7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
- SHA256 7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
Overview
overview
10Static
static
3AMIDEWINx64.exe
windows10-2004-x64
1AMIDEWINx64.exe
windows11-ltsc_2024-x64
1Run.bat
windows10-2004-x64
10Run.bat
windows11-ltsc_2024-x64
10amifldrv64.sys
windows10-2004-x64
3amifldrv64.sys
windows11-ltsc_2024-x64
3amigendrv64.sys
windows10-2004-x64
3sn.bat
windows10-2004-x64
10sn.bat
windows11-ltsc_2024-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AMIDEWINx64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AMIDEWINx64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Run.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Run.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
amifldrv64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
amifldrv64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
amigendrv64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
sn.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
sn.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
- Size 159KB
- Sample261029-mk17zaa18w
- SHA256 7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
- MD5 99246524a52ab63720b4b7b1e351116d
- SHA1 034e2c175494472cd78372f82e9a962f853edb73
- SHA512 52af719412b70312f6e06f09232b3a7cecfeaa9e5b6d52e5401cfe49eb9fec7e99aaff18812eef1b7ce0124309a1693b741880c54f7caf0ff74f8ec5c906fe8a
- SSDEEP 3072:Mj2Yvu4Gway6TohaeFQgBvve73LBDxY7Mumd8THsA2PHiXyskk2CI:Mj2YvSwVaeF2pDiqGHslPHiXOk4
- TLSH T1D9F3121D5B5C03CBCECAE2F8A5168CC5642C3CC6B45B2358A6827195DA3B5EF8F476C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AMIDEWINx64.EXE
File Explorer
-
7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885.zip 159KB
-
AMIDEWINx64.EXE.exe 377KB
-
Run.bat216B
-
SunwardPkg.idx318B
-
SunwardPkgFiles.dat272B
-
amifldrv64.sys.sys 28KB
-
amigendrv64.sys.sys 33KB
-
sn.bat1KB
AMIDEWINx64.EXE
- IMPHASH 5d7543265f1d05f9bd6a417f4988fb48
- SHA256 2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4
- MD5 64ae4aa4904d3b259dda8cc53769064f
- SHA1 24be8fb54afd8182652819b9a307b6f66f3fc58d
- SHA512 6c16d2bc23c20a7456b4db7136e1bb5fcee9cbf83a73d8de507b7b3ffc618f81f020cde638d2cd1ef5f154541b745a2a0e27b4c654683a21571183f7a1bffd16
- SSDEEP 6144:4NFU+vVycygjjsp5dcAONdA22xVK8LRPo4WBIeX+oD9/nwbr9W9v6i:4bygjjsrdcAONdA22xVK8LRPo4WGkD90
- TLSH T1ED84296AEBA620E4EC7791BC84912302F7A1B4644731D7E7B3AD451A4F33BE4A93D710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
DeleteFileA
GetCurrentDirectoryA
GetModuleHandleA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
wsprintfA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Run.bat
- SHA256 5a8585c1e5bf7d02be3590c94f7bf25804f9f9af3ee74e626c5d2b42b28650de
- MD5 2ff229035f388999fed9f49e4025f877
- SHA1 ff655c2033b80c5aa63875ee75e1e63b95df2a45
- SHA512 932c149c9f875792b06a0f65a908ccea3f35b5184030331125fcdfdeb005d70bc568434e2af05224eca95ee278b188e61ca562017d561ec0950b6ff1dc766037
- TLSH T146D022373DC2119969860A71DAF1BCC5B3D66AD3000BFBE8A710E1F0E869C950650EAC
- MD5 SHA1 SHA512 TLSH
SunwardPkg.idx
- SHA256 d4cf249d28bf5f60d64ed015346f7ec9781ea3f33a8e079a6c50dadb9e2f04e8
- MD5 96fea6f014f48d82010f01163f6c4dfc
- SHA1 92c6702da3a34fd577347a0a12f3727ff38d6c71
- SHA512 2dd08d706180d7bee7ee2b6def95369b67f642176ebd569421e3c2f128b5cc2001c4399415dce315ef5dbe426916290d4fd271585b5535c17564d6d4ccda6299
- TLSH T149E07234E2A3AA33D119053F0A612861AFBAA3E65B45C00B21C242C1C0ECB3878402A9
- MD5 SHA1 SHA512 TLSH
SunwardPkgFiles.dat
- SHA256 d3216b9c5fb6a9de1ecac9d4222053de8794dfa34602cadc7fd9c5b9f4af2b2e
- MD5 bd6007cf8320e888f8ebc21752077f30
- SHA1 6da845b217fb6813c96aaed2390558128525d1ed
- SHA512 594065158f1f21381f04c10582c3427d60edcf20be81fc2dc39a07a8881d076d49e652a9f87a8838798950e7cbaa16882ba944f84756e76f316bc266da3c831c
- TLSH T186D02BD492D1C12AE547A79283355C50DCA0AA0A5F289519E736957DCE0D2934E8B4D1
- MD5 SHA1 SHA512 TLSH
amifldrv64.sys
- IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
- SHA256 20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb
- MD5 0dff47f3b14fb1c1bad47cc517f0581a
- SHA1 db3538f324f9e52defaba7be1ab991008e43d012
- SHA512 f572e741b5a7e854353420bfe072f4e8d10ea61bd0be06a48f3b07bb58e98987761a4cbd77423bf1ab4a9a79b599b824b6b2951bae9e8ad16bca98c84c72b0a6
- SSDEEP 384:Hv+RD9ZsRVl8jqiZchbao0HMrEDulUoLdZFnJtQSZsHLPK6jzOO9bvFR3lZbI1:HvyJZmmqlHCMmulJLZJt6PKgaO9Po1
- TLSH T1C6D24B91C6784C43EEA3DD3062F4D6277D34B6822B60CACF411AD0A44B927C1AB7C36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
69:99:ca:ca:67:b3:78:60:ab:b5:e6:d9:54:20:d1:b0:d0:49:66:bc:66:74:aa:c3:bf:de:4e:23:94:ad:37:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 26, 2020
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
8e:67:62:87:43:95:9e:8b:73:d8:2a:e5:b9:ee:7a:38:7a:51:92:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 25, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmMapIoSpace
MmMapLockedPagesSpecifyCache
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmGetPhysicalAddress
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
910B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=23, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
amigendrv64.sys
- IMPHASH f9141c3df8f7ec7b3f2d46265a3b5528
- SHA256 38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20
- MD5 119f0656ab4bb872f79ee5d421e2b9f9
- SHA1 e35969966769e7760094cbcffb294d0d04a09db6
- SHA512 428c2a7db1559cb39a882a7dce5a0559efd9d83c2e86ca94bbe3c10c9989fe63c160ab7f475db0400a2ed016ab21f00faa9d0e0b7fdba5e3c34daadab24e71f2
- SSDEEP 768:Jn9+pli0X09luuJ4j/2HGra+Jt6PKgeGPeHPc:t0muuJK1a+JtkwGPMc
- TLSH T1F8F25C9197B84C92FDAB9E3062E0D6577D78F6D23A30C7CF0164C0640F63BC26928369
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4f:35:cf:1f:2e:0f:b8:7a:27:28:30:30:91:ee:50:5a:0b:c5:46:cf:63:dc:d3:81:78:ad:f4:84:77:ec:0f:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 29, 2020
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
9f:88:70:ec:27:29:33:ee:6f:4e:1e:da:97:5a:6d:5d:b5:f9:fb:de
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jul 28, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:897A-E356-1701,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2c:22:af:45:97:75:f9:1b:ee:00:00:00:00:01:2c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Work\WindowsDriverModel\amifldrv\sys\x64\Release\amifldrv64.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
MmBuildMdlForNonPagedPool
MmMapIoSpace
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KfRaiseIrql
RtlCompareMemory
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=27412,
count=33, id=1, productName=Unmarked objects,
count=4, id=259, version=27412,
count=7, id=260, version=27412,
count=1, id=262, version=27412,
count=2, id=259, productName=VS2019 v16.3.2 build 28105, version=28105,
count=9, id=260, productName=VS2019 v16.3.2 build 28105, version=28105,
count=1, id=255, productName=VS2019 v16.3.2 build 28105, version=28105,
count=1, id=258, productName=VS2019 v16.3.2 build 28105, version=28105,
sn.bat
- SHA256 cf982fd519273de4e1ec7c0c43c119dfb10df2b31691b6178f6de0ff9b483a93
- MD5 710c62d79d05aa77b09609cd9dfbfc5b
- SHA1 f7693959741ee80a0066832293a6567fa791f607
- SHA512 4088b7dc5bbd87ba9b6873f215d8aa5b366c5ff0de661e2e14421751a94cf4e952030402d00ae40f4bd22681bc31e39a2ef05cee2a0f60528242ef2b6a00ca58
- TLSH T10F21DD09A140DD6E5D7FC053FB012D7CE069A14784DA75B6A78E74010E30EFE8E0ABE1
- MD5 SHA1 SHA512 TLSH