5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
- SHA256 5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
Overview
overview
10Static
static
3AMCap.exe
windows10-2004-x64
10AMCap.exe
windows11-ltsc_2024-x64
10win10_64bi...nk.sys
windows10-2004-x64
3win10_64bi...eo.sys
windows10-2004-x64
3USB ...�.docx
windows10-2004-x64
1USB ...�.docx
windows11-ltsc_2024-x64
1USB ...�.docx
windows10-2004-x64
1USB ...�.docx
windows11-ltsc_2024-x64
1usbvideo.i...eo.sys
windows10-2004-x64
3usbvideo.i...eo.sys
windows11-ltsc_2024-x64
3win7_64bit...nk.sys
windows10-2004-x64
3win7_64bit...nk.sys
windows11-ltsc_2024-x64
3win7_64bit...eo.sys
windows10-2004-x64
3win7_64bit...eo.sys
windows11-ltsc_2024-x64
3USB ...�.docx
windows10-2004-x64
1USB ...�.docx
windows11-ltsc_2024-x64
1CDC驱动/...��.pdf
windows10-2004-x64
3CDC驱动/...��.pdf
windows11-ltsc_2024-x64
3USB ...��.pdf
windows10-2004-x64
3USB ...��.pdf
windows11-ltsc_2024-x64
3win10_64bi...nk.sys
windows10-2004-x64
3win10_64bi...eo.sys
windows10-2004-x64
3win10 64λ...nk.sys
windows10-2004-x64
3win10 64λ...eo.sys
windows10-2004-x64
3win10 64λ...).docx
windows10-2004-x64
1win10 64λ...).docx
windows11-ltsc_2024-x64
1win7 32λ6...�.docx
windows10-2004-x64
1win7 32λ6...�.docx
windows11-ltsc_2024-x64
1win7 32λ6.../u.sys
windows10-2004-x64
3win7 32λ6.../u.sys
windows11-ltsc_2024-x64
3usbvideo.i...eo.sys
windows10-2004-x64
3usbvideo.i...eo.sys
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AMCap.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
AMCap.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
win10_64bit/ksthunk.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
win10_64bit/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
USB /win10 64λϵͳUVCºװ˵.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
USB /win10 64λϵͳUVCºװ˵.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
USB /win7 32λ64λϵͳUVCºװ˵.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
USB /win7 32λ64λϵͳUVCºװ˵.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
usbvideo.inf_x86_neutral/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
usbvideo.inf_x86_neutral/usbvideo.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
win7_64bit/ksthunk.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
win7_64bit/ksthunk.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
win7_64bit/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
win7_64bit/usbvideo.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
USB /win7 32λ64λϵͳUVCºװ˵.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
USB /win7 32λ64λϵͳUVCºװ˵.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
CDC驱动/WIN7安装CDC驱动方法.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
CDC驱动/WIN7安装CDC驱动方法.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
USB /win7 32λ64λϵͳUVCºװ˵.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
USB /win7 32λ64λϵͳUVCºװ˵.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
win10_64bit/ksthunk.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
win10_64bit/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/ksthunk.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/u.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/u.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
usbvideo.inf_x86_neutral/usbvideo.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
usbvideo.inf_x86_neutral/usbvideo.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
- Size 3.5MB
- Sample261107-x8cjma1vbw
- SHA256 5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
- MD5 5c3624bcc1ed285d746b6a7565a6511b
- SHA1 9c330a998023be0f3c18ed82c5b66a335a61249b
- SHA512 402a67bb576a7720cda3bc9187ab1308bf51496cd2f8a00f9f9923ba24476b0d3cb887543ffb353fbf10183a6e1136f8cf3b79052af20d90fffd9d1af790ddae
- SSDEEP 98304:WEpgdwHeM5lZ+5yy8+hEpc+duwneM5lZ+5W:vS6Vn+y+I3dRVn+8
- TLSH T14206333E1DF02A3AD8614AA3ACD92459C7AC7F8D71305E26E2F154311FDD7A40A7782B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/AMCap.exe unpack002/win10_64bit/ksthunk.sys unpack003/usbvideo.inf_x86_neutral/usbvideo.sys unpack004/win7_64bit/ksthunk.sys unpack004/win7_64bit/usbvideo.sys unpack008/win10_64bit/ksthunk.sys unpack001/win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/ksthunk.sys unpack001/win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.sys unpack009/usbvideo.inf_x86_neutral/usbvideo.sys unpack001/win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/ksthunk.sys unpack001/win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/usbvideo.sys
File Explorer
-
5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a.zip 3.5MB
-
AMCap.exe.exe 632KB
-
USB /usb .txt722B
-
USB /win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit.rar.rar 139KB
-
win10_64bit/ksthunk.sys.sys 28KB
-
win10_64bit/usbvideo.inf20KB
-
win10_64bit/usbvideo.sys.sys 293KB
-
USB /win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx.docx 172KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx.docx 315KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_32bit.zip.zip 72KB
-
usbvideo.inf_x86_neutral/usbvideo.inf14KB
-
usbvideo.inf_x86_neutral/usbvideo.sys.sys 142KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit.rar.rar 85KB
-
win7_64bit/ksthunk.sys.sys 20KB
-
win7_64bit/usbvideo.inf14KB
-
win7_64bit/usbvideo.sys.sys 181KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/².docx.docx 172KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC.rar.rar 270KB
-
CDC驱动/WIN7安装CDC驱动方法.pdf.pdf 279KB
-
CDC驱动/usbser_32.inf3KB
-
CDC驱动/usbser_64.inf3KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/WIN7װCDC.pdf.pdf 279KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_32.inf3KB
-
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_64.inf3KB
-
usb .txt722B
-
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit.rar.rar 139KB
-
win10_64bit/ksthunk.sys.sys 28KB
-
win10_64bit/usbvideo.inf20KB
-
win10_64bit/usbvideo.sys.sys 293KB
-
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/ksthunk.sys.sys 28KB
-
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.inf20KB
-
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.sys.sys 293KB
-
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx.docx 172KB
-
win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx.docx 315KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.inf14KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.sys.sys 142KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_32bit.zip.zip 72KB
-
usbvideo.inf_x86_neutral/usbvideo.inf14KB
-
usbvideo.inf_x86_neutral/usbvideo.sys.sys 142KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit.rar.rar 85KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/ksthunk.sys.sys 20KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/usbvideo.inf14KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/usbvideo.sys.sys 181KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/².docx.docx 172KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC.rar.rar 270KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/WIN7װCDC.pdf.pdf 279KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_32.inf3KB
-
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_64.inf3KB
AMCap.exe
- IMPHASH 5d4b8f8ed2816fdabae68fc26095ed5c
- SHA256 ef9717b44bfd73a4805be6933e75a56eafa69001ccdcbd5ddc0783bb25011f08
- MD5 c295f6e905ca3dd7a6a40d7a0d55c903
- SHA1 52c698bae0f12f91547b8c251b5f6932709badef
- SHA512 e9f7f578abfe028b4bf86e91727e138450a340abaebbc93571efa962d089a7b693486f754e193572bc26c2424b61672107bf27da87ac9cc42c1520b3330e94d7
- SSDEEP 12288:+rX7x+Ibz29ZoKMzjGFE2NQHrNtBFvTaB58nfd18sW:y4I2nE22j85efd1L
- TLSH T13ED45C2237D1C076C17234724B5AA3B526AFB87149765B0B7BD40B3D2F746B29E2831E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
663552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Cap软件\Amcap\内部测试用\修改版\2010.07.07-AMCap v3.0.9 source code\Release_Unicode\amcap(3.0.9).pdb
winmm
timeGetTime
olepro32
ord250
kernel32
GetFileSizeEx
GetFileTime
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentDirectoryW
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapReAlloc
HeapSize
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameA
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
SetFileTime
LocalFileTimeToFileTime
IsValidCodePage
GetTimeZoneInformation
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
FileTimeToLocalFileTime
SetErrorMode
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetModuleHandleA
CreateEventW
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GlobalFlags
SystemTimeToFileTime
FileTimeToSystemTime
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
lstrlenA
lstrcmpA
GetAtomNameW
GlobalGetAtomNameW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadLocale
GetStringTypeExW
DeleteFileW
MoveFileW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
SetLastError
CopyFileW
FormatMessageW
LocalFree
MulDiv
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GlobalSize
GetFileAttributesW
CreateDirectoryW
WriteFile
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
RaiseException
GetLastError
GetModuleFileNameW
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
Sleep
GetCurrentProcessId
WriteProfileStringW
CreateFileW
GetSystemTimeAsFileTime
GetFileSize
CloseHandle
WideCharToMultiByte
GetSystemDirectoryW
LoadLibraryW
lstrlenW
GetVersionExW
lstrcpyW
GetProfileStringW
GetProfileIntW
GetModuleHandleW
GetProcAddress
lstrcpynW
lstrcatW
RtlUnwind
ExitProcess
CreateFileA
SetFileAttributesW
SetEnvironmentVariableA
user32
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
CopyRect
PtInRect
SetWindowPlacement
GetDlgCtrlID
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetFocus
IsWindowEnabled
GetParent
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetWindowTextW
GetSysColor
CharNextW
SendDlgItemMessageW
EnableWindow
GetDlgItem
SetScrollInfo
RegisterHotKey
SetMenu
UnregisterHotKey
LoadMenuW
GetSysColorBrush
GetScrollInfo
SetScrollPos
ScrollWindow
GetDlgItemInt
CheckDlgButton
GetDlgItemTextW
IsDlgButtonChecked
EndDialog
DialogBoxParamW
SetClassLongW
GetClassNameW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
IsChild
WinHelpW
GetMenuItemCount
wsprintfW
RemoveMenu
AppendMenuW
InvalidateRect
SetTimer
UpdateWindow
MessageBoxW
IsWindow
KillTimer
DestroyWindow
CreateDialogParamW
SendMessageW
SetFocus
GetWindowRect
GetClientRect
ClientToScreen
SetWindowPos
EnableMenuItem
CheckMenuItem
GetMenu
GetSubMenu
PostQuitMessage
GetAsyncKeyState
PostMessageW
BeginPaint
GetWindowThreadProcessId
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetNextDlgTabItem
CreateDialogIndirectParamW
GetActiveWindow
GetDesktopWindow
InflateRect
GetMenuItemInfoW
SystemParametersInfoW
ValidateRect
GetCursorPos
GetMessageW
FillRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetWindowDC
UnregisterClassW
DestroyIcon
GetDialogBaseUnits
SetRectEmpty
SetCursor
ShowOwnedPopups
DeleteMenu
BringWindowToTop
CreatePopupMenu
SetCapture
LockWindowUpdate
GetDCEx
UnionRect
SetParent
GetSystemMenu
IsRectEmpty
MapVirtualKeyW
GetKeyNameTextW
WindowFromPoint
SetRect
EndPaint
SetDlgItemTextW
SendDlgItemMessageA
RegisterWindowMessageW
CharUpperW
CheckRadioButton
SetDlgItemInt
IsDialogMessageW
ScrollWindowEx
GetSystemMetrics
MoveWindow
DefWindowProcW
PeekMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
WaitMessage
LoadAcceleratorsW
LoadStringW
LoadCursorW
LoadIconW
RegisterClassW
GetDC
ReleaseDC
CreateWindowExW
GetWindowLongW
SetWindowLongW
ShowWindow
SetWindowTextW
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
ReleaseCapture
GetScrollPos
InsertMenuItemW
DestroyMenu
gdi32
CreateBitmap
CreateFontIndirectW
GetTextExtentPoint32W
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocW
PtVisible
RectVisible
GetObjectW
CreateDCW
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateHatchBrush
GetCharWidthW
StretchDIBits
CreateCompatibleBitmap
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
GetBkColor
GetClipBox
TextOutW
GetDCOrgEx
CopyMetaFileW
GetDeviceCaps
SetBkColor
SetTextColor
ExtTextOutW
PatBlt
CreateSolidBrush
CreateFontW
StretchBlt
CreateCompatibleDC
CreateDIBitmap
BitBlt
DeleteObject
DeleteDC
GetStockObject
GetTextMetricsW
Escape
SelectObject
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
comdlg32
GetOpenFileNameW
GetFileTitleW
advapi32
RegSetValueExW
RegEnumKeyW
RegQueryValueW
RegCreateKeyW
RegOpenKeyW
RegSetValueW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
shell32
SHBrowseForFolderW
SHGetFileInfoW
ExtractIconW
DragFinish
DragQueryFileW
SHGetPathFromIDListW
ole32
CoTreatAsClass
ReleaseStgMedium
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
GetRunningObjectTable
CreateItemMoniker
CreateBindCtx
MkParseDisplayName
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
OleDuplicateData
CoDisconnectObject
StringFromGUID2
CLSIDFromString
StringFromCLSID
oleaut32
SafeArrayCopy
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SysFreeString
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VarUI4FromStr
comctl32
CreateStatusWindowW
shlwapi
PathRemoveExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
gdiplus
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateBitmapFromGdiDib
GdipDrawImageRectI
GdipCloneImage
GdipDisposeImage
GdipSaveImageToStream
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDrawImageRect
GdipDeleteGraphics
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipFree
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
Name
.text
Size
479KB
Virtual Size
478KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
�� ˣu4
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=149, productName=VS2008 build 21022, version=21022,
count=151, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=8, id=150, version=20413,
count=31, id=123, productName=VS2005 build 50727, version=50727,
count=558, id=1, productName=Unmarked objects,
count=1, id=28, version=9178,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=136, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 build 21022, version=21022,
USB /usb .txt
- SHA256 19f705d34c98dc384790e28dabf28f063ae50ab5e995a93033a773d4203453ff
- MD5 9e3af212a6bb379f7067b90e7d475797
- SHA1 635b111673e18fbbc680490b050f7edac804a594
- SHA512 ae287120469b21bc18ac7d23affd17a5d27e1d33922f67756a9dba4c54e38d2090b29094185cbee8d762a7ee73ce8c3533a96335829636f97b18fe3fc98571bc
- TLSH T13901DCEE011B4C838BBB3402B32E3059343728C7AEF0E6C2C09064B4336A625C88313F
- MD5 SHA1 SHA512 TLSH
USB /win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit.rar
- SHA256 1fbde730431f4663813947a2e4135d049574d6a8d25bd1249bc2f529a1fe804f
- MD5 7a30b2a086fb8a39d631cd28461786b0
- SHA1 8eede2f14f892855e03b1144332d24be3c729b52
- SHA512 359b047867ff2fc31a62cf6bad1bf16610b05aa9e56c1e276ebd2f363c639af634a285d7aaacbed320bc4b8a39eabf4faa846e48a317b8c215a97359351db23e
- SSDEEP 3072:w4QxTJ8s8l3bHReScetzENEJoVwy+HgRSnKGPo:VQP8s8lrHReScgzEN88vySijo
- TLSH T1EBE312751EB55B13A403192B25420DA99FF8D7FDB608CC3A87111921B2ED90FBBFB122
- MD5 SHA1 SHA512 SSDEEP TLSH
win10_64bit/ksthunk.sys
- IMPHASH 5797829ee7a0e7fc90fa9e97aba6d6b9
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
45216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ksthunk.pdb
ntoskrnl.exe
KeInitializeEvent
IofCompleteRequest
KeWaitForSingleObject
PoStartNextPowerIrp
KeInitializeMutex
RtlInitUnicodeString
KeInitializeSpinLock
IoOpenDeviceRegistryKey
_purecall
RtlQueryRegistryValues
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
ZwClose
__C_specific_handler
IoCreateDevice
_wcsnicmp
IoIs32bitProcess
ProbeForRead
MmUnlockPages
IoCancelIrp
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
ProbeForWrite
IoFreeMdl
IoAllocateIrp
MmMapLockedPagesSpecifyCache
ExRaiseStatus
IoReleaseCancelSpinLock
ExAllocatePoolWithQuotaTag
IofCallDriver
KeSetEvent
KeReleaseSpinLock
IoAttachDeviceToDeviceStack
IoDeleteDevice
PoCallDriver
IoDetachDevice
KeAcquireSpinLockRaiseToDpc
ExFreePool
IoAllocateDriverObjectExtension
KeReleaseMutex
IoGetDriverObjectExtension
IoIsInitiator32bitProcess
ks.sys
?NonDelegatedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KsSynchronousIoControlDevice
??0CBaseUnknown@@QEAA@PEAUIUnknown@@@Z
??1CBaseUnknown@@UEAA@XZ
?NonDelegatedAddRef@CBaseUnknown@@UEAAKXZ
?NonDelegatedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedAddRef@CBaseUnknown@@UEAAKXZ
?IndirectedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KoCreateInstance
KsPropertyHandler
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
257B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=5, id=260, version=26213,
count=4, id=259, version=26213,
count=7, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
win10_64bit/usbvideo.inf
- SHA256 acef3af76d65f701660068d678daec43453fe44ec75367986ea938b654e28f8a
- MD5 70fbcbefabd3adc0ea26e43d460e221f
- SHA1 e5ec323c8ca3dd2038c18af275e41314338cbfca
- SHA512 a5ee48e1e4a05c5741160c0095d9343c1059e0099d95f3db8df0c103a2006020b00b042bdd2e413fbb4ad9c1833f97b9fcede8e68a7d2bd3a3985d7e422c676b
- SSDEEP 192:hhqPopqgZyAoLngrs47EbSYM7nv3ZC3/kLBxIBkBdBtnBLFB4k5OnU1V/x52a5vk:So0XgrECBOBkBdBtnBLFB4k5OnCfYCe
- TLSH T14692F511B7F80218F2F76B94AAF9857B9A76BC62582CCA5E00D4474E19F1F018C61F77
- MD5 SHA1 SHA512 SSDEEP TLSH
win10_64bit/usbvideo.sys
- IMPHASH e42cbb439cd35957def57f7970253138
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
83:78:5c:7d:84:24:28:a1:63:f9:c1:19:be:0d:8b:72:c1:58:28:9d:94:7c:67:ff:bd:67:8d:cb:7e:8d:f5:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 16, 2020
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:D9DE-E39A-43FE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2d:2e:4d:41:ca:63:65:33:a0:00:00:00:00:01:2d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
295312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usbvideo.pdb
ntoskrnl.exe
KeClearEvent
IofCompleteRequest
KeResetEvent
RtlFreeUnicodeString
IoOpenDeviceInterfaceRegistryKey
RtlQueryRegistryValues
IoCsqInsertIrp
IoGetDeviceInterfaceAlias
RtlCompareMemory
IoFreeIrp
IoSetCompletionRoutineEx
IoGetAttachedDeviceReference
ZwOpenKey
__C_specific_handler
KeWaitForMultipleObjects
PsCreateSystemThread
ObReferenceObjectByHandle
KeSetPriorityThread
PsTerminateSystemThread
IoCsqRemoveIrp
IoCsqRemoveNextIrp
ExInterlockedInsertTailList
KeInitializeMutex
IoBuildDeviceIoControlRequest
PoRequestPowerIrp
IoCancelIrp
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
IoWMIRegistrationControl
MmGetSystemRoutineAddress
ZwSetValueKey
ZwClose
IoQueueWorkItem
KeInitializeEvent
ZwQueryValueKey
IoFreeWorkItem
IoCsqInitialize
IoGetDeviceProperty
KeInitializeSemaphore
IoForwardIrpSynchronously
IoInitializeRemoveLockEx
IoOpenDeviceRegistryKey
RtlInitUnicodeString
IoAllocateWorkItem
KeDelayExecutionThread
IoAcquireRemoveLockEx
IoInitializeIrp
KeWaitForSingleObject
ExFreePoolWithTag
IofCallDriver
ExInterlockedRemoveHeadList
ExAllocatePoolWithTag
IoAllocateIrp
KeReleaseSemaphore
KeSetEvent
KeReleaseSpinLock
KeReleaseMutex
IoBuildSynchronousFsdRequest
KeInitializeSpinLock
KeReadStateSemaphore
ExInterlockedInsertHeadList
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
ExUuidCreate
EtwSetInformation
EtwUnregister
EtwRegister
RtlCompareUnicodeStrings
MmIsDriverVerifying
DbgPrintEx
RtlGetVersion
_vsnprintf
memcmp
hal
KeQueryPerformanceCounter
ks.sys
KsUnregisterWorker
KsGetObjectFromFileObject
KsDefaultAddEventHandler
KsReleaseControl
KsGetPinFromIrp
KsAcquireControl
KsRemoveItemFromObjectBag
KsGenerateEvents
KsMergeAutomationTables
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinRegisterPowerCallbacks
_KsEdit
KsGetFilterFromIrp
KsFilterFactoryGetSymbolicLink
KsGetParent
KsCreateFilterFactory
KsGetDevice
KsGenerateEvent
KsInitializeDriver
KsReleaseDevice
KsAcquireDevice
KsGetFirstChild
KsAddItemToObjectBag
KsPinAcquireProcessingMutex
KsStreamPointerClone
KsPinGetReferenceClockInterface
KsPinReleaseProcessingMutex
KsStreamPointerUnlock
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsRegisterCountedWorker
KsPinGetParentFilter
KsIncrementCountedWorker
KsStreamPointerDelete
KsStreamPointerAdvanceOffsetsAndUnlock
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_ParseDescriptors
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.guids
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
497B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=117, id=1, productName=Unmarked objects,
count=9, id=257, version=26213,
count=6, id=260, version=26213,
count=4, id=259, version=26213,
count=34, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
USB /win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
- SHA256 514f606abd07575d2b81d11b1c5f27c831d12754f79281b72b65e31835420873
- MD5 4746583426c1bf63406303c09905ce7f
- SHA1 dc886388c0951232b3f567e2975ae3957e6f5936
- SHA512 1f3c16fb7f124277153acfec295123274aa68d136bfba60b6d968c915ba8918b54ec6e1e604d388adcf6c34bcc7264a6344748d6e552bac4f7420623a834ef33
- SSDEEP 6144:ziUxyfF42u8hFuzwP1FKuCaumGykQiWGI8iZIVPZE0Mbg8FvSeDVEdbb+4l:fxqu/sPzumGykQsOsFMbg8oeBEdbb+4l
- TLSH T17364F0B3D0B43033C8B6CE7C5C4927493D3A5CA950BEAA65DAC97D8D262F1ED294344E
- MD5 SHA1 SHA512 SSDEEP TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_32bit.zip
- SHA256 5643e83815da05ab66155c66bf8596e62acccf5d628b022c488e1fb9ed166a61
- MD5 05aedc2147eb34b222e7b0cafa5a0017
- SHA1 90b15f73889a36076b25a8d22434013e0e90ee64
- SHA512 5ac1de068b63643c87f1e51995e284d47a8a9363bd8d4b02509e06869df2afdb8ff651f8e8a3ccd6a580cb18952129f263a75d1d0b9d5f72874977f9cea4df94
- SSDEEP 1536:O5JadUwz2qROJ+GetY2qmZRz4F/8S0D3YCyD:O5J5wvOeegz4F0SDD
- TLSH T1B173125715616822FA44CC7BB369B4CCE34CDB44B6EC9AA9CF7139010ECD5DF098A2E6
- MD5 SHA1 SHA512 SSDEEP TLSH
usbvideo.inf_x86_neutral/usbvideo.inf
- SHA256 5737e125e2070b8c0fd4b40b463c516e94f2fde12a110c699d0c008f00231be6
- MD5 f16951ad9648dd4793de5e85698f4171
- SHA1 ced13f7d7bc32324c2fdeb312c1a47c60b181b52
- SHA512 7303f6c8c4a4ef704ed3abc9a6b35ddbf314ecdc5103c3c9287d7b051d0d775bfee5c8c4bbbfc9202de64f25c6d4f997a0437603c7ce3e54cc8229e88c2c477a
- SSDEEP 192:eIMlPZyAoLngrr48EcSYM78v3ZCwv3ZClkS1h/b52a5v15C5as5s555P5uqKC/m:vMagryvdYC+
- TLSH T13D62E212B7F80218F1F76BD0AAF9457B5676BC62682CCA5E00D4478E29F1E414C61FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
usbvideo.inf_x86_neutral/usbvideo.sys
- IMPHASH 2762629f24d83f8c2344a15421deac7a
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
135476
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
usbvideo.pdb
ntoskrnl.exe
IoReleaseRemoveLockEx
PoRequestPowerIrp
IoReleaseRemoveLockAndWaitEx
KeClearEvent
KeQuerySystemTime
_vsnprintf
IoCsqRemoveNextIrp
ExfInterlockedRemoveHeadList
KeResetEvent
IoCsqInsertIrp
PsTerminateSystemThread
KeWaitForMultipleObjects
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ExfInterlockedInsertHeadList
IoBuildDeviceIoControlRequest
IoCancelIrp
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIWriteEvent
ExFreePool
ZwSetValueKey
KeInitializeEvent
IoAllocateWorkItem
IoAcquireRemoveLockEx
IoQueueWorkItem
IoFreeWorkItem
IoOpenDeviceRegistryKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
KeInitializeSemaphore
IoInitializeRemoveLockEx
IoCsqInitialize
KeInitializeMutex
IoAllocateIrp
IoFreeIrp
KeReleaseMutex
InterlockedIncrement
IofCallDriver
IoInitializeIrp
InterlockedDecrement
KeSetEvent
KeWaitForSingleObject
KeReadStateSemaphore
KeReleaseSemaphore
memset
memcpy
IoCsqRemoveIrp
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExFreePoolWithTag
ObfDereferenceObject
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsStreamPointerAdvanceOffsetsAndUnlock
KsDefaultAddEventHandler
KsGetObjectFromFileObject
KsGetPinFromIrp
KsRemoveItemFromObjectBag
KsMergeAutomationTables
KsPinGetConnectedFilterInterface
_KsEdit
KsPinGetAvailableByteCount
KsGetFilterFromIrp
KsCreateFilterFactory
KsGetDevice
KsGetParent
KsGenerateEvent
KsInitializeDriver
KsFilterGetFirstChildPin
KsPinGetNextSiblingPin
KsAcquireDevice
KsReleaseDevice
KsReleaseControl
KsAcquireControl
KsGetNextSibling
KsGetFirstChild
KsAddItemToObjectBag
KsRegisterCountedWorker
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerClone
KsStreamPointerUnlock
KsIncrementCountedWorker
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinAcquireProcessingMutex
KsPinReleaseProcessingMutex
KsStreamPointerDelete
KsUnregisterWorker
usbd.sys
USBD_ParseDescriptors
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.guids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit.rar
- SHA256 22f585b04edccae77a28e657d1692ee99b8c83056ccaffe423ff543d61dd9fd2
- MD5 8b1bb90e6523ea5c2056c563d6a08e74
- SHA1 173aeba1d6f67f9909c426dcddd9814917a700c9
- SHA512 1c06ad37ed105552a78e349900c5593ba071c739f1ab7ff47eab2b84d97521d3e6f5305d75ef4ec06a5468bfd72dbe7cef3bb12d4e49120e728238adb0f8ebe2
- SSDEEP 1536:3WA0Jzpy6Yys4RIWXJqmK2CE1wB1fIoZlaRn9wvs/u5vzKQIMiRtF2PqV97OUUbs:3h0JzpeMILvzfLXalmsm5vzKuBYl4W5
- TLSH T1778312DF5D4BEDFF94B889020B925844C1EDB7E7A0D39A75819938254E2E67887F1033
- MD5 SHA1 SHA512 SSDEEP TLSH
win7_64bit/ksthunk.sys
- IMPHASH 16c82c898d7334a504f0180ac5bebb34
- SHA256 866a23e69b32a78d378d6cb3b3da3695ffdff0fec3c9f68c8c3f988df417044b
- MD5 6869281e78cb31a43e969f06b57347c4
- SHA1 a490c8f4c501652cb732b63620bebe261f457117
- SHA512 f87e4958dcb67e79439264fd0c812a8e493f150ab1022f6f9cb2fc881eeb1b4b3e7cd6a8ed65b64d8fdce6745fc87468394abb254e55946fe2d542901093a4b6
- SSDEEP 384:8PF5txvHHgXvrpMEiRz0Lf4a0HMJj6h2NIxxxV5EK7V6v0JWtwXwW:/ve0LQaCMJD2Es4v0H
- TLSH T14892394AA2E108BDF57A813EC3C72397E7B1B446631107EF1264565E2E2BFD49D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
17740
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ksthunk.pdb
ntoskrnl.exe
PoCallDriver
IoCreateDevice
IofCallDriver
KeAcquireSpinLockRaiseToDpc
ExAllocatePoolWithTag
KeInitializeMutex
RtlQueryRegistryValues
ZwClose
_purecall
IoOpenDeviceRegistryKey
ProbeForRead
_wcsnicmp
IoIs32bitProcess
IoAttachDeviceToDeviceStack
ExRaiseStatus
ProbeForWrite
IoFreeMdl
IoCancelIrp
MmMapLockedPagesSpecifyCache
IoFreeIrp
MmProbeAndLockPages
IoAllocateIrp
MmUnlockPages
IoReleaseCancelSpinLock
IoAllocateMdl
ExAllocatePoolWithQuotaTag
KeBugCheckEx
KeWaitForSingleObject
IofCompleteRequest
PoStartNextPowerIrp
IoDetachDevice
KeReleaseSpinLock
KeInitializeEvent
KeSetEvent
IoDeleteDevice
IoGetDriverObjectExtension
ExFreePool
KeReleaseMutex
IoAllocateDriverObjectExtension
__C_specific_handler
ks.sys
KsPropertyHandler
KsSynchronousIoControlDevice
??0CBaseUnknown@@QEAA@PEAUIUnknown@@@Z
??1CBaseUnknown@@UEAA@XZ
?NonDelegatedAddRef@CBaseUnknown@@UEAAKXZ
?NonDelegatedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedAddRef@CBaseUnknown@@UEAAKXZ
?IndirectedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KoCreateInstance
?NonDelegatedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
640B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
250B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
win7_64bit/usbvideo.inf
- SHA256 bb4ba1c40c7fa1a85e3ff43bb7124b73b4353d21ee2c2b51492255747b9ade05
- MD5 15a8ae7c6aa871947bee432181729bbb
- SHA1 5f7b314facef265eb2cc81382111e9a9fb01ded7
- SHA512 92ab2a85a58d88d7478c550ad332323f23b94c3d2a502a83cb47697aea4fcc62f3679dfd7836f18cd7f9f9330f76f2bbfa6bdbf8cc66866f48d0ac84af51caf9
- SSDEEP 192:jsolPZyAoLngrr48EcSYM78v3ZCwv3ZClkS1h/b52a5v15C5as5s555P5uqKC/m:goagryvdYC+
- TLSH T17162F112B7F80218F1F76BD0AAF9857B5676BC62682CCA5E00D4478E29F1E414C61FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
win7_64bit/usbvideo.sys
- IMPHASH f065491fdd06d157765edb60b1799a42
- SHA256 6d3de5bd3ef3a76e997e5baf900c51d25308f5a9682d1f62017f577a24095b90
- MD5 1f775da4cf1a3a1834207e975a72e9d7
- SHA1 2026a1fcf8fa23654707d12a1e285a68d21aa9ff
- SHA512 23567c1cd17ef7f6a16e135717e038db2a631edba99ca8e4eb7c6c17854b8b34cde44527ef1c492e650770868d74b0d2044e7ed73a6802989252af23e854ceb5
- SSDEEP 3072:8wrTLwJkzq7in2jK8hMI4bYxYAOtKxSbLhfjs9L/xkgOs:1r/Aig+5ZbYxYA+KxoF4ZR
- TLSH T127044C05E29564F9E8BBC1789EE6535BFBB1380E172496DB1170CA547F03AE4AB7C308
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
180064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usbvideo.pdb
ntoskrnl.exe
IoCancelIrp
IoReleaseRemoveLockAndWaitEx
IoSetCompletionRoutineEx
_vsnprintf
IoCsqRemoveIrp
IoCsqInsertIrp
PoRequestPowerIrp
PsTerminateSystemThread
IoCsqRemoveNextIrp
ObReferenceObjectByHandle
ObfDereferenceObject
KeWaitForMultipleObjects
KeBugCheckEx
IoReleaseRemoveLockEx
KeResetEvent
IoBuildDeviceIoControlRequest
KeClearEvent
RtlCompareMemory
IofCompleteRequest
ExFreePool
MmGetSystemRoutineAddress
IoWMIWriteEvent
IoWMIRegistrationControl
IoQueueWorkItem
IoOpenDeviceRegistryKey
IoInitializeRemoveLockEx
KeInitializeSemaphore
ZwClose
IoAllocateWorkItem
IoCsqInitialize
ZwQueryValueKey
ZwSetValueKey
KeInitializeEvent
IoFreeWorkItem
RtlInitUnicodeString
IoAcquireRemoveLockEx
KeAcquireSpinLockRaiseToDpc
IofCallDriver
IoInitializeIrp
ExInterlockedRemoveHeadList
IoAllocateIrp
KeReadStateSemaphore
KeReleaseSemaphore
IoFreeIrp
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedInsertHeadList
KeReleaseMutex
KeSetEvent
KeReleaseSpinLock
KeInitializeMutex
ExFreePoolWithTag
PsCreateSystemThread
ExAllocatePoolWithTag
ks.sys
KsStreamPointerAdvanceOffsetsAndUnlock
KsDefaultAddEventHandler
KsGetObjectFromFileObject
KsGetPinFromIrp
KsRemoveItemFromObjectBag
KsMergeAutomationTables
KsGetFilterFromIrp
KsPinGetAvailableByteCount
_KsEdit
KsPinGetConnectedFilterInterface
KsCreateFilterFactory
KsGetDevice
KsGetParent
KsGenerateEvent
KsInitializeDriver
KsAcquireDevice
KsReleaseDevice
KsAcquireControl
KsGetFirstChild
KsGetNextSibling
KsFilterGetFirstChildPin
KsPinGetNextSiblingPin
KsReleaseControl
KsIncrementCountedWorker
KsAddItemToObjectBag
KsPinGetReferenceClockInterface
KsStreamPointerDelete
KsRegisterCountedWorker
KsStreamPointerClone
KsPinReleaseProcessingMutex
KsPinAcquireProcessingMutex
KsPinGetLeadingEdgeStreamPointer
KsPinGetParentFilter
KsStreamPointerUnlock
KsDecrementCountedWorker
KsUnregisterWorker
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_ParseDescriptors
Name
.text
Size
155KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.guids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1006B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=93, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/².docx
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC.rar
- SHA256 b6760938530a79263ab91c2d99ecdac289438f251dac3f454252b2f20b4ccda4
- MD5 3307a01a079f794b19c086924ccd50e3
- SHA1 1e4cf81c6694cdb9808f50021cb05bfae1468333
- SHA512 0d5da8f725f4b4e95e48814b367330cb742fa3ed509d49e6592a9fdfc4ea65be749cba644c27aff46dc7ac939809f68fa6d79a4c300de3dee935ec67cf957728
- SSDEEP 6144:phylNjMmR1ZPeEAFfjY4xW8St4farGb9goXbNlupah9B34QaY/z5NG:pUlKmFX4xWafFXXZApah5l5s
- TLSH T14944232E7ED06E046CF4DF138E9DB99AC0361652BE780ED130F89D68695F774612290B
- MD5 SHA1 SHA512 SSDEEP TLSH
CDC驱动/WIN7安装CDC驱动方法.pdf
- SHA256 ee614655017c21b50a3d7fbf8a17a9130bbcfc041de7a47530c186cf5f47ca37
- MD5 4bdc028e5e5c960fef68bac1fefffb2d
- SHA1 950867b708c3c93932a33602530cb75b73c7e49d
- SHA512 691a887859aeca9aee54b0e99245e7aee8403145df15f5299b9048da4c9f0f8f5fe6dba652d1bb68ae7f6205354d8d0be2efe2a7b2928362377ef2de265478b3
- SSDEEP 6144:NEbL55EFUBxeNVv4yP20ydQ671aQt/wkezVuWmmZ/xhiZAeT+w:NEbL55lxeT5P20GQ671QkezVuWmmZXij
- TLSH T12854223C9D32420AD95502F95AD96D0DB80EF1BFBCF9C816CACD868D8005997E75B3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
CDC驱动/usbser_32.inf
- SHA256 0ba297fe46f87cc294b9f528db75d431489aee276a60cc0fd19a2904487b0652
- MD5 54b7391146bdf5dd617d15879e837dca
- SHA1 1c9b687051d938379fc7e5d0e6089dc858bd0b02
- SHA512 b581d959ce6bb84347c482cca02dbce53c92aa05b7747aab400188165783962d6f590c69d0868816d92d271938a5a5e87447ee37d80ebe6ccf27bd8fde05bbca
- TLSH T11961CC0485830C38795333D5664728E22609614350A565C97FDE79C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH
CDC驱动/usbser_64.inf
- SHA256 36ec2227e77885f8b1e980880ee84bc0415d32c5f26f8f387e02dbed8306a1dc
- MD5 c7563ef3f707f7c221a4fd1d6b0e8845
- SHA1 712430413ccb94305e34a30b6714b20cd89a473b
- SHA512 a9f5891e0325067cf27423a9f3dd09da67faebd60ddf40df931b3f8c5cd263b41cc5be3f71afeef09ea09730d2aa608965e16236b90032e9027163b4ab8ac050
- TLSH T15661CB0485830C387A5333D5674728E22609614350A565897FEEB9C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/WIN7װCDC.pdf
- SHA256 ee614655017c21b50a3d7fbf8a17a9130bbcfc041de7a47530c186cf5f47ca37
- MD5 4bdc028e5e5c960fef68bac1fefffb2d
- SHA1 950867b708c3c93932a33602530cb75b73c7e49d
- SHA512 691a887859aeca9aee54b0e99245e7aee8403145df15f5299b9048da4c9f0f8f5fe6dba652d1bb68ae7f6205354d8d0be2efe2a7b2928362377ef2de265478b3
- SSDEEP 6144:NEbL55EFUBxeNVv4yP20ydQ671aQt/wkezVuWmmZ/xhiZAeT+w:NEbL55lxeT5P20GQ671QkezVuWmmZXij
- TLSH T12854223C9D32420AD95502F95AD96D0DB80EF1BFBCF9C816CACD868D8005997E75B3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_32.inf
- SHA256 0ba297fe46f87cc294b9f528db75d431489aee276a60cc0fd19a2904487b0652
- MD5 54b7391146bdf5dd617d15879e837dca
- SHA1 1c9b687051d938379fc7e5d0e6089dc858bd0b02
- SHA512 b581d959ce6bb84347c482cca02dbce53c92aa05b7747aab400188165783962d6f590c69d0868816d92d271938a5a5e87447ee37d80ebe6ccf27bd8fde05bbca
- TLSH T11961CC0485830C38795333D5664728E22609614350A565C97FDE79C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH
USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_64.inf
- SHA256 36ec2227e77885f8b1e980880ee84bc0415d32c5f26f8f387e02dbed8306a1dc
- MD5 c7563ef3f707f7c221a4fd1d6b0e8845
- SHA1 712430413ccb94305e34a30b6714b20cd89a473b
- SHA512 a9f5891e0325067cf27423a9f3dd09da67faebd60ddf40df931b3f8c5cd263b41cc5be3f71afeef09ea09730d2aa608965e16236b90032e9027163b4ab8ac050
- TLSH T15661CB0485830C387A5333D5674728E22609614350A565897FEEB9C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH
usb .txt
- SHA256 19f705d34c98dc384790e28dabf28f063ae50ab5e995a93033a773d4203453ff
- MD5 9e3af212a6bb379f7067b90e7d475797
- SHA1 635b111673e18fbbc680490b050f7edac804a594
- SHA512 ae287120469b21bc18ac7d23affd17a5d27e1d33922f67756a9dba4c54e38d2090b29094185cbee8d762a7ee73ce8c3533a96335829636f97b18fe3fc98571bc
- TLSH T13901DCEE011B4C838BBB3402B32E3059343728C7AEF0E6C2C09064B4336A625C88313F
- MD5 SHA1 SHA512 TLSH
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit.rar
- SHA256 1fbde730431f4663813947a2e4135d049574d6a8d25bd1249bc2f529a1fe804f
- MD5 7a30b2a086fb8a39d631cd28461786b0
- SHA1 8eede2f14f892855e03b1144332d24be3c729b52
- SHA512 359b047867ff2fc31a62cf6bad1bf16610b05aa9e56c1e276ebd2f363c639af634a285d7aaacbed320bc4b8a39eabf4faa846e48a317b8c215a97359351db23e
- SSDEEP 3072:w4QxTJ8s8l3bHReScetzENEJoVwy+HgRSnKGPo:VQP8s8lrHReScgzEN88vySijo
- TLSH T1EBE312751EB55B13A403192B25420DA99FF8D7FDB608CC3A87111921B2ED90FBBFB122
- MD5 SHA1 SHA512 SSDEEP TLSH
win10_64bit/ksthunk.sys
- IMPHASH 5797829ee7a0e7fc90fa9e97aba6d6b9
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
45216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ksthunk.pdb
ntoskrnl.exe
KeInitializeEvent
IofCompleteRequest
KeWaitForSingleObject
PoStartNextPowerIrp
KeInitializeMutex
RtlInitUnicodeString
KeInitializeSpinLock
IoOpenDeviceRegistryKey
_purecall
RtlQueryRegistryValues
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
ZwClose
__C_specific_handler
IoCreateDevice
_wcsnicmp
IoIs32bitProcess
ProbeForRead
MmUnlockPages
IoCancelIrp
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
ProbeForWrite
IoFreeMdl
IoAllocateIrp
MmMapLockedPagesSpecifyCache
ExRaiseStatus
IoReleaseCancelSpinLock
ExAllocatePoolWithQuotaTag
IofCallDriver
KeSetEvent
KeReleaseSpinLock
IoAttachDeviceToDeviceStack
IoDeleteDevice
PoCallDriver
IoDetachDevice
KeAcquireSpinLockRaiseToDpc
ExFreePool
IoAllocateDriverObjectExtension
KeReleaseMutex
IoGetDriverObjectExtension
IoIsInitiator32bitProcess
ks.sys
?NonDelegatedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KsSynchronousIoControlDevice
??0CBaseUnknown@@QEAA@PEAUIUnknown@@@Z
??1CBaseUnknown@@UEAA@XZ
?NonDelegatedAddRef@CBaseUnknown@@UEAAKXZ
?NonDelegatedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedAddRef@CBaseUnknown@@UEAAKXZ
?IndirectedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KoCreateInstance
KsPropertyHandler
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
257B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=5, id=260, version=26213,
count=4, id=259, version=26213,
count=7, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
win10_64bit/usbvideo.inf
- SHA256 acef3af76d65f701660068d678daec43453fe44ec75367986ea938b654e28f8a
- MD5 70fbcbefabd3adc0ea26e43d460e221f
- SHA1 e5ec323c8ca3dd2038c18af275e41314338cbfca
- SHA512 a5ee48e1e4a05c5741160c0095d9343c1059e0099d95f3db8df0c103a2006020b00b042bdd2e413fbb4ad9c1833f97b9fcede8e68a7d2bd3a3985d7e422c676b
- SSDEEP 192:hhqPopqgZyAoLngrs47EbSYM7nv3ZC3/kLBxIBkBdBtnBLFB4k5OnU1V/x52a5vk:So0XgrECBOBkBdBtnBLFB4k5OnCfYCe
- TLSH T14692F511B7F80218F2F76B94AAF9857B9A76BC62582CCA5E00D4474E19F1F018C61F77
- MD5 SHA1 SHA512 SSDEEP TLSH
win10_64bit/usbvideo.sys
- IMPHASH e42cbb439cd35957def57f7970253138
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
83:78:5c:7d:84:24:28:a1:63:f9:c1:19:be:0d:8b:72:c1:58:28:9d:94:7c:67:ff:bd:67:8d:cb:7e:8d:f5:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 16, 2020
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:D9DE-E39A-43FE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2d:2e:4d:41:ca:63:65:33:a0:00:00:00:00:01:2d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
295312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usbvideo.pdb
ntoskrnl.exe
KeClearEvent
IofCompleteRequest
KeResetEvent
RtlFreeUnicodeString
IoOpenDeviceInterfaceRegistryKey
RtlQueryRegistryValues
IoCsqInsertIrp
IoGetDeviceInterfaceAlias
RtlCompareMemory
IoFreeIrp
IoSetCompletionRoutineEx
IoGetAttachedDeviceReference
ZwOpenKey
__C_specific_handler
KeWaitForMultipleObjects
PsCreateSystemThread
ObReferenceObjectByHandle
KeSetPriorityThread
PsTerminateSystemThread
IoCsqRemoveIrp
IoCsqRemoveNextIrp
ExInterlockedInsertTailList
KeInitializeMutex
IoBuildDeviceIoControlRequest
PoRequestPowerIrp
IoCancelIrp
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
IoWMIRegistrationControl
MmGetSystemRoutineAddress
ZwSetValueKey
ZwClose
IoQueueWorkItem
KeInitializeEvent
ZwQueryValueKey
IoFreeWorkItem
IoCsqInitialize
IoGetDeviceProperty
KeInitializeSemaphore
IoForwardIrpSynchronously
IoInitializeRemoveLockEx
IoOpenDeviceRegistryKey
RtlInitUnicodeString
IoAllocateWorkItem
KeDelayExecutionThread
IoAcquireRemoveLockEx
IoInitializeIrp
KeWaitForSingleObject
ExFreePoolWithTag
IofCallDriver
ExInterlockedRemoveHeadList
ExAllocatePoolWithTag
IoAllocateIrp
KeReleaseSemaphore
KeSetEvent
KeReleaseSpinLock
KeReleaseMutex
IoBuildSynchronousFsdRequest
KeInitializeSpinLock
KeReadStateSemaphore
ExInterlockedInsertHeadList
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
ExUuidCreate
EtwSetInformation
EtwUnregister
EtwRegister
RtlCompareUnicodeStrings
MmIsDriverVerifying
DbgPrintEx
RtlGetVersion
_vsnprintf
memcmp
hal
KeQueryPerformanceCounter
ks.sys
KsUnregisterWorker
KsGetObjectFromFileObject
KsDefaultAddEventHandler
KsReleaseControl
KsGetPinFromIrp
KsAcquireControl
KsRemoveItemFromObjectBag
KsGenerateEvents
KsMergeAutomationTables
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinRegisterPowerCallbacks
_KsEdit
KsGetFilterFromIrp
KsFilterFactoryGetSymbolicLink
KsGetParent
KsCreateFilterFactory
KsGetDevice
KsGenerateEvent
KsInitializeDriver
KsReleaseDevice
KsAcquireDevice
KsGetFirstChild
KsAddItemToObjectBag
KsPinAcquireProcessingMutex
KsStreamPointerClone
KsPinGetReferenceClockInterface
KsPinReleaseProcessingMutex
KsStreamPointerUnlock
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsRegisterCountedWorker
KsPinGetParentFilter
KsIncrementCountedWorker
KsStreamPointerDelete
KsStreamPointerAdvanceOffsetsAndUnlock
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_ParseDescriptors
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.guids
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
497B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=117, id=1, productName=Unmarked objects,
count=9, id=257, version=26213,
count=6, id=260, version=26213,
count=4, id=259, version=26213,
count=34, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/ksthunk.sys
- IMPHASH 5797829ee7a0e7fc90fa9e97aba6d6b9
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
45216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ksthunk.pdb
ntoskrnl.exe
KeInitializeEvent
IofCompleteRequest
KeWaitForSingleObject
PoStartNextPowerIrp
KeInitializeMutex
RtlInitUnicodeString
KeInitializeSpinLock
IoOpenDeviceRegistryKey
_purecall
RtlQueryRegistryValues
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
ZwClose
__C_specific_handler
IoCreateDevice
_wcsnicmp
IoIs32bitProcess
ProbeForRead
MmUnlockPages
IoCancelIrp
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
ProbeForWrite
IoFreeMdl
IoAllocateIrp
MmMapLockedPagesSpecifyCache
ExRaiseStatus
IoReleaseCancelSpinLock
ExAllocatePoolWithQuotaTag
IofCallDriver
KeSetEvent
KeReleaseSpinLock
IoAttachDeviceToDeviceStack
IoDeleteDevice
PoCallDriver
IoDetachDevice
KeAcquireSpinLockRaiseToDpc
ExFreePool
IoAllocateDriverObjectExtension
KeReleaseMutex
IoGetDriverObjectExtension
IoIsInitiator32bitProcess
ks.sys
?NonDelegatedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KsSynchronousIoControlDevice
??0CBaseUnknown@@QEAA@PEAUIUnknown@@@Z
??1CBaseUnknown@@UEAA@XZ
?NonDelegatedAddRef@CBaseUnknown@@UEAAKXZ
?NonDelegatedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedAddRef@CBaseUnknown@@UEAAKXZ
?IndirectedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KoCreateInstance
KsPropertyHandler
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
257B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=5, id=260, version=26213,
count=4, id=259, version=26213,
count=7, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.inf
- SHA256 acef3af76d65f701660068d678daec43453fe44ec75367986ea938b654e28f8a
- MD5 70fbcbefabd3adc0ea26e43d460e221f
- SHA1 e5ec323c8ca3dd2038c18af275e41314338cbfca
- SHA512 a5ee48e1e4a05c5741160c0095d9343c1059e0099d95f3db8df0c103a2006020b00b042bdd2e413fbb4ad9c1833f97b9fcede8e68a7d2bd3a3985d7e422c676b
- SSDEEP 192:hhqPopqgZyAoLngrs47EbSYM7nv3ZC3/kLBxIBkBdBtnBLFB4k5OnU1V/x52a5vk:So0XgrECBOBkBdBtnBLFB4k5OnCfYCe
- TLSH T14692F511B7F80218F2F76B94AAF9857B9A76BC62582CCA5E00D4474E19F1F018C61F77
- MD5 SHA1 SHA512 SSDEEP TLSH
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.sys
- IMPHASH e42cbb439cd35957def57f7970253138
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
83:78:5c:7d:84:24:28:a1:63:f9:c1:19:be:0d:8b:72:c1:58:28:9d:94:7c:67:ff:bd:67:8d:cb:7e:8d:f5:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 16, 2020
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:D9DE-E39A-43FE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2d:2e:4d:41:ca:63:65:33:a0:00:00:00:00:01:2d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
295312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usbvideo.pdb
ntoskrnl.exe
KeClearEvent
IofCompleteRequest
KeResetEvent
RtlFreeUnicodeString
IoOpenDeviceInterfaceRegistryKey
RtlQueryRegistryValues
IoCsqInsertIrp
IoGetDeviceInterfaceAlias
RtlCompareMemory
IoFreeIrp
IoSetCompletionRoutineEx
IoGetAttachedDeviceReference
ZwOpenKey
__C_specific_handler
KeWaitForMultipleObjects
PsCreateSystemThread
ObReferenceObjectByHandle
KeSetPriorityThread
PsTerminateSystemThread
IoCsqRemoveIrp
IoCsqRemoveNextIrp
ExInterlockedInsertTailList
KeInitializeMutex
IoBuildDeviceIoControlRequest
PoRequestPowerIrp
IoCancelIrp
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
IoWMIRegistrationControl
MmGetSystemRoutineAddress
ZwSetValueKey
ZwClose
IoQueueWorkItem
KeInitializeEvent
ZwQueryValueKey
IoFreeWorkItem
IoCsqInitialize
IoGetDeviceProperty
KeInitializeSemaphore
IoForwardIrpSynchronously
IoInitializeRemoveLockEx
IoOpenDeviceRegistryKey
RtlInitUnicodeString
IoAllocateWorkItem
KeDelayExecutionThread
IoAcquireRemoveLockEx
IoInitializeIrp
KeWaitForSingleObject
ExFreePoolWithTag
IofCallDriver
ExInterlockedRemoveHeadList
ExAllocatePoolWithTag
IoAllocateIrp
KeReleaseSemaphore
KeSetEvent
KeReleaseSpinLock
KeReleaseMutex
IoBuildSynchronousFsdRequest
KeInitializeSpinLock
KeReadStateSemaphore
ExInterlockedInsertHeadList
ObfDereferenceObject
KeAcquireSpinLockRaiseToDpc
PoRegisterPowerSettingCallback
EtwWriteTransfer
PoUnregisterPowerSettingCallback
ExUuidCreate
EtwSetInformation
EtwUnregister
EtwRegister
RtlCompareUnicodeStrings
MmIsDriverVerifying
DbgPrintEx
RtlGetVersion
_vsnprintf
memcmp
hal
KeQueryPerformanceCounter
ks.sys
KsUnregisterWorker
KsGetObjectFromFileObject
KsDefaultAddEventHandler
KsReleaseControl
KsGetPinFromIrp
KsAcquireControl
KsRemoveItemFromObjectBag
KsGenerateEvents
KsMergeAutomationTables
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinRegisterPowerCallbacks
_KsEdit
KsGetFilterFromIrp
KsFilterFactoryGetSymbolicLink
KsGetParent
KsCreateFilterFactory
KsGetDevice
KsGenerateEvent
KsInitializeDriver
KsReleaseDevice
KsAcquireDevice
KsGetFirstChild
KsAddItemToObjectBag
KsPinAcquireProcessingMutex
KsStreamPointerClone
KsPinGetReferenceClockInterface
KsPinReleaseProcessingMutex
KsStreamPointerUnlock
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsRegisterCountedWorker
KsPinGetParentFilter
KsIncrementCountedWorker
KsStreamPointerDelete
KsStreamPointerAdvanceOffsetsAndUnlock
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_ParseDescriptors
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.guids
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
497B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
GFIDS
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=117, id=1, productName=Unmarked objects,
count=9, id=257, version=26213,
count=6, id=260, version=26213,
count=4, id=259, version=26213,
count=34, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
- SHA256 514f606abd07575d2b81d11b1c5f27c831d12754f79281b72b65e31835420873
- MD5 4746583426c1bf63406303c09905ce7f
- SHA1 dc886388c0951232b3f567e2975ae3957e6f5936
- SHA512 1f3c16fb7f124277153acfec295123274aa68d136bfba60b6d968c915ba8918b54ec6e1e604d388adcf6c34bcc7264a6344748d6e552bac4f7420623a834ef33
- SSDEEP 6144:ziUxyfF42u8hFuzwP1FKuCaumGykQiWGI8iZIVPZE0Mbg8FvSeDVEdbb+4l:fxqu/sPzumGykQsOsFMbg8oeBEdbb+4l
- TLSH T17364F0B3D0B43033C8B6CE7C5C4927493D3A5CA950BEAA65DAC97D8D262F1ED294344E
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.inf
- SHA256 5737e125e2070b8c0fd4b40b463c516e94f2fde12a110c699d0c008f00231be6
- MD5 f16951ad9648dd4793de5e85698f4171
- SHA1 ced13f7d7bc32324c2fdeb312c1a47c60b181b52
- SHA512 7303f6c8c4a4ef704ed3abc9a6b35ddbf314ecdc5103c3c9287d7b051d0d775bfee5c8c4bbbfc9202de64f25c6d4f997a0437603c7ce3e54cc8229e88c2c477a
- SSDEEP 192:eIMlPZyAoLngrr48EcSYM78v3ZCwv3ZClkS1h/b52a5v15C5as5s555P5uqKC/m:vMagryvdYC+
- TLSH T13D62E212B7F80218F1F76BD0AAF9457B5676BC62682CCA5E00D4478E29F1E414C61FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.sys
- IMPHASH 2762629f24d83f8c2344a15421deac7a
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
135476
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
usbvideo.pdb
ntoskrnl.exe
IoReleaseRemoveLockEx
PoRequestPowerIrp
IoReleaseRemoveLockAndWaitEx
KeClearEvent
KeQuerySystemTime
_vsnprintf
IoCsqRemoveNextIrp
ExfInterlockedRemoveHeadList
KeResetEvent
IoCsqInsertIrp
PsTerminateSystemThread
KeWaitForMultipleObjects
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ExfInterlockedInsertHeadList
IoBuildDeviceIoControlRequest
IoCancelIrp
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIWriteEvent
ExFreePool
ZwSetValueKey
KeInitializeEvent
IoAllocateWorkItem
IoAcquireRemoveLockEx
IoQueueWorkItem
IoFreeWorkItem
IoOpenDeviceRegistryKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
KeInitializeSemaphore
IoInitializeRemoveLockEx
IoCsqInitialize
KeInitializeMutex
IoAllocateIrp
IoFreeIrp
KeReleaseMutex
InterlockedIncrement
IofCallDriver
IoInitializeIrp
InterlockedDecrement
KeSetEvent
KeWaitForSingleObject
KeReadStateSemaphore
KeReleaseSemaphore
memset
memcpy
IoCsqRemoveIrp
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExFreePoolWithTag
ObfDereferenceObject
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsStreamPointerAdvanceOffsetsAndUnlock
KsDefaultAddEventHandler
KsGetObjectFromFileObject
KsGetPinFromIrp
KsRemoveItemFromObjectBag
KsMergeAutomationTables
KsPinGetConnectedFilterInterface
_KsEdit
KsPinGetAvailableByteCount
KsGetFilterFromIrp
KsCreateFilterFactory
KsGetDevice
KsGetParent
KsGenerateEvent
KsInitializeDriver
KsFilterGetFirstChildPin
KsPinGetNextSiblingPin
KsAcquireDevice
KsReleaseDevice
KsReleaseControl
KsAcquireControl
KsGetNextSibling
KsGetFirstChild
KsAddItemToObjectBag
KsRegisterCountedWorker
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerClone
KsStreamPointerUnlock
KsIncrementCountedWorker
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinAcquireProcessingMutex
KsPinReleaseProcessingMutex
KsStreamPointerDelete
KsUnregisterWorker
usbd.sys
USBD_ParseDescriptors
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.guids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_32bit.zip
- SHA256 5643e83815da05ab66155c66bf8596e62acccf5d628b022c488e1fb9ed166a61
- MD5 05aedc2147eb34b222e7b0cafa5a0017
- SHA1 90b15f73889a36076b25a8d22434013e0e90ee64
- SHA512 5ac1de068b63643c87f1e51995e284d47a8a9363bd8d4b02509e06869df2afdb8ff651f8e8a3ccd6a580cb18952129f263a75d1d0b9d5f72874977f9cea4df94
- SSDEEP 1536:O5JadUwz2qROJ+GetY2qmZRz4F/8S0D3YCyD:O5J5wvOeegz4F0SDD
- TLSH T1B173125715616822FA44CC7BB369B4CCE34CDB44B6EC9AA9CF7139010ECD5DF098A2E6
- MD5 SHA1 SHA512 SSDEEP TLSH
usbvideo.inf_x86_neutral/usbvideo.inf
- SHA256 5737e125e2070b8c0fd4b40b463c516e94f2fde12a110c699d0c008f00231be6
- MD5 f16951ad9648dd4793de5e85698f4171
- SHA1 ced13f7d7bc32324c2fdeb312c1a47c60b181b52
- SHA512 7303f6c8c4a4ef704ed3abc9a6b35ddbf314ecdc5103c3c9287d7b051d0d775bfee5c8c4bbbfc9202de64f25c6d4f997a0437603c7ce3e54cc8229e88c2c477a
- SSDEEP 192:eIMlPZyAoLngrr48EcSYM78v3ZCwv3ZClkS1h/b52a5v15C5as5s555P5uqKC/m:vMagryvdYC+
- TLSH T13D62E212B7F80218F1F76BD0AAF9457B5676BC62682CCA5E00D4478E29F1E414C61FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
usbvideo.inf_x86_neutral/usbvideo.sys
- IMPHASH 2762629f24d83f8c2344a15421deac7a
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
135476
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
usbvideo.pdb
ntoskrnl.exe
IoReleaseRemoveLockEx
PoRequestPowerIrp
IoReleaseRemoveLockAndWaitEx
KeClearEvent
KeQuerySystemTime
_vsnprintf
IoCsqRemoveNextIrp
ExfInterlockedRemoveHeadList
KeResetEvent
IoCsqInsertIrp
PsTerminateSystemThread
KeWaitForMultipleObjects
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ExfInterlockedInsertHeadList
IoBuildDeviceIoControlRequest
IoCancelIrp
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
MmGetSystemRoutineAddress
IoWMIWriteEvent
ExFreePool
ZwSetValueKey
KeInitializeEvent
IoAllocateWorkItem
IoAcquireRemoveLockEx
IoQueueWorkItem
IoFreeWorkItem
IoOpenDeviceRegistryKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
KeInitializeSemaphore
IoInitializeRemoveLockEx
IoCsqInitialize
KeInitializeMutex
IoAllocateIrp
IoFreeIrp
KeReleaseMutex
InterlockedIncrement
IofCallDriver
IoInitializeIrp
InterlockedDecrement
KeSetEvent
KeWaitForSingleObject
KeReadStateSemaphore
KeReleaseSemaphore
memset
memcpy
IoCsqRemoveIrp
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExFreePoolWithTag
ObfDereferenceObject
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsStreamPointerAdvanceOffsetsAndUnlock
KsDefaultAddEventHandler
KsGetObjectFromFileObject
KsGetPinFromIrp
KsRemoveItemFromObjectBag
KsMergeAutomationTables
KsPinGetConnectedFilterInterface
_KsEdit
KsPinGetAvailableByteCount
KsGetFilterFromIrp
KsCreateFilterFactory
KsGetDevice
KsGetParent
KsGenerateEvent
KsInitializeDriver
KsFilterGetFirstChildPin
KsPinGetNextSiblingPin
KsAcquireDevice
KsReleaseDevice
KsReleaseControl
KsAcquireControl
KsGetNextSibling
KsGetFirstChild
KsAddItemToObjectBag
KsRegisterCountedWorker
KsDecrementCountedWorker
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerClone
KsStreamPointerUnlock
KsIncrementCountedWorker
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinAcquireProcessingMutex
KsPinReleaseProcessingMutex
KsStreamPointerDelete
KsUnregisterWorker
usbd.sys
USBD_ParseDescriptors
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.guids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit.rar
- SHA256 22f585b04edccae77a28e657d1692ee99b8c83056ccaffe423ff543d61dd9fd2
- MD5 8b1bb90e6523ea5c2056c563d6a08e74
- SHA1 173aeba1d6f67f9909c426dcddd9814917a700c9
- SHA512 1c06ad37ed105552a78e349900c5593ba071c739f1ab7ff47eab2b84d97521d3e6f5305d75ef4ec06a5468bfd72dbe7cef3bb12d4e49120e728238adb0f8ebe2
- SSDEEP 1536:3WA0Jzpy6Yys4RIWXJqmK2CE1wB1fIoZlaRn9wvs/u5vzKQIMiRtF2PqV97OUUbs:3h0JzpeMILvzfLXalmsm5vzKuBYl4W5
- TLSH T1778312DF5D4BEDFF94B889020B925844C1EDB7E7A0D39A75819938254E2E67887F1033
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/ksthunk.sys
- IMPHASH 16c82c898d7334a504f0180ac5bebb34
- SHA256 866a23e69b32a78d378d6cb3b3da3695ffdff0fec3c9f68c8c3f988df417044b
- MD5 6869281e78cb31a43e969f06b57347c4
- SHA1 a490c8f4c501652cb732b63620bebe261f457117
- SHA512 f87e4958dcb67e79439264fd0c812a8e493f150ab1022f6f9cb2fc881eeb1b4b3e7cd6a8ed65b64d8fdce6745fc87468394abb254e55946fe2d542901093a4b6
- SSDEEP 384:8PF5txvHHgXvrpMEiRz0Lf4a0HMJj6h2NIxxxV5EK7V6v0JWtwXwW:/ve0LQaCMJD2Es4v0H
- TLSH T14892394AA2E108BDF57A813EC3C72397E7B1B446631107EF1264565E2E2BFD49D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
17740
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ksthunk.pdb
ntoskrnl.exe
PoCallDriver
IoCreateDevice
IofCallDriver
KeAcquireSpinLockRaiseToDpc
ExAllocatePoolWithTag
KeInitializeMutex
RtlQueryRegistryValues
ZwClose
_purecall
IoOpenDeviceRegistryKey
ProbeForRead
_wcsnicmp
IoIs32bitProcess
IoAttachDeviceToDeviceStack
ExRaiseStatus
ProbeForWrite
IoFreeMdl
IoCancelIrp
MmMapLockedPagesSpecifyCache
IoFreeIrp
MmProbeAndLockPages
IoAllocateIrp
MmUnlockPages
IoReleaseCancelSpinLock
IoAllocateMdl
ExAllocatePoolWithQuotaTag
KeBugCheckEx
KeWaitForSingleObject
IofCompleteRequest
PoStartNextPowerIrp
IoDetachDevice
KeReleaseSpinLock
KeInitializeEvent
KeSetEvent
IoDeleteDevice
IoGetDriverObjectExtension
ExFreePool
KeReleaseMutex
IoAllocateDriverObjectExtension
__C_specific_handler
ks.sys
KsPropertyHandler
KsSynchronousIoControlDevice
??0CBaseUnknown@@QEAA@PEAUIUnknown@@@Z
??1CBaseUnknown@@UEAA@XZ
?NonDelegatedAddRef@CBaseUnknown@@UEAAKXZ
?NonDelegatedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedAddRef@CBaseUnknown@@UEAAKXZ
?IndirectedRelease@CBaseUnknown@@UEAAKXZ
?IndirectedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
KoCreateInstance
?NonDelegatedQueryInterface@CBaseUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
640B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
250B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/usbvideo.inf
- SHA256 bb4ba1c40c7fa1a85e3ff43bb7124b73b4353d21ee2c2b51492255747b9ade05
- MD5 15a8ae7c6aa871947bee432181729bbb
- SHA1 5f7b314facef265eb2cc81382111e9a9fb01ded7
- SHA512 92ab2a85a58d88d7478c550ad332323f23b94c3d2a502a83cb47697aea4fcc62f3679dfd7836f18cd7f9f9330f76f2bbfa6bdbf8cc66866f48d0ac84af51caf9
- SSDEEP 192:jsolPZyAoLngrr48EcSYM78v3ZCwv3ZClkS1h/b52a5v15C5as5s555P5uqKC/m:goagryvdYC+
- TLSH T17162F112B7F80218F1F76BD0AAF9857B5676BC62682CCA5E00D4478E29F1E414C61FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/win7_64bit/usbvideo.sys
- IMPHASH f065491fdd06d157765edb60b1799a42
- SHA256 6d3de5bd3ef3a76e997e5baf900c51d25308f5a9682d1f62017f577a24095b90
- MD5 1f775da4cf1a3a1834207e975a72e9d7
- SHA1 2026a1fcf8fa23654707d12a1e285a68d21aa9ff
- SHA512 23567c1cd17ef7f6a16e135717e038db2a631edba99ca8e4eb7c6c17854b8b34cde44527ef1c492e650770868d74b0d2044e7ed73a6802989252af23e854ceb5
- SSDEEP 3072:8wrTLwJkzq7in2jK8hMI4bYxYAOtKxSbLhfjs9L/xkgOs:1r/Aig+5ZbYxYA+KxoF4ZR
- TLSH T127044C05E29564F9E8BBC1789EE6535BFBB1380E172496DB1170CA547F03AE4AB7C308
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
180064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usbvideo.pdb
ntoskrnl.exe
IoCancelIrp
IoReleaseRemoveLockAndWaitEx
IoSetCompletionRoutineEx
_vsnprintf
IoCsqRemoveIrp
IoCsqInsertIrp
PoRequestPowerIrp
PsTerminateSystemThread
IoCsqRemoveNextIrp
ObReferenceObjectByHandle
ObfDereferenceObject
KeWaitForMultipleObjects
KeBugCheckEx
IoReleaseRemoveLockEx
KeResetEvent
IoBuildDeviceIoControlRequest
KeClearEvent
RtlCompareMemory
IofCompleteRequest
ExFreePool
MmGetSystemRoutineAddress
IoWMIWriteEvent
IoWMIRegistrationControl
IoQueueWorkItem
IoOpenDeviceRegistryKey
IoInitializeRemoveLockEx
KeInitializeSemaphore
ZwClose
IoAllocateWorkItem
IoCsqInitialize
ZwQueryValueKey
ZwSetValueKey
KeInitializeEvent
IoFreeWorkItem
RtlInitUnicodeString
IoAcquireRemoveLockEx
KeAcquireSpinLockRaiseToDpc
IofCallDriver
IoInitializeIrp
ExInterlockedRemoveHeadList
IoAllocateIrp
KeReadStateSemaphore
KeReleaseSemaphore
IoFreeIrp
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedInsertHeadList
KeReleaseMutex
KeSetEvent
KeReleaseSpinLock
KeInitializeMutex
ExFreePoolWithTag
PsCreateSystemThread
ExAllocatePoolWithTag
ks.sys
KsStreamPointerAdvanceOffsetsAndUnlock
KsDefaultAddEventHandler
KsGetObjectFromFileObject
KsGetPinFromIrp
KsRemoveItemFromObjectBag
KsMergeAutomationTables
KsGetFilterFromIrp
KsPinGetAvailableByteCount
_KsEdit
KsPinGetConnectedFilterInterface
KsCreateFilterFactory
KsGetDevice
KsGetParent
KsGenerateEvent
KsInitializeDriver
KsAcquireDevice
KsReleaseDevice
KsAcquireControl
KsGetFirstChild
KsGetNextSibling
KsFilterGetFirstChildPin
KsPinGetNextSiblingPin
KsReleaseControl
KsIncrementCountedWorker
KsAddItemToObjectBag
KsPinGetReferenceClockInterface
KsStreamPointerDelete
KsRegisterCountedWorker
KsStreamPointerClone
KsPinReleaseProcessingMutex
KsPinAcquireProcessingMutex
KsPinGetLeadingEdgeStreamPointer
KsPinGetParentFilter
KsStreamPointerUnlock
KsDecrementCountedWorker
KsUnregisterWorker
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_ParseDescriptors
Name
.text
Size
155KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.guids
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1006B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=93, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/².docx
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC.rar
- SHA256 b6760938530a79263ab91c2d99ecdac289438f251dac3f454252b2f20b4ccda4
- MD5 3307a01a079f794b19c086924ccd50e3
- SHA1 1e4cf81c6694cdb9808f50021cb05bfae1468333
- SHA512 0d5da8f725f4b4e95e48814b367330cb742fa3ed509d49e6592a9fdfc4ea65be749cba644c27aff46dc7ac939809f68fa6d79a4c300de3dee935ec67cf957728
- SSDEEP 6144:phylNjMmR1ZPeEAFfjY4xW8St4farGb9goXbNlupah9B34QaY/z5NG:pUlKmFX4xWafFXXZApah5l5s
- TLSH T14944232E7ED06E046CF4DF138E9DB99AC0361652BE780ED130F89D68695F774612290B
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/WIN7װCDC.pdf
- SHA256 ee614655017c21b50a3d7fbf8a17a9130bbcfc041de7a47530c186cf5f47ca37
- MD5 4bdc028e5e5c960fef68bac1fefffb2d
- SHA1 950867b708c3c93932a33602530cb75b73c7e49d
- SHA512 691a887859aeca9aee54b0e99245e7aee8403145df15f5299b9048da4c9f0f8f5fe6dba652d1bb68ae7f6205354d8d0be2efe2a7b2928362377ef2de265478b3
- SSDEEP 6144:NEbL55EFUBxeNVv4yP20ydQ671aQt/wkezVuWmmZ/xhiZAeT+w:NEbL55lxeT5P20GQ671QkezVuWmmZXij
- TLSH T12854223C9D32420AD95502F95AD96D0DB80EF1BFBCF9C816CACD868D8005997E75B3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_32.inf
- SHA256 0ba297fe46f87cc294b9f528db75d431489aee276a60cc0fd19a2904487b0652
- MD5 54b7391146bdf5dd617d15879e837dca
- SHA1 1c9b687051d938379fc7e5d0e6089dc858bd0b02
- SHA512 b581d959ce6bb84347c482cca02dbce53c92aa05b7747aab400188165783962d6f590c69d0868816d92d271938a5a5e87447ee37d80ebe6ccf27bd8fde05bbca
- TLSH T11961CC0485830C38795333D5664728E22609614350A565C97FDE79C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH
win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/usbser_64.inf
- SHA256 36ec2227e77885f8b1e980880ee84bc0415d32c5f26f8f387e02dbed8306a1dc
- MD5 c7563ef3f707f7c221a4fd1d6b0e8845
- SHA1 712430413ccb94305e34a30b6714b20cd89a473b
- SHA512 a9f5891e0325067cf27423a9f3dd09da67faebd60ddf40df931b3f8c5cd263b41cc5be3f71afeef09ea09730d2aa608965e16236b90032e9027163b4ab8ac050
- TLSH T15661CB0485830C387A5333D5674728E22609614350A565897FEEB9C8CBCFE6CB32A8FF
- MD5 SHA1 SHA512 TLSH