2e5a9b16b85e0efee5730c497fb49fd235c36c72e54f80b77aa86b1258d70f2c

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/drv_wall/zfwallinst.exe
unpack001/drv_wall/zfwallinst.exe0

.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

85:51:0a:93:1f:01:cd:91:91:b8:06:3e:6f:10:b1:6d:e0:f4:a0:92:15:eb:53:45:70:48:00:05:4a:82:db:fc
Signer

Actual PE Digest

85:51:0a:93:1f:01:cd:91:91:b8:06:3e:6f:10:b1:6d:e0:f4:a0:92:15:eb:53:45:70:48:00:05:4a:82:db:fc

Digest Algorithm

sha256

PE Digest Matches

true

82:27:cd:8a:42:e0:21:e3:61:76:64:fb:69:95:3d:d1:a6:79:a2:23
Signer

Actual PE Digest

82:27:cd:8a:42:e0:21:e3:61:76:64:fb:69:95:3d:d1:a6:79:a2:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW

RegEnumKeyW

RegQueryValueExW

RegSetValueExW

RegCloseKey

RegDeleteValueW

RegDeleteKeyW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

SetFileSecurityW

RegOpenKeyExW

RegEnumValueW

shell32

SHGetSpecialFolderLocation

SHFileOperationW

SHBrowseForFolderW

SHGetPathFromIDListW

ShellExecuteExW

SHGetFileInfoW

ole32

OleInitialize

OleUninitialize

CoCreateInstance

IIDFromString

CoTaskMemFree

comctl32

ord17

ImageList_Create

ImageList_Destroy

ImageList_AddMasked

user32

GetClientRect

EndPaint

DrawTextW

IsWindowEnabled

DispatchMessageW

wsprintfA

CharNextA

CharPrevW

MessageBoxIndirectW

GetDlgItemTextW

SetDlgItemTextW

GetSystemMetrics

FillRect

AppendMenuW

TrackPopupMenu

OpenClipboard

SetClipboardData

CloseClipboard

IsWindowVisible

CallWindowProcW

GetMessagePos

CheckDlgButton

LoadCursorW

SetCursor

GetSysColor

SetWindowPos

GetWindowLongW

PeekMessageW

SetClassLongW

GetSystemMenu

EnableMenuItem

GetWindowRect

ScreenToClient

EndDialog

RegisterClassW

SystemParametersInfoW

CreateWindowExW

GetClassInfoW

DialogBoxParamW

CharNextW

ExitWindowsEx

DestroyWindow

CreateDialogParamW

SetTimer

SetWindowTextW

PostQuitMessage

SetForegroundWindow

ShowWindow

wsprintfW

SendMessageTimeoutW

FindWindowExW

IsWindow

GetDlgItem

SetWindowLongW

LoadImageW

GetDC

ReleaseDC

EnableWindow

InvalidateRect

SendMessageW

DefWindowProcW

BeginPaint

EmptyClipboard

CreatePopupMenu

gdi32

SetBkMode

SetBkColor

GetDeviceCaps

CreateFontIndirectW

CreateBrushIndirect

DeleteObject

SetTextColor

SelectObject

kernel32

GetExitCodeProcess

WaitForSingleObject

GetModuleHandleA

GetProcAddress

GetSystemDirectoryW

lstrcatW

Sleep

lstrcpyA

WriteFile

GetTempFileNameW

lstrcmpiA

RemoveDirectoryW

CreateProcessW

CreateDirectoryW

GetLastError

CreateThread

GlobalLock

GlobalUnlock

GetDiskFreeSpaceW

WideCharToMultiByte

lstrcpynW

lstrlenW

SetErrorMode

GetVersionExW

GetCommandLineW

GetTempPathW

GetWindowsDirectoryW

SetEnvironmentVariableW

CopyFileW

ExitProcess

GetCurrentProcess

GetModuleFileNameW

GetFileSize

CreateFileW

GetTickCount

MulDiv

SetFileAttributesW

GetFileAttributesW

SetCurrentDirectoryW

MoveFileW

GetFullPathNameW

GetShortPathNameW

SearchPathW

CompareFileTime

SetFileTime

CloseHandle

lstrcmpiW

lstrcmpW

ExpandEnvironmentStringsW

GlobalFree

GlobalAlloc

GetModuleHandleW

LoadLibraryExW

MoveFileExW

FreeLibrary

WritePrivateProfileStringW

GetPrivateProfileStringW

lstrlenA

MultiByteToWideChar

ReadFile

SetFilePointer

FindClose

FindNextFileW

FindFirstFileW

DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$COMMONFILES/ZfHookProject/zfhesm.dll

.dll windows:5 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a1:d1:fb:1f:7e:0f:c7:82:12:ad:ce:47:96:1b:4d:61:0a:6b:ce:2e:fc:70:29:83:b0:92:de:4b:d1:15:a5:75
Signer

Actual PE Digest

a1:d1:fb:1f:7e:0f:c7:82:12:ad:ce:47:96:1b:4d:61:0a:6b:ce:2e:fc:70:29:83:b0:92:de:4b:d1:15:a5:75

Digest Algorithm

sha256

PE Digest Matches

true

51:69:9c:d9:0c:57:0e:02:f2:59:23:60:8e:ec:13:5f:cc:3e:ba:3b
Signer

Actual PE Digest

51:69:9c:d9:0c:57:0e:02:f2:59:23:60:8e:ec:13:5f:cc:3e:ba:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Sections

.rsrc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$COMMONFILES/ZfHookProject/zfhesm.dll0

.dll windows:5 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a1:d1:fb:1f:7e:0f:c7:82:12:ad:ce:47:96:1b:4d:61:0a:6b:ce:2e:fc:70:29:83:b0:92:de:4b:d1:15:a5:75
Signer

Actual PE Digest

a1:d1:fb:1f:7e:0f:c7:82:12:ad:ce:47:96:1b:4d:61:0a:6b:ce:2e:fc:70:29:83:b0:92:de:4b:d1:15:a5:75

Digest Algorithm

sha256

PE Digest Matches

true

51:69:9c:d9:0c:57:0e:02:f2:59:23:60:8e:ec:13:5f:cc:3e:ba:3b
Signer

Actual PE Digest

51:69:9c:d9:0c:57:0e:02:f2:59:23:60:8e:ec:13:5f:cc:3e:ba:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Sections

.rsrc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW

GlobalFree

GlobalSize

lstrcpynW

lstrcpyW

GetProcAddress

WideCharToMultiByte

VirtualFree

FreeLibrary

lstrlenW

LoadLibraryW

GlobalAlloc

MultiByteToWideChar

VirtualAlloc

VirtualProtect

GetLastError

user32

wsprintfW

ole32

StringFromGUID2

CLSIDFromString

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$_35_/ZfHookCtrlExT.dll

.dll windows:5 windows x86 arch:x86

6b6c721eeaaa48b35b242e6ce2e01e73

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

bb:dc:b3:6c:ff:56:fc:0c:26:00:95:e1:e9:b2:c0:f9:db:70:88:e6:4d:8b:42:19:99:72:25:c6:31:f8:f3:63
Signer

Actual PE Digest

bb:dc:b3:6c:ff:56:fc:0c:26:00:95:e1:e9:b2:c0:f9:db:70:88:e6:4d:8b:42:19:99:72:25:c6:31:f8:f3:63

Digest Algorithm

sha256

PE Digest Matches

true

c1:64:93:f8:62:d4:65:f8:71:b1:c9:15:2d:bd:96:26:ce:f4:c8:5f
Signer

Actual PE Digest

c1:64:93:f8:62:d4:65:f8:71:b1:c9:15:2d:bd:96:26:ce:f4:c8:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\ZfHookCtrlExT.pdb

Imports

kernel32

OpenMutexW

SetLastError

LockFileEx

DeviceIoControl

OpenFileMappingW

GetCurrentThreadId

OutputDebugStringA

GetCurrentProcessId

GetSystemDirectoryW

TlsGetValue

FreeLibrary

TlsSetValue

LoadLibraryW

FormatMessageW

MultiByteToWideChar

ReadFile

Sleep

HeapFree

HeapAlloc

GetProcessHeap

UnlockFileEx

lstrcpynA

UnmapViewOfFile

MapViewOfFile

DeleteFileA

LockResource

GetProcAddress

GetSystemTimeAsFileTime

SetEvent

CreateSemaphoreA

CreateEventA

WaitForMultipleObjectsEx

GetModuleHandleA

ReleaseSemaphore

GetTickCount

WaitForSingleObjectEx

SizeofResource

LoadResource

FindResourceW

FindResourceExW

DeleteFileW

TlsFree

TlsAlloc

CloseHandle

GetLastError

GetFileSizeEx

lstrlenW

CreateFileW

WideCharToMultiByte

WriteFile

CompareStringW

OutputDebugStringW

ResetEvent

OpenEventA

GetEnvironmentVariableW

ExpandEnvironmentStringsW

HeapDestroy

HeapReAlloc

HeapSize

RaiseException

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

InterlockedIncrement

InterlockedDecrement

InterlockedCompareExchange

InterlockedExchange

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCommandLineA

RtlUnwind

GetCPInfo

LCMapStringA

LCMapStringW

HeapCreate

VirtualFree

VirtualAlloc

GetModuleHandleW

GetStdHandle

GetModuleFileNameA

ExitProcess

GetACP

GetOEMCP

IsValidCodePage

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetStringTypeA

GetStringTypeW

GetUserDefaultLCID

GetLocaleInfoA

EnumSystemLocalesA

IsValidLocale

InitializeCriticalSectionAndSpinCount

LoadLibraryA

GetLocaleInfoW

SetFilePointer

GetConsoleCP

GetConsoleMode

GetTimeZoneInformation

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

CreateFileA

FlushFileBuffers

CompareStringA

SetEnvironmentVariableA

VirtualQuery

lstrcpynW

GetFileAttributesW

GetModuleFileNameW

GetLocalTime

lstrcatW

GetFileInformationByHandle

CreateMutexW

FindFirstFileW

GetVersionExW

lstrcmpW

FindClose

CreateFileMappingW

FindNextFileW

lstrcpyW

GetFullPathNameW

GetFullPathNameA

GetFileSize

SetEndOfFile

SystemTimeToFileTime

UnlockFile

LockFile

FormatMessageA

GetFileAttributesA

HeapValidate

GetTempPathW

GetDiskFreeSpaceW

GetDiskFreeSpaceA

GetSystemInfo

GetFileAttributesExW

GetVersionExA

GetTempPathA

LocalFree

GetSystemTime

AreFileApisANSI

user32

LoadStringW

GetDesktopWindow

advapi32

AddAce

ConvertStringSecurityDescriptorToSecurityDescriptorW

QueryServiceConfigW

QueryServiceStatusEx

RegQueryValueExW

OpenServiceW

OpenSCManagerW

CloseServiceHandle

RegCreateKeyExA

GetSecurityDescriptorDacl

GetSecurityDescriptorGroup

RegCloseKey

GetLengthSid

MakeSelfRelativeSD

GetSecurityDescriptorSacl

InitializeSid

GetSidLengthRequired

RegOpenKeyExW

IsValidSid

GetSecurityDescriptorOwner

InitializeAcl

MakeAbsoluteSD

GetSecurityDescriptorLength

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

GetSecurityDescriptorControl

RegCreateKeyExW

CopySid

GetAclInformation

GetSidSubAuthority

shell32

SHGetSpecialFolderPathW

SHCreateDirectoryExW

SHCreateDirectoryExA

SHGetPathFromIDListW

SHGetSpecialFolderLocation

oleaut32

SysFreeString

VariantClear

SysAllocStringLen

shlwapi

wnsprintfW

StrCmpIW

PathFindFileNameA

SHSetValueW

PathAppendW

SHGetValueW

PathFindFileNameW

PathIsRelativeW

wvnsprintfW

PathFileExistsW

psapi

GetModuleBaseNameW

Exports

??0?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@QAE@XZ

??0?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@QAE@XZ

??0?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@QAE@XZ

??0?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@QAE@XZ

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Upolicynode@DBPolicy@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51

??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51

??_B?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@3@XZ@51

?get_const_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Upolicynode@DBPolicy@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@23@XZ

?get_const_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?get_const_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Upolicynode@DBPolicy@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@23@XZ

?get_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@3@XZ

?get_mutable_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@A

?instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Upolicynode@DBPolicy@@@23@A

?instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@A

?instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@23@A

?instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@A

?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A

?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A

?instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@A

?instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@3@A

?instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@A

?instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@3@A

?is_destroyed@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ

?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ

?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ

?save_object_data@?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z

?save_object_data@?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z

?save_object_data@?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z

?save_object_data@?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Upolicynode@DBPolicy@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Upolicynode@DBPolicy@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A

?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vxml_oarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vxml_oarchive@archive@boost@@Upolicynode@DBPolicy@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vxml_oarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vxml_oarchive@archive@boost@@V?$set@Upolicynode@DBPolicy@@U?$less@Upolicynode@DBPolicy@@@std@@V?$allocator@Upolicynode@DBPolicy@@@4@@std@@@detail@archive@boost@@@634@A

CheckAndWaitForInstallLock

CheckAndWaitForInstallLockForSetup

CheckAndWaitForUnInstallLockForSetup

ClosePolicySnapshot

CreatePolicySnapshot

DeleteHookPluginA

DeleteHookPluginW

DeleteHookPolicyA

DeleteHookPolicyW

DeletePolicyFile

GetDirDeniedList

InsertHookPluginA

InsertHookPluginW

InsertHookPolicyA

InsertHookPolicyW

IsLastOpDelayUntilReboot

IsNeedReboot

IsNeedRebootEx

MyDelayMoveFile

PausePolicy

PlcSnapNext

PolicyCount

PolicyFree

PolicyNext

PolicyReset

QueryPolicy

ReleaseInstallLock

ResumePolicy

SetDirDenied

SetOpDelayUntilReboot

SetPolyPolicies

SetRebootFlagA

ZfhGetLastCheckResult

ZfhHealthCheck

Sections

.text
Size: 769KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$_35_/installhlpr.dll

.dll windows:5 windows x86 arch:x86

94e91baf89fe6680b2b93597262b497e

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00
Signer

Actual PE Digest

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00

Digest Algorithm

sha256

PE Digest Matches

true

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48
Signer

Actual PE Digest

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\installhlpr.pdb

Imports

kernel32

WriteFile

SetEndOfFile

GetCurrentProcessId

SetFilePointerEx

CopyFileW

GetFileSizeEx

MoveFileExW

DeleteFileW

TerminateProcess

WaitForSingleObject

OpenProcess

HeapFree

GetProcessHeap

HeapAlloc

GetCurrentProcess

GetModuleHandleW

GetProcAddress

CloseHandle

Sleep

LockFileEx

CreateFileW

LocalFree

LocalAlloc

GetLastError

SetLastError

lstrlenW

GetLocalTime

SetEnvironmentVariableA

CompareStringW

CompareStringA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetModuleHandleA

GetLocaleInfoA

GetStringTypeW

GetEnvironmentVariableW

ExpandEnvironmentStringsW

WideCharToMultiByte

MultiByteToWideChar

GetFullPathNameW

GetFullPathNameA

HeapReAlloc

CreateFileA

GetFileSize

CreateMutexW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

FreeLibrary

SystemTimeToFileTime

QueryPerformanceCounter

InterlockedCompareExchange

UnlockFile

LockFile

GetTickCount

UnlockFileEx

GetSystemTimeAsFileTime

FormatMessageA

InitializeCriticalSection

LoadLibraryW

FormatMessageW

HeapDestroy

LeaveCriticalSection

GetFileAttributesA

HeapCreate

HeapValidate

GetFileAttributesW

ReadFile

FlushFileBuffers

GetTempPathW

HeapSize

EnterCriticalSection

GetDiskFreeSpaceW

LoadLibraryA

CreateFileMappingW

GetDiskFreeSpaceA

GetSystemInfo

GetFileAttributesExW

DeleteCriticalSection

GetVersionExA

GetTempPathA

GetSystemTime

AreFileApisANSI

DeleteFileA

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

InterlockedDecrement

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

VirtualFree

VirtualAlloc

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

GetTimeZoneInformation

GetConsoleCP

GetConsoleMode

InitializeCriticalSectionAndSpinCount

GetStringTypeA

DisableThreadLibraryCalls

user32

LoadStringW

advapi32

DeregisterEventSource

OpenProcessToken

QueryServiceStatusEx

ChangeServiceConfigW

CreateServiceW

OpenSCManagerW

CloseServiceHandle

DeleteService

ControlService

OpenServiceW

FreeSid

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

SetEntriesInAclW

AllocateAndInitializeSid

RegQueryValueExW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegSetValueExW

RegCreateKeyExW

GetTokenInformation

ReportEventW

RegisterEventSourceW

shell32

ord165

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

PathMatchSpecW

PathQuoteSpacesW

PathAppendW

Exports

AddEventSource

AppendFileToInventory

AssureUpdateServiceImageCanRelease

ClearFileInventory

CreateSharedKeys

CreateUpdateService

DeleteUpdateService

EnumFilesInInventory

EventMessage

FixDefaultPolicies

GetInstallLock

GetLocalBuildNumber

IsEffectUntilReboot

RemoveEventSource

RenameFileReboot

ResetFileInventory

UninstallOldServices

WriteLog

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/FFDASDBG.7z

.7z

drv/FFDASDBG.7z0

.7z

drv/filemon.json

drv/hkcore32.dll

.dll windows:5 windows x86 arch:x86

0fd31e978bc0319cf5693446a9d59ca7

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8f:cc:0d:6d:25:1c:23:fd:60:13:90:3c:27:05:dd:95:e5:33:86:33:73:be:44:13:96:2b:42:bf:cd:df:77:c4
Signer

Actual PE Digest

8f:cc:0d:6d:25:1c:23:fd:60:13:90:3c:27:05:dd:95:e5:33:86:33:73:be:44:13:96:2b:42:bf:cd:df:77:c4

Digest Algorithm

sha256

PE Digest Matches

true

de:2f:a1:50:46:36:63:e1:28:d5:17:b1:73:4e:67:6b:d0:60:d3:de
Signer

Actual PE Digest

de:2f:a1:50:46:36:63:e1:28:d5:17:b1:73:4e:67:6b:d0:60:d3:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\hkcore32.pdb

Imports

kernel32

GetModuleFileNameW

DisableThreadLibraryCalls

CreateEventW

TlsAlloc

GetCurrentProcessId

TlsFree

GetModuleHandleW

GetProcAddress

FlushFileBuffers

CloseHandle

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WideCharToMultiByte

MultiByteToWideChar

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

GetLastError

HeapFree

HeapAlloc

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

TlsGetValue

TlsSetValue

InterlockedIncrement

SetLastError

InterlockedDecrement

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapCreate

HeapDestroy

VirtualFree

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

VirtualAlloc

HeapReAlloc

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

HeapSize

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetFilePointer

GetConsoleCP

GetConsoleMode

Exports

FF11DDEE

InjectInit

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/hkcore32.dll0

.dll windows:5 windows x86 arch:x86

0fd31e978bc0319cf5693446a9d59ca7

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8f:cc:0d:6d:25:1c:23:fd:60:13:90:3c:27:05:dd:95:e5:33:86:33:73:be:44:13:96:2b:42:bf:cd:df:77:c4
Signer

Actual PE Digest

8f:cc:0d:6d:25:1c:23:fd:60:13:90:3c:27:05:dd:95:e5:33:86:33:73:be:44:13:96:2b:42:bf:cd:df:77:c4

Digest Algorithm

sha256

PE Digest Matches

true

de:2f:a1:50:46:36:63:e1:28:d5:17:b1:73:4e:67:6b:d0:60:d3:de
Signer

Actual PE Digest

de:2f:a1:50:46:36:63:e1:28:d5:17:b1:73:4e:67:6b:d0:60:d3:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\hkcore32.pdb

Imports

kernel32

GetModuleFileNameW

DisableThreadLibraryCalls

CreateEventW

TlsAlloc

GetCurrentProcessId

TlsFree

GetModuleHandleW

GetProcAddress

FlushFileBuffers

CloseHandle

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WideCharToMultiByte

MultiByteToWideChar

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

GetLastError

HeapFree

HeapAlloc

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

TlsGetValue

TlsSetValue

InterlockedIncrement

SetLastError

InterlockedDecrement

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapCreate

HeapDestroy

VirtualFree

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

VirtualAlloc

HeapReAlloc

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

HeapSize

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetFilePointer

GetConsoleCP

GetConsoleMode

Exports

FF11DDEE

InjectInit

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/hkcore64.dll

.dll windows:5 windows x64 arch:x64

cb19459b225608d5e098bf16487a9326

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

1a:b3:da:0e:bf:e8:e7:b9:3e:9d:91:62:e6:62:53:91:2c:88:7a:54:3b:7a:0c:69:d9:a5:8c:53:78:a3:22:b9
Signer

Actual PE Digest

1a:b3:da:0e:bf:e8:e7:b9:3e:9d:91:62:e6:62:53:91:2c:88:7a:54:3b:7a:0c:69:d9:a5:8c:53:78:a3:22:b9

Digest Algorithm

sha256

PE Digest Matches

true

bd:f4:d4:d7:8b:d9:54:cf:75:7a:51:52:a1:89:2a:ec:85:17:56:c3
Signer

Actual PE Digest

bd:f4:d4:d7:8b:d9:54:cf:75:7a:51:52:a1:89:2a:ec:85:17:56:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\hkcore64.pdb

Imports

kernel32

GetModuleFileNameW

DisableThreadLibraryCalls

CreateEventW

TlsAlloc

GetCurrentProcessId

TlsFree

GetModuleHandleW

GetProcAddress

FlushFileBuffers

CloseHandle

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WideCharToMultiByte

MultiByteToWideChar

GetCurrentThreadId

FlsSetValue

GetCommandLineA

RaiseException

RtlPcToFileHeader

RtlLookupFunctionEntry

RtlUnwindEx

GetLastError

HeapFree

HeapAlloc

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlCaptureContext

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapSetInformation

HeapCreate

HeapDestroy

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

LeaveCriticalSection

EnterCriticalSection

HeapSize

HeapReAlloc

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetFilePointer

GetConsoleCP

GetConsoleMode

Exports

FF11DDEE

InjectInit

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/hkcore64.dll0

.dll windows:5 windows x64 arch:x64

cb19459b225608d5e098bf16487a9326

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

1a:b3:da:0e:bf:e8:e7:b9:3e:9d:91:62:e6:62:53:91:2c:88:7a:54:3b:7a:0c:69:d9:a5:8c:53:78:a3:22:b9
Signer

Actual PE Digest

1a:b3:da:0e:bf:e8:e7:b9:3e:9d:91:62:e6:62:53:91:2c:88:7a:54:3b:7a:0c:69:d9:a5:8c:53:78:a3:22:b9

Digest Algorithm

sha256

PE Digest Matches

true

bd:f4:d4:d7:8b:d9:54:cf:75:7a:51:52:a1:89:2a:ec:85:17:56:c3
Signer

Actual PE Digest

bd:f4:d4:d7:8b:d9:54:cf:75:7a:51:52:a1:89:2a:ec:85:17:56:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\hkcore64.pdb

Imports

kernel32

GetModuleFileNameW

DisableThreadLibraryCalls

CreateEventW

TlsAlloc

GetCurrentProcessId

TlsFree

GetModuleHandleW

GetProcAddress

FlushFileBuffers

CloseHandle

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WideCharToMultiByte

MultiByteToWideChar

GetCurrentThreadId

FlsSetValue

GetCommandLineA

RaiseException

RtlPcToFileHeader

RtlLookupFunctionEntry

RtlUnwindEx

GetLastError

HeapFree

HeapAlloc

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlCaptureContext

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapSetInformation

HeapCreate

HeapDestroy

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

LeaveCriticalSection

EnterCriticalSection

HeapSize

HeapReAlloc

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetFilePointer

GetConsoleCP

GetConsoleMode

Exports

FF11DDEE

InjectInit

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/inject32.dll

.dll windows:5 windows x86 arch:x86

c1584155e34f8dc01e170f10ccbf4c02

Code Sign

30:be:a9:a0:36:42:89:a5:c0:7f:c0:1b:2d:c7:d5:a7:13:4a:42:73
Signer

Actual PE Digest

30:be:a9:a0:36:42:89:a5:c0:7f:c0:1b:2d:c7:d5:a7:13:4a:42:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\inject32.pdb

Imports

kernel32

lstrcpynA

VirtualQueryEx

ReadProcessMemory

VirtualProtectEx

VirtualAllocEx

WriteProcessMemory

GetTickCount

CloseHandle

lstrcmpiW

GetProcAddress

GetLastError

lstrlenW

Sleep

LoadLibraryW

GetSystemDirectoryW

OpenProcess

GetModuleHandleW

GetCurrentProcess

TlsFree

TlsAlloc

GetProcessHeap

SetEndOfFile

CreateFileA

DisableThreadLibraryCalls

GetModuleFileNameW

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

InterlockedIncrement

InterlockedDecrement

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

VirtualQuery

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetFileInformationByHandle

GetEnvironmentVariableW

ExpandEnvironmentStringsW

FindFirstFileW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

WaitForSingleObject

GetLogicalDrives

GetVersionExW

TerminateProcess

ReadFile

lstrcmpW

FindClose

Process32FirstW

OpenThread

CreateEventW

QueryDosDeviceW

Process32NextW

GetModuleHandleA

FindNextFileW

CreateToolhelp32Snapshot

lstrcpyW

SetEvent

WaitForMultipleObjects

OpenFileMappingW

CreateThread

lstrlenA

WideCharToMultiByte

MultiByteToWideChar

CreateRemoteThread

QueueUserAPC

TryEnterCriticalSection

ReleaseMutex

GetQueuedCompletionStatus

CreateIoCompletionPort

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

HeapFree

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCommandLineA

RtlUnwind

RaiseException

LCMapStringA

LCMapStringW

GetCPInfo

HeapAlloc

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapCreate

HeapDestroy

VirtualFree

VirtualAlloc

GetConsoleCP

GetConsoleMode

TlsGetValue

TlsSetValue

SetLastError

GetModuleFileNameA

ExitProcess

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapSize

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

GetLocaleInfoA

EnumSystemLocalesA

IsValidLocale

GetStringTypeA

GetStringTypeW

shlwapi

StrCmpNW

StrCmpNIA

StrCmpIW

wnsprintfA

StrCmpNIW

PathFindFileNameA

SHSetValueW

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

PathMatchSpecW

PathAppendW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHCreateDirectoryExW

ole32

CoInitializeEx

CoUninitialize

CoInitializeSecurity

CoSetProxyBlanket

CoCreateInstance

oleaut32

SysFreeString

VariantInit

VariantClear

SysAllocString

Exports

InjectDestroy

InjectInit

TestProc

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/inject32.dll0

.dll windows:5 windows x86 arch:x86

c1584155e34f8dc01e170f10ccbf4c02

Code Sign

30:be:a9:a0:36:42:89:a5:c0:7f:c0:1b:2d:c7:d5:a7:13:4a:42:73
Signer

Actual PE Digest

30:be:a9:a0:36:42:89:a5:c0:7f:c0:1b:2d:c7:d5:a7:13:4a:42:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\inject32.pdb

Imports

kernel32

lstrcpynA

VirtualQueryEx

ReadProcessMemory

VirtualProtectEx

VirtualAllocEx

WriteProcessMemory

GetTickCount

CloseHandle

lstrcmpiW

GetProcAddress

GetLastError

lstrlenW

Sleep

LoadLibraryW

GetSystemDirectoryW

OpenProcess

GetModuleHandleW

GetCurrentProcess

TlsFree

TlsAlloc

GetProcessHeap

SetEndOfFile

CreateFileA

DisableThreadLibraryCalls

GetModuleFileNameW

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

InterlockedIncrement

InterlockedDecrement

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

VirtualQuery

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetFileInformationByHandle

GetEnvironmentVariableW

ExpandEnvironmentStringsW

FindFirstFileW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

WaitForSingleObject

GetLogicalDrives

GetVersionExW

TerminateProcess

ReadFile

lstrcmpW

FindClose

Process32FirstW

OpenThread

CreateEventW

QueryDosDeviceW

Process32NextW

GetModuleHandleA

FindNextFileW

CreateToolhelp32Snapshot

lstrcpyW

SetEvent

WaitForMultipleObjects

OpenFileMappingW

CreateThread

lstrlenA

WideCharToMultiByte

MultiByteToWideChar

CreateRemoteThread

QueueUserAPC

TryEnterCriticalSection

ReleaseMutex

GetQueuedCompletionStatus

CreateIoCompletionPort

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

HeapFree

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCommandLineA

RtlUnwind

RaiseException

LCMapStringA

LCMapStringW

GetCPInfo

HeapAlloc

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapCreate

HeapDestroy

VirtualFree

VirtualAlloc

GetConsoleCP

GetConsoleMode

TlsGetValue

TlsSetValue

SetLastError

GetModuleFileNameA

ExitProcess

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapSize

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

GetLocaleInfoA

EnumSystemLocalesA

IsValidLocale

GetStringTypeA

GetStringTypeW

shlwapi

StrCmpNW

StrCmpNIA

StrCmpIW

wnsprintfA

StrCmpNIW

PathFindFileNameA

SHSetValueW

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

PathMatchSpecW

PathAppendW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHCreateDirectoryExW

ole32

CoInitializeEx

CoUninitialize

CoInitializeSecurity

CoSetProxyBlanket

CoCreateInstance

oleaut32

SysFreeString

VariantInit

VariantClear

SysAllocString

Exports

InjectDestroy

InjectInit

TestProc

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/inject64.dll

.dll windows:5 windows x64 arch:x64

eca0b339eae4883c5f0d05df90ae6ebe

Code Sign

92:d1:d9:38:ea:5c:3d:71:bd:dd:d7:cb:58:51:40:09:f4:91:f4:ff
Signer

Actual PE Digest

92:d1:d9:38:ea:5c:3d:71:bd:dd:d7:cb:58:51:40:09:f4:91:f4:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\inject64.pdb

Imports

kernel32

lstrcpynA

VirtualQueryEx

ReadProcessMemory

VirtualProtectEx

VirtualAllocEx

WriteProcessMemory

GetTickCount

CloseHandle

GetProcAddress

GetLastError

lstrlenW

Sleep

GetSystemDirectoryW

OpenProcess

GetModuleHandleW

GetCurrentProcess

TlsFree

TlsAlloc

GetProcessHeap

CreateFileA

DisableThreadLibraryCalls

GetModuleFileNameW

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

VirtualQuery

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetFileInformationByHandle

GetEnvironmentVariableW

ExpandEnvironmentStringsW

FindFirstFileW

SetFilePointer

WaitForSingleObject

TerminateProcess

ReadFile

lstrcmpW

FindClose

Process32FirstW

OpenThread

CreateEventW

Process32NextW

FindNextFileW

CreateToolhelp32Snapshot

lstrcpyW

SetEvent

CreateThread

lstrlenA

WideCharToMultiByte

MultiByteToWideChar

CreateRemoteThread

QueueUserAPC

TryEnterCriticalSection

ReleaseMutex

GetQueuedCompletionStatus

CreateIoCompletionPort

HeapFree

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RtlUnwindEx

RaiseException

RtlPcToFileHeader

LCMapStringA

LCMapStringW

GetCPInfo

HeapAlloc

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapSetInformation

HeapCreate

HeapDestroy

GetConsoleCP

GetConsoleMode

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

GetModuleFileNameA

ExitProcess

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapSize

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

GetLocaleInfoA

EnumSystemLocalesA

IsValidLocale

GetStringTypeA

GetStringTypeW

shlwapi

StrCmpNIA

StrCmpIW

wnsprintfA

StrCmpNIW

PathFindFileNameA

SHSetValueW

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

PathAppendW

psapi

GetModuleBaseNameW

shell32

SHCreateDirectoryExW

oleaut32

VariantClear

Exports

InjectDestroy

InjectInit

TestProc

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/inject64.dll0

.dll windows:5 windows x64 arch:x64

eca0b339eae4883c5f0d05df90ae6ebe

Code Sign

92:d1:d9:38:ea:5c:3d:71:bd:dd:d7:cb:58:51:40:09:f4:91:f4:ff
Signer

Actual PE Digest

92:d1:d9:38:ea:5c:3d:71:bd:dd:d7:cb:58:51:40:09:f4:91:f4:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\inject64.pdb

Imports

kernel32

lstrcpynA

VirtualQueryEx

ReadProcessMemory

VirtualProtectEx

VirtualAllocEx

WriteProcessMemory

GetTickCount

CloseHandle

GetProcAddress

GetLastError

lstrlenW

Sleep

GetSystemDirectoryW

OpenProcess

GetModuleHandleW

GetCurrentProcess

TlsFree

TlsAlloc

GetProcessHeap

CreateFileA

DisableThreadLibraryCalls

GetModuleFileNameW

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

VirtualQuery

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetFileInformationByHandle

GetEnvironmentVariableW

ExpandEnvironmentStringsW

FindFirstFileW

SetFilePointer

WaitForSingleObject

TerminateProcess

ReadFile

lstrcmpW

FindClose

Process32FirstW

OpenThread

CreateEventW

Process32NextW

FindNextFileW

CreateToolhelp32Snapshot

lstrcpyW

SetEvent

CreateThread

lstrlenA

WideCharToMultiByte

MultiByteToWideChar

CreateRemoteThread

QueueUserAPC

TryEnterCriticalSection

ReleaseMutex

GetQueuedCompletionStatus

CreateIoCompletionPort

HeapFree

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RtlUnwindEx

RaiseException

RtlPcToFileHeader

LCMapStringA

LCMapStringW

GetCPInfo

HeapAlloc

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapSetInformation

HeapCreate

HeapDestroy

GetConsoleCP

GetConsoleMode

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

GetModuleFileNameA

ExitProcess

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapSize

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

GetLocaleInfoA

EnumSystemLocalesA

IsValidLocale

GetStringTypeA

GetStringTypeW

shlwapi

StrCmpNIA

StrCmpIW

wnsprintfA

StrCmpNIW

PathFindFileNameA

SHSetValueW

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

PathAppendW

psapi

GetModuleBaseNameW

shell32

SHCreateDirectoryExW

oleaut32

VariantClear

Exports

InjectDestroy

InjectInit

TestProc

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/injectcfg1.json

drv/injectcfg2.json

drv/zfpcache32.dll

.dll windows:5 windows x86 arch:x86

951f78706cc9e19d054ea8036e72b6e7

Code Sign

f1:a3:85:45:20:ae:82:83:77:fb:5f:a5:4e:3e:61:25:6f:62:e4:4b
Signer

Actual PE Digest

f1:a3:85:45:20:ae:82:83:77:fb:5f:a5:4e:3e:61:25:6f:62:e4:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\zfpcache32.pdb

Imports

kernel32

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WriteConsoleW

GetConsoleCP

CreateFileA

GetProcAddress

GetFileAttributesW

lstrcpynW

GetModuleHandleW

GetCurrentProcess

DisableThreadLibraryCalls

GetProcessHeap

CloseHandle

GetConsoleMode

GetModuleFileNameW

GetModuleHandleA

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCurrentThreadId

GetCommandLineA

HeapAlloc

GetLastError

HeapFree

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

InterlockedDecrement

RaiseException

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

WideCharToMultiByte

GetEnvironmentStringsW

HeapCreate

HeapDestroy

VirtualFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

VirtualAlloc

HeapReAlloc

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

RtlUnwind

HeapSize

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetLocaleInfoA

GetStringTypeA

MultiByteToWideChar

GetStringTypeW

LCMapStringA

LCMapStringW

lstrlenW

SetFilePointer

GetVersionExW

ReadFile

CreateFileW

GetLocalTime

FlushFileBuffers

advapi32

RegEnumKeyW

RegCreateKeyExW

RegOpenKeyW

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegSetKeySecurity

RegQueryInfoKeyW

RegOpenKeyExW

RegCloseKey

shlwapi

PathFindFileNameW

wnsprintfW

StrCmpW

SHSetValueW

SHGetValueW

StrCmpIW

SHDeleteKeyW

PathMatchSpecW

version

GetFileVersionInfoW

VerQueryValueW

GetFileVersionInfoSizeW

oleaut32

VariantClear

Exports

DestroyProcInfoCache

GetProcCacheByPath

InitProcInfoCache

SetProcInfoToCache

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/zfpcache32.dll0

.dll windows:5 windows x86 arch:x86

951f78706cc9e19d054ea8036e72b6e7

Code Sign

f1:a3:85:45:20:ae:82:83:77:fb:5f:a5:4e:3e:61:25:6f:62:e4:4b
Signer

Actual PE Digest

f1:a3:85:45:20:ae:82:83:77:fb:5f:a5:4e:3e:61:25:6f:62:e4:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\Release\zfpcache32.pdb

Imports

kernel32

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

WriteConsoleW

GetConsoleCP

CreateFileA

GetProcAddress

GetFileAttributesW

lstrcpynW

GetModuleHandleW

GetCurrentProcess

DisableThreadLibraryCalls

GetProcessHeap

CloseHandle

GetConsoleMode

GetModuleFileNameW

GetModuleHandleA

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCurrentThreadId

GetCommandLineA

HeapAlloc

GetLastError

HeapFree

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

InterlockedDecrement

RaiseException

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

WideCharToMultiByte

GetEnvironmentStringsW

HeapCreate

HeapDestroy

VirtualFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

VirtualAlloc

HeapReAlloc

WriteFile

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

RtlUnwind

HeapSize

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetLocaleInfoA

GetStringTypeA

MultiByteToWideChar

GetStringTypeW

LCMapStringA

LCMapStringW

lstrlenW

SetFilePointer

GetVersionExW

ReadFile

CreateFileW

GetLocalTime

FlushFileBuffers

advapi32

RegEnumKeyW

RegCreateKeyExW

RegOpenKeyW

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegSetKeySecurity

RegQueryInfoKeyW

RegOpenKeyExW

RegCloseKey

shlwapi

PathFindFileNameW

wnsprintfW

StrCmpW

SHSetValueW

SHGetValueW

StrCmpIW

SHDeleteKeyW

PathMatchSpecW

version

GetFileVersionInfoW

VerQueryValueW

GetFileVersionInfoSizeW

oleaut32

VariantClear

Exports

DestroyProcInfoCache

GetProcCacheByPath

InitProcInfoCache

SetProcInfoToCache

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/zfpcfg.json

drv/zfprotect32.inf

drv/zfprotect32.sys

.sys windows:6 windows x86 arch:x86

49d089494bdd28b81ee1fef771e3e385

Code Sign

93:92:9b:94:08:a0:2e:07:95:e8:bf:f0:2a:49:5f:14:e6:76:6d:e8
Signer

Actual PE Digest

93:92:9b:94:08:a0:2e:07:95:e8:bf:f0:2a:49:5f:14:e6:76:6d:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\drv\objchk_win7_x86\i386\zfprotect32.pdb

Imports

ntoskrnl.exe

PsGetProcessId

IoThreadToProcess

ExInitializeResourceLite

ExDeleteResourceLite

RtlCompareMemory

RtlCopyUnicodeString

RtlAssert

IoCreateSymbolicLink

IoCreateDevice

IoDeleteDevice

IoDeleteSymbolicLink

PsSetLoadImageNotifyRoutine

PsSetCreateProcessNotifyRoutine

PsGetCurrentThreadId

PsRemoveLoadImageNotifyRoutine

PsProcessType

ExInitializeNPagedLookasideList

ExDeleteNPagedLookasideList

InterlockedPushEntrySList

CmRegisterCallback

ObQueryNameString

CmUnRegisterCallback

KeTickCount

KeBugCheckEx

RtlUnwind

MmGetSystemRoutineAddress

PsThreadType

KeServiceDescriptorTable

MmCreateMdl

MmBuildMdlForNonPagedPool

MmMapLockedPages

MmUnmapLockedPages

IoFreeMdl

ZwOpenProcess

RtlGetVersion

PsGetCurrentProcessId

memset

RtlCompareUnicodeString

memmove

memcpy

MmMapLockedPagesSpecifyCache

RtlInitUnicodeString

ZwQueryValueKey

ExAllocatePoolWithTag

ExFreePoolWithTag

IofCompleteRequest

ZwOpenKey

ZwClose

_allmul

DbgPrint

_aullrem

_aulldiv

_allrem

_alldiv

ObfDereferenceObject

ObOpenObjectByPointer

PsLookupProcessByProcessId

hal

KeGetCurrentIrql

fltmgr.sys

FltSendMessage

FltCloseClientPort

FltBuildDefaultSecurityDescriptor

FltCreateCommunicationPort

FltFreeSecurityDescriptor

FltAcquireResourceExclusive

FltReleaseResource

FltRegisterFilter

FltStartFiltering

FltUnregisterFilter

FltGetDestinationFileNameInformation

FltGetStreamHandleContext

FltAllocateContext

FltSetStreamHandleContext

FltReleaseContext

FltSetCallbackDataDirty

FltIsOperationSynchronous

FltReissueSynchronousIo

FltGetFileNameInformation

FltParseFileNameInformation

FltGetRequestorProcessId

FltReleaseFileNameInformation

FltAcquireResourceShared

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/zfprotect64.inf

drv/zfprotect64.sys

.sys windows:6 windows x64 arch:x64

660fefa95a0446139ee7ac6a2bf1adea

Code Sign

8f:6b:80:7a:51:06:62:f6:50:c7:cf:bc:07:3b:af:4e:79:33:9b:42
Signer

Actual PE Digest

8f:6b:80:7a:51:06:62:f6:50:c7:cf:bc:07:3b:af:4e:79:33:9b:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfprotect\drv\objchk_win7_amd64\amd64\zfprotect64.pdb

Imports

ntoskrnl.exe

ExInitializeResourceLite

IoDeleteSymbolicLink

IoDeleteDevice

IoCreateSymbolicLink

IoCreateDevice

RtlAssert

PsSetLoadImageNotifyRoutine

PsSetCreateProcessNotifyRoutine

PsRemoveLoadImageNotifyRoutine

PsGetCurrentThreadId

IoIs32bitProcess

RtlCopyUnicodeString

ExpInterlockedPushEntrySList

ExQueryDepthSList

ExDeleteNPagedLookasideList

ObQueryNameString

CmRegisterCallback

CmUnRegisterCallback

KeBugCheckEx

ExDeleteResourceLite

RtlCompareMemory

PsGetProcessId

PsGetCurrentProcessId

ZwOpenProcess

PsThreadType

IoFreeMdl

RtlGetVersion

MmGetSystemRoutineAddress

PsProcessType

IoThreadToProcess

MmUnmapLockedPages

RtlCompareUnicodeString

MmMapLockedPagesSpecifyCache

ZwOpenKey

IofCompleteRequest

ZwClose

ZwQueryValueKey

RtlInitUnicodeString

ExFreePoolWithTag

ExAllocatePoolWithTag

DbgPrint

ExInitializeNPagedLookasideList

PsLookupProcessByProcessId

ObfDereferenceObject

ObOpenObjectByPointer

__C_specific_handler

fltmgr.sys

FltBuildDefaultSecurityDescriptor

FltFreeSecurityDescriptor

FltCreateCommunicationPort

FltCloseClientPort

FltSendMessage

FltAcquireResourceExclusive

FltReleaseResource

FltStartFiltering

FltParseFileNameInformation

FltReleaseFileNameInformation

FltRegisterFilter

FltUnregisterFilter

FltGetFileNameInformation

FltAllocateContext

FltReleaseContext

FltReissueSynchronousIo

FltIsOperationSynchronous

FltSetCallbackDataDirty

FltGetDestinationFileNameInformation

FltGetRequestorProcessId

FltSetStreamHandleContext

FltGetStreamHandleContext

FltAcquireResourceShared

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/zfprotectxp.inf

drv/zfpuser32.dll

.dll windows:5 windows x86 arch:x86

c8a6fd5b8928243fb77bb65cab6c6d44

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

17:9c:b8:55:12:ef:bf:bf:0e:99:67:42:37:39:51:46:f4:f6:4f:3c:3f:e1:e5:b0:8b:a3:1b:31:0d:4f:26:ac
Signer

Actual PE Digest

17:9c:b8:55:12:ef:bf:bf:0e:99:67:42:37:39:51:46:f4:f6:4f:3c:3f:e1:e5:b0:8b:a3:1b:31:0d:4f:26:ac

Digest Algorithm

sha256

PE Digest Matches

true

4e:32:99:e5:4d:14:d7:61:cd:2c:c4:07:1d:de:f9:14:fe:af:5f:78
Signer

Actual PE Digest

4e:32:99:e5:4d:14:d7:61:cd:2c:c4:07:1d:de:f9:14:fe:af:5f:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\driver\zfprotect\Release\zfpuser32.pdb

Imports

kernel32

lstrcpyW

GetLocalTime

lstrcpynW

VerSetConditionMask

MoveFileExW

GetCurrentProcess

GetModuleHandleW

CreateEventW

CopyFileW

VerifyVersionInfoW

GetProcAddress

DeleteFileW

InterlockedCompareExchange

GetCurrentProcessId

TlsSetValue

SetLastError

GetLongPathNameW

lstrlenW

GetProcessHeap

SetEvent

HeapFree

GetQueuedCompletionStatus

HeapAlloc

TlsFree

TlsAlloc

DisableThreadLibraryCalls

GetLastError

TlsGetValue

CreateThread

CreateIoCompletionPort

QueryDosDeviceW

WaitForMultipleObjects

GetTempPathW

FlushFileBuffers

WriteFile

GetTickCount

WaitForSingleObject

CloseHandle

GetFileTime

lstrcmpiW

DeviceIoControl

OpenMutexW

GetFileSizeEx

CreateFileW

GetModuleFileNameW

TerminateProcess

GetFileAttributesW

GetSystemDirectoryW

OpenProcess

SetEndOfFile

CreateFileA

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

GetStringTypeW

GetStringTypeA

IsValidLocale

EnumSystemLocalesA

GetLocaleInfoA

InterlockedIncrement

InterlockedDecrement

Sleep

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

CreateMutexW

FindFirstFileW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

CreateProcessW

GetLogicalDrives

GetVersionExW

ReadFile

lstrcmpW

FindClose

Process32FirstW

ProcessIdToSessionId

CreateFileMappingW

Process32NextW

WTSGetActiveConsoleSessionId

GetModuleHandleA

FindNextFileW

CreateToolhelp32Snapshot

TryEnterCriticalSection

ReleaseMutex

WideCharToMultiByte

MultiByteToWideChar

VirtualQuery

OutputDebugStringW

lstrcatW

GetCurrentThreadId

GetFileInformationByHandle

OpenFileMappingW

OpenEventW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

ExitThread

GetCommandLineA

RaiseException

RtlUnwind

LCMapStringA

LCMapStringW

GetCPInfo

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapCreate

HeapDestroy

VirtualFree

VirtualAlloc

GetConsoleCP

GetConsoleMode

HeapSize

ExitProcess

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

advapi32

OpenProcessToken

CreateProcessAsUserW

RegOpenKeyW

SetTokenInformation

DuplicateTokenEx

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegEnumValueW

DeleteService

StartServiceW

RegQueryValueExW

RegNotifyChangeKeyValue

ChangeServiceConfigW

OpenServiceW

OpenSCManagerW

CloseServiceHandle

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

shell32

ShellExecuteExW

SHCreateDirectoryExW

fltlib

FilterGetMessage

FilterSendMessage

FilterConnectCommunicationPort

FilterReplyMessage

shlwapi

StrCmpNW

wvnsprintfW

PathFindFileNameA

SHDeleteValueW

StrCmpIW

StrStrIW

StrStrW

SHSetValueW

StrCmpNIW

SHGetValueW

StrCmpW

PathFindFileNameW

wnsprintfW

PathMatchSpecW

PathAppendW

SHDeleteKeyW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

EnumProcesses

version

GetFileVersionInfoW

GetFileVersionInfoSizeW

VerQueryValueW

userenv

DestroyEnvironmentBlock

CreateEnvironmentBlock

oleaut32

VariantClear

Exports

RegisterProcCreateNotify

RegisterProcDestroyNotify

RegisterProcessImageLoadNotify

RegisterPttRegOpPreDeleteKey

RegisterPttRegOpPreDeleteValueKey

RegisterPttRegOpPreRenameKey

RegisterPttRegOpPreSetValueKey

TestProc

UnRegisterProcCreateNotify

UnRegisterProcDestroyNotify

UnRegisterProcessImageLoadNotify

UnregisterPttRegOpPreDeleteKey

UnregisterPttRegOpPreDeleteValueKey

UnregisterPttRegOpPreRenameKey

UnregisterPttRegOpPreSetValueKey

ZfpAddSuperProcsByPath

ZfpBeginFileHide

ZfpBeginFileProtect

ZfpBeginProcGuard

ZfpCommitFileHide

ZfpCommitFileProtect

ZfpCommitProcGuard

ZfpDbgGetFileHideBlackPolicyJson

ZfpDbgGetFileHidePolicyJson

ZfpDbgGetFileOpPolicyJson

ZfpDbgGetFileProtectPolicyJson

ZfpDbgGetHookPassProcJson

ZfpDbgGetProcGuardPolicyJson

ZfpDbgGetSuperProcsJson

ZfpFileHideClearPolicy

ZfpFileHideClearPrivilegeProc

ZfpFileHideSetPathSet

ZfpFileHideSetPrivilegeProcPathSet

ZfpFileProtectAddProtectPath

ZfpFileProtectClearLayerPolicy

ZfpFileProtectSetPriProc

ZfpGetDrvClient

ZfpInitEnv

ZfpInitEnv2

ZfpInstallService

ZfpIsProtectStoped

ZfpIsServiceActivated

ZfpIsServiceExist

ZfpProcGuardClearPolicy

ZfpProcGuardClearPrivilegeProc

ZfpProcGuardRegisterLogReceiver

ZfpProcGuardSetPrivilegeProcPathSet

ZfpProcGuardSetProcPathSet

ZfpProcGuardUnRegisterLogReceiver

ZfpRemoveService

ZfpSetKeyProtectPolicy

ZfpStartService

ZfpStopProtect

ZfpStopService

Sections

.text
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv/zfpuser32_temp.dll

.dll windows:5 windows x86 arch:x86

c8a6fd5b8928243fb77bb65cab6c6d44

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

17:9c:b8:55:12:ef:bf:bf:0e:99:67:42:37:39:51:46:f4:f6:4f:3c:3f:e1:e5:b0:8b:a3:1b:31:0d:4f:26:ac
Signer

Actual PE Digest

17:9c:b8:55:12:ef:bf:bf:0e:99:67:42:37:39:51:46:f4:f6:4f:3c:3f:e1:e5:b0:8b:a3:1b:31:0d:4f:26:ac

Digest Algorithm

sha256

PE Digest Matches

true

4e:32:99:e5:4d:14:d7:61:cd:2c:c4:07:1d:de:f9:14:fe:af:5f:78
Signer

Actual PE Digest

4e:32:99:e5:4d:14:d7:61:cd:2c:c4:07:1d:de:f9:14:fe:af:5f:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\driver\zfprotect\Release\zfpuser32.pdb

Imports

kernel32

lstrcpyW

GetLocalTime

lstrcpynW

VerSetConditionMask

MoveFileExW

GetCurrentProcess

GetModuleHandleW

CreateEventW

CopyFileW

VerifyVersionInfoW

GetProcAddress

DeleteFileW

InterlockedCompareExchange

GetCurrentProcessId

TlsSetValue

SetLastError

GetLongPathNameW

lstrlenW

GetProcessHeap

SetEvent

HeapFree

GetQueuedCompletionStatus

HeapAlloc

TlsFree

TlsAlloc

DisableThreadLibraryCalls

GetLastError

TlsGetValue

CreateThread

CreateIoCompletionPort

QueryDosDeviceW

WaitForMultipleObjects

GetTempPathW

FlushFileBuffers

WriteFile

GetTickCount

WaitForSingleObject

CloseHandle

GetFileTime

lstrcmpiW

DeviceIoControl

OpenMutexW

GetFileSizeEx

CreateFileW

GetModuleFileNameW

TerminateProcess

GetFileAttributesW

GetSystemDirectoryW

OpenProcess

SetEndOfFile

CreateFileA

GetLocaleInfoW

LoadLibraryA

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

InitializeCriticalSectionAndSpinCount

GetStringTypeW

GetStringTypeA

IsValidLocale

EnumSystemLocalesA

GetLocaleInfoA

InterlockedIncrement

InterlockedDecrement

Sleep

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

CreateMutexW

FindFirstFileW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

CreateProcessW

GetLogicalDrives

GetVersionExW

ReadFile

lstrcmpW

FindClose

Process32FirstW

ProcessIdToSessionId

CreateFileMappingW

Process32NextW

WTSGetActiveConsoleSessionId

GetModuleHandleA

FindNextFileW

CreateToolhelp32Snapshot

TryEnterCriticalSection

ReleaseMutex

WideCharToMultiByte

MultiByteToWideChar

VirtualQuery

OutputDebugStringW

lstrcatW

GetCurrentThreadId

GetFileInformationByHandle

OpenFileMappingW

OpenEventW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

ExitThread

GetCommandLineA

RaiseException

RtlUnwind

LCMapStringA

LCMapStringW

GetCPInfo

HeapReAlloc

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

HeapCreate

HeapDestroy

VirtualFree

VirtualAlloc

GetConsoleCP

GetConsoleMode

HeapSize

ExitProcess

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetACP

GetOEMCP

IsValidCodePage

GetUserDefaultLCID

advapi32

OpenProcessToken

CreateProcessAsUserW

RegOpenKeyW

SetTokenInformation

DuplicateTokenEx

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegEnumValueW

DeleteService

StartServiceW

RegQueryValueExW

RegNotifyChangeKeyValue

ChangeServiceConfigW

OpenServiceW

OpenSCManagerW

CloseServiceHandle

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

shell32

ShellExecuteExW

SHCreateDirectoryExW

fltlib

FilterGetMessage

FilterSendMessage

FilterConnectCommunicationPort

FilterReplyMessage

shlwapi

StrCmpNW

wvnsprintfW

PathFindFileNameA

SHDeleteValueW

StrCmpIW

StrStrIW

StrStrW

SHSetValueW

StrCmpNIW

SHGetValueW

StrCmpW

PathFindFileNameW

wnsprintfW

PathMatchSpecW

PathAppendW

SHDeleteKeyW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

EnumProcesses

version

GetFileVersionInfoW

GetFileVersionInfoSizeW

VerQueryValueW

userenv

DestroyEnvironmentBlock

CreateEnvironmentBlock

oleaut32

VariantClear

Exports

RegisterProcCreateNotify

RegisterProcDestroyNotify

RegisterProcessImageLoadNotify

RegisterPttRegOpPreDeleteKey

RegisterPttRegOpPreDeleteValueKey

RegisterPttRegOpPreRenameKey

RegisterPttRegOpPreSetValueKey

TestProc

UnRegisterProcCreateNotify

UnRegisterProcDestroyNotify

UnRegisterProcessImageLoadNotify

UnregisterPttRegOpPreDeleteKey

UnregisterPttRegOpPreDeleteValueKey

UnregisterPttRegOpPreRenameKey

UnregisterPttRegOpPreSetValueKey

ZfpAddSuperProcsByPath

ZfpBeginFileHide

ZfpBeginFileProtect

ZfpBeginProcGuard

ZfpCommitFileHide

ZfpCommitFileProtect

ZfpCommitProcGuard

ZfpDbgGetFileHideBlackPolicyJson

ZfpDbgGetFileHidePolicyJson

ZfpDbgGetFileOpPolicyJson

ZfpDbgGetFileProtectPolicyJson

ZfpDbgGetHookPassProcJson

ZfpDbgGetProcGuardPolicyJson

ZfpDbgGetSuperProcsJson

ZfpFileHideClearPolicy

ZfpFileHideClearPrivilegeProc

ZfpFileHideSetPathSet

ZfpFileHideSetPrivilegeProcPathSet

ZfpFileProtectAddProtectPath

ZfpFileProtectClearLayerPolicy

ZfpFileProtectSetPriProc

ZfpGetDrvClient

ZfpInitEnv

ZfpInitEnv2

ZfpInstallService

ZfpIsProtectStoped

ZfpIsServiceActivated

ZfpIsServiceExist

ZfpProcGuardClearPolicy

ZfpProcGuardClearPrivilegeProc

ZfpProcGuardRegisterLogReceiver

ZfpProcGuardSetPrivilegeProcPathSet

ZfpProcGuardSetProcPathSet

ZfpProcGuardUnRegisterLogReceiver

ZfpRemoveService

ZfpSetKeyProtectPolicy

ZfpStartService

ZfpStopProtect

ZfpStopService

Sections

.text
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/DrvUser32.dll

.dll windows:5 windows x86 arch:x86

7a9d42f3bab9973f510e2c577f966170

Code Sign

14:9b:cb:0c:79:18:83:fb:eb:e3:2c:d4:13:aa:21:7e:01:59:53:93
Signer

Actual PE Digest

14:9b:cb:0c:79:18:83:fb:eb:e3:2c:d4:13:aa:21:7e:01:59:53:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\local\WinDivert\Debug\DrvUser32.pdb

Imports

kernel32

TlsGetValue

TlsSetValue

CreateEventW

TlsAlloc

CreateFileW

ReleaseMutex

CloseHandle

CreateMutexW

GetModuleFileNameW

IsWow64Process

GetCurrentProcess

GetOverlappedResult

DeviceIoControl

TlsFree

GetLastError

HeapCreate

HeapAlloc

HeapDestroy

WaitForSingleObject

SetLastError

GetCurrentThreadId

GetCommandLineA

IsDebuggerPresent

RaiseException

DebugBreak

WideCharToMultiByte

MultiByteToWideChar

lstrlenA

GetProcAddress

LoadLibraryA

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetModuleHandleW

InterlockedIncrement

InterlockedDecrement

GetCurrentThread

HeapValidate

IsBadReadPtr

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapFree

VirtualFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetProcessHeap

VirtualQuery

FreeLibrary

EnterCriticalSection

LeaveCriticalSection

FatalAppExitA

GetACP

GetOEMCP

GetCPInfo

IsValidCodePage

HeapSize

HeapReAlloc

VirtualAlloc

WriteFile

SetConsoleCtrlHandler

InterlockedExchange

InitializeCriticalSectionAndSpinCount

RtlUnwind

OutputDebugStringA

WriteConsoleW

OutputDebugStringW

LoadLibraryW

GetTimeFormatA

GetDateFormatA

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

LCMapStringA

LCMapStringW

GetLocaleInfoW

GetTimeZoneInformation

SetFilePointer

GetConsoleCP

GetConsoleMode

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

CreateFileA

FlushFileBuffers

CompareStringA

CompareStringW

SetEnvironmentVariableA

advapi32

OpenServiceW

CreateServiceW

StartServiceW

DeleteService

CloseServiceHandle

OpenSCManagerW

Exports

WinDivertClose

WinDivertGetParam

WinDivertHelperCalcChecksums

WinDivertHelperCompileFilter

WinDivertHelperDecrementTTL

WinDivertHelperEvalFilter

WinDivertHelperFormatFilter

WinDivertHelperFormatIPv4Address

WinDivertHelperFormatIPv6Address

WinDivertHelperHashPacket

WinDivertHelperHtonIPv6Address

WinDivertHelperHtonIpv6Address

WinDivertHelperHtonl

WinDivertHelperHtonll

WinDivertHelperHtons

WinDivertHelperNtohIPv6Address

WinDivertHelperNtohIpv6Address

WinDivertHelperNtohl

WinDivertHelperNtohll

WinDivertHelperNtohs

WinDivertHelperParseIPv4Address

WinDivertHelperParseIPv6Address

WinDivertHelperParsePacket

WinDivertOpen

WinDivertRecv

WinDivertRecvEx

WinDivertSend

WinDivertSendEx

WinDivertSetParam

WinDivertShutdown

Sections

.textbss
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.text
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/DrvUser32.dll0

.dll windows:5 windows x86 arch:x86

7a9d42f3bab9973f510e2c577f966170

Code Sign

14:9b:cb:0c:79:18:83:fb:eb:e3:2c:d4:13:aa:21:7e:01:59:53:93
Signer

Actual PE Digest

14:9b:cb:0c:79:18:83:fb:eb:e3:2c:d4:13:aa:21:7e:01:59:53:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\workspace\local\WinDivert\Debug\DrvUser32.pdb

Imports

kernel32

TlsGetValue

TlsSetValue

CreateEventW

TlsAlloc

CreateFileW

ReleaseMutex

CloseHandle

CreateMutexW

GetModuleFileNameW

IsWow64Process

GetCurrentProcess

GetOverlappedResult

DeviceIoControl

TlsFree

GetLastError

HeapCreate

HeapAlloc

HeapDestroy

WaitForSingleObject

SetLastError

GetCurrentThreadId

GetCommandLineA

IsDebuggerPresent

RaiseException

DebugBreak

WideCharToMultiByte

MultiByteToWideChar

lstrlenA

GetProcAddress

LoadLibraryA

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetModuleHandleW

InterlockedIncrement

InterlockedDecrement

GetCurrentThread

HeapValidate

IsBadReadPtr

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapFree

VirtualFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetProcessHeap

VirtualQuery

FreeLibrary

EnterCriticalSection

LeaveCriticalSection

FatalAppExitA

GetACP

GetOEMCP

GetCPInfo

IsValidCodePage

HeapSize

HeapReAlloc

VirtualAlloc

WriteFile

SetConsoleCtrlHandler

InterlockedExchange

InitializeCriticalSectionAndSpinCount

RtlUnwind

OutputDebugStringA

WriteConsoleW

OutputDebugStringW

LoadLibraryW

GetTimeFormatA

GetDateFormatA

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

LCMapStringA

LCMapStringW

GetLocaleInfoW

GetTimeZoneInformation

SetFilePointer

GetConsoleCP

GetConsoleMode

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

CreateFileA

FlushFileBuffers

CompareStringA

CompareStringW

SetEnvironmentVariableA

advapi32

OpenServiceW

CreateServiceW

StartServiceW

DeleteService

CloseServiceHandle

OpenSCManagerW

Exports

WinDivertClose

WinDivertGetParam

WinDivertHelperCalcChecksums

WinDivertHelperCompileFilter

WinDivertHelperDecrementTTL

WinDivertHelperEvalFilter

WinDivertHelperFormatFilter

WinDivertHelperFormatIPv4Address

WinDivertHelperFormatIPv6Address

WinDivertHelperHashPacket

WinDivertHelperHtonIPv6Address

WinDivertHelperHtonIpv6Address

WinDivertHelperHtonl

WinDivertHelperHtonll

WinDivertHelperHtons

WinDivertHelperNtohIPv6Address

WinDivertHelperNtohIpv6Address

WinDivertHelperNtohl

WinDivertHelperNtohll

WinDivertHelperNtohs

WinDivertHelperParseIPv4Address

WinDivertHelperParseIPv6Address

WinDivertHelperParsePacket

WinDivertOpen

WinDivertRecv

WinDivertRecvEx

WinDivertSend

WinDivertSendEx

WinDivertSetParam

WinDivertShutdown

Sections

.textbss
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.text
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/netsf.inf

drv_wall/netsf.inf0

drv_wall/netsf_m.inf

drv_wall/netsf_m.inf0

drv_wall/zfnetwall32.sys

.sys windows:6 windows x86 arch:x86

c6b3b68ca6d0de4da281cff421b98cf5

Code Sign

1e:a4:3a:b1:d6:b5:d7:ab:c6:bf:fa:f3:08:a2:20:50:69:cd:f8:dc
Signer

Actual PE Digest

1e:a4:3a:b1:d6:b5:d7:ab:c6:bf:fa:f3:08:a2:20:50:69:cd:f8:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\local\windivert\install\WDDK\i386\zfnetwall32.pdb

Imports

ntoskrnl.exe

_aullshr

ExUuidCreate

_allmul

ExFreePoolWithTag

ObfDereferenceObject

PsGetProcessId

MmMapLockedPagesSpecifyCache

memcpy

RtlCopyUnicodeString

ExAllocatePoolWithTag

IoFreeMdl

MmBuildMdlForNonPagedPool

IoAllocateMdl

KeBugCheckEx

KeTickCount

RtlIntegerToUnicodeString

IoAllocateErrorLogEntry

IoWriteErrorLogEntry

_allshl

IoGetRequestorProcess

ObfReferenceObject

IoGetCurrentProcess

memset

_alldiv

RtlGetVersion

hal

KeReleaseInStackQueuedSpinLock

KeAcquireInStackQueuedSpinLock

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool

NdisGetDataBuffer

NdisRetreatNetBufferDataStart

NdisAdvanceNetBufferDataStart

NdisFreeNetBufferListPool

NdisFreeNetBufferPool

NdisAllocateNetBufferListPool

fwpkclnt.sys

FwpmProviderDeleteByKey0

FwpsAllocateNetBufferAndNetBufferList0

FwpsInjectForwardAsync0

FwpsInjectNetworkSendAsync0

FwpsInjectNetworkReceiveAsync0

FwpsFreeNetBufferList0

FwpsFlowAssociateContext0

FwpsQueryPacketInjectionState0

FwpsCalloutRegister0

FwpmCalloutAdd0

FwpmFilterAdd0

FwpmFilterDeleteByKey0

FwpmCalloutDeleteByKey0

FwpsCalloutUnregisterByKey0

FwpsFlowRemoveContext0

FwpmSubLayerAdd0

FwpmProviderAdd0

FwpsInjectionHandleDestroy0

FwpmEngineClose0

FwpmSubLayerDeleteByKey0

FwpsInjectionHandleCreate0

FwpmTransactionCommit0

FwpmTransactionAbort0

FwpmTransactionBegin0

FwpmEngineOpen0

wdfldr.sys

WdfVersionBind

WdfVersionBindClass

WdfVersionUnbindClass

WdfVersionUnbind

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfnetwall32.sys0

.sys windows:6 windows x86 arch:x86

c6b3b68ca6d0de4da281cff421b98cf5

Code Sign

1e:a4:3a:b1:d6:b5:d7:ab:c6:bf:fa:f3:08:a2:20:50:69:cd:f8:dc
Signer

Actual PE Digest

1e:a4:3a:b1:d6:b5:d7:ab:c6:bf:fa:f3:08:a2:20:50:69:cd:f8:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\local\windivert\install\WDDK\i386\zfnetwall32.pdb

Imports

ntoskrnl.exe

_aullshr

ExUuidCreate

_allmul

ExFreePoolWithTag

ObfDereferenceObject

PsGetProcessId

MmMapLockedPagesSpecifyCache

memcpy

RtlCopyUnicodeString

ExAllocatePoolWithTag

IoFreeMdl

MmBuildMdlForNonPagedPool

IoAllocateMdl

KeBugCheckEx

KeTickCount

RtlIntegerToUnicodeString

IoAllocateErrorLogEntry

IoWriteErrorLogEntry

_allshl

IoGetRequestorProcess

ObfReferenceObject

IoGetCurrentProcess

memset

_alldiv

RtlGetVersion

hal

KeReleaseInStackQueuedSpinLock

KeAcquireInStackQueuedSpinLock

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool

NdisGetDataBuffer

NdisRetreatNetBufferDataStart

NdisAdvanceNetBufferDataStart

NdisFreeNetBufferListPool

NdisFreeNetBufferPool

NdisAllocateNetBufferListPool

fwpkclnt.sys

FwpmProviderDeleteByKey0

FwpsAllocateNetBufferAndNetBufferList0

FwpsInjectForwardAsync0

FwpsInjectNetworkSendAsync0

FwpsInjectNetworkReceiveAsync0

FwpsFreeNetBufferList0

FwpsFlowAssociateContext0

FwpsQueryPacketInjectionState0

FwpsCalloutRegister0

FwpmCalloutAdd0

FwpmFilterAdd0

FwpmFilterDeleteByKey0

FwpmCalloutDeleteByKey0

FwpsCalloutUnregisterByKey0

FwpsFlowRemoveContext0

FwpmSubLayerAdd0

FwpmProviderAdd0

FwpsInjectionHandleDestroy0

FwpmEngineClose0

FwpmSubLayerDeleteByKey0

FwpsInjectionHandleCreate0

FwpmTransactionCommit0

FwpmTransactionAbort0

FwpmTransactionBegin0

FwpmEngineOpen0

wdfldr.sys

WdfVersionBind

WdfVersionBindClass

WdfVersionUnbindClass

WdfVersionUnbind

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfnetwall64.sys

.sys windows:6 windows x64 arch:x64

07e58449b42cdb30e52832d7c548b398

Code Sign

14:33:14:96:21:e2:32:d1:59:b6:90:ea:fb:e8:3e:3a:f3:71:cd:70
Signer

Actual PE Digest

14:33:14:96:21:e2:32:d1:59:b6:90:ea:fb:e8:3e:3a:f3:71:cd:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\workspace\local\windivert\install\WDDK\amd64\zfnetwall64.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString

KeBugCheckEx

IoAllocateMdl

PsGetProcessId

ObfDereferenceObject

ObfReferenceObject

IoGetCurrentProcess

MmMapLockedPagesSpecifyCache

IoAllocateErrorLogEntry

IoFreeMdl

MmBuildMdlForNonPagedPool

KeAcquireInStackQueuedSpinLock

RtlGetVersion

RtlIntegerToUnicodeString

KeReleaseInStackQueuedSpinLock

IoGetRequestorProcess

ExFreePoolWithTag

ExUuidCreate

IoWriteErrorLogEntry

ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

ndis.sys

NdisFreeNetBufferListPool

NdisAdvanceNetBufferDataStart

NdisRetreatNetBufferDataStart

NdisFreeNetBufferPool

NdisGetDataBuffer

NdisAllocateNetBufferPool

NdisAllocateNetBufferListPool

fwpkclnt.sys

FwpsInjectionHandleDestroy0

FwpsInjectionHandleCreate0

FwpmTransactionCommit0

FwpsInjectNetworkSendAsync0

FwpmCalloutAdd0

FwpmSubLayerDeleteByKey0

FwpsQueryPacketInjectionState0

FwpmFilterDeleteByKey0

FwpmCalloutDeleteByKey0

FwpsFlowRemoveContext0

FwpsInjectNetworkReceiveAsync0

FwpmSubLayerAdd0

FwpsCalloutUnregisterByKey0

FwpsFlowAssociateContext0

FwpsAllocateNetBufferAndNetBufferList0

FwpsFreeNetBufferList0

FwpmEngineClose0

FwpmTransactionBegin0

FwpmFilterAdd0

FwpmProviderDeleteByKey0

FwpmEngineOpen0

FwpmTransactionAbort0

FwpsCalloutRegister0

FwpmProviderAdd0

FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass

WdfVersionUnbindClass

WdfVersionBind

WdfVersionUnbind

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfnetwall64.sys0

.sys windows:6 windows x64 arch:x64

07e58449b42cdb30e52832d7c548b398

Code Sign

14:33:14:96:21:e2:32:d1:59:b6:90:ea:fb:e8:3e:3a:f3:71:cd:70
Signer

Actual PE Digest

14:33:14:96:21:e2:32:d1:59:b6:90:ea:fb:e8:3e:3a:f3:71:cd:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\workspace\local\windivert\install\WDDK\amd64\zfnetwall64.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString

KeBugCheckEx

IoAllocateMdl

PsGetProcessId

ObfDereferenceObject

ObfReferenceObject

IoGetCurrentProcess

MmMapLockedPagesSpecifyCache

IoAllocateErrorLogEntry

IoFreeMdl

MmBuildMdlForNonPagedPool

KeAcquireInStackQueuedSpinLock

RtlGetVersion

RtlIntegerToUnicodeString

KeReleaseInStackQueuedSpinLock

IoGetRequestorProcess

ExFreePoolWithTag

ExUuidCreate

IoWriteErrorLogEntry

ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

ndis.sys

NdisFreeNetBufferListPool

NdisAdvanceNetBufferDataStart

NdisRetreatNetBufferDataStart

NdisFreeNetBufferPool

NdisGetDataBuffer

NdisAllocateNetBufferPool

NdisAllocateNetBufferListPool

fwpkclnt.sys

FwpsInjectionHandleDestroy0

FwpsInjectionHandleCreate0

FwpmTransactionCommit0

FwpsInjectNetworkSendAsync0

FwpmCalloutAdd0

FwpmSubLayerDeleteByKey0

FwpsQueryPacketInjectionState0

FwpmFilterDeleteByKey0

FwpmCalloutDeleteByKey0

FwpsFlowRemoveContext0

FwpsInjectNetworkReceiveAsync0

FwpmSubLayerAdd0

FwpsCalloutUnregisterByKey0

FwpsFlowAssociateContext0

FwpsAllocateNetBufferAndNetBufferList0

FwpsFreeNetBufferList0

FwpmEngineClose0

FwpmTransactionBegin0

FwpmFilterAdd0

FwpmProviderDeleteByKey0

FwpmEngineOpen0

FwpmTransactionAbort0

FwpsCalloutRegister0

FwpmProviderAdd0

FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass

WdfVersionUnbindClass

WdfVersionBind

WdfVersionUnbind

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwall.sys

.sys windows:6 windows x86 arch:x86

058b39d337179c1089675f6f647b1c9e

Code Sign

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74
Signer

Actual PE Digest

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\driver\nt5\objchk_win7_x86\i386\zfwall32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx

KeTickCount

MmMapLockedPagesSpecifyCache

IoGetStackLimits

IoFreeMdl

DbgPrint

RtlCompareString

PsSetCreateProcessNotifyRoutine

memcpy

ExAllocatePoolWithTag

ExFreePoolWithTag

RtlAssert

IofCompleteRequest

PsGetCurrentProcessId

memset

RtlInitUnicodeString

ZwOpenEvent

ZwClose

RtlCopyUnicodeString

MmGetSystemRoutineAddress

ObfDereferenceObject

ObOpenObjectByPointer

PsLookupProcessByProcessId

ZwEnumerateKey

ZwOpenKey

ZwQueryValueKey

KeQueryTimeIncrement

_alldiv

_allmul

KeDelayExecutionThread

_aullrem

_aulldiv

_allrem

hal

KfReleaseSpinLock

KeGetCurrentIrql

KfAcquireSpinLock

ndis.sys

NdisGetReceivedPacket

NdisDprAllocatePacket

NdisDprFreePacket

NdisDeregisterProtocol

NdisIMCancelInitializeDeviceInstance

NdisIMDeInitializeDeviceInstance

NdisOpenProtocolConfiguration

NdisIMNotifyPnPEvent

NdisInitializeEvent

NdisAllocatePacketPoolEx

NdisAllocateBufferPool

NdisOpenAdapter

NdisIMInitializeDeviceInstanceEx

NdisCloseConfiguration

NdisMDeregisterDevice

NdisReEnumerateProtocolBindings

NdisPacketPoolUsage

NdisReadConfiguration

NdisMRegisterUnloadHandler

NdisSetEvent

NdisMSetAttributesEx

NdisIMGetDeviceContext

NdisFreePacket

NdisIMCopySendCompletePerPacketInfo

NdisIMCopySendPerPacketInfo

NdisAllocatePacket

NdisIMGetCurrentPacketStack

NdisFreeMemory

NdisUnchainBufferAtFront

NdisAllocateBuffer

NdisAllocateMemoryWithTag

NdisRequest

NdisMIndicateStatusComplete

NdisMIndicateStatus

NdisReturnPackets

NdisGetPoolFromPacket

NdisWaitEvent

NdisCloseAdapter

NdisResetEvent

NdisCancelSendPackets

NdisFreeBufferPool

NdisFreePacketPool

NdisTerminateWrapper

NdisIMAssociateMiniport

NdisIMDeregisterLayeredMiniport

NdisRegisterProtocol

NdisMSleep

NdisIMRegisterLayeredMiniport

NdisInitializeWrapper

NdisMRegisterDevice

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwall.sys0

.sys windows:6 windows x86 arch:x86

058b39d337179c1089675f6f647b1c9e

Code Sign

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74
Signer

Actual PE Digest

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\driver\nt5\objchk_win7_x86\i386\zfwall32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx

KeTickCount

MmMapLockedPagesSpecifyCache

IoGetStackLimits

IoFreeMdl

DbgPrint

RtlCompareString

PsSetCreateProcessNotifyRoutine

memcpy

ExAllocatePoolWithTag

ExFreePoolWithTag

RtlAssert

IofCompleteRequest

PsGetCurrentProcessId

memset

RtlInitUnicodeString

ZwOpenEvent

ZwClose

RtlCopyUnicodeString

MmGetSystemRoutineAddress

ObfDereferenceObject

ObOpenObjectByPointer

PsLookupProcessByProcessId

ZwEnumerateKey

ZwOpenKey

ZwQueryValueKey

KeQueryTimeIncrement

_alldiv

_allmul

KeDelayExecutionThread

_aullrem

_aulldiv

_allrem

hal

KfReleaseSpinLock

KeGetCurrentIrql

KfAcquireSpinLock

ndis.sys

NdisGetReceivedPacket

NdisDprAllocatePacket

NdisDprFreePacket

NdisDeregisterProtocol

NdisIMCancelInitializeDeviceInstance

NdisIMDeInitializeDeviceInstance

NdisOpenProtocolConfiguration

NdisIMNotifyPnPEvent

NdisInitializeEvent

NdisAllocatePacketPoolEx

NdisAllocateBufferPool

NdisOpenAdapter

NdisIMInitializeDeviceInstanceEx

NdisCloseConfiguration

NdisMDeregisterDevice

NdisReEnumerateProtocolBindings

NdisPacketPoolUsage

NdisReadConfiguration

NdisMRegisterUnloadHandler

NdisSetEvent

NdisMSetAttributesEx

NdisIMGetDeviceContext

NdisFreePacket

NdisIMCopySendCompletePerPacketInfo

NdisIMCopySendPerPacketInfo

NdisAllocatePacket

NdisIMGetCurrentPacketStack

NdisFreeMemory

NdisUnchainBufferAtFront

NdisAllocateBuffer

NdisAllocateMemoryWithTag

NdisRequest

NdisMIndicateStatusComplete

NdisMIndicateStatus

NdisReturnPackets

NdisGetPoolFromPacket

NdisWaitEvent

NdisCloseAdapter

NdisResetEvent

NdisCancelSendPackets

NdisFreeBufferPool

NdisFreePacketPool

NdisTerminateWrapper

NdisIMAssociateMiniport

NdisIMDeregisterLayeredMiniport

NdisRegisterProtocol

NdisMSleep

NdisIMRegisterLayeredMiniport

NdisInitializeWrapper

NdisMRegisterDevice

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwallinst.exe

.exe windows:5 windows x86 arch:x86

82d097f49887af5989f34b8b8c939243

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\Release\zfwallinst.pdb

Imports

kernel32

GetVersionExW

GetFileAttributesW

GetModuleFileNameW

GetLastError

GetProcAddress

FormatMessageW

GetLocalTime

FindNextFileW

DeleteFileW

LocalFree

LoadLibraryW

GetSystemDirectoryW

MoveFileExW

FindFirstFileW

FindClose

GetCommandLineW

CreateFileA

CloseHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

FlushFileBuffers

GetLocaleInfoW

InitializeCriticalSectionAndSpinCount

LoadLibraryA

GetConsoleMode

GetConsoleCP

SetFilePointer

GetTimeZoneInformation

GetModuleHandleA

GetStringTypeA

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

HeapReAlloc

VirtualAlloc

HeapSize

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

QueryPerformanceCounter

InterlockedIncrement

InterlockedDecrement

WideCharToMultiByte

Sleep

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

InterlockedCompareExchange

MultiByteToWideChar

GetLocaleInfoA

UnhandledExceptionFilter

SetUnhandledExceptionFilter

HeapFree

RtlUnwind

RaiseException

TerminateProcess

GetCurrentProcess

IsDebuggerPresent

LCMapStringA

LCMapStringW

GetCPInfo

GetTimeFormatA

GetDateFormatA

CompareStringA

CompareStringW

GetStringTypeW

HeapAlloc

GetACP

GetOEMCP

IsValidCodePage

GetModuleHandleW

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

SetLastError

GetCurrentThreadId

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

SetHandleCount

GetFileType

GetStartupInfoA

HeapCreate

VirtualFree

SetEnvironmentVariableA

advapi32

OpenServiceW

OpenSCManagerW

DeleteService

CloseServiceHandle

QueryServiceStatus

shell32

SHGetFolderPathW

CommandLineToArgvW

ole32

CoTaskMemFree

CoUninitialize

CoInitialize

CoTaskMemAlloc

CoCreateInstance

shlwapi

PathAppendW

SHDeleteKeyW

wnsprintfW

setupapi

SetupCopyOEMInfW

SetupGetStringFieldW

SetupCloseInfFile

SetupOpenInfFileW

SetupFindFirstLineW

Sections

.text
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwallinst.exe0

.exe windows:5 windows x86 arch:x86

82d097f49887af5989f34b8b8c939243

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\Release\zfwallinst.pdb

Imports

kernel32

GetVersionExW

GetFileAttributesW

GetModuleFileNameW

GetLastError

GetProcAddress

FormatMessageW

GetLocalTime

FindNextFileW

DeleteFileW

LocalFree

LoadLibraryW

GetSystemDirectoryW

MoveFileExW

FindFirstFileW

FindClose

GetCommandLineW

CreateFileA

CloseHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

FlushFileBuffers

GetLocaleInfoW

InitializeCriticalSectionAndSpinCount

LoadLibraryA

GetConsoleMode

GetConsoleCP

SetFilePointer

GetTimeZoneInformation

GetModuleHandleA

GetStringTypeA

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

HeapReAlloc

VirtualAlloc

HeapSize

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

QueryPerformanceCounter

InterlockedIncrement

InterlockedDecrement

WideCharToMultiByte

Sleep

InterlockedExchange

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

InterlockedCompareExchange

MultiByteToWideChar

GetLocaleInfoA

UnhandledExceptionFilter

SetUnhandledExceptionFilter

HeapFree

RtlUnwind

RaiseException

TerminateProcess

GetCurrentProcess

IsDebuggerPresent

LCMapStringA

LCMapStringW

GetCPInfo

GetTimeFormatA

GetDateFormatA

CompareStringA

CompareStringW

GetStringTypeW

HeapAlloc

GetACP

GetOEMCP

IsValidCodePage

GetModuleHandleW

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

SetLastError

GetCurrentThreadId

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

SetHandleCount

GetFileType

GetStartupInfoA

HeapCreate

VirtualFree

SetEnvironmentVariableA

advapi32

OpenServiceW

OpenSCManagerW

DeleteService

CloseServiceHandle

QueryServiceStatus

shell32

SHGetFolderPathW

CommandLineToArgvW

ole32

CoTaskMemFree

CoUninitialize

CoInitialize

CoTaskMemAlloc

CoCreateInstance

shlwapi

PathAppendW

SHDeleteKeyW

wnsprintfW

setupapi

SetupCopyOEMInfW

SetupGetStringFieldW

SetupCloseInfFile

SetupOpenInfFileW

SetupFindFirstLineW

Sections

.text
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwallmp.sys

.sys windows:6 windows x86 arch:x86

058b39d337179c1089675f6f647b1c9e

Code Sign

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74
Signer

Actual PE Digest

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\driver\nt5\objchk_win7_x86\i386\zfwall32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx

KeTickCount

MmMapLockedPagesSpecifyCache

IoGetStackLimits

IoFreeMdl

DbgPrint

RtlCompareString

PsSetCreateProcessNotifyRoutine

memcpy

ExAllocatePoolWithTag

ExFreePoolWithTag

RtlAssert

IofCompleteRequest

PsGetCurrentProcessId

memset

RtlInitUnicodeString

ZwOpenEvent

ZwClose

RtlCopyUnicodeString

MmGetSystemRoutineAddress

ObfDereferenceObject

ObOpenObjectByPointer

PsLookupProcessByProcessId

ZwEnumerateKey

ZwOpenKey

ZwQueryValueKey

KeQueryTimeIncrement

_alldiv

_allmul

KeDelayExecutionThread

_aullrem

_aulldiv

_allrem

hal

KfReleaseSpinLock

KeGetCurrentIrql

KfAcquireSpinLock

ndis.sys

NdisGetReceivedPacket

NdisDprAllocatePacket

NdisDprFreePacket

NdisDeregisterProtocol

NdisIMCancelInitializeDeviceInstance

NdisIMDeInitializeDeviceInstance

NdisOpenProtocolConfiguration

NdisIMNotifyPnPEvent

NdisInitializeEvent

NdisAllocatePacketPoolEx

NdisAllocateBufferPool

NdisOpenAdapter

NdisIMInitializeDeviceInstanceEx

NdisCloseConfiguration

NdisMDeregisterDevice

NdisReEnumerateProtocolBindings

NdisPacketPoolUsage

NdisReadConfiguration

NdisMRegisterUnloadHandler

NdisSetEvent

NdisMSetAttributesEx

NdisIMGetDeviceContext

NdisFreePacket

NdisIMCopySendCompletePerPacketInfo

NdisIMCopySendPerPacketInfo

NdisAllocatePacket

NdisIMGetCurrentPacketStack

NdisFreeMemory

NdisUnchainBufferAtFront

NdisAllocateBuffer

NdisAllocateMemoryWithTag

NdisRequest

NdisMIndicateStatusComplete

NdisMIndicateStatus

NdisReturnPackets

NdisGetPoolFromPacket

NdisWaitEvent

NdisCloseAdapter

NdisResetEvent

NdisCancelSendPackets

NdisFreeBufferPool

NdisFreePacketPool

NdisTerminateWrapper

NdisIMAssociateMiniport

NdisIMDeregisterLayeredMiniport

NdisRegisterProtocol

NdisMSleep

NdisIMRegisterLayeredMiniport

NdisInitializeWrapper

NdisMRegisterDevice

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwallmp.sys0

.sys windows:6 windows x86 arch:x86

058b39d337179c1089675f6f647b1c9e

Code Sign

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74
Signer

Actual PE Digest

89:84:dd:79:3f:fd:16:01:6c:31:70:34:84:03:9e:64:fd:69:ce:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\driver\nt5\objchk_win7_x86\i386\zfwall32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx

KeTickCount

MmMapLockedPagesSpecifyCache

IoGetStackLimits

IoFreeMdl

DbgPrint

RtlCompareString

PsSetCreateProcessNotifyRoutine

memcpy

ExAllocatePoolWithTag

ExFreePoolWithTag

RtlAssert

IofCompleteRequest

PsGetCurrentProcessId

memset

RtlInitUnicodeString

ZwOpenEvent

ZwClose

RtlCopyUnicodeString

MmGetSystemRoutineAddress

ObfDereferenceObject

ObOpenObjectByPointer

PsLookupProcessByProcessId

ZwEnumerateKey

ZwOpenKey

ZwQueryValueKey

KeQueryTimeIncrement

_alldiv

_allmul

KeDelayExecutionThread

_aullrem

_aulldiv

_allrem

hal

KfReleaseSpinLock

KeGetCurrentIrql

KfAcquireSpinLock

ndis.sys

NdisGetReceivedPacket

NdisDprAllocatePacket

NdisDprFreePacket

NdisDeregisterProtocol

NdisIMCancelInitializeDeviceInstance

NdisIMDeInitializeDeviceInstance

NdisOpenProtocolConfiguration

NdisIMNotifyPnPEvent

NdisInitializeEvent

NdisAllocatePacketPoolEx

NdisAllocateBufferPool

NdisOpenAdapter

NdisIMInitializeDeviceInstanceEx

NdisCloseConfiguration

NdisMDeregisterDevice

NdisReEnumerateProtocolBindings

NdisPacketPoolUsage

NdisReadConfiguration

NdisMRegisterUnloadHandler

NdisSetEvent

NdisMSetAttributesEx

NdisIMGetDeviceContext

NdisFreePacket

NdisIMCopySendCompletePerPacketInfo

NdisIMCopySendPerPacketInfo

NdisAllocatePacket

NdisIMGetCurrentPacketStack

NdisFreeMemory

NdisUnchainBufferAtFront

NdisAllocateBuffer

NdisAllocateMemoryWithTag

NdisRequest

NdisMIndicateStatusComplete

NdisMIndicateStatus

NdisReturnPackets

NdisGetPoolFromPacket

NdisWaitEvent

NdisCloseAdapter

NdisResetEvent

NdisCancelSendPackets

NdisFreeBufferPool

NdisFreePacketPool

NdisTerminateWrapper

NdisIMAssociateMiniport

NdisIMDeregisterLayeredMiniport

NdisRegisterProtocol

NdisMSleep

NdisIMRegisterLayeredMiniport

NdisInitializeWrapper

NdisMRegisterDevice

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwalluser32.dll

.dll windows:5 windows x86 arch:x86

8f3122851b8f6b6c6fc1244cb9e7a710

Code Sign

80:45:88:89:d4:dd:5f:a4:02:be:04:b8:fa:12:33:97:36:fb:c1:be
Signer

Actual PE Digest

80:45:88:89:d4:dd:5f:a4:02:be:04:b8:fa:12:33:97:36:fb:c1:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\Debug\zfwalluser32.pdb

Imports

kernel32

GetModuleHandleW

DeleteFileW

GetCurrentProcess

LoadLibraryW

QueryDosDeviceW

GetProcAddress

GetSystemDirectoryW

MoveFileExW

CopyFileW

GetFileAttributesW

WaitForSingleObject

LocalAlloc

GetExitCodeProcess

CreateMutexW

OpenMutexW

VerSetConditionMask

VerifyVersionInfoW

GetTickCount

GetCurrentProcessId

OpenEventW

SetEvent

CreateThread

GetLastError

Sleep

TlsGetValue

InterlockedExchange

TlsSetValue

DeviceIoControl

CreateFileW

CloseHandle

TlsAlloc

DisableThreadLibraryCalls

GetModuleFileNameW

InterlockedCompareExchange

TlsFree

SetEnvironmentVariableA

CompareStringW

CompareStringA

CreateFileA

GetTimeZoneInformation

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetUserDefaultLCID

EnumSystemLocalesA

IsValidLocale

GetDateFormatA

InterlockedIncrement

InterlockedDecrement

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

lstrlenW

lstrlenA

lstrcmpA

lstrcmpiA

WideCharToMultiByte

MultiByteToWideChar

GetLocalTime

FindClose

FindNextFileW

lstrcmpW

FindFirstFileW

lstrcpyW

RemoveDirectoryW

ReadFile

GetFileSizeEx

GetModuleHandleA

GetLogicalDrives

OpenProcess

Process32NextW

Process32FirstW

CreateToolhelp32Snapshot

GetVersionExW

CreateEventW

CreateProcessW

WTSGetActiveConsoleSessionId

ProcessIdToSessionId

lstrcpynW

MapViewOfFile

CreateFileMappingW

UnmapViewOfFile

TerminateProcess

GetStartupInfoW

CreatePipe

SetFilePointer

ResumeThread

SuspendThread

OpenThread

Thread32Next

Thread32First

ReleaseMutex

TryEnterCriticalSection

GetFileInformationByHandle

OutputDebugStringW

lstrcatW

GetCurrentThreadId

FlushFileBuffers

WriteFile

VirtualQuery

WaitForMultipleObjects

OpenFileMappingW

ExpandEnvironmentStringsW

GetEnvironmentVariableW

RtlUnwind

RaiseException

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCommandLineA

HeapValidate

IsBadReadPtr

WriteConsoleW

GetFileType

GetStdHandle

ExitProcess

SetLastError

GetCurrentThread

DebugBreak

LoadLibraryA

FatalAppExitA

OutputDebugStringA

SetConsoleCtrlHandler

GetModuleFileNameA

SetHandleCount

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapDestroy

HeapCreate

HeapFree

VirtualFree

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapAlloc

HeapSize

HeapReAlloc

VirtualAlloc

GetACP

GetOEMCP

GetCPInfo

IsValidCodePage

GetConsoleCP

GetConsoleMode

LCMapStringA

LCMapStringW

FreeLibrary

InitializeCriticalSectionAndSpinCount

GetProcessHeap

GetLocaleInfoW

GetLocaleInfoA

GetStringTypeA

GetStringTypeW

GetTimeFormatA

LocalFree

advapi32

RegSetKeySecurity

RegOpenKeyW

RegEnumKeyW

ConvertStringSecurityDescriptorToSecurityDescriptorW

InitializeSecurityDescriptor

ConvertStringSecurityDescriptorToSecurityDescriptorA

CreateProcessAsUserW

DuplicateTokenEx

LookupPrivilegeValueW

GetTokenInformation

OpenProcessToken

SetTokenInformation

CloseServiceHandle

OpenServiceW

OpenSCManagerW

ChangeServiceConfig2W

CreateServiceW

StartServiceW

ControlService

QueryServiceStatus

DeleteService

SetServiceStatus

RegCreateKeyExW

RegSetValueExW

RegCloseKey

RegOpenKeyExW

RegQueryValueExW

RegEnumValueW

iphlpapi

GetAdaptersInfo

shlwapi

PathFindFileNameW

PathFindFileNameA

wvnsprintfW

wnsprintfA

PathFileExistsW

SHGetValueW

SHSetValueW

wnsprintfW

StrStrIA

StrStrA

StrStrIW

StrStrW

StrCmpNIA

StrCmpNA

StrCmpIW

StrCmpW

StrCmpNIW

StrCmpNW

PathMatchSpecW

PathAppendW

SHDeleteKeyW

ws2_32

htonl

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

version

GetFileVersionInfoSizeW

GetFileVersionInfoW

VerQueryValueW

userenv

CreateEnvironmentBlock

DestroyEnvironmentBlock

user32

GetWindowTextLengthW

GetDesktopWindow

GetWindowRect

MoveWindow

IsWindow

GetWindowTextW

shell32

SHCreateDirectoryExW

SHGetDesktopFolder

SHOpenFolderAndSelectItems

ShellExecuteW

ole32

CoUninitialize

CoInitializeSecurity

CoCreateInstance

CoTaskMemFree

CoSetProxyBlanket

CoInitialize

CoInitializeEx

oleaut32

CreateErrorInfo

SetErrorInfo

VariantChangeType

GetErrorInfo

SysFreeString

VariantInit

SysAllocString

VariantClear

Exports

TestProc

ZfWallAddWhiteIpSectionV4

ZfWallSetIpHeaderTtl

ZfWallSetTcpSynHeaderOption

ZfwallAddBlackIpSectionV4

ZfwallBeginIpPortPolicy

ZfwallClearAllPolicy

ZfwallClearIpHeaderTtl

ZfwallClearIpPortPolicy

ZfwallClearSuperProcs

ZfwallClearTcpSynHeaderOption

ZfwallCommitIpPortPolicy

ZfwallDbgGetIpPortPolicyJson

ZfwallDbgGetLastError

ZfwallDbgGetSuperProcsJson

ZfwallGetDrvStat

ZfwallInitEnv

ZfwallInstallService

ZfwallIsSuspend

ZfwallNotifyUserServiceStart

ZfwallRemoveService

ZfwallResume

ZfwallServiceInit

ZfwallSetSuperProcs

ZfwallStopService

ZfwallSuspend

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.didat
Size: 1024B - Virtual size: 939B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

drv_wall/zfwalluser32_temp.dll

.dll windows:5 windows x86 arch:x86

8f3122851b8f6b6c6fc1244cb9e7a710

Code Sign

80:45:88:89:d4:dd:5f:a4:02:be:04:b8:fa:12:33:97:36:fb:c1:be
Signer

Actual PE Digest

80:45:88:89:d4:dd:5f:a4:02:be:04:b8:fa:12:33:97:36:fb:c1:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\driver\zfnetwall\Debug\zfwalluser32.pdb

Imports

kernel32

GetModuleHandleW

DeleteFileW

GetCurrentProcess

LoadLibraryW

QueryDosDeviceW

GetProcAddress

GetSystemDirectoryW

MoveFileExW

CopyFileW

GetFileAttributesW

WaitForSingleObject

LocalAlloc

GetExitCodeProcess

CreateMutexW

OpenMutexW

VerSetConditionMask

VerifyVersionInfoW

GetTickCount

GetCurrentProcessId

OpenEventW

SetEvent

CreateThread

GetLastError

Sleep

TlsGetValue

InterlockedExchange

TlsSetValue

DeviceIoControl

CreateFileW

CloseHandle

TlsAlloc

DisableThreadLibraryCalls

GetModuleFileNameW

InterlockedCompareExchange

TlsFree

SetEnvironmentVariableA

CompareStringW

CompareStringA

CreateFileA

GetTimeZoneInformation

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetUserDefaultLCID

EnumSystemLocalesA

IsValidLocale

GetDateFormatA

InterlockedIncrement

InterlockedDecrement

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

lstrlenW

lstrlenA

lstrcmpA

lstrcmpiA

WideCharToMultiByte

MultiByteToWideChar

GetLocalTime

FindClose

FindNextFileW

lstrcmpW

FindFirstFileW

lstrcpyW

RemoveDirectoryW

ReadFile

GetFileSizeEx

GetModuleHandleA

GetLogicalDrives

OpenProcess

Process32NextW

Process32FirstW

CreateToolhelp32Snapshot

GetVersionExW

CreateEventW

CreateProcessW

WTSGetActiveConsoleSessionId

ProcessIdToSessionId

lstrcpynW

MapViewOfFile

CreateFileMappingW

UnmapViewOfFile

TerminateProcess

GetStartupInfoW

CreatePipe

SetFilePointer

ResumeThread

SuspendThread

OpenThread

Thread32Next

Thread32First

ReleaseMutex

TryEnterCriticalSection

GetFileInformationByHandle

OutputDebugStringW

lstrcatW

GetCurrentThreadId

FlushFileBuffers

WriteFile

VirtualQuery

WaitForMultipleObjects

OpenFileMappingW

ExpandEnvironmentStringsW

GetEnvironmentVariableW

RtlUnwind

RaiseException

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCommandLineA

HeapValidate

IsBadReadPtr

WriteConsoleW

GetFileType

GetStdHandle

ExitProcess

SetLastError

GetCurrentThread

DebugBreak

LoadLibraryA

FatalAppExitA

OutputDebugStringA

SetConsoleCtrlHandler

GetModuleFileNameA

SetHandleCount

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapDestroy

HeapCreate

HeapFree

VirtualFree

QueryPerformanceCounter

GetSystemTimeAsFileTime

HeapAlloc

HeapSize

HeapReAlloc

VirtualAlloc

GetACP

GetOEMCP

GetCPInfo

IsValidCodePage

GetConsoleCP

GetConsoleMode

LCMapStringA

LCMapStringW

FreeLibrary

InitializeCriticalSectionAndSpinCount

GetProcessHeap

GetLocaleInfoW

GetLocaleInfoA

GetStringTypeA

GetStringTypeW

GetTimeFormatA

LocalFree

advapi32

RegSetKeySecurity

RegOpenKeyW

RegEnumKeyW

ConvertStringSecurityDescriptorToSecurityDescriptorW

InitializeSecurityDescriptor

ConvertStringSecurityDescriptorToSecurityDescriptorA

CreateProcessAsUserW

DuplicateTokenEx

LookupPrivilegeValueW

GetTokenInformation

OpenProcessToken

SetTokenInformation

CloseServiceHandle

OpenServiceW

OpenSCManagerW

ChangeServiceConfig2W

CreateServiceW

StartServiceW

ControlService

QueryServiceStatus

DeleteService

SetServiceStatus

RegCreateKeyExW

RegSetValueExW

RegCloseKey

RegOpenKeyExW

RegQueryValueExW

RegEnumValueW

iphlpapi

GetAdaptersInfo

shlwapi

PathFindFileNameW

PathFindFileNameA

wvnsprintfW

wnsprintfA

PathFileExistsW

SHGetValueW

SHSetValueW

wnsprintfW

StrStrIA

StrStrA

StrStrIW

StrStrW

StrCmpNIA

StrCmpNA

StrCmpIW

StrCmpW

StrCmpNIW

StrCmpNW

PathMatchSpecW

PathAppendW

SHDeleteKeyW

ws2_32

htonl

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

version

GetFileVersionInfoSizeW

GetFileVersionInfoW

VerQueryValueW

userenv

CreateEnvironmentBlock

DestroyEnvironmentBlock

user32

GetWindowTextLengthW

GetDesktopWindow

GetWindowRect

MoveWindow

IsWindow

GetWindowTextW

shell32

SHCreateDirectoryExW

SHGetDesktopFolder

SHOpenFolderAndSelectItems

ShellExecuteW

ole32

CoUninitialize

CoInitializeSecurity

CoCreateInstance

CoTaskMemFree

CoSetProxyBlanket

CoInitialize

CoInitializeEx

oleaut32

CreateErrorInfo

SetErrorInfo

VariantChangeType

GetErrorInfo

SysFreeString

VariantInit

SysAllocString

VariantClear

Exports

TestProc

ZfWallAddWhiteIpSectionV4

ZfWallSetIpHeaderTtl

ZfWallSetTcpSynHeaderOption

ZfwallAddBlackIpSectionV4

ZfwallBeginIpPortPolicy

ZfwallClearAllPolicy

ZfwallClearIpHeaderTtl

ZfwallClearIpPortPolicy

ZfwallClearSuperProcs

ZfwallClearTcpSynHeaderOption

ZfwallCommitIpPortPolicy

ZfwallDbgGetIpPortPolicyJson

ZfwallDbgGetLastError

ZfwallDbgGetSuperProcsJson

ZfwallGetDrvStat

ZfwallInitEnv

ZfwallInstallService

ZfwallIsSuspend

ZfwallNotifyUserServiceStart

ZfwallRemoveService

ZfwallResume

ZfwallServiceInit

ZfwallSetSuperProcs

ZfwallStopService

ZfwallSuspend

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.didat
Size: 1024B - Virtual size: 939B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

installhlpr.dll

.dll windows:5 windows x86 arch:x86

94e91baf89fe6680b2b93597262b497e

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00
Signer

Actual PE Digest

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00

Digest Algorithm

sha256

PE Digest Matches

true

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48
Signer

Actual PE Digest

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\installhlpr.pdb

Imports

kernel32

WriteFile

SetEndOfFile

GetCurrentProcessId

SetFilePointerEx

CopyFileW

GetFileSizeEx

MoveFileExW

DeleteFileW

TerminateProcess

WaitForSingleObject

OpenProcess

HeapFree

GetProcessHeap

HeapAlloc

GetCurrentProcess

GetModuleHandleW

GetProcAddress

CloseHandle

Sleep

LockFileEx

CreateFileW

LocalFree

LocalAlloc

GetLastError

SetLastError

lstrlenW

GetLocalTime

SetEnvironmentVariableA

CompareStringW

CompareStringA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetModuleHandleA

GetLocaleInfoA

GetStringTypeW

GetEnvironmentVariableW

ExpandEnvironmentStringsW

WideCharToMultiByte

MultiByteToWideChar

GetFullPathNameW

GetFullPathNameA

HeapReAlloc

CreateFileA

GetFileSize

CreateMutexW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

FreeLibrary

SystemTimeToFileTime

QueryPerformanceCounter

InterlockedCompareExchange

UnlockFile

LockFile

GetTickCount

UnlockFileEx

GetSystemTimeAsFileTime

FormatMessageA

InitializeCriticalSection

LoadLibraryW

FormatMessageW

HeapDestroy

LeaveCriticalSection

GetFileAttributesA

HeapCreate

HeapValidate

GetFileAttributesW

ReadFile

FlushFileBuffers

GetTempPathW

HeapSize

EnterCriticalSection

GetDiskFreeSpaceW

LoadLibraryA

CreateFileMappingW

GetDiskFreeSpaceA

GetSystemInfo

GetFileAttributesExW

DeleteCriticalSection

GetVersionExA

GetTempPathA

GetSystemTime

AreFileApisANSI

DeleteFileA

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

InterlockedDecrement

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

VirtualFree

VirtualAlloc

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

GetTimeZoneInformation

GetConsoleCP

GetConsoleMode

InitializeCriticalSectionAndSpinCount

GetStringTypeA

DisableThreadLibraryCalls

user32

LoadStringW

advapi32

DeregisterEventSource

OpenProcessToken

QueryServiceStatusEx

ChangeServiceConfigW

CreateServiceW

OpenSCManagerW

CloseServiceHandle

DeleteService

ControlService

OpenServiceW

FreeSid

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

SetEntriesInAclW

AllocateAndInitializeSid

RegQueryValueExW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegSetValueExW

RegCreateKeyExW

GetTokenInformation

ReportEventW

RegisterEventSourceW

shell32

ord165

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

PathMatchSpecW

PathQuoteSpacesW

PathAppendW

Exports

AddEventSource

AppendFileToInventory

AssureUpdateServiceImageCanRelease

ClearFileInventory

CreateSharedKeys

CreateUpdateService

DeleteUpdateService

EnumFilesInInventory

EventMessage

FixDefaultPolicies

GetInstallLock

GetLocalBuildNumber

IsEffectUntilReboot

RemoveEventSource

RenameFileReboot

ResetFileInventory

UninstallOldServices

WriteLog

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

installhlpr.dll0

.dll windows:5 windows x86 arch:x86

94e91baf89fe6680b2b93597262b497e

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00
Signer

Actual PE Digest

2b:ed:ac:83:0e:70:1c:06:5b:ad:01:86:a5:07:3d:63:2f:11:9f:1e:91:24:6b:42:3a:07:60:72:d3:c3:47:00

Digest Algorithm

sha256

PE Digest Matches

true

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48
Signer

Actual PE Digest

5b:3a:c6:33:e1:b6:6b:87:65:c4:58:d3:e4:1a:58:a0:93:22:5a:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\installhlpr.pdb

Imports

kernel32

WriteFile

SetEndOfFile

GetCurrentProcessId

SetFilePointerEx

CopyFileW

GetFileSizeEx

MoveFileExW

DeleteFileW

TerminateProcess

WaitForSingleObject

OpenProcess

HeapFree

GetProcessHeap

HeapAlloc

GetCurrentProcess

GetModuleHandleW

GetProcAddress

CloseHandle

Sleep

LockFileEx

CreateFileW

LocalFree

LocalAlloc

GetLastError

SetLastError

lstrlenW

GetLocalTime

SetEnvironmentVariableA

CompareStringW

CompareStringA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetModuleHandleA

GetLocaleInfoA

GetStringTypeW

GetEnvironmentVariableW

ExpandEnvironmentStringsW

WideCharToMultiByte

MultiByteToWideChar

GetFullPathNameW

GetFullPathNameA

HeapReAlloc

CreateFileA

GetFileSize

CreateMutexW

SetFilePointer

MapViewOfFile

UnmapViewOfFile

FreeLibrary

SystemTimeToFileTime

QueryPerformanceCounter

InterlockedCompareExchange

UnlockFile

LockFile

GetTickCount

UnlockFileEx

GetSystemTimeAsFileTime

FormatMessageA

InitializeCriticalSection

LoadLibraryW

FormatMessageW

HeapDestroy

LeaveCriticalSection

GetFileAttributesA

HeapCreate

HeapValidate

GetFileAttributesW

ReadFile

FlushFileBuffers

GetTempPathW

HeapSize

EnterCriticalSection

GetDiskFreeSpaceW

LoadLibraryA

CreateFileMappingW

GetDiskFreeSpaceA

GetSystemInfo

GetFileAttributesExW

DeleteCriticalSection

GetVersionExA

GetTempPathA

GetSystemTime

AreFileApisANSI

DeleteFileA

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

InterlockedDecrement

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

VirtualFree

VirtualAlloc

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

GetTimeZoneInformation

GetConsoleCP

GetConsoleMode

InitializeCriticalSectionAndSpinCount

GetStringTypeA

DisableThreadLibraryCalls

user32

LoadStringW

advapi32

DeregisterEventSource

OpenProcessToken

QueryServiceStatusEx

ChangeServiceConfigW

CreateServiceW

OpenSCManagerW

CloseServiceHandle

DeleteService

ControlService

OpenServiceW

FreeSid

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

SetEntriesInAclW

AllocateAndInitializeSid

RegQueryValueExW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegSetValueExW

RegCreateKeyExW

GetTokenInformation

ReportEventW

RegisterEventSourceW

shell32

ord165

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

PathMatchSpecW

PathQuoteSpacesW

PathAppendW

Exports

AddEventSource

AppendFileToInventory

AssureUpdateServiceImageCanRelease

ClearFileInventory

CreateSharedKeys

CreateUpdateService

DeleteUpdateService

EnumFilesInInventory

EventMessage

FixDefaultPolicies

GetInstallLock

GetLocalBuildNumber

IsEffectUntilReboot

RemoveEventSource

RenameFileReboot

ResetFileInventory

UninstallOldServices

WriteLog

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

unins000.exe

.exe windows:5 windows x86 arch:x86

377e77a34869ad6920ef6c3aaf6b935f

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

58:73:bb:f1:35:02:6a:fa:5e:8d:ff:6b:bc:a4:12:bb:3c:20:56:1a:93:d7:03:1d:d1:21:25:81:bf:1e:5d:70
Signer

Actual PE Digest

58:73:bb:f1:35:02:6a:fa:5e:8d:ff:6b:bc:a4:12:bb:3c:20:56:1a:93:d7:03:1d:d1:21:25:81:bf:1e:5d:70

Digest Algorithm

sha256

PE Digest Matches

true

3c:43:28:dc:b9:44:30:1a:d2:ce:eb:a3:0e:ab:1c:d1:2d:e8:9e:ee
Signer

Actual PE Digest

3c:43:28:dc:b9:44:30:1a:d2:ce:eb:a3:0e:ab:1c:d1:2d:e8:9e:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\unins000.pdb

Imports

kernel32

CreateFileW

DeviceIoControl

CloseHandle

CreateMutexW

GetModuleFileNameW

DeleteFileW

GetLastError

CompareStringW

LCMapStringW

LCMapStringA

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetModuleHandleW

Sleep

GetProcAddress

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineW

SetHandleCount

GetFileType

GetStartupInfoA

DeleteCriticalSection

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

GetCurrentThreadId

InterlockedDecrement

HeapCreate

VirtualFree

HeapFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

HeapAlloc

VirtualAlloc

HeapReAlloc

RtlUnwind

HeapSize

GetLocaleInfoA

WideCharToMultiByte

GetStringTypeA

MultiByteToWideChar

GetStringTypeW

shlwapi

PathAppendW

PathRemoveFileSpecW

PathMatchSpecW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

unins000.exe0

.exe windows:5 windows x86 arch:x86

377e77a34869ad6920ef6c3aaf6b935f

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

58:73:bb:f1:35:02:6a:fa:5e:8d:ff:6b:bc:a4:12:bb:3c:20:56:1a:93:d7:03:1d:d1:21:25:81:bf:1e:5d:70
Signer

Actual PE Digest

58:73:bb:f1:35:02:6a:fa:5e:8d:ff:6b:bc:a4:12:bb:3c:20:56:1a:93:d7:03:1d:d1:21:25:81:bf:1e:5d:70

Digest Algorithm

sha256

PE Digest Matches

true

3c:43:28:dc:b9:44:30:1a:d2:ce:eb:a3:0e:ab:1c:d1:2d:e8:9e:ee
Signer

Actual PE Digest

3c:43:28:dc:b9:44:30:1a:d2:ce:eb:a3:0e:ab:1c:d1:2d:e8:9e:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\work\nhqdpt\trunk\src\hook\HookPlat\VS2008\Release\unins000.pdb

Imports

kernel32

CreateFileW

DeviceIoControl

CloseHandle

CreateMutexW

GetModuleFileNameW

DeleteFileW

GetLastError

CompareStringW

LCMapStringW

LCMapStringA

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetModuleHandleW

Sleep

GetProcAddress

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineW

SetHandleCount

GetFileType

GetStartupInfoA

DeleteCriticalSection

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

GetCurrentThreadId

InterlockedDecrement

HeapCreate

VirtualFree

HeapFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

LeaveCriticalSection

EnterCriticalSection

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

HeapAlloc

VirtualAlloc

HeapReAlloc

RtlUnwind

HeapSize

GetLocaleInfoA

WideCharToMultiByte

GetStringTypeA

MultiByteToWideChar

GetStringTypeW

shlwapi

PathAppendW

PathRemoveFileSpecW

PathMatchSpecW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/Dumper64.dll

.dll windows:5 windows x64 arch:x64

6cb1514d16b172092a6292309387482d

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

66:05:d1:5e:c1:d1:dd:e7:17:df:87:f9:90:c9:48:94:66:96:f8:01:32:fc:8f:a5:80:b6:01:2d:6b:56:ed:df
Signer

Actual PE Digest

66:05:d1:5e:c1:d1:dd:e7:17:df:87:f9:90:c9:48:94:66:96:f8:01:32:fc:8f:a5:80:b6:01:2d:6b:56:ed:df

Digest Algorithm

sha256

PE Digest Matches

true

02:70:21:18:dc:ca:15:4c:a5:ce:1a:41:28:84:89:9e:8c:38:19:78
Signer

Actual PE Digest

02:70:21:18:dc:ca:15:4c:a5:ce:1a:41:28:84:89:9e:8c:38:19:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\modules\dumper\Release\Dumper64.pdb

Imports

kernel32

GetModuleFileNameW

CreateFileW

lstrlenW

GetProcAddress

GetLocalTime

GetSystemDirectoryW

CloseHandle

FileTimeToLocalFileTime

FileTimeToSystemTime

GetCurrentProcessId

lstrcpyW

OpenProcess

GetProcessTimes

GetCurrentThread

GetModuleHandleW

WaitForSingleObject

DeleteFileW

LoadLibraryW

GetCurrentProcess

SetUnhandledExceptionFilter

CreateProcessW

GetCurrentThreadId

DisableThreadLibraryCalls

LoadLibraryExA

LoadLibraryExW

VirtualProtect

VirtualAlloc

FlushInstructionCache

VirtualFree

SetThreadContext

GetThreadContext

GetFileInformationByHandle

lstrcatW

OutputDebugStringW

VirtualQuery

ResumeThread

SuspendThread

GetLastError

HeapFree

HeapAlloc

TerminateProcess

UnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RaiseException

RtlPcToFileHeader

HeapSetInformation

HeapCreate

HeapDestroy

Sleep

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

RtlUnwindEx

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

EnterCriticalSection

LeaveCriticalSection

WideCharToMultiByte

GetConsoleCP

GetConsoleMode

SetHandleCount

GetFileType

GetStartupInfoA

DeleteCriticalSection

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

HeapSize

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

FreeLibrary

LoadLibraryA

InitializeCriticalSectionAndSpinCount

CreateFileA

MultiByteToWideChar

SetFilePointer

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

SetStdHandle

FlushFileBuffers

HeapReAlloc

LCMapStringA

LCMapStringW

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetEndOfFile

GetProcessHeap

ReadFile

FindFirstFileW

GetLogicalDrives

GetVersionExW

lstrcpynW

GetFileAttributesW

lstrcmpW

GetFileSizeEx

FindClose

QueryDosDeviceW

GetModuleHandleA

FindNextFileW

shell32

SHCreateDirectoryExW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

shlwapi

wnsprintfW

SHGetValueW

StrCmpNIW

SHSetValueW

PathFindFileNameW

StrCmpIW

wvnsprintfW

PathFindFileNameA

PathAppendW

oleaut32

VariantClear

Exports

DumperInit

RundllFun

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/Dumper64.dll0

.dll windows:5 windows x64 arch:x64

6cb1514d16b172092a6292309387482d

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

66:05:d1:5e:c1:d1:dd:e7:17:df:87:f9:90:c9:48:94:66:96:f8:01:32:fc:8f:a5:80:b6:01:2d:6b:56:ed:df
Signer

Actual PE Digest

66:05:d1:5e:c1:d1:dd:e7:17:df:87:f9:90:c9:48:94:66:96:f8:01:32:fc:8f:a5:80:b6:01:2d:6b:56:ed:df

Digest Algorithm

sha256

PE Digest Matches

true

02:70:21:18:dc:ca:15:4c:a5:ce:1a:41:28:84:89:9e:8c:38:19:78
Signer

Actual PE Digest

02:70:21:18:dc:ca:15:4c:a5:ce:1a:41:28:84:89:9e:8c:38:19:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\modules\dumper\Release\Dumper64.pdb

Imports

kernel32

GetModuleFileNameW

CreateFileW

lstrlenW

GetProcAddress

GetLocalTime

GetSystemDirectoryW

CloseHandle

FileTimeToLocalFileTime

FileTimeToSystemTime

GetCurrentProcessId

lstrcpyW

OpenProcess

GetProcessTimes

GetCurrentThread

GetModuleHandleW

WaitForSingleObject

DeleteFileW

LoadLibraryW

GetCurrentProcess

SetUnhandledExceptionFilter

CreateProcessW

GetCurrentThreadId

DisableThreadLibraryCalls

LoadLibraryExA

LoadLibraryExW

VirtualProtect

VirtualAlloc

FlushInstructionCache

VirtualFree

SetThreadContext

GetThreadContext

GetFileInformationByHandle

lstrcatW

OutputDebugStringW

VirtualQuery

ResumeThread

SuspendThread

GetLastError

HeapFree

HeapAlloc

TerminateProcess

UnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RaiseException

RtlPcToFileHeader

HeapSetInformation

HeapCreate

HeapDestroy

Sleep

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

RtlUnwindEx

EncodePointer

DecodePointer

FlsGetValue

FlsFree

SetLastError

FlsAlloc

EnterCriticalSection

LeaveCriticalSection

WideCharToMultiByte

GetConsoleCP

GetConsoleMode

SetHandleCount

GetFileType

GetStartupInfoA

DeleteCriticalSection

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetSystemTimeAsFileTime

HeapSize

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

FreeLibrary

LoadLibraryA

InitializeCriticalSectionAndSpinCount

CreateFileA

MultiByteToWideChar

SetFilePointer

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

SetStdHandle

FlushFileBuffers

HeapReAlloc

LCMapStringA

LCMapStringW

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetEndOfFile

GetProcessHeap

ReadFile

FindFirstFileW

GetLogicalDrives

GetVersionExW

lstrcpynW

GetFileAttributesW

lstrcmpW

GetFileSizeEx

FindClose

QueryDosDeviceW

GetModuleHandleA

FindNextFileW

shell32

SHCreateDirectoryExW

psapi

GetModuleBaseNameW

GetProcessImageFileNameW

shlwapi

wnsprintfW

SHGetValueW

StrCmpNIW

SHSetValueW

PathFindFileNameW

StrCmpIW

wvnsprintfW

PathFindFileNameA

PathAppendW

oleaut32

VariantClear

Exports

DumperInit

RundllFun

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookDirReadPlugin.dll

.dll windows:5 windows x64 arch:x64

3eeac2ef980f7231d98c79460c1af569

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

09:dd:d2:fb:68:72:65:eb:d5:01:9c:71:88:27:b6:dc:52:1c:f7:5b:25:ac:07:b4:9c:f8:07:55:ee:d9:4d:c9
Signer

Actual PE Digest

09:dd:d2:fb:68:72:65:eb:d5:01:9c:71:88:27:b6:dc:52:1c:f7:5b:25:ac:07:b4:9c:f8:07:55:ee:d9:4d:c9

Digest Algorithm

sha256

PE Digest Matches

true

b2:73:a0:d3:6d:87:e3:d6:6e:8a:2f:c7:b3:35:2b:05:78:21:b8:8e
Signer

Actual PE Digest

b2:73:a0:d3:6d:87:e3:d6:6e:8a:2f:c7:b3:35:2b:05:78:21:b8:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\hook\HookPlat\x64\Release\ZfHookDirReadPlugin.pdb

Imports

kernel32

GetModuleFileNameW

lstrlenW

GetLastError

SetLastError

DisableThreadLibraryCalls

LockResource

SizeofResource

CloseHandle

GetFileInformationByHandle

GetVolumeInformationW

GetCurrentThread

GetTickCount

GetLogicalDrives

GetLogicalDriveStringsW

LoadResource

FindResourceW

FindResourceExW

GetDriveTypeW

UnmapViewOfFile

MapViewOfFile

OpenFileMappingW

IsBadStringPtrW

RaiseException

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

HeapDestroy

HeapAlloc

HeapFree

HeapReAlloc

HeapSize

GetProcessHeap

WideCharToMultiByte

MultiByteToWideChar

VirtualQuery

GetCurrentProcess

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetThreadContext

SetThreadContext

VirtualFree

FlushInstructionCache

VirtualAlloc

VirtualProtect

SuspendThread

ResumeThread

FindFirstFileW

SetFilePointer

GetModuleHandleW

TerminateProcess

lstrcmpW

GetProcAddress

FindClose

FindNextFileW

lstrcpyW

FlsSetValue

GetCommandLineA

RtlUnwindEx

RtlPcToFileHeader

RtlLookupFunctionEntry

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlCaptureContext

EncodePointer

DecodePointer

FlsGetValue

FlsFree

FlsAlloc

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapSetInformation

HeapCreate

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

GetConsoleCP

GetConsoleMode

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

CreateFileA

shlwapi

PathAppendW

SHSetValueW

PathMatchSpecW

PathFindFileNameA

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

StrCmpNIW

StrCmpIW

ntdll

NtCreateFile

NtQueryInformationFile

NtOpenFile

psapi

GetModuleBaseNameW

version

VerQueryValueW

GetFileVersionInfoSizeW

GetFileVersionInfoW

shell32

SHCreateDirectoryExW

oleaut32

VariantClear

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookDirReadPlugin.dll0

.dll windows:5 windows x64 arch:x64

3eeac2ef980f7231d98c79460c1af569

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

09:dd:d2:fb:68:72:65:eb:d5:01:9c:71:88:27:b6:dc:52:1c:f7:5b:25:ac:07:b4:9c:f8:07:55:ee:d9:4d:c9
Signer

Actual PE Digest

09:dd:d2:fb:68:72:65:eb:d5:01:9c:71:88:27:b6:dc:52:1c:f7:5b:25:ac:07:b4:9c:f8:07:55:ee:d9:4d:c9

Digest Algorithm

sha256

PE Digest Matches

true

b2:73:a0:d3:6d:87:e3:d6:6e:8a:2f:c7:b3:35:2b:05:78:21:b8:8e
Signer

Actual PE Digest

b2:73:a0:d3:6d:87:e3:d6:6e:8a:2f:c7:b3:35:2b:05:78:21:b8:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

d:\workspace\nhqdpt_develop\trunk\src\hook\HookPlat\x64\Release\ZfHookDirReadPlugin.pdb

Imports

kernel32

GetModuleFileNameW

lstrlenW

GetLastError

SetLastError

DisableThreadLibraryCalls

LockResource

SizeofResource

CloseHandle

GetFileInformationByHandle

GetVolumeInformationW

GetCurrentThread

GetTickCount

GetLogicalDrives

GetLogicalDriveStringsW

LoadResource

FindResourceW

FindResourceExW

GetDriveTypeW

UnmapViewOfFile

MapViewOfFile

OpenFileMappingW

IsBadStringPtrW

RaiseException

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

HeapDestroy

HeapAlloc

HeapFree

HeapReAlloc

HeapSize

GetProcessHeap

WideCharToMultiByte

MultiByteToWideChar

VirtualQuery

GetCurrentProcess

OutputDebugStringW

WriteFile

lstrcpynW

GetFileAttributesW

CreateFileW

FlushFileBuffers

GetFileSizeEx

GetLocalTime

lstrcatW

GetCurrentThreadId

DeleteFileW

GetCurrentProcessId

GetThreadContext

SetThreadContext

VirtualFree

FlushInstructionCache

VirtualAlloc

VirtualProtect

SuspendThread

ResumeThread

FindFirstFileW

SetFilePointer

GetModuleHandleW

TerminateProcess

lstrcmpW

GetProcAddress

FindClose

FindNextFileW

lstrcpyW

FlsSetValue

GetCommandLineA

RtlUnwindEx

RtlPcToFileHeader

RtlLookupFunctionEntry

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlCaptureContext

EncodePointer

DecodePointer

FlsGetValue

FlsFree

FlsAlloc

Sleep

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapSetInformation

HeapCreate

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LCMapStringA

LCMapStringW

GetConsoleCP

GetConsoleMode

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

CreateFileA

shlwapi

PathAppendW

SHSetValueW

PathMatchSpecW

PathFindFileNameA

SHGetValueW

PathFindFileNameW

wvnsprintfW

wnsprintfW

StrCmpNIW

StrCmpIW

ntdll

NtCreateFile

NtQueryInformationFile

NtOpenFile

psapi

GetModuleBaseNameW

version

VerQueryValueW

GetFileVersionInfoSizeW

GetFileVersionInfoW

shell32

SHCreateDirectoryExW

oleaut32

VariantClear

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookEng.dll

.dll windows:5 windows x64 arch:x64

c3055cf208d5480c745b48148b94614d

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

24:f1:5d:c9:84:9d:ce:55:a1:33:34:6e:3f:75:f1:be:ad:0d:ae:1d:5e:c6:ee:e0:dd:a0:a1:6b:7e:08:9d:8b
Signer

Actual PE Digest

24:f1:5d:c9:84:9d:ce:55:a1:33:34:6e:3f:75:f1:be:ad:0d:ae:1d:5e:c6:ee:e0:dd:a0:a1:6b:7e:08:9d:8b

Digest Algorithm

sha256

PE Digest Matches

true

6f:c9:1d:11:88:5a:c2:b7:dd:56:55:61:66:9a:d8:2e:13:35:dc:0b
Signer

Actual PE Digest

6f:c9:1d:11:88:5a:c2:b7:dd:56:55:61:66:9a:d8:2e:13:35:dc:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\x64\Release\ZfHookEng.pdb

Imports

kernel32

GetVolumeInformationW

GetFullPathNameW

CopyFileExW

MoveFileExW

GetModuleHandleW

GetCurrentThread

SetLastError

DeleteFileW

InitializeCriticalSection

LoadLibraryW

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

GetCurrentProcess

OpenProcess

GetCurrentProcessId

GetTempPathW

WaitForSingleObject

OutputDebugStringW

WaitNamedPipeW

WriteFile

ReadFile

GetOverlappedResult

CreateEventW

SetNamedPipeHandleState

CancelIo

LocalFree

QueryDosDeviceW

FindResourceExW

FindResourceW

LoadResource

SizeofResource

LockResource

SetFilePointer

WideCharToMultiByte

CreateFileW

GetLocalTime

GetFileSize

GetTickCount

lstrcpynW

GetFileAttributesW

TlsFree

lstrcmpiW

GetCurrentThreadId

VirtualProtect

GetFileInformationByHandle

CloseHandle

TlsAlloc

GetLastError

OpenMutexW

TlsSetValue

GetLogicalDriveStringsW

TlsGetValue

GetProcAddress

LoadLibraryExW

GetLongPathNameW

lstrlenW

CompareStringW

GetProcessHeap

HeapFree

HeapAlloc

VerifyVersionInfoW

GetModuleFileNameW

FormatMessageA

ResetEvent

OpenEventA

WaitForSingleObjectEx

SetEvent

CreateEventA

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

GetStringTypeW

GetStringTypeA

GetLocaleInfoA

GetLocaleInfoW

GetConsoleMode

GetConsoleCP

InitializeCriticalSectionAndSpinCount

LoadLibraryA

LCMapStringW

GetFileSizeEx

VerSetConditionMask

LCMapStringA

IsValidCodePage

GetOEMCP

RaiseException

HeapDestroy

HeapReAlloc

HeapSize

VirtualQuery

FlushFileBuffers

lstrcatW

GetThreadContext

SetThreadContext

VirtualFree

FlushInstructionCache

VirtualAlloc

SuspendThread

ResumeThread

FreeLibrary

LoadLibraryExA

MultiByteToWideChar

FindFirstFileW

GetLogicalDrives

TerminateProcess

lstrcmpW

FindClose

FindNextFileW

lstrcpyW

GetSystemDirectoryW

TryEnterCriticalSection

ReleaseMutex

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RtlUnwindEx

RtlPcToFileHeader

EncodePointer

DecodePointer

FlsGetValue

FlsFree

FlsAlloc

Sleep

ExitProcess

GetStdHandle

GetModuleFileNameA

HeapSetInformation

HeapCreate

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetCPInfo

GetACP

user32

IsWindow

GetWindowThreadProcessId

advapi32

RegCloseKey

RegOpenKeyExW

RegQueryValueExW

shell32

SHGetPathFromIDListW

CommandLineToArgvW

SHCreateDirectoryExW

ole32

CoTaskMemFree

oleaut32

VariantClear

zfhookpluginloader

CommAllocJsonRequest

CommReleaseRequest

IsCurProcNeedDetour

ClassicalPolicyHitTest

PolicyHitTest

CommSendRequest

CommIsActionConcerned

IsHitBlackImagePolicy

shlwapi

StrStrIW

PathFindExtensionW

StrCpyNW

PathFindFileNameW

wnsprintfW

PathRemoveFileSpecW

PathIsRelativeW

PathAppendW

SHGetValueW

PathFileExistsW

PathMatchSpecW

wvnsprintfW

SHSetValueW

PathFindFileNameA

StrCmpIW

StrCmpNIW

StrCmpNW

ntdll

NtQueryInformationFile

NtQueryInformationProcess

RtlInitUnicodeString

NtCreateFile

RtlNtStatusToDosError

NtClose

NtWriteFile

NtWaitForSingleObject

NtReadFile

psapi

GetModuleBaseNameW

GetModuleFileNameExW

GetProcessImageFileNameW

Exports

InitInject

UnInitInject

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookEng.dll0

.dll windows:5 windows x64 arch:x64

c3055cf208d5480c745b48148b94614d

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

24:f1:5d:c9:84:9d:ce:55:a1:33:34:6e:3f:75:f1:be:ad:0d:ae:1d:5e:c6:ee:e0:dd:a0:a1:6b:7e:08:9d:8b
Signer

Actual PE Digest

24:f1:5d:c9:84:9d:ce:55:a1:33:34:6e:3f:75:f1:be:ad:0d:ae:1d:5e:c6:ee:e0:dd:a0:a1:6b:7e:08:9d:8b

Digest Algorithm

sha256

PE Digest Matches

true

6f:c9:1d:11:88:5a:c2:b7:dd:56:55:61:66:9a:d8:2e:13:35:dc:0b
Signer

Actual PE Digest

6f:c9:1d:11:88:5a:c2:b7:dd:56:55:61:66:9a:d8:2e:13:35:dc:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

f:\work\nhqdpt\trunk\src\hook\HookPlat\x64\Release\ZfHookEng.pdb

Imports

kernel32

GetVolumeInformationW

GetFullPathNameW

CopyFileExW

MoveFileExW

GetModuleHandleW

GetCurrentThread

SetLastError

DeleteFileW

InitializeCriticalSection

LoadLibraryW

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

GetCurrentProcess

OpenProcess

GetCurrentProcessId

GetTempPathW

WaitForSingleObject

OutputDebugStringW

WaitNamedPipeW

WriteFile

ReadFile

GetOverlappedResult

CreateEventW

SetNamedPipeHandleState

CancelIo

LocalFree

QueryDosDeviceW

FindResourceExW

FindResourceW

LoadResource

SizeofResource

LockResource

SetFilePointer

WideCharToMultiByte

CreateFileW

GetLocalTime

GetFileSize

GetTickCount

lstrcpynW

GetFileAttributesW

TlsFree

lstrcmpiW

GetCurrentThreadId

VirtualProtect

GetFileInformationByHandle

CloseHandle

TlsAlloc

GetLastError

OpenMutexW

TlsSetValue

GetLogicalDriveStringsW

TlsGetValue

GetProcAddress

LoadLibraryExW

GetLongPathNameW

lstrlenW

CompareStringW

GetProcessHeap

HeapFree

HeapAlloc

VerifyVersionInfoW

GetModuleFileNameW

FormatMessageA

ResetEvent

OpenEventA

WaitForSingleObjectEx

SetEvent

CreateEventA

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

GetStringTypeW

GetStringTypeA

GetLocaleInfoA

GetLocaleInfoW

GetConsoleMode

GetConsoleCP

InitializeCriticalSectionAndSpinCount

LoadLibraryA

LCMapStringW

GetFileSizeEx

VerSetConditionMask

LCMapStringA

IsValidCodePage

GetOEMCP

RaiseException

HeapDestroy

HeapReAlloc

HeapSize

VirtualQuery

FlushFileBuffers

lstrcatW

GetThreadContext

SetThreadContext

VirtualFree

FlushInstructionCache

VirtualAlloc

SuspendThread

ResumeThread

FreeLibrary

LoadLibraryExA

MultiByteToWideChar

FindFirstFileW

GetLogicalDrives

TerminateProcess

lstrcmpW

FindClose

FindNextFileW

lstrcpyW

GetSystemDirectoryW

TryEnterCriticalSection

ReleaseMutex

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsSetValue

GetCommandLineA

RtlUnwindEx

RtlPcToFileHeader

EncodePointer

DecodePointer

FlsGetValue

FlsFree

FlsAlloc

Sleep

ExitProcess

GetStdHandle

GetModuleFileNameA

HeapSetInformation

HeapCreate

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetCPInfo

GetACP

user32

IsWindow

GetWindowThreadProcessId

advapi32

RegCloseKey

RegOpenKeyExW

RegQueryValueExW

shell32

SHGetPathFromIDListW

CommandLineToArgvW

SHCreateDirectoryExW

ole32

CoTaskMemFree

oleaut32

VariantClear

zfhookpluginloader

CommAllocJsonRequest

CommReleaseRequest

IsCurProcNeedDetour

ClassicalPolicyHitTest

PolicyHitTest

CommSendRequest

CommIsActionConcerned

IsHitBlackImagePolicy

shlwapi

StrStrIW

PathFindExtensionW

StrCpyNW

PathFindFileNameW

wnsprintfW

PathRemoveFileSpecW

PathIsRelativeW

PathAppendW

SHGetValueW

PathFileExistsW

PathMatchSpecW

wvnsprintfW

SHSetValueW

PathFindFileNameA

StrCmpIW

StrCmpNIW

StrCmpNW

ntdll

NtQueryInformationFile

NtQueryInformationProcess

RtlInitUnicodeString

NtCreateFile

RtlNtStatusToDosError

NtClose

NtWriteFile

NtWaitForSingleObject

NtReadFile

psapi

GetModuleBaseNameW

GetModuleFileNameExW

GetProcessImageFileNameW

Exports

InitInject

UnInitInject

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookFileMmPlugin.dll

.dll windows:5 windows x64 arch:x64

2bd306794c87614e0f8dd9859022d984

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

d7:9b:8f:39:21:f6:2f:a5:8b:c0:c8:44:f1:d0:88:1e:0f:11:8e:d2:29:9a:33:3a:7c:c2:c7:16:89:9a:b9:7e
Signer

Actual PE Digest

d7:9b:8f:39:21:f6:2f:a5:8b:c0:c8:44:f1:d0:88:1e:0f:11:8e:d2:29:9a:33:3a:7c:c2:c7:16:89:9a:b9:7e

Digest Algorithm

sha256

PE Digest Matches

true

ab:7e:b6:93:c9:18:ff:96:fe:5d:b7:8d:ac:90:e2:24:d1:ea:83:06
Signer

Actual PE Digest

ab:7e:b6:93:c9:18:ff:96:fe:5d:b7:8d:ac:90:e2:24:d1:ea:83:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

F:\work\nhqdpt\trunk\src\hook\HookPlat\x64\Release\ZfHookFileMmPlugin.pdb

Imports

kernel32

CompareStringW

ExpandEnvironmentStringsW

GetWindowsDirectoryW

SetFilePointer

OutputDebugStringW

GetModuleHandleW

WriteFile

WideCharToMultiByte

CreateFileW

GetProcAddress

CreateEventA

WaitForSingleObjectEx

LocalFree

MultiByteToWideChar

lstrlenA

SetEvent

WaitForSingleObject

HeapAlloc

HeapFree

CreateMutexW

ReleaseMutex

lstrlenW

GetFullPathNameW

TlsGetValue

lstrcpynA

VerSetConditionMask

MoveFileExW

GetCurrentThread

InitializeCriticalSection

TlsSetValue

LoadLibraryW

Sleep

LeaveCriticalSection

lstrcpynW

VerifyVersionInfoW

GetCurrentDirectoryW

EnterCriticalSection

lstrcmpiW

VirtualProtect

DeleteCriticalSection

GetCurrentThreadId

OpenMutexW

GetLongPathNameW

ResetEvent

GetCommandLineW

GetCurrentProcessId

CreateThread

CloseHandle

LockResource

SetLastError

GetLastError

SizeofResource

LoadResource

FindResourceW

FindResourceExW

TlsAlloc

GetProcessHeap

GetModuleFileNameW

OpenEventA

TlsFree

LoadLibraryExA

LoadLibraryExW

SuspendThread

VirtualAlloc

FlushInstructionCache

VirtualFree

VirtualQuery

SetThreadContext

GetThreadContext

FlushFileBuffers

CreateFileA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

FormatMessageA

SetStdHandle

GetLocaleInfoW

InitializeCriticalSectionAndSpinCount

LoadLibraryA

FreeLibrary

GetConsoleMode

GetConsoleCP

GetStringTypeW

GetStringTypeA

IsValidLocale

EnumSystemLocalesA

GetLocaleInfoA

GetUserDefaultLCID

GetSystemTimeAsFileTime

GetTickCount

RaiseException

HeapDestroy

HeapReAlloc

HeapSize

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

ExitThread

ResumeThread

FlsSetValue

GetCommandLineA

LCMapStringA

LCMapStringW

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

EncodePointer

DecodePointer

FlsGetValue

FlsFree

FlsAlloc

ExitProcess

HeapSetInformation

HeapCreate

GetStdHandle

GetModuleFileNameA

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

user32

EnumWindows

IsWindow

GetWindowTextW

GetForegroundWindow

GetWindowThreadProcessId

gdi32

StartDocW

advapi32

RegSetValueExW

RegDeleteKeyW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

shell32

SHGetPathFromIDListW

ole32

CoUninitialize

CoTaskMemFree

CoInitializeEx

CoCreateInstance

zfhookwinhook

GetImageFileString

zfhookpluginloader

ClassicalPolicyHitTest

shlwapi

PathAppendW

PathRemoveFileSpecW

PathFileExistsW

PathMatchSpecW

StrCpyNW

PathIsDirectoryW

PathFindExtensionW

PathGetDriveNumberW

PathIsFileSpecW

version

VerQueryValueW

GetFileVersionInfoSizeW

GetFileVersionInfoW

ntdll

NtWaitForSingleObject

RtlVirtualUnwind

NtWriteFile

RtlNtStatusToDosError

NtClose

NtCreateFile

RtlLookupFunctionEntry

RtlCaptureContext

RtlUnwindEx

RtlPcToFileHeader

RtlInitUnicodeString

NtReadFile

Exports

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@23@XZ@51

??_B?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51

??_B?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51

??_B?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51

?get_const_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ

?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@23@XZ

?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@XZ

?get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@23@XZ

?get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@3@XZ

?get_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?get_mutable_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ

?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ

?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ

?instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@0AEAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@23@EA

?instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@serialization@boost@@0AEAV?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@23@EA

?instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@0AEAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@23@EA

?instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@serialization@boost@@0AEAV?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@23@EA

?instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@0AEAV?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@3@EA

?instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@serialization@boost@@0AEAV?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@3@EA

?instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@0AEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@3@EA

?instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@serialization@boost@@0AEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@3@EA

?instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@EA

?instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@EA

?instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@EA

?is_destroyed@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ

?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ

?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ

?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z

?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z

?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z

?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Upolicynode@ZfPipeClient@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@serialization@boost@@CAAEAV?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@serialization@boost@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vxml_iarchive@archive@boost@@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vxml_iarchive@archive@boost@@Upolicynode@ZfPipeClient@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vxml_iarchive@archive@boost@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@serialization@boost@@CAAEAV?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vxml_iarchive@archive@boost@@V?$set@Upolicynode@ZfPipeClient@@U?$less@Upolicynode@ZfPipeClient@@@std@@V?$allocator@Upolicynode@ZfPipeClient@@@4@@std@@@detail@archive@boost@@@634@A

?t@?1??get_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A

?t@?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A

?t@?1??get_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A

InitInject

UnInitInject

Sections

.text
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

x64/ZfHookFileMmPlugin.dll0