWindow
bxnd_coinstaller
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=125, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=229, id=1, productName=Unmarked objects,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=64, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxndcox.dll1.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 12b1034bdead6a9905aceaaf21562bf5
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
21840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bxndcox.pdb
mfc42
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord609
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord692
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord616
ord3610
ord4407
ord656
ord3719
ord793
ord1907
ord800
ord768
ord860
ord540
ord489
ord4425
ord4835
ord5287
ord1775
ord6052
ord3402
ord4998
ord4854
ord4377
ord5265
ord3798
ord4976
ord4905
ord5160
ord5162
ord5161
ord2370
ord2302
ord6467
ord4258
ord2818
ord6334
ord2642
ord6215
ord4710
ord5981
ord4224
ord4160
ord2817
ord6028
ord4123
ord4742
ord4358
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord269
ord826
ord1168
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3574
ord567
ord823
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord4948
ord2976
ord2514
ord825
msvcrt
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
sprintf
_ultoa
memset
malloc
atoi
free
_stricmp
comctl32
CreatePropertySheetPageA
setupapi
SetupDiSetDeviceInstallParamsA
SetupDiChangeState
SetupDiSetClassInstallParamsA
CM_Set_DevNode_Problem
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiOpenDevRegKey
CM_Get_Parent
SetupDiGetClassInstallParamsA
SetupDiGetClassDevsA
shlwapi
SHDeleteKeyA
SHCopyKeyA
kernel32
CloseHandle
CreateFileA
GetLastError
LocalFree
LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
advapi32
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegFlushKey
user32
SendMessageA
SetWindowLongA
GetWindowLongA
EnableWindow
bxnd_coinstaller
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=125, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=229, id=1, productName=Unmarked objects,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=64, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxndcox.dll2.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 12b1034bdead6a9905aceaaf21562bf5
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
21840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bxndcox.pdb
mfc42
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord609
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord692
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord616
ord3610
ord4407
ord656
ord3719
ord793
ord1907
ord800
ord768
ord860
ord540
ord489
ord4425
ord4835
ord5287
ord1775
ord6052
ord3402
ord4998
ord4854
ord4377
ord5265
ord3798
ord4976
ord4905
ord5160
ord5162
ord5161
ord2370
ord2302
ord6467
ord4258
ord2818
ord6334
ord2642
ord6215
ord4710
ord5981
ord4224
ord4160
ord2817
ord6028
ord4123
ord4742
ord4358
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord269
ord826
ord1168
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3574
ord567
ord823
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord4948
ord2976
ord2514
ord825
msvcrt
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
sprintf
_ultoa
memset
malloc
atoi
free
_stricmp
comctl32
CreatePropertySheetPageA
setupapi
SetupDiSetDeviceInstallParamsA
SetupDiChangeState
SetupDiSetClassInstallParamsA
CM_Set_DevNode_Problem
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiOpenDevRegKey
CM_Get_Parent
SetupDiGetClassInstallParamsA
SetupDiGetClassDevsA
shlwapi
SHDeleteKeyA
SHCopyKeyA
kernel32
CloseHandle
CreateFileA
GetLastError
LocalFree
LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
advapi32
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegFlushKey
user32
SendMessageA
SetWindowLongA
GetWindowLongA
EnableWindow
bxnd_coinstaller
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=125, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=229, id=1, productName=Unmarked objects,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=64, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxndcox.dll3.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 12b1034bdead6a9905aceaaf21562bf5
- SHA256 911f58d84958f306ee07e09ba1b53d940b274db4ff0ebf92225621f4fb0bd408
- MD5 20b5b8c94b64c960ac3738c015b13f70
- SHA1 b4799f77e515f4c7268d0f86fb7af873f99abb4a
- SHA512 b4c3fbabeb611396adc0a8765056e9faad05b0e76176ea0e796db2ec1e35b62bacdf391504b6e74b71062d6be38c49b2d398c6413dfe94f53489e751d5a68cc7
- SSDEEP 384:e4ey0d5ef1grXyXk/63NOWYf4h9P6MbSuh3larCw/ZOpJO74X4ey1fb6Bvm/KWqt:e4eReOUNPu4h5PLNsS4ey6vm/dn8QNk
- TLSH T1DB031B52ED9480B5C4D61A7518AE736523BD7A200B3784DF136237BEEC36BC199313DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
21840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bxndcox.pdb
mfc42
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord609
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord692
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord616
ord3610
ord4407
ord656
ord3719
ord793
ord1907
ord800
ord768
ord860
ord540
ord489
ord4425
ord4835
ord5287
ord1775
ord6052
ord3402
ord4998
ord4854
ord4377
ord5265
ord3798
ord4976
ord4905
ord5160
ord5162
ord5161
ord2370
ord2302
ord6467
ord4258
ord2818
ord6334
ord2642
ord6215
ord4710
ord5981
ord4224
ord4160
ord2817
ord6028
ord4123
ord4742
ord4358
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord269
ord826
ord1168
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3574
ord567
ord823
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord4948
ord2976
ord2514
ord825
msvcrt
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
sprintf
_ultoa
memset
malloc
atoi
free
_stricmp
comctl32
CreatePropertySheetPageA
setupapi
SetupDiSetDeviceInstallParamsA
SetupDiChangeState
SetupDiSetClassInstallParamsA
CM_Set_DevNode_Problem
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyA
SetupDiGetDeviceInstallParamsA
SetupDiOpenDevRegKey
CM_Get_Parent
SetupDiGetClassInstallParamsA
SetupDiGetClassDevsA
shlwapi
SHDeleteKeyA
SHCopyKeyA
kernel32
CloseHandle
CreateFileA
GetLastError
LocalFree
LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
advapi32
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegFlushKey
user32
SendMessageA
SetWindowLongA
GetWindowLongA
EnableWindow
bxnd_coinstaller
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=125, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=229, id=1, productName=Unmarked objects,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=64, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
bxois.cat.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 df1af0c546e0d9d48e703fc7b0b14613734edf5c2ef8c6306e180210ec6a6fc0
- MD5 ff22e59cd58fa9a3cf58389139f397c4
- SHA1 f67aa3ec6f39f8e3bff5d924be52661472a49285
- SHA512 ee7bd26faead5890d59e2e1557695147f6b680251aa983d542168e8a486d48dc039bf2179d2e74d6d483a651d2abec8fa3515340855c58fa4c71cce6a90fa531
- SSDEEP 192:yd6fHpYgIFDh5NTEhjXHUz1TroAW5LfsxhQ8SXoX:45NCjXHUyAGLa3Sq
- TLSH T1191295EA45AD8583FD5B887066E5E5AB7C7DB7C32C11442D216BF3A408837D1EF6900E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxois.inf.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 6d132b3b03f24eeffcf8fc323ca1625862b833cb0cbb48f373b065d4a2b78141
- MD5 b5cd6f065f9dd3c70f3198a1c3320168
- SHA1 a3cb00e98274dc2fb77160332becc37138032eaa
- SHA512 00b458d30928be93bbe40c085684abb212941484009835ac0f3389087e5720859b1e9cae1038002f535a7efc1668fc07575b19e5b6b6efe99764f802622155c6
- SSDEEP 192:uon5HJ6Mk3IUsoLFs+u/q8IQHNfxHs7rCNJxQpsgZSu0b1l+h+8M:uon5p6Mk3IUsoLFs+u/q8IQHNfxHs7rc
- TLSH T12D22196276EA130CF4B339C9E9F2807BEA35F4759979869E40A4470F17E2D4048927BF
- MD5 SHA1 SHA512 SSDEEP TLSH
bxois.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 0a0d5e00201db54af56e53fd4833290d
- SHA256 7a1addb995d9abb58d7dbb6a128d0d7c960aae56120ad8b2f3a776d8588068e3
- MD5 e28e93545a215e4f045c9ff795f13136
- SHA1 59ecfe8429533c97526e0899b345934fc8867bd0
- SHA512 537ec670d78acd34bfc93e3f9219a45c725037fea9f93d412fabb88414fcbca0dea9f7268a62523f50e872efc08801ee5c18e3b2d6ee99cc6c7cf0b8671aa52e
- SSDEEP 12288:RfRE1QRLFa1KzoU0uKSUXn3XhWRuMazb+yfZCl:Rm1QVFoU0uKSwn38RuMKvCl
- TLSH T146947B62A9408171CCDA32F0925D3334266EDAA2073966C796981AF4FD34BD16F393DF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9d:3d:6e:54:6b:d1:96:e5:36:88:ea:78:4f:47:44:c5:c4:32:78:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Dec 10, 2010
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
401701
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
o:\davidp\iscsi\6.2.7.0\ois\objfre_wnet_x86\i386\bxois.pdb
storport.sys
ScsiPortNotification
ScsiPortMoveMemory
StorPortInitialize
StorPortSetDeviceQueueDepth
StorPortResumeDevice
StorPortPauseDevice
StorPortAllocateRegistryBuffer
StorPortRegistryRead
StorPortFreeRegistryBuffer
StorPortMoveMemory
StorPortExtendedFunction
StorPortNotification
ntoskrnl.exe
KeBugCheckEx
KeTickCount
MmBuildMdlForNonPagedPool
IoAllocateMdl
IofCallDriver
_vsnprintf
_vsnwprintf
KeSetEvent
KeQuerySystemTime
KeWaitForSingleObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlCompareMemory
strchr
ZwClose
ZwDeleteValueKey
ZwOpenKey
RtlInitUnicodeString
IoOpenDeviceRegistryKey
KeInitializeEvent
KeClearEvent
WRITE_REGISTER_USHORT
WRITE_REGISTER_ULONG
memchr
wcsncmp
KeQueryTimeIncrement
PsTerminateSystemThread
KeSetPriorityThread
ObReferenceObjectByHandle
PsThreadType
PsCreateSystemThread
ObfDereferenceObject
strncpy
ExFreePoolWithTag
ZwQuerySystemInformation
ExAllocatePoolWithTag
memmove
strncmp
KeResetEvent
ZwQueryValueKey
IoFreeWorkItem
KeGetCurrentThread
ZwUnmapViewOfSection
ZwMapViewOfSection
isprint
DbgPrint
ZwSetValueKey
ZwCreateKey
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlSubAuthoritySid
RtlInitializeSid
RtlCreateAcl
RtlCreateSecurityDescriptor
ZwEnumerateValueKey
KeInsertQueueDpc
KeSetImportanceDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeQueryActiveProcessors
IoAllocateWorkItem
IoQueueWorkItem
IoGetDeviceProperty
IoGetDmaAdapter
RtlAnsiCharToUnicodeChar
PsGetVersion
MmGetSystemRoutineAddress
strrchr
_snprintf
isspace
RtlRandomEx
ZwOpenSection
IoAllocateIrp
IoFreeIrp
RtlUnicodeStringToInteger
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
KeDelayExecutionThread
IoFreeMdl
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
hal
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeQueryPerformanceCounter
Name
.text
Size
364KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=125, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=105, id=1, productName=Unmarked objects,
count=4, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=112, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bxoisco.dll.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 039eff0427225f2445cd3546c1102c11
- SHA256 5097a77340e15fd2d81061d9efce904fdd869da4b8fb9c0c8bdaf7ab606700e7
- MD5 33d9bd52a5ea4adaf0a4ab1e2c90b1cd
- SHA1 8cef1068b4dc34cc641aee733c59e4abd84bfe46
- SHA512 bb4a73e7aec368536ddab8541d30999e3329a377b9395b98305a22078c2f5a94b9a92c34832b02a03b21441d8450d203a8cfc1e65110dc3dc88324e929ed34e3
- SSDEEP 768:eifldZm7vAxhj31x3FJc+xtUsIRUO78RuJQREHnwZLGtSecI2vHXpAw6XsdbQOJ:eifNFWCOgAQR9ZytSemvF6XQQe
- TLSH T131633A3176D0E6B1C5D721B4A28EB77612BDD1B00BA065C7AB160BEDEE747C1AE30247
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
36348
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
o:\davidp\iscsi\6.2.7.0\ois\coinst\objfre_wnet_x86\i386\bxoisco.pdb
msvcrt
_isatty
_write
_lseeki64
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isspace
isdigit
_onexit
_lock
__dllonexit
_unlock
memmove
memcpy
realloc
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
_callnewh
free
_CxxThrowException
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
_errno
__CxxFrameHandler
_vscwprintf
??0exception@@QAE@XZ
memset
_resetstkoflw
_vscprintf
calloc
_mbscmp
_ismbcspace
_mbsinc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
malloc
advapi32
RegCloseKey
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
OpenThreadToken
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegDeleteValueA
comctl32
CreatePropertySheetPageA
ord17
kernel32
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
LockResource
FindResourceA
FindResourceExA
LocalAlloc
GetCurrentProcess
GetCurrentThread
DisableThreadLibraryCalls
CloseHandle
LocalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
InterlockedDecrement
GetComputerNameW
RaiseException
EnterCriticalSection
LoadResource
LeaveCriticalSection
gdi32
GetObjectA
CreateFontIndirectA
oleaut32
VariantInit
VariantClear
SysAllocString
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayPutElement
SafeArrayCreate
SysFreeString
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
setupapi
SetupDiGetDeviceInstallParamsA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Device_ID_ExA
SetupDiSetClassInstallParamsA
SetupDiSetDeviceInstallParamsA
SetupDiGetClassInstallParamsA
user32
GetClientRect
EnableWindow
SendMessageA
SetWindowLongA
SetFocus
GetDlgItem
GetDlgItemTextA
SetDlgItemTextA
GetWindowLongA
UnregisterClassA
ws2_32
WSAStringToAddressA
WSAStartup
WSACleanup
iSCSICoInstaller
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bxvbd.cat.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 8147df250b991a46ebad39baacf78025040b13329aa2ff1b1318481db6dd28e5
- MD5 c288e8d211cc1216ff0b9849e1feeb39
- SHA1 a87004b1b3fba209f955989d07b44dbae7fc85ac
- SHA512 aa5888f119773a0d7b76825c32772af033eb6ddada031e57b8dafb3cb4b7a78206be105df8ec3c29aba4df6a8644b9da6cb583e27cd6786721670b496e905263
- SSDEEP 192:UDmThwT1TryWdGwhjeyveCtAW5LfsxhQ8Iw4s:UIE9vLjpvjAGLa3Iwv
- TLSH T15902B6AB89BC4683FE1B996053F5E857BC35BBC36C11653D116BF79405823E0BB4842E
- MD5 SHA1 SHA512 SSDEEP TLSH
bxvbd.inf.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 6d21883c8757555cbb99f85c313b8e316fc69523733bba6e07fdb05075329f93
- MD5 d70de7b03d96e0ea6edc6ffd9d722acb
- SHA1 776f80843115ac151172ef1917d44f6a8f313e33
- SHA512 28acae8fa3900d1fbf3e7ff779ca93d996b81575f0431904fa92a7b8b914b407c82249ad628b63bc996f52a0af9721475ff7a1ad288d6d06db92b81757a63e0a
- SSDEEP 384:jssoBoQoVo5oLocoPoVEwCO6DxX/6R5O7sjPuRZioktuaaRUdkCLpt7B0uww8Xei:1oBoQoVo5oLocoPoQaGQnEW8
- TLSH T107A2523C830E7E22725BA5DE99589CE789586402369055B837DF3EF983EED0CE1AF044
- MD5 SHA1 SHA512 SSDEEP TLSH
bxvbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 5de1af12a7753bb1753f771a1d7d8019
- SHA256 a9a352b1e5415a63f9e25d799f314575e6fd4cdcaf9c3595338dab7ebeb4498d
- MD5 07ea834fad4ab6cbfbf4c580ec95e0c2
- SHA1 f8e141910e47ee9a093bda20154b576890aa4161
- SHA512 54a4e09c6de34305cbe8e9d1f5b576ac0465f630ae4ddb1dc538444ed7d51f9a06e1d74f8fcae32a03a7b71a478a324f92c2da2e8e98f86c1b27fc23ba4b28fe
- SSDEEP 12288:3k7zy+tFFZvD7Nsu1sblr1ElPrbDIT5NAJmh4kV1A:StFbPNsu1sblr1YM5NeM/A
- TLSH T1CAA49F11D3A04677C8A919B0D4EE2EF236388AD6135153EB9164ACFCBD453E29F6338D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2a:28:a7:61:62:b9:fd:d4:6d:95:2b:b2:6d:1d:5c:86:e0:30:41:55
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Jan 6, 2011
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Computing,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
3a:8e:49:11:ea:41:4d:e5:37:bc:ee:2a:aa:b7:4f:c7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2009 - Apr 20, 2012
Minor OS version
1
Major OS version
6
Entry point
175900
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\work\bcm5706\p4root\t6.2\drivers\windows\vbd\Obj\i386\bxvbdx.pdb
ntoskrnl.exe
RtlIntegerToUnicodeString
RtlAppendUnicodeToString
memcpy
ZwClose
ZwCreateKey
ZwDeleteKey
RtlWriteRegistryValue
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ExFreePoolWithTag
RtlUnicodeStringToInteger
IoGetDeviceProperty
memmove
ZwEnumerateKey
ExAllocatePoolWithTag
ZwSetValueKey
RtlCheckRegistryKey
KeQuerySystemTime
_aulldiv
KeSetTimer
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeDelayExecutionThread
ObfDereferenceObject
KeCancelTimer
IoGetDmaAdapter
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoAllocateIrp
ObReferenceObjectByHandle
PsCreateSystemThread
KeSetImportanceDpc
KeInitializeDpc
KeInitializeTimer
RtlQueryRegistryValues
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
_allmul
KeInsertQueueDpc
_allshl
KeQueryInterruptTime
MmUnmapIoSpace
ExDeleteNPagedLookasideList
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ZwFlushKey
KeClearEvent
MmMapIoSpace
_alldiv
ZwQuerySystemInformation
RtlCompareMemory
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenSection
KeTickCount
KeBugCheckEx
IoFreeIrp
IofCallDriver
KeWaitForSingleObject
KeSetEvent
KeInitializeEvent
KeNumberProcessors
PsGetVersion
KeSetTargetProcessorDpc
RtlInitUnicodeString
RtlCopyUnicodeString
MmGetSystemRoutineAddress
ExInitializeNPagedLookasideList
memset
hal
KeGetCurrentIrql
KfAcquireSpinLock
KeRaiseIrqlToDpcLevel
KeQueryPerformanceCounter
KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql
KeStallExecutionProcessor
wdfldr.sys
WdfVersionUnbind
WdfVersionBind
Name
.text
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
273KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=80, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=31, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
evbd.cat.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 ae6702f3482daaa0abeab07b446b091c48edef5e17b826554b3379839f9ebd02
- MD5 7068e93033ba38b6330b3da961179a04
- SHA1 cb6f292ecb80be7798a1d040f0b55d8432f8504a
- SHA512 ab142b25dc702e4b4aa820c0d87daec7390386a9409c7cdcb29991160aedd19a2e82498d2795c05e0468108d93035e949e578cd3249c0158610b7b32699a41ea
- SSDEEP 192:A2TZwTu1TTXy8dTJmOI7DhjXHUz1TroAW5LfsxhQ8RFbm:AUsq5gjXHUyAGLa3RFC
- TLSH T1F752FC5F18ED06DBFD2B8D3113B15957BCB57AC37C10292C999BEB281A813C0E5B816D
- MD5 SHA1 SHA512 SSDEEP TLSH
evbd.inf.F935445C_34D7_444E_8A17_CD3E66853B72
- SHA256 da82880ec6147f86e610aa849f6d2a47f642c1467ad4037dd12072a6c33d3743
- MD5 d6b63628fd740d96986dab65a3136bcf
- SHA1 f067bc026d13ceb7a5cabe1b5cf7d20221ab7a2f
- SHA512 7be9d69ffe26d68b82cbd16a99c8cc839ee7c5bf2d4ebf813fbbd4dae6b886ecca4b5cc96fe6ae08d5bfd4d19a82116fbe06e779c2927a25b707464e0ef76409
- SSDEEP 1536:Ug844EdBWgzDBFf4y+IQMbGSRSFe/i9ZzhSi9iGSxRyjNz0SJhh3ESDJ5FqR92Tz:9Ev
- TLSH T1A9C3DD38B34ABD20758B2EEE7E0558E6C8146405B5A068F4B7DB2FE4E3CDD0D825EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
evbdx.sys.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 4940fbc62f04089823ce0e97e34b16d7
- SHA256 9533522c0aa283acdb254cfc6a5a77897b1bc408b544fecef5f02df5a50415a4
- MD5 16cff939dee99b82af86a52bc808ab16
- SHA1 d03155d84e8c3da0fadd9c1b58f2fff19e600dc4
- SHA512 0e554a33c79f6c9d026fec0e710844afbc228f485549787e4c9d5f85abffc8edceead08f8a9c0a1adb99fdc64d1e1b02d0ee03505e0266a56f1da6fe32a70230
- SSDEEP 24576:ubw8lJckrSVF7k1tOfQf8ecCJg7f0ChYFMLpFlXKuZZHI:uU8lTU1If8egPF9jI
- TLSH T19DB52761B291C6E2D49923315EE7C6F60A399E86CF1082CB32917F5E2DF16C59C3A35C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
06:2a:fe:18:d3:ab:a4:18:9d:4e:fa:e6:1e:43:5d:bf:d2:1e:6c:b1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Aug 6, 2026
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
44:7d:65:1c:cc:06:93:47:61:4f:94:9c:61:e6:75:df
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 21, 2009 - Oct 21, 2012
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
225236
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\workt6.x\577xx\drivers\windows\b10bdrv\fre_wnet_x86\i386\evbdx.pdb
ntoskrnl.exe
DbgPrint
memcpy
RtlIntegerToUnicodeString
RtlAppendUnicodeToString
wcsstr
IoGetDeviceProperty
ZwClose
ZwCreateKey
ZwDeleteKey
RtlWriteRegistryValue
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
memmove
ZwEnumerateKey
RtlInitUnicodeString
ZwSetValueKey
IoInvalidateDeviceState
RtlCheckRegistryKey
_aulldiv
_allmul
strrchr
KeQuerySystemTime
KeSetTimer
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeInsertQueueDpc
KeSetImportanceDpc
KeNumberProcessors
IoGetDmaAdapter
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeCancelTimer
KeInitializeDpc
RtlUnicodeStringToInteger
RtlQueryRegistryValues
wcsncpy
ObfDereferenceObject
ExAllocatePoolWithTag
IoConnectInterrupt
ObReferenceObjectByHandle
PsThreadType
PsCreateSystemThread
KeInitializeTimer
PsGetVersion
IoAllocateWorkItem
IoQueueWorkItem
IoFreeWorkItem
IoRaiseInformationalHardError
IoSetThreadHardErrorMode
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeSetTargetProcessorDpc
MmGetSystemRoutineAddress
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
IoDisconnectInterrupt
KeDelayExecutionThread
MmGetPhysicalMemoryRanges
RtlCompareMemory
ExInitializeNPagedLookasideList
IoFreeMdl
MmMapIoSpace
MmUnmapIoSpace
KeTickCount
KeBugCheckEx
ExFreePoolWithTag
IoAllocateIrp
IoFreeIrp
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
KeSetEvent
RtlCopyUnicodeString
_aullshr
_allshl
sprintf
strncmp
_aulldvrm
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenSection
memset
KeResetEvent
wcsrchr
hal
KfRaiseIrql
KfAcquireSpinLock
KeStallExecutionProcessor
KeGetCurrentIrql
KfReleaseSpinLock
KfLowerIrql
KeQueryPerformanceCounter
wdfldr.sys
WdfVersionUnbind
WdfVersionBind
Name
.text
Size
768KB
Virtual Size
767KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
55KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=98, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
wdfcoinstaller01007..F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 9aa2546c4dfe543e11dbbf7cb79c00c5
- SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
- MD5 81d9bcceb78795cd0315b24960f2d130
- SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
- SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
- SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
- TLSH T17E352251A7EC4964F5F32FB19A7EA6922A7DBDD12E75C08E6248895C1830F84CC70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
67:f1:0f:19:25:39:f6:40:e2:69:b1:19:9c:75:1f:4e:47:c6:b7:84
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 27, 2008
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:47:52:ba:00:00:00:00:00:04
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:49:7c:ed:00:00:00:00:00:05
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:30:7e:00:00:00:00:00:06
Issuer
CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 10, 2008 - Jun 10, 2009
Subject
CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 11, 2005 - Apr 26, 2010
Minor OS version
0
Major OS version
6
Entry point
52098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WdfCoInstaller01007.pdb
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf
setupapi
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
kernel32
GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
LocalFree
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
advapi32
RegQueryValueExW
LockServiceDatabase
QueryServiceLockStatusW
ChangeServiceConfigW
UnlockServiceDatabase
QueryServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey
crypt32
CertGetCertificateContextProperty
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
shell32
CommandLineToArgvW
user32
IsCharAlphaW
IsCharAlphaNumericW
LoadStringW
ole32
CoTaskMemFree
WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1019KB
Virtual Size
1019KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=174, id=1, productName=Unmarked objects,
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=15, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
wdfcoinstaller01007.1.F935445C_34D7_444E_8A17_CD3E66853B72
- IMPHASH 9aa2546c4dfe543e11dbbf7cb79c00c5
- SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
- MD5 81d9bcceb78795cd0315b24960f2d130
- SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
- SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
- SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
- TLSH T17E352251A7EC4964F5F32FB19A7EA6922A7DBDD12E75C08E6248895C1830F84CC70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
67:f1:0f:19:25:39:f6:40:e2:69:b1:19:9c:75:1f:4e:47:c6:b7:84
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 27, 2008
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:47:52:ba:00:00:00:00:00:04
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:49:7c:ed:00:00:00:00:00:05
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 16, 2006 - Sep 16, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:30:7e:00:00:00:00:00:06
Issuer
CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 10, 2008 - Jun 10, 2009
Subject
CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 11, 2005 - Apr 26, 2010
Minor OS version
0
Major OS version
6
Entry point
52098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WdfCoInstaller01007.pdb
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
malloc
free
_wtoi
_wcsicmp
_ultow
_stricmp
memset
memcpy
_vsnwprintf
setupapi
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
CM_Set_DevNode_Problem_Ex
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupPromptReboot
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupDiGetSelectedDriverW
kernel32
GetWindowsDirectoryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FileTimeToSystemTime
CloseHandle
FormatMessageW
GetLocalTime
OutputDebugStringW
LoadLibraryW
FreeLibrary
lstrlenA
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
LocalFree
GetLastError
GetProcAddress
GetModuleHandleW
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
advapi32
RegQueryValueExW
LockServiceDatabase
QueryServiceLockStatusW
ChangeServiceConfigW
UnlockServiceDatabase
QueryServiceConfigW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExW
RegCloseKey
crypt32
CertGetCertificateContextProperty
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
shell32
CommandLineToArgvW
user32
IsCharAlphaW
IsCharAlphaNumericW
LoadStringW
ole32
CoTaskMemFree
WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceRemove
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1019KB
Virtual Size
1019KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=174, id=1, productName=Unmarked objects,
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=15, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Server/W2K3_W2K8/DrvInst/Release.txt
- SHA256 406b5a46979ff9b57afc179e41be3f0205819d1c18f66d98b474db49f9593eaa
- MD5 40e398b723f3b694046081fce586b819
- SHA1 c38598003a1668c663776ec0ac487bc18d1e6d72
- SHA512 b4c2dcc0ecf1e39c9bfe0a790439a963bd2613fb5415cc34e79f31355b80662ab84abee121e772efbfbd80852d4920b8ee5d9db0e944cf0d1bb39b16d5cb394d
- SSDEEP 3072:t3ajC/ub3O+kstgnIOpQq067gHy2CoEMTptcFmHOM4XNIEFMXDs7XXbDfGnSV1Ck:0C/ub3O+kstgnIOpQq067gHy2CoEMTp4
- TLSH T150F3005A3F01513A71B5C33F567AE822E2187B9BA662073730CEE6040F71745B7DE29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Server/W2K3_W2K8/DrvInst/Setup.ini
- SHA256 44ac90771c5f0f3a1cb6c69c3fd5a947e3a53bf0e1449357743eef97e72c8495
- MD5 794db1d8730b5bf40db0f0a1413df12b
- SHA1 46a0f1913fa839b9ab4cb1386ea0f83204b43269
- SHA512 9c42c21112458e8a167363279599beb0a51016a387d6a916ad9a8975150afd16139e095d74d3b63355dd436c502324fcaf1f5ab8cbd104f12ca1d554b1ef456f
- TLSH T1DB5134D535A718ADD25B60B775E7228365CD296009167305A3884BD3DF9CA2B0B3F2B3
- MD5 SHA1 SHA512 TLSH
Server/W2K3_W2K8/DrvInst/Silent.txt
- SHA256 64451ec1b1396dfa8fc6fc122a5d5147a46e9fba3ef4c705a4c5d195742857b9
- MD5 6ab28ea292817a362bb51b9ed3cce362
- SHA1 1484c9c1078f00d69dc3a97c3d8a3fcaf8488470
- SHA512 62a15555f47f4abeee602076f814a1ca57bea06ab27479a3fe1c9e790bdf7ea5365b46d913118b54c34a3064cfc0ef7784000f3b4bf49e2b67dcc118995f9cf5
- TLSH T12931648D0A4B1172387083D9710F2775BA46A2592366664078EF343C07937AD4BAB1DB
- MD5 SHA1 SHA512 TLSH
Server/W2K3_W2K8/DrvInst/Version.txt
- SHA256 a0587342d7ed45177c6974344452c77af9494a06c1a901b3765efaf398edc31d
- MD5 0e67a323506e65d66fcb4b109b907721
- SHA1 763c52fb8ed7a22c0dd27ed93fec0c6a143b5cbb
- SHA512 5a8cd6091bffbac97b73df11ab16111ffeceb380b0aa2dd998906ab4f8393523c98b989cfe69696bf185ba52c5d6ce9c17acd72179eb048ee1e421be13999b16
- SSDEEP 48:ScGJ2JFNIUn9kyinPDCkyinqgkyqmquckyqIqFkyqNVW1kyqaVeky9BDDky4cDp9:Tt/gCZubkWD+rK1qZpS1NPTCTOT5mFF
- TLSH T14152344A8E487DF57831C69052179DC2C3CA522322AAEB1174CEB31EEF7D46B540FA97
- MD5 SHA1 SHA512 SSDEEP TLSH
Server/W2K3_W2K8/DrvInst/instmsia.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 267304efcc831e35927c1f25d610d36fb64121d108a6f4ff0168c53df01e2b16
- MD5 43f7305c2e5dd4a8f3c5abeb2ffe4833
- SHA1 03bda624ab7f0d7cb9ada41a960c35c0152f98fd
- SHA512 e24072f1b5b102fbd52126396854463ff07d8d0efce1d922ed99acd0369cff163e415abc1faeaf559ef7898e5f82945db544a0f425db0db42696282d0acd7c7c
- SSDEEP 49152:Ru0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5T:o0mVgSxa872av9
- TLSH T16D852382DBE94632F0351B7558F6232B3B347DA95D36EB2EAE43008518735C4A5B4B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
dc:3d:2c:e7:fd:06:24:37:5c:24:70:80:2c:89:2f:43
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=Copyright (c) 2001 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Corporation,OU=Copyright (c) 2001 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:2a:8d:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 29, 2001 - May 29, 2002
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Minor OS version
1
Major OS version
5
Entry point
23179
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9043,
count=126, id=1, productName=Unmarked objects,
count=1, id=56, version=2402,
count=24, id=28, version=9037,
count=1, id=61, version=9043,
Server/W2K3_W2K8/DrvInst/instmsiw.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 b93fdcd1136faa9a8cb73a329b2f1f5f430a150ddcec35de916e3a1539f09351
- MD5 61a5fb191ae2ae876db31dcce75e4183
- SHA1 751669c38b666c7435b2a65a5c6fe40435d59aaa
- SHA512 76ed473ff370255e7b09a931c10e1aea7d9d84b4655d85e9ad28faa5f143bb9063c363829a28614fb89cd00c4755e825268123e5f6f4849a0db9328297811ffc
- SSDEEP 49152:OFxErb1F2gqQF6d8RrycC51DtuoIwgpXIfWzbnoP2qDAV:2Gb1FLqQF6dWry//DthQiooP2qDAV
- TLSH T121853342A7DE453BD0BA1BB0B5F91A637BBA38D0ADB6F76C3302494408316D14D7936B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
45:e0:9f:4f:67:b3:9c:54:70:29:30:ba:3c:89:9d:fd
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=Copyright (c) 2001 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Corporation,OU=Copyright (c) 2001 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:2a:8d:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 29, 2001 - May 29, 2002
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Minor OS version
1
Major OS version
5
Entry point
23179
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9043,
count=126, id=1, productName=Unmarked objects,
count=1, id=56, version=2402,
count=24, id=28, version=9037,
count=1, id=61, version=9043,
Server/W2K3_W2K8/DrvInst/setup.exe
- IMPHASH 4b9b006bc496a2526b31c07ccf134c3b
- SHA256 4c60d55da2e93c0fedbc991cf97e3b912628de359afd06d3347c30cb0791f846
- MD5 64c8de941312ab23b904026500a2982c
- SHA1 628f439ad8830294fb9ebc1db953015e59635490
- SHA512 b660f49aec09954e82ba47ad515d46dd9a9fe12e9a870588b06021a3ce416bc4a9d6a2e8ad788fecdd5d3afbe93ccf8c86b34e0232bba580e56056319260fde9
- SSDEEP 12288:nGRDU5ervjUo9BEgfYoIpKYSc53an9lpGN4VGtTRIMFYtmxGF9jB:nGRmervjUoDEgfnImcJaBhotTRTFFxG9
- TLSH T123D48D123DB0C133E56280B0D99E9B78E6F99C714C25888777C8A91D6DB2993D72372F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
13:2b:ad:c5:03:42:92:bf:88:52:6d:98:d1:de:0e:a8
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Chains
Jan 1, 0001
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Broadcom Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Broadcom Corporation,L=Irvine,ST=California,C=US
Serial Number
44:7d:65:1c:cc:06:93:47:61:4f:94:9c:61:e6:75:df
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 21, 2009 - Oct 21, 2012
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Minor OS version
0
Major OS version
4
Entry point
221991
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHFileOperationA
comctl32
ord17
kernel32
WaitForSingleObject
CreateProcessA
lstrcpyA
GetWindowsDirectoryA
SetErrorMode
GetTempPathA
ExpandEnvironmentStringsA
LockResource
SizeofResource
LoadResource
FindResourceA
GetTickCount
GetExitCodeThread
CreateThread
CopyFileA
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
CreateEventA
lstrcatA
GetTempFileNameA
CompareStringA
CompareStringW
GetVersionExA
LoadLibraryA
FreeLibrary
GetProcAddress
lstrcmpA
lstrcmpiA
GetSystemDefaultLCID
GlobalHandle
VerLanguageNameA
MoveFileA
SetCurrentDirectoryA
FindClose
FindNextFileA
CompareFileTime
FindFirstFileA
GetSystemTimeAsFileTime
SetFileAttributesA
LocalFree
FormatMessageA
GetSystemInfo
MulDiv
IsValidCodePage
GetVersion
GetModuleHandleA
GetFileAttributesA
IsBadReadPtr
VirtualQuery
FlushFileBuffers
SetEndOfFile
GetDiskFreeSpaceA
GetDriveTypeA
CreateDirectoryA
GetLastError
GetCurrentThread
GetLocaleInfoA
GetCurrentProcessId
FindResourceExA
LoadLibraryExA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetProcessTimes
OpenProcess
SearchPathA
SetEnvironmentVariableA
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
SetConsoleCtrlHandler
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
FatalAppExitA
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
SetLastError
HeapSize
HeapReAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
lstrlenA
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
GetCurrentProcess
DuplicateHandle
GetThreadContext
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
ResumeThread
DeleteFileA
Sleep
RemoveDirectoryA
IsDBCSLeadByte
SetFilePointer
GetProcessHeap
HeapAlloc
HeapFree
WriteFile
lstrcpynA
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
GetLocalTime
MultiByteToWideChar
VirtualProtect
ResetEvent
SetEvent
QueryPerformanceCounter
SystemTimeToFileTime
GetExitCodeProcess
LocalAlloc
user32
UpdateWindow
SetCursor
GetWindow
GetDlgItemTextA
SetFocus
GetClassInfoA
wvsprintfA
LoadStringA
EnableWindow
GetParent
GetWindowTextLengthA
GetWindowTextA
MoveWindow
SetWindowTextA
GetWindowPlacement
DrawIcon
DestroyIcon
GetDlgCtrlID
FillRect
GetSysColor
IsDialogMessageA
SendMessageA
GetWindowRect
GetSystemMetrics
SetRect
FindWindowA
IntersectRect
SubtractRect
IsWindow
CharPrevA
CharNextA
WaitForInputIdle
GetWindowLongA
BeginPaint
EndPaint
SetWindowLongA
GetClientRect
ClientToScreen
SetWindowPos
GetWindowDC
EndDialog
GetDlgItem
ShowWindow
GetDesktopWindow
wsprintfA
MsgWaitForMultipleObjects
PeekMessageA
MessageBoxA
CreateDialogIndirectParamA
CreateDialogParamA
DialogBoxIndirectParamA
DialogBoxParamA
DefWindowProcA
PostMessageA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
CharUpperA
ExitWindowsEx
SendDlgItemMessageA
DestroyWindow
GetSysColorBrush
SetDlgItemTextA
gdi32
CreateFontA
GetTextExtentPoint32A
SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetStockObject
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
CreateDIBitmap
TranslateCharsetInfo
advapi32
RegCreateKeyA
RegOpenKeyA
OpenThreadToken
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyA
RegEnumKeyExA
RegDeleteKeyA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
SetSecurityDescriptorDacl
ole32
CLSIDFromProgID
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoInitializeSecurity
CreateItemMoniker
GetRunningObjectTable
ProgIDFromCLSID
StringFromGUID2
CoUninitialize
CoInitialize
CoCreateGuid
oleaut32
SysAllocStringLen
SysReAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantChangeType
GetErrorInfo
CreateErrorInfo
RegisterTypeLi
LoadTypeLi
SetErrorInfo
SysFreeString
rpcrt4
UuidFromStringA
UuidCreate
UuidToStringA
RpcStringFreeA
Name
.text
Size
416KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=10, version=8966,
count=2, id=12, version=7291,
count=32, id=14, version=7299,
count=132, id=10, version=8047,
count=16, id=11, version=8047,
count=2, id=37, version=8755,
count=2, id=28, version=9178,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=325, id=1, productName=Unmarked objects,
count=19, id=25, version=9210,
count=51, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,