VixenFreePerm.zip
- SHA256 6797c4ddcc7917ea9e6f28e61a96795d5ae1fa8e29440b71cdacee2787d2fd61
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VixenFreePerm.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
VixenFreePerm.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target VixenFreePerm.zip
- Size 2.3MB
- Sample261027-2pstqavy8n
- SHA256 6797c4ddcc7917ea9e6f28e61a96795d5ae1fa8e29440b71cdacee2787d2fd61
- MD5 936ccc789f49d56a6ac328f10d4aca22
- SHA1 b53b4a9a0594847f5567540378d6c6dbd3ad81ae
- SHA512 297e1281502c1f321809caf21e3734f56648ff770f808bc57503ecca4e94f55a713e789d148b70803b0f0f960d0cc9e6d694587aabb0ac5a26424bb131d4cc40
- SSDEEP 49152:r85miX5N4clVYBEWu2DmKCPbCO4GMUkD1eexrSd/3aaObd0+YeW+2PR13:riX0clXWTDmKCOOXMUkDtO/3msel2Pf3
- TLSH T12CB53353F0F863AC91B58CAF97771CE68583ED50AD0CFE0989941E6621C1C866736FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/deps/AMIDEWINx64.EXE unpack001/deps/PSWOA.exe unpack001/deps/rtkiow10x64.sys
File Explorer
-
VixenFreePerm.zip.zip 2.3MB
-
RUN AS ADMIN TO SPOOF.bat318B
-
deps/AMIDEWINx64.EXE.exe 377KB
-
deps/AMIFLDRV64.SYS.sys 29KB
-
deps/EEUPDATE.exe.exe 4.5MB
-
deps/PSWOA.exe.exe 392KB
-
deps/RTIoLib64.dll.dll 155KB
-
deps/RTNicPgW64.exe.exe 745KB
-
deps/amigendrv64.sys.sys 36KB
-
deps/i3782.bat.bat 5KB
-
deps/iqvsw64e.cat9KB
-
deps/iqvsw64e.inf2KB
-
deps/iqvsw64e.sys.sys 61KB
-
deps/rtkio64.sys.sys 53KB
-
deps/rtkiow10x64.sys.sys 63KB
RUN AS ADMIN TO SPOOF.bat
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
deps/AMIDEWINx64.EXE
- IMPHASH e3d5de629e09ae6898196a1418661d7f
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- TLSH T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
CreateServiceA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
deps/AMIFLDRV64.SYS
- IMPHASH b05ee5c816a30bc52378c759486af0b9
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 13, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2019
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d3:d0:94:56:9d:0e:bd:83:06:00:00:00:00:00:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
394B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
deps/EEUPDATE.exe
- IMPHASH 0716c6aab03eb269c8f44de9ab66ebb4
- SHA256 bc195aac847d8015d875562be929804e59bf0c0cdab5407a06f3359be98641a2
- MD5 4325420a99393a6ad6044818ae61f945
- SHA1 cbe636eee83e6a016d0ed65a09dc88a5cb8398a3
- SHA512 30a7456f6c55d957a9bdf9ca1f9c2fb76f6144015f24ccfcb5168275996091c425dd86e08b6d0b4940ff63af6876b1393aa8926bef62a880a5ff1b9551f5a0ae
- SSDEEP 49152:xVBQSmh7Dtk/bX5YuWI4zAXFBVTf9UnoGvlG0unS9w:9yD+/VYzI4zA1BRf9FGvlG0unS9w
- TLSH T1C626F957E7B321F5D4BAD1345143733ABC7274698338DBD79A808A1A4732BE0A93EB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
44:2a:82:80:df:63:5b:49:f4:ef:9d:9b:10:04:53:c9:05:b4:71:22:3a:ce:46:ff:83:3a:31:82:67:6a:7e:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Chains
Mar 16, 2022
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Serial Number
51:d1:95:74:21:63:07:a3:45:b1:50:aa:98:c4:27:03
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 2, 2021 - Apr 2, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
3290656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetStdHandle
FindClose
FindFirstFileA
FindNextFileA
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
SetConsoleScreenBufferSize
SetConsoleCursorPosition
SetConsoleCursorInfo
SetConsoleWindowInfo
SetConsoleTextAttribute
GetConsoleMode
SetConsoleMode
GetEnvironmentVariableA
OutputDebugStringA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThread
TerminateThread
GetExitCodeThread
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetLogicalProcessorInformation
SetDefaultDllDirectories
HeapReAlloc
CreateFileA
DeviceIoControl
GetSystemDirectoryA
GetSystemFirmwareTable
MultiByteToWideChar
WideCharToMultiByte
HeapSize
WriteConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
CreateDirectoryW
CreateFileW
GetTimeZoneInformation
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
VirtualProtect
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleFileNameW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReadFile
GetDriveTypeW
GetFullPathNameA
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleCtrlHandler
WriteFile
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleCP
ReadConsoleW
SetFilePointerEx
DeleteFileW
SetEndOfFile
user32
ExitWindowsEx
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantChangeType
setupapi
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
CM_Open_DevNode_Key
CM_Get_DevNode_Status
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDevRegKey
Name
.text
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
819KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=174, id=243, version=40116,
count=1, id=244, version=40116,
count=6, id=259, version=23013,
count=31, id=261, version=23013,
count=20, id=260, version=23013,
count=8, id=241, version=40116,
count=17, id=242, version=40116,
count=178, id=1, productName=Unmarked objects,
count=11, id=239, version=40116,
count=185, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
deps/PSWOA.exe
- IMPHASH 38b9864d7adfc879f05a5683b7a29a74
- SHA256 3f93b27c72838fd452d71706296a6273e84f3dec953cccda2666333d6e5be222
- MD5 77a82dfb2ad17a03c1057f9d76bebe80
- SHA1 43f4dbdf7996419086f74b644ec8ecea64b33249
- SHA512 9cd7b66f6203811c0cb3488667248943eee564d95bbb70f9815fd049970fcc92f67d0734a25829cc058f34aa9b1217f79088a4cb6f4ea74d9c3fde9b014c909f
- SSDEEP 6144:J32tDyw4/cNP4vTTkHcnL1cUInSRUWv7qlm5beS:Jm33snkZUISQQaS
- TLSH T1AC847C19EA9109F9D9A79578C9224546E731BC4F43B0D6DB23FC0A560F17AF06E3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
125712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\conspiracy\source\repos\PSWO\x64\Release\PSWOA.pdb
kernel32
CloseHandle
HeapAlloc
FillConsoleOutputAttribute
GetProcessHeap
CreateProcessA
SetConsoleCursorPosition
Sleep
HeapSize
SetStdHandle
CreatePipe
GetStdHandle
HeapFree
GetConsoleScreenBufferInfo
SetHandleInformation
FillConsoleOutputCharacterA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
WriteConsoleW
ReadFile
MultiByteToWideChar
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
IsValidCodePage
RtlUnwind
user32
MessageBoxA
advapi32
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
iphlpapi
GetAdaptersInfo
Name
.text
Size
279KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=180, id=261, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=85, id=261, version=35207,
count=20, id=260, version=33145,
count=11, id=257, version=33145,
count=142, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
deps/RTIoLib64.dll
- IMPHASH 625a9a2139046104e37e4654c9a0a63d
- SHA256 e68365ab48c6fa3b3c8036c578cd61793e645b76c8a17641ff07ad01038ccbb8
- MD5 23b63b64c57ffe0129af6ee4b38ea7db
- SHA1 ce0cec8e15d7d9cc861613a6b2599cf2d580c70f
- SHA512 3a5b19c4363e4bafd6a6ddc538ac592afebd81b6de05687e7f169c402c232ca9685ac36391c03719e588b919cdb0fadd56b42d26ae90b1e3aa3e231e0686e4ab
- SSDEEP 3072:RMmIcRC1BP5gn6ENjoJszSKKmNdWTZILJpu9S5:OURC1yvm2f9dWYpJ
- TLSH T110F34A91B19200F4DAFA993489E54A06F7F178244325A7CF266082270F73BE9FD7E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
97:a7:6c:15:98:8d:69:07:17:d4:b2:1e:78:7a:85:12:ca:d9:55:a1:2b:d8:03:e4:61:ce:5e:18:c8:a1:4c:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Jun 4, 2020
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
86:f8:4c:8b:35:c4:41:84:68:6b:cb:d6:1c:c1:cf:fb:1c:4b:3a:eb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Jun 4, 2020
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
04:df:4d:56:73:3a:e3:8d:59:8e:a0:04:dd:2d:9c:51
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 9, 2020 - Sep 15, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Sep 18, 2026
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0d:94:73:e0:01:50:bc:5e:b4:7f:29:a1:0d:cc:dd:bd
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 26, 2018 - Sep 15, 2020
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
65328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\documents and settings\administrator\桌面\src\x64\release\RTIoLib64.pdb
kernel32
GetCurrentProcessId
CreateFileW
OpenProcess
DeviceIoControl
DuplicateHandle
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
Sleep
GetLastError
GetVersionExW
GetCurrentProcess
GetProcAddress
CloseHandle
GetModuleHandleW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
HeapSize
WriteFile
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
advapi32
StartServiceW
DeleteService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ControlService
GetIoBase
LoadPhyMemDriver
MapPhyMem
ReadPortByte
ReadPortLong
ReadPortWord
RtIoInformFWS3S4S5
RtIoReadAsfUchar
RtIoReadAsfUlong
RtIoReadAsfUshort
RtIoReadCPUUchar
RtIoReadCPUUlong
RtIoReadCPUUshort
RtIoReadCSIUchar
RtIoReadCSIUlong
RtIoReadCSIUshort
RtIoReadChannel
RtIoReadEEPROMUshort
RtIoReadEfuseByte
RtIoReadExtGMACUchar
RtIoReadExtGMACUlong
RtIoReadExtGMACUshort
RtIoReadMacByte
RtIoReadMacDword
RtIoReadMacWord
RtIoReadMcuAccessRegWord
RtIoReadOCPUchar
RtIoReadOCPUlong
RtIoReadOCPUshort
RtIoReadPCIUchar
RtIoReadPCIUlong
RtIoReadPCIUshort
RtIoReadPciEPhyUshort
RtIoReadPhyOcpRegWord
RtIoReadPhyUshort
RtIoReadUSBUchar
RtIoReadUSBUlong
RtIoReadUSBUshort
RtIoReadVPD
RtIoWriteAsfUchar
RtIoWriteAsfUlong
RtIoWriteAsfUshort
RtIoWriteCPUUchar
RtIoWriteCPUUlong
RtIoWriteCPUUshort
RtIoWriteCSIUchar
RtIoWriteCSIUlong
RtIoWriteCSIUshort
RtIoWriteChannel
RtIoWriteEEPROMUshort
RtIoWriteEfuseByte
RtIoWriteExtGMACUchar
RtIoWriteExtGMACUlong
RtIoWriteExtGMACUshort
RtIoWriteMacByte
RtIoWriteMacDword
RtIoWriteMacWord
RtIoWriteMcuAccessRegWord
RtIoWriteOCPUchar
RtIoWriteOCPUlong
RtIoWriteOCPUshort
RtIoWritePCIUchar
RtIoWritePCIUlong
RtIoWritePCIUshort
RtIoWritePciEPhyUshort
RtIoWritePhyOcpRegWord
RtIoWritePhyUshort
RtIoWriteUSBUchar
RtIoWriteUSBUlong
RtIoWriteUSBUshort
RtIoWriteVPD
SendSMI
UnloadPhyMemDriver
UnmapPhyMem
WritePortByte
WritePortLong
WritePortWord
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Shared
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=44, id=110, productName=VS2005 build 50727, version=50727,
count=95, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=107, id=1, productName=Unmarked objects,
count=6, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
deps/RTNicPgW64.exe
- IMPHASH 39dfab18f435aa1ac7d1cb18d1a19c2d
- SHA256 791d18024007d988725ad24ae499f9e8f26dfc1ac8f95f9094568fc5c300d0bf
- MD5 302a86510b5c2a807bfad326224880d1
- SHA1 0afea09cb54d9216895e1ad2e60e2606c89d8697
- SHA512 a4da927d4e33639b97062fcae6003075e60ce939edf7e807119e2f5b300c0918fdbd801668d78e8a707e920bb7b4aade72ed4ac3f3168129b1af2fe40397ff4f
- SSDEEP 12288:pp99WL/vCzx3QRIL4DbKsxA/3SYsF2WKEnkiUJ0yn:r8/vaN4PKsxisF2L+yn
- TLSH T11CF4B05E56B106B5D1A68230C596461BFAF530100328EAFF66FC4AB15F77B862E2FF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
86:f6:b2:71:ac:88:47:38:82:e3:fb:2f:03:ed:83:02:1c:ee:11:f5:cf:4f:74:58:be:1d:3d:9f:74:51:e8:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 25, 2022
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
0b:8e:6c:fd:6e:11:ce:a0:55:da:5a:3f:af:cb:53:b6:df:5b:c1:ec
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 25, 2022
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
01:ea:b8:7b:37:17:35:53:ad:a0:99:07:25:3c:88:4b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 16, 2021 - Jul 19, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
436736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Working\PG_275_QC\RTNICPG\x64\Release\RTNicPgW64.pdb
rtiolib64
RtIoReadPCIUlong
RtIoWritePCIUlong
RtIoReadPCIUshort
RtIoWritePCIUchar
MapPhyMem
RtIoReadPCIUchar
RtIoWritePCIUshort
UnloadPhyMemDriver
LoadPhyMemDriver
WritePortWord
ReadPortLong
UnmapPhyMem
ReadPortByte
WritePortByte
WritePortLong
ReadPortWord
setupapi
SetupDiDestroyDeviceInfoList
CM_Get_Device_ID_ExW
SetupDiGetClassDevsExW
SetupDiGetDeviceInfoListDetailW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiClassGuidsFromNameExW
kernel32
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetEndOfFile
DeleteFileW
FlushFileBuffers
SetStdHandle
ReadConsoleW
GetConsoleMode
GetConsoleCP
CancelIo
DeviceIoControl
CreateEventW
GetStringTypeW
GetLastError
CloseHandle
GetNativeSystemInfo
LoadLibraryW
GetOverlappedResult
GetProcAddress
FreeLibrary
GetSystemPowerStatus
GetSystemFirmwareTable
GetCurrentProcess
lstrlenW
WaitForSingleObject
CreateFileW
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
SetConsoleTextAttribute
GetStdHandle
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
WriteConsoleW
HeapSize
HeapReAlloc
Sleep
QueryPerformanceCounter
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
WriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
RtlUnwind
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ReadFile
QueryPerformanceFrequency
GetFileType
user32
CharPrevW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
LsaNtStatusToWinError
RegCloseKey
shell32
ShellExecuteExW
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocStringByteLen
SysAllocString
SysStringLen
VariantClear
Name
.text
Size
563KB
Virtual Size
563KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26715,
count=7, id=259, version=26715,
count=170, id=261, version=26715,
count=47, id=261, version=27316,
count=17, id=260, version=27316,
count=8, id=259, version=27316,
count=1, id=262, version=26715,
count=14, id=257, version=26715,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=148, id=1, productName=Unmarked objects,
count=28, id=265, version=27404,
count=1, id=255, version=27404,
count=1, id=151,
count=1, id=258, version=27404,
deps/amigendrv64.sys
- IMPHASH ce753744099dc03f568621989387593a
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:d7:a1:75:23:8d:96:93:2d:e6:e8:30:91:77:01:1f:90:68:76:96:a9:37:b6:66:2b:a6:d8:23:00:dc:f9:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 16, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
09:d7:a1:75:23:8d:96:93:2d:e6:e8:30:91:77:01:1f:90:68:76:96:a9:37:b6:66:2b:a6:d8:23:00:dc:f9:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2022
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9f:2b:45:35:15:08:2e:4b:5d:00:01:00:00:01:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amigendrv64.pdb
ntoskrnl.exe
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
ZwUnmapViewOfSection
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlCompareMemory
KfRaiseIrql
MmMapIoSpace
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KeLowerIrql
RtlGetVersion
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=29395,
count=34, id=1, productName=Unmarked objects,
count=5, id=259, version=29395,
count=9, id=260, version=29395,
count=1, id=262, version=29395,
count=2, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=9, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
deps/i3782.bat
- SHA256 5d1c7fc83a9b03ec15af37328df37e71e222d0433dc513e01b6ca0e161457e07
- MD5 b3c2e53412fa8d74dd0a9ec7811f16b9
- SHA1 3d1f49a3fabd821967a943d353444bb3d08f08f5
- SHA512 a55ddec20d0658e260190b236cf0692501b94ce2ca0e32130f5a613bdad2fd9171574df8e875df0ea61709864ae062f57960676f8e0f278da2e79b65e1097498
- SSDEEP 96:3UmsVWzs0hTky9a/Pijqp+akPijQBMMwVgsFgH4VfFtK6zoyN7t:EphyOYtfsFga06zRN7t
- TLSH T14BC143BC6ED0A231DE9AC716AE2650C2F366D1B60126558C30DB90A8F60747C737EAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
deps/iqvsw64e.cat
- SHA256 bd4f42c45db35f9b042d610fab4c9810132dffea07265422f360b342b4a7790e
- MD5 93e365f71c2e9c8d61c64f2783fa0868
- SHA1 b3662eecbeafe5af9ee3be504df77cbd99fc7c36
- SHA512 031e615503633fc643dd72f44eeee7961361945a5ba4e6d2dc0ff184b38f7e2b65a5e9ab53315b40e895a9d7fbce9a91f180bac6738ee681744f6301ab0c5838
- SSDEEP 192:Qt83i2oJCuvyyKwnsFWQF7aCOJxZAqnajKsQcLIm:cdrnsFR5aCOJ/AlGsQcsm
- TLSH T1DC22D7E24A6C54C3ED53286043A8E567BC3D6BCB2C50856D31AFE7A51C83BC5E70856D
- MD5 SHA1 SHA512 SSDEEP TLSH
deps/iqvsw64e.inf
- SHA256 4af639c5c9f9106f73985a8c53a916d73c78a3bf67b450eaf4b06387129c3975
- MD5 9fc2029a6ebf64e1af9f656b82fdea1a
- SHA1 20c6e51b5dacde55d80b0873720f987d2593c47a
- SHA512 1ccbb5c488e7967baadca45d241f5d66ea1559d886662bc25c86b91634a7639416d5a8777f1e07a1b7d3cc638b857d32a52ef2960e935cb03c682abe4827dd02
- TLSH T1D141CCAD19E34E49767B34A193A3CAC2F210200609443D8D345EF4A5AB3ED9DD3659BE
- MD5 SHA1 SHA512 TLSH
deps/iqvsw64e.sys
- IMPHASH 11f988f5957aeb7baa8193fae423958c
- SHA256 a1c886d0e3b8dae271940d6c366f10fa54aff9582ee571394d7b0ead60f9c609
- MD5 a04fa610c631055c3c7b11df5887fbab
- SHA1 b37916fb4a764aa82cff5faba997437d3d93fb30
- SHA512 4fecdb2de280cd251421e3f09188b62fa95732db19488846677e75277f0a271d06f5ae2d38b62b65b359c03d715ece14cc5ff11aab0f7c4520bdd10904740f92
- SSDEEP 1536:LfeG1kQWHBqSfyAXy5IFCxxoPt1Q+8iAS2w2zB:LfwFftuQCr5D3t
- TLSH T1255349C72BB420C4F8FB9575869AC66BEFB0B19A17324BEB06A5C0550E533D1873D683
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:10:85:ac:23:70:2f:49:af:ce:03:b9:58:9b:4b:18:e0:70:45:04:ab:73:4d:e1:b5:c0:4f:30:75:7c:ee:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 4, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
6b:10:85:ac:23:70:2f:49:af:ce:03:b9:58:9b:4b:18:e0:70:45:04:ab:73:4d:e1:b5:c0:4f:30:75:7c:ee:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Chains
Jan 28, 2022
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Serial Number
51:d1:95:74:21:63:07:a3:45:b1:50:aa:98:c4:27:03
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 2, 2021 - Apr 2, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2021 - Jun 16, 2022
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:DD8C-E337-2FAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9c:0f:a6:4d:61:d2:9e:4b:28:00:01:00:00:01:9c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
20947360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\sandbox\999444\sdk\nal\driver\x64\Release\iqvsw64e.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmMapIoSpace
MmUnmapIoSpace
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
IoGetDmaAdapter
MmGetPhysicalAddress
MmIsAddressValid
_vsnprintf
strstr
wcsncmp
wcsncpy
wcsstr
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeEvent
KeWaitForSingleObject
IoBuildSynchronousFsdRequest
IofCallDriver
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoGetDeviceInterfaces
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwEnumerateValueKey
wcscmp
RtlGetVersion
ProbeForWrite
ExAllocatePool
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
__C_specific_handler
MmGetSystemRoutineAddress
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
ExAllocatePoolWithTag
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
RtlFreeUnicodeString
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
DbgPrint
IofCompleteRequest
strncpy
hal
KeQueryPerformanceCounter
KeStallExecutionProcessor
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
19.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=262, version=24610,
count=76, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=260, version=24610,
count=5, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
deps/rtkio64.sys
- IMPHASH 4343c9c0b78ee21e895f10d929c240d4
- SHA256 4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7
- MD5 96e10a2904fff9491762a4fb549ad580
- SHA1 02a8b74899591da7b7f49c0450328d39b939d7e4
- SHA512 06f477ddbcac1b1e79f142b4c0476e5c27b2a002b8d84ca098fc2d66df9b6f4ce6fe2e4c1648b061f594ad7c410e6daa37526a84d4f5b379699e8c8a89147ee9
- SSDEEP 1536:raz9Zl4jhovMHMvi78HOXtcrEC4RsbuaUfc:wDk+MsviouRC4a
- TLSH T196336C51C3A40865E9F7CE78B8F8922AFEB1B445A734C6DF0218C1919B53BD1AA3C356
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
90:2b:75:4d:d3:02:a9:94:07:4e:a8:d3:e6:19:d2:f9:00:0e:6c:69:97:e4:28:f1:9f:41:53:3f:7c:5e:19:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Jul 9, 2020
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
e6:6b:3b:65:07:61:b1:27:2b:22:d4:6a:b4:16:49:b8:a5:c2:66:03
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Jul 9, 2020
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
04:df:4d:56:73:3a:e3:8d:59:8e:a0:04:dd:2d:9c:51
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 9, 2020 - Sep 15, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Sep 18, 2026
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=HSINCHU,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0d:94:73:e0:01:50:bc:5e:b4:7f:29:a1:0d:cc:dd:bd
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 26, 2018 - Sep 15, 2020
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
46268
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\svn\rtiolib\rtkio\src\x64\objfre_wnet_amd64\amd64\rtkio64.pdb
ntoskrnl.exe
MmMapIoSpace
MmUnmapLockedPages
ExUnregisterCallback
ExAllocatePoolWithTag
IoWMIRegistrationControl
KeQueryActiveProcessors
IoDeleteSymbolicLink
ExFreePoolWithTag
IoWMIWriteEvent
IoRegisterShutdownNotification
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
MmBuildMdlForNonPagedPool
IoFreeMdl
MmUnmapIoSpace
ZwQueryValueKey
IoUnregisterShutdownNotification
ZwClose
IofCompleteRequest
ExRegisterCallback
RtlCompareMemory
IoCreateSymbolicLink
KeSetSystemAffinityThread
ObfDereferenceObject
ExCreateCallback
IoAllocateMdl
ZwOpenKey
KeBugCheckEx
MmMapLockedPagesSpecifyCache
_vsnprintf
IoCreateDevice
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
RtlFreeUnicodeString
__C_specific_handler
hal
KeStallExecutionProcessor
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=135, version=30729,
count=57, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
deps/rtkiow10x64.sys
- IMPHASH 317f02ddc9809d608a9bf63ce24e9550
- SHA256 ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89
- MD5 96a8b535b5e14b582ca5679a3e2a5946
- SHA1 f6b3577ea4b1a5641ae3421151a26268434c3db8
- SHA512 ca8ec4cec41e47560cc4d3b3af7bffa5c27455a1f55cc6ca1f3b1553ceda93b501a62a3f3599db1c88fd20fdeb48630973255ca23129b7036e938c7faaaf0376
- SSDEEP 1536:+OsdGoYvrhm0Kxu4RN496QOxsbXgkUfQOLf:Rm0K321OcoLf
- TLSH T1BB536D9197E80891F9B7CE7165F89057BE71B6862B31C6EF0229C0649BA3BD0F734319
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
45712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\SVN\RTIoLib\rtkio\SRC\sysw10x64\Release\x64\rtkiow10x64.pdb
ntoskrnl.exe
KfRaiseIrql
MmUnmapIoSpace
MmMapIoSpaceEx
RtlInitUnicodeString
MmGetSystemRoutineAddress
KeSetSystemAffinityThreadEx
KeQueryActiveProcessors
ExAllocatePoolWithTag
ExFreePoolWithTag
ExCreateCallback
ExRegisterCallback
ExUnregisterCallback
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
KeLowerIrql
IoAllocateMdl
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
IoWMIRegistrationControl
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
__C_specific_handler
ZwCreateKey
MmUnmapLockedPages
_vsnprintf
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwSetValueKey
RtlFreeUnicodeString
hal
KeStallExecutionProcessor
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=262, version=26213,
count=55, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=6, id=260, version=26213,
count=4, id=259, version=26213,
count=1, id=259, productName=VS2017 v15.8.0 build 26726, version=26726,
count=4, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,
count=1, id=255, productName=VS2017 v15.8.0 build 26726, version=26726,
count=1, id=258, productName=VS2017 v15.8.0 build 26726, version=26726,