{"Id":"79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2","Tags":["VBoxDrv.sys"],"Verified":"TRUE","Author":"Nasreddine Bencherchali","Created":"2023-05-06","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create VBoxDrv.sys binPath=C:\\windows\\temp\\VBoxDrv.sys type=kernel && sc.exe start VBoxDrv.sys","Description":"","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["Internal Research"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"VBoxDrv.sys","MD5":"b1b8e6b85dd03c7f1290b1a071fc79c1","SHA1":"a22dead5cdf05bd2f79a4d0066ffcf01c7d303ec","SHA256":"26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712","Authentihash":{"MD5":"6837b5fe3a3a100c88c7cf4f0408f528","SHA1":"d679aadb2844462deaaf069d48e7d0fc76979741","SHA256":"7dcd81140dc57d1d412c39940643ea923a1925815097f83788d840c1a7b57d25"},"Description":"VirtualBox Support Driver","Company":"Vektor T13 Security Service","InternalName":"VBoxDrv","OriginalFilename":"VBoxDrv.sys","FileVersion":"1.2.0.119230","Product":"Antidetect 2018 Public by Vektor T13 (rev.05)","ProductVersion":"1.2.0.119230","Copyright":"Copyright (C) 2009-2018 Oracle Corporation","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["ASMAtomicBitClear","ASMAtomicXchgU16","ASMAtomicXchgU8","ASMGetCS","ASMGetDS","ASMGetES","ASMGetFS","ASMGetGS","ASMGetIDTR","ASMGetSS","ASMMultU64ByU32DivByU32","ASMNopPause","RTAssertAreQuiet","RTAssertMayPanic","RTAssertMsg1","RTAssertMsg1Weak","RTAssertMsg2AddV","RTAssertMsg2V","RTAssertMsg2Weak","RTAssertMsg2WeakV","RTAssertSetMayPanic","RTAssertSetQuiet","RTAssertShouldPanic","RTAvlPVDestroy","RTAvlPVDoWithAll","RTAvlPVGet","RTAvlPVGetBestFit","RTAvlPVInsert","RTAvlPVRemove","RTAvlPVRemoveBestFit","RTCrc32","RTCrc32Finish","RTCrc32Process","RTCrc32Start","RTErrConvertFromErrno","RTErrConvertFromNtStatus","RTErrConvertToErrno","RTErrInfoAdd","RTErrInfoAddF","RTErrInfoAddV","RTErrInfoSet","RTErrInfoSetF","RTErrInfoSetV","RTErrVarsAreEqual","RTErrVarsHaveChanged","RTErrVarsRestore","RTErrVarsSave","RTHandleTableAllocWithCtx","RTHandleTableCreate","RTHandleTableCreateEx","RTHandleTableDestroy","RTHandleTableFreeWithCtx","RTHandleTableLookupWithCtx","RTLatin1CalcUtf8Len","RTLatin1CalcUtf8LenEx","RTLatin1ToUtf8ExTag","RTLatin1ToUtf8Tag","RTLogClearFileDelayFlag","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDefaultInstanceEx","RTLogDestinations","RTLogDestroy","RTLogDumpPrintfV","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGetDefaultInstanceEx","RTLogGetDestinations","RTLogGetFlags","RTLogGetGroupSettings","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelGetDefaultInstance","RTLogRelGetDefaultInstanceEx","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetBuffering","RTLogRelSetDefaultInstance","RTLogSetBuffering","RTLogSetCustomPrefixCallback","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAllocExTag","RTMemAllocTag","RTMemAllocVarTag","RTMemAllocZTag","RTMemAllocZVarTag","RTMemContAlloc","RTMemContFree","RTMemDupExTag","RTMemDupTag","RTMemExecAllocTag","RTMemExecFree","RTMemFree","RTMemFreeEx","RTMemReallocTag","RTMemTmpAllocTag","RTMemTmpAllocZTag","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpCurSetIndex","RTMpCurSetIndexAndId","RTMpGetArraySize","RTMpGetCount","RTMpGetCpuGroupCounts","RTMpGetMaxCpuGroupCount","RTMpGetMaxCpuId","RTMpGetOnlineCoreCount","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetPresentCoreCount","RTMpGetPresentCount","RTMpGetPresentSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuPresent","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnAllIsConcurrentSafe","RTMpOnOthers","RTMpOnPair","RTMpOnPairIsConcurrentExecSupported","RTMpOnSpecific","RTMpPokeCpu","RTMpSetIndexFromCpuGroupMember","RTNetIPv4AddDataChecksum","RTNetIPv4AddTCPChecksum","RTNetIPv4AddUDPChecksum","RTNetIPv4FinalizeChecksum","RTNetIPv4HdrChecksum","RTNetIPv4IsDHCPValid","RTNetIPv4IsHdrValid","RTNetIPv4IsTCPSizeValid","RTNetIPv4IsTCPValid","RTNetIPv4IsUDPSizeValid","RTNetIPv4IsUDPValid","RTNetIPv4PseudoChecksum","RTNetIPv4PseudoChecksumBits","RTNetIPv4TCPChecksum","RTNetIPv4UDPChecksum","RTNetIPv6PseudoChecksum","RTNetIPv6PseudoChecksumBits","RTNetIPv6PseudoChecksumEx","RTNetTCPChecksum","RTNetUDPChecksum","RTOnceReset","RTOnceSlow","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0AssertPanicSystem","RTR0Init","RTR0MemAreKrnlAndUsrDifferent","RTR0MemKernelCopyFrom","RTR0MemKernelCopyTo","RTR0MemKernelIsValidAddr","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocContTag","RTR0MemObjAllocLowTag","RTR0MemObjAllocPageTag","RTR0MemObjAllocPhysExTag","RTR0MemObjAllocPhysNCTag","RTR0MemObjAllocPhysTag","RTR0MemObjEnterPhysTag","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernelTag","RTR0MemObjLockUserTag","RTR0MemObjMapKernelExTag","RTR0MemObjMapKernelTag","RTR0MemObjMapUserTag","RTR0MemObjProtect","RTR0MemObjReserveKernelTag","RTR0MemObjReserveUserTag","RTR0MemObjSize","RTR0MemUserCopyFrom","RTR0MemUserCopyTo","RTR0MemUserIsValidAddr","RTR0ProcHandleSelf","RTR0Term","RTR0TermForced","RTSemEventCreate","RTSemEventCreateEx","RTSemEventDestroy","RTSemEventGetResolution","RTSemEventMultiCreate","RTSemEventMultiCreateEx","RTSemEventMultiDestroy","RTSemEventMultiGetResolution","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitEx","RTSemEventMultiWaitExDebug","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitEx","RTSemEventWaitExDebug","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSemMutexCreate","RTSemMutexCreateEx","RTSemMutexDestroy","RTSemMutexIsOwned","RTSemMutexRelease","RTSemMutexRequest","RTSemMutexRequestDebug","RTSemMutexRequestNoResume","RTSemMutexRequestNoResumeDebug","RTSemSpinMutexCreate","RTSemSpinMutexDestroy","RTSemSpinMutexRelease","RTSemSpinMutexRequest","RTSemSpinMutexTryRequest","RTSpinlockAcquire","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTStrAAppendNTag","RTStrAAppendTag","RTStrATruncateTag","RTStrAllocExTag","RTStrAllocTag","RTStrCalcLatin1Len","RTStrCalcLatin1LenEx","RTStrCalcUtf16Len","RTStrCalcUtf16LenEx","RTStrCat","RTStrConvertHexBytes","RTStrCopy","RTStrCopyEx","RTStrCopyP","RTStrDupExTag","RTStrDupNTag","RTStrDupTag","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrFree","RTStrGetCpExInternal","RTStrGetCpInternal","RTStrGetCpNExInternal","RTStrIsValidEncoding","RTStrNCmp","RTStrPrevCp","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrPurgeComplementSet","RTStrPurgeEncoding","RTStrPutCpInternal","RTStrReallocTag","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToLatin1ExTag","RTStrToLatin1Tag","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTStrToUni","RTStrToUniEx","RTStrToUtf16BigExTag","RTStrToUtf16BigTag","RTStrToUtf16ExTag","RTStrToUtf16Tag","RTStrUniLen","RTStrUniLenEx","RTStrValidateEncoding","RTStrValidateEncodingEx","RTTermDeregisterCallback","RTTermRegisterCallback","RTTermRunCallbacks","RTThreadCreate","RTThreadCreateF","RTThreadCreateV","RTThreadCtxHookCreate","RTThreadCtxHookDestroy","RTThreadCtxHookDisable","RTThreadCtxHookEnable","RTThreadCtxHookIsEnabled","RTThreadFromNative","RTThreadGetName","RTThreadGetNative","RTThreadGetType","RTThreadIsInInterrupt","RTThreadIsInitialized","RTThreadIsMain","RTThreadIsSelfAlive","RTThreadIsSelfKnown","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptIsPending","RTThreadPreemptIsPendingTrusty","RTThreadPreemptIsPossible","RTThreadPreemptRestore","RTThreadSelf","RTThreadSelfName","RTThreadSetName","RTThreadSetType","RTThreadSleep","RTThreadUserReset","RTThreadUserSignal","RTThreadUserWait","RTThreadUserWaitNoResume","RTThreadWait","RTThreadWaitNoResume","RTThreadYield","RTTimeExplode","RTTimeFromString","RTTimeImplode","RTTimeIsLeapYear","RTTimeMilliTS","RTTimeNanoTS","RTTimeNormalize","RTTimeNow","RTTimeSpecFromString","RTTimeSpecToString","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimeToString","RTTimerCanDoHighResolution","RTTimerChangeInterval","RTTimerCreate","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","RTUuidClear","RTUuidCompare","RTUuidCompare2Strs","RTUuidCompareStr","RTUuidFromStr","RTUuidFromUtf16","RTUuidIsNull","RTUuidToStr","RTUuidToUtf16","SUPGetCpuHzFromGipForAsyncMode","SUPGetGIP","SUPGetTscDeltaSlow","SUPIsTscFreqCompatible","SUPIsTscFreqCompatibleEx","SUPR0BadContext","SUPR0ChangeCR4","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetCurrentGdtRw","SUPR0GetKernelFeatures","SUPR0GetPagingMode","SUPR0GetSessionGVM","SUPR0GetSessionVM","SUPR0GetSvmUsability","SUPR0GetVmxUsability","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0PageProtect","SUPR0Printf","SUPR0QueryUcodeRev","SUPR0QueryVTCaps","SUPR0ResumeVTxOnCpu","SUPR0SetSessionVM","SUPR0SuspendVTxOnCpu","SUPR0TracerDeregisterDrv","SUPR0TracerDeregisterImpl","SUPR0TracerFireProbe","SUPR0TracerRegisterDrv","SUPR0TracerRegisterImpl","SUPR0TracerRegisterModule","SUPR0TracerUmodProbeFire","SUPR0TscDeltaMeasureBySetIndex","SUPR0UnlockMem","SUPReadTscWithDelta","SUPSemEventClose","SUPSemEventCreate","SUPSemEventGetResolution","SUPSemEventMultiClose","SUPSemEventMultiCreate","SUPSemEventMultiGetResolution","SUPSemEventMultiReset","SUPSemEventMultiSignal","SUPSemEventMultiWait","SUPSemEventMultiWaitNoResume","SUPSemEventMultiWaitNsAbsIntr","SUPSemEventMultiWaitNsRelIntr","SUPSemEventSignal","SUPSemEventWait","SUPSemEventWaitNoResume","SUPSemEventWaitNsAbsIntr","SUPSemEventWaitNsRelIntr","g_pSUPGlobalInfoPage","g_pszRTAssertExpr","g_pszRTAssertFile","g_pszRTAssertFunction","g_szRTAssertMsg1","g_szRTAssertMsg2","g_u32RTAssertLine"],"ImportedFunctions":["strchr","IoDeleteDevice","IoCreateDevice","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","__C_specific_handler","ExFreePoolWithTag","ExAllocatePoolWithTag","IoIs32bitProcess","ZwSetSystemInformation","ExRegisterCallback","ExCreateCallback","MmGetSystemRoutineAddress","RtlQueryRegistryValues","DbgPrint","KeSetTimerEx","KeInsertQueueDpc","KeRemoveQueueDpc","KeCancelTimer","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","KeQueryTimeIncrement","KeDelayExecutionThread","ZwYieldExecution","KeSetPriorityThread","KeWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","PsCreateSystemThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeMutex","KeReleaseMutex","KeReadStateMutex","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeResetEvent","PsGetCurrentProcessId","IoGetCurrentProcess","ProbeForRead","ProbeForWrite","MmHighestUserAddress","MmSystemRangeStart","KeSetTargetProcessorDpc","KeNumberProcessors","PsGetVersion","MmIsAddressValid","MmUnmapIoSpace","MmUnlockPages","MmFreeContiguousMemory","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemorySpecifyCache","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache","MmGetPhysicalAddress","MmAllocateContiguousMemory"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"CN=Vektor T13 Security Service","ValidFrom":"2018-04-19 00:15:30","ValidTo":"2039-12-31 23:59:59","Signature":"6a53b7553edfd579a2a4dd005b893883cc26c3e314683b8b92b95b8b60e33d6c9841d1761bd52c2e5a69f9bec38e457bf5a06f43fdb4d4f601a2ae0b0c7e16e180b8447308fca66dcbdf34c0a4319e96af6f96f4b9037bfd7f1360efe2fd24efe837d59c64e895cee83d63952d217672932decd29af822e80d0d25a580d53e0c","SignatureAlgorithmOID":"1.3.14.3.2.29","IsCertificateAuthority":true,"SerialNumber":"c3b2c606d320e0bf4f71f1e73668a938","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"bdf06d2ae5584184829321a1af947932","SHA1":"ffbcdef9b656d73245e310774c99d2d48645eb01","SHA256":"4ab0c3d0bd9761a17acd26fcc700469539d69032c9e4946ed50447486c1d8148","SHA384":"d2f7f4fe7b034b7d714b31cf6f49fb915cd61914e41433a8e768bfd7a05f2f9dae331b8ea9f85f6cabbdc6b168f4f59f"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"c3b2c606d320e0bf4f71f1e73668a938","Issuer":"CN=Vektor T13 Security Service","Version":1}]}],"RichPEHeaderHash":{"MD5":"2699d722188f4664155df5d5ec416047","SHA1":"1d9a8b11fbf151fc371dcb9a1a3b333f0dadb1e0","SHA256":"6292be78ca89765e09fcf9a02d007dd8adafbf18a032d9d71e35686f922cd1f6"},"Sections":{".text":{"Entropy":6.420460567884749,"Virtual Size":"0x2bc30"},".rdata":{"Entropy":5.939129698977538,"Virtual Size":"0xf690"},".data":{"Entropy":4.2622979727406065,"Virtual Size":"0x12a40"},".pdata":{"Entropy":5.55793348559494,"Virtual Size":"0x32c4"},".edata":{"Entropy":5.804608403248267,"Virtual Size":"0x34f8"},"INIT":{"Entropy":5.082239885482413,"Virtual Size":"0x856"},".rsrc":{"Entropy":3.442966233517804,"Virtual Size":"0x420"},".reloc":{"Entropy":4.07818833178508,"Virtual Size":"0xfb8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-06-22 07:17:13","Imphash":"9470f56376e665fb981a35b303436041","LoadsDespiteHVCI":"TRUE"},{"Filename":"VBoxDrv.sys","MD5":"02a1d77ef13bd41cad04abcce896d0b9","SHA1":"59c0fa0d61576d9eb839c9c7e15d57047ee7fe29","SHA256":"3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b","Authentihash":{"MD5":"49f3b147b53aa5ebce9ddce9a20fe9ff","SHA1":"46064d1e248e2c9d24950d6a5dcf68a2c12aeb9d","SHA256":"7e5abe4530eff3838d44516f95c15d8b3ec6cec44ca7b67998e50641c939d12a"},"Description":"VirtualBox Support Driver","Company":"Vektor T13 Security Service","InternalName":"VBoxDrv","OriginalFilename":"VBoxDrv.sys","FileVersion":"1.4.2.119230","Product":"Antidetect 2019 Public","ProductVersion":"1.4.2.119230","Copyright":"Copyright (C) 2009-2019 Oracle Corporation","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["ASMAtomicBitClear","ASMAtomicXchgU16","ASMAtomicXchgU8","ASMGetCS","ASMGetDS","ASMGetES","ASMGetFS","ASMGetGS","ASMGetIDTR","ASMGetSS","ASMMultU64ByU32DivByU32","ASMNopPause","RTAssertAreQuiet","RTAssertMayPanic","RTAssertMsg1","RTAssertMsg1Weak","RTAssertMsg2AddV","RTAssertMsg2V","RTAssertMsg2Weak","RTAssertMsg2WeakV","RTAssertSetMayPanic","RTAssertSetQuiet","RTAssertShouldPanic","RTAvlPVDestroy","RTAvlPVDoWithAll","RTAvlPVGet","RTAvlPVGetBestFit","RTAvlPVInsert","RTAvlPVRemove","RTAvlPVRemoveBestFit","RTCrc32","RTCrc32Finish","RTCrc32Process","RTCrc32Start","RTErrConvertFromErrno","RTErrConvertFromNtStatus","RTErrConvertToErrno","RTErrInfoAdd","RTErrInfoAddF","RTErrInfoAddV","RTErrInfoSet","RTErrInfoSetF","RTErrInfoSetV","RTErrVarsAreEqual","RTErrVarsHaveChanged","RTErrVarsRestore","RTErrVarsSave","RTHandleTableAllocWithCtx","RTHandleTableCreate","RTHandleTableCreateEx","RTHandleTableDestroy","RTHandleTableFreeWithCtx","RTHandleTableLookupWithCtx","RTLatin1CalcUtf8Len","RTLatin1CalcUtf8LenEx","RTLatin1ToUtf8ExTag","RTLatin1ToUtf8Tag","RTLogClearFileDelayFlag","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDefaultInstanceEx","RTLogDestinations","RTLogDestroy","RTLogDumpPrintfV","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGetDefaultInstanceEx","RTLogGetDestinations","RTLogGetFlags","RTLogGetGroupSettings","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelGetDefaultInstance","RTLogRelGetDefaultInstanceEx","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetBuffering","RTLogRelSetDefaultInstance","RTLogSetBuffering","RTLogSetCustomPrefixCallback","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAllocExTag","RTMemAllocTag","RTMemAllocVarTag","RTMemAllocZTag","RTMemAllocZVarTag","RTMemContAlloc","RTMemContFree","RTMemDupExTag","RTMemDupTag","RTMemExecAllocTag","RTMemExecFree","RTMemFree","RTMemFreeEx","RTMemReallocTag","RTMemTmpAllocTag","RTMemTmpAllocZTag","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpCurSetIndex","RTMpCurSetIndexAndId","RTMpGetArraySize","RTMpGetCount","RTMpGetCpuGroupCounts","RTMpGetMaxCpuGroupCount","RTMpGetMaxCpuId","RTMpGetOnlineCoreCount","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetPresentCoreCount","RTMpGetPresentCount","RTMpGetPresentSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuPresent","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnAllIsConcurrentSafe","RTMpOnOthers","RTMpOnPair","RTMpOnPairIsConcurrentExecSupported","RTMpOnSpecific","RTMpPokeCpu","RTMpSetIndexFromCpuGroupMember","RTNetIPv4AddDataChecksum","RTNetIPv4AddTCPChecksum","RTNetIPv4AddUDPChecksum","RTNetIPv4FinalizeChecksum","RTNetIPv4HdrChecksum","RTNetIPv4IsDHCPValid","RTNetIPv4IsHdrValid","RTNetIPv4IsTCPSizeValid","RTNetIPv4IsTCPValid","RTNetIPv4IsUDPSizeValid","RTNetIPv4IsUDPValid","RTNetIPv4PseudoChecksum","RTNetIPv4PseudoChecksumBits","RTNetIPv4TCPChecksum","RTNetIPv4UDPChecksum","RTNetIPv6PseudoChecksum","RTNetIPv6PseudoChecksumBits","RTNetIPv6PseudoChecksumEx","RTNetTCPChecksum","RTNetUDPChecksum","RTOnceReset","RTOnceSlow","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0AssertPanicSystem","RTR0Init","RTR0MemAreKrnlAndUsrDifferent","RTR0MemKernelCopyFrom","RTR0MemKernelCopyTo","RTR0MemKernelIsValidAddr","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocContTag","RTR0MemObjAllocLowTag","RTR0MemObjAllocPageTag","RTR0MemObjAllocPhysExTag","RTR0MemObjAllocPhysNCTag","RTR0MemObjAllocPhysTag","RTR0MemObjEnterPhysTag","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernelTag","RTR0MemObjLockUserTag","RTR0MemObjMapKernelExTag","RTR0MemObjMapKernelTag","RTR0MemObjMapUserTag","RTR0MemObjProtect","RTR0MemObjReserveKernelTag","RTR0MemObjReserveUserTag","RTR0MemObjSize","RTR0MemUserCopyFrom","RTR0MemUserCopyTo","RTR0MemUserIsValidAddr","RTR0ProcHandleSelf","RTR0Term","RTR0TermForced","RTSemEventCreate","RTSemEventCreateEx","RTSemEventDestroy","RTSemEventGetResolution","RTSemEventMultiCreate","RTSemEventMultiCreateEx","RTSemEventMultiDestroy","RTSemEventMultiGetResolution","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitEx","RTSemEventMultiWaitExDebug","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitEx","RTSemEventWaitExDebug","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSemMutexCreate","RTSemMutexCreateEx","RTSemMutexDestroy","RTSemMutexIsOwned","RTSemMutexRelease","RTSemMutexRequest","RTSemMutexRequestDebug","RTSemMutexRequestNoResume","RTSemMutexRequestNoResumeDebug","RTSemSpinMutexCreate","RTSemSpinMutexDestroy","RTSemSpinMutexRelease","RTSemSpinMutexRequest","RTSemSpinMutexTryRequest","RTSpinlockAcquire","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTStrAAppendNTag","RTStrAAppendTag","RTStrATruncateTag","RTStrAllocExTag","RTStrAllocTag","RTStrCalcLatin1Len","RTStrCalcLatin1LenEx","RTStrCalcUtf16Len","RTStrCalcUtf16LenEx","RTStrCat","RTStrConvertHexBytes","RTStrCopy","RTStrCopyEx","RTStrCopyP","RTStrDupExTag","RTStrDupNTag","RTStrDupTag","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrFree","RTStrGetCpExInternal","RTStrGetCpInternal","RTStrGetCpNExInternal","RTStrIsValidEncoding","RTStrNCmp","RTStrPrevCp","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrPurgeComplementSet","RTStrPurgeEncoding","RTStrPutCpInternal","RTStrReallocTag","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToLatin1ExTag","RTStrToLatin1Tag","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTStrToUni","RTStrToUniEx","RTStrToUtf16BigExTag","RTStrToUtf16BigTag","RTStrToUtf16ExTag","RTStrToUtf16Tag","RTStrUniLen","RTStrUniLenEx","RTStrValidateEncoding","RTStrValidateEncodingEx","RTTermDeregisterCallback","RTTermRegisterCallback","RTTermRunCallbacks","RTThreadCreate","RTThreadCreateF","RTThreadCreateV","RTThreadCtxHookCreate","RTThreadCtxHookDestroy","RTThreadCtxHookDisable","RTThreadCtxHookEnable","RTThreadCtxHookIsEnabled","RTThreadFromNative","RTThreadGetName","RTThreadGetNative","RTThreadGetType","RTThreadIsInInterrupt","RTThreadIsInitialized","RTThreadIsMain","RTThreadIsSelfAlive","RTThreadIsSelfKnown","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptIsPending","RTThreadPreemptIsPendingTrusty","RTThreadPreemptIsPossible","RTThreadPreemptRestore","RTThreadSelf","RTThreadSelfName","RTThreadSetName","RTThreadSetType","RTThreadSleep","RTThreadUserReset","RTThreadUserSignal","RTThreadUserWait","RTThreadUserWaitNoResume","RTThreadWait","RTThreadWaitNoResume","RTThreadYield","RTTimeExplode","RTTimeFromString","RTTimeImplode","RTTimeIsLeapYear","RTTimeMilliTS","RTTimeNanoTS","RTTimeNormalize","RTTimeNow","RTTimeSpecFromString","RTTimeSpecToString","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimeToString","RTTimerCanDoHighResolution","RTTimerChangeInterval","RTTimerCreate","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","RTUuidClear","RTUuidCompare","RTUuidCompare2Strs","RTUuidCompareStr","RTUuidFromStr","RTUuidFromUtf16","RTUuidIsNull","RTUuidToStr","RTUuidToUtf16","SUPGetCpuHzFromGipForAsyncMode","SUPGetGIP","SUPGetTscDeltaSlow","SUPIsTscFreqCompatible","SUPIsTscFreqCompatibleEx","SUPR0BadContext","SUPR0ChangeCR4","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetCurrentGdtRw","SUPR0GetKernelFeatures","SUPR0GetPagingMode","SUPR0GetSessionGVM","SUPR0GetSessionVM","SUPR0GetSvmUsability","SUPR0GetVmxUsability","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0PageProtect","SUPR0Printf","SUPR0QueryUcodeRev","SUPR0QueryVTCaps","SUPR0ResumeVTxOnCpu","SUPR0SetSessionVM","SUPR0SuspendVTxOnCpu","SUPR0TracerDeregisterDrv","SUPR0TracerDeregisterImpl","SUPR0TracerFireProbe","SUPR0TracerRegisterDrv","SUPR0TracerRegisterImpl","SUPR0TracerRegisterModule","SUPR0TracerUmodProbeFire","SUPR0TscDeltaMeasureBySetIndex","SUPR0UnlockMem","SUPReadTscWithDelta","SUPSemEventClose","SUPSemEventCreate","SUPSemEventGetResolution","SUPSemEventMultiClose","SUPSemEventMultiCreate","SUPSemEventMultiGetResolution","SUPSemEventMultiReset","SUPSemEventMultiSignal","SUPSemEventMultiWait","SUPSemEventMultiWaitNoResume","SUPSemEventMultiWaitNsAbsIntr","SUPSemEventMultiWaitNsRelIntr","SUPSemEventSignal","SUPSemEventWait","SUPSemEventWaitNoResume","SUPSemEventWaitNsAbsIntr","SUPSemEventWaitNsRelIntr","g_pSUPGlobalInfoPage","g_pszRTAssertExpr","g_pszRTAssertFile","g_pszRTAssertFunction","g_szRTAssertMsg1","g_szRTAssertMsg2","g_u32RTAssertLine"],"ImportedFunctions":["strchr","IoDeleteDevice","IoCreateDevice","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","__C_specific_handler","ExFreePoolWithTag","ExAllocatePoolWithTag","IoIs32bitProcess","ZwSetSystemInformation","ExRegisterCallback","ExCreateCallback","MmGetSystemRoutineAddress","RtlQueryRegistryValues","DbgPrint","KeSetTimerEx","KeInsertQueueDpc","KeRemoveQueueDpc","KeCancelTimer","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","KeQueryTimeIncrement","KeDelayExecutionThread","ZwYieldExecution","KeSetPriorityThread","KeWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","PsCreateSystemThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeMutex","KeReleaseMutex","KeReadStateMutex","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeResetEvent","PsGetCurrentProcessId","IoGetCurrentProcess","ProbeForRead","ProbeForWrite","MmHighestUserAddress","MmSystemRangeStart","KeSetTargetProcessorDpc","KeNumberProcessors","PsGetVersion","MmIsAddressValid","MmUnmapIoSpace","MmUnlockPages","MmFreeContiguousMemory","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemorySpecifyCache","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache","MmGetPhysicalAddress","MmAllocateContiguousMemory"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"CN=Vektor T13 Technology","ValidFrom":"2018-08-10 07:42:52","ValidTo":"2039-12-31 23:59:59","Signature":"4819acb135277102eb22d1ebf53707b6651b1dac668cbe264acefb52a0567dee778627ae98f2f8a69142e210ed9a585a826bea9339108f6cc8567a8a0d3b471dde8e932b4d7b466e657e0592faa7578e548c1d1f3b746190fac243e75735ad18bb9cf901d94d92ed4bfbe7729d439bdd300a6cb5fb75d17364033f92a8d15398","SignatureAlgorithmOID":"1.3.14.3.2.29","IsCertificateAuthority":true,"SerialNumber":"4d87df1b3d1e239b405dc85d0a0bad22","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"fbe18b58073fb49c37c5790f1e2065f0","SHA1":"a0a8778312b53234bbf75e19e10664c52e0c524c","SHA256":"42da0182b3119325ebc53f870276cc8b9f6f4d7248d6223372fea7fc994d85a8","SHA384":"12140c817a8d0771e3ee4c8e1eecda708c7203c537b4a702175fb370098e2bc704fca98b9b65cf346d80845fd961ed03"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"4d87df1b3d1e239b405dc85d0a0bad22","Issuer":"CN=Vektor T13 Technology","Version":1}]}],"RichPEHeaderHash":{"MD5":"2699d722188f4664155df5d5ec416047","SHA1":"1d9a8b11fbf151fc371dcb9a1a3b333f0dadb1e0","SHA256":"6292be78ca89765e09fcf9a02d007dd8adafbf18a032d9d71e35686f922cd1f6"},"Sections":{".text":{"Entropy":6.419823737384689,"Virtual Size":"0x2bc30"},".rdata":{"Entropy":5.946657911688005,"Virtual Size":"0xf8c8"},".data":{"Entropy":4.260596456256825,"Virtual Size":"0x12a40"},".pdata":{"Entropy":5.559894875195939,"Virtual Size":"0x32c4"},".edata":{"Entropy":5.803857413810883,"Virtual Size":"0x34f8"},"INIT":{"Entropy":5.082239885482413,"Virtual Size":"0x856"},".rsrc":{"Entropy":3.4258421343253227,"Virtual Size":"0x400"},".reloc":{"Entropy":4.078099091032765,"Virtual Size":"0xfb8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-02-16 00:57:54","Imphash":"9470f56376e665fb981a35b303436041","LoadsDespiteHVCI":"TRUE"},{"Filename":"VBoxDrv.sys","MD5":"962a33a191dbe56915fd196e3a868cf0","SHA1":"449ff4f5ce2fdddac05a6c82e45a7e802b1c1305","SHA256":"7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c","Authentihash":{"MD5":"5491106d0dc46b737e07072122359638","SHA1":"2fa597885c165e354736143e9645570e3637b57b","SHA256":"c62bf9d0cc1edfffc15f3f002cd7f51efe3372320ec89d9dc96011000915c186"},"Description":"VirtualBox Support Driver","Company":"Sun Microsystems, Inc.","InternalName":"VBoxDrv.sys","OriginalFilename":"VBoxDrv.sys","FileVersion":"3.0.0.r49315","Product":"Sun VirtualBox","ProductVersion":"3.0.0.r49315","Copyright":"Copyright (C) 2009 Sun Microsystems, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["?RTThreadAdopt@@YAHW4RTTHREADTYPE@@IPEBDPEAPEAURTTHREADINT@@@Z","AssertMsg1","AssertMsg2","RTAssertShouldPanic","RTAvlPVDestroy","RTAvlPVDoWithAll","RTAvlPVGet","RTAvlPVGetBestFit","RTAvlPVInsert","RTAvlPVRemove","RTAvlPVRemoveBestFit","RTErrConvertFromNtStatus","RTHandleTableAllocWithCtx","RTHandleTableCreate","RTHandleTableCreateEx","RTHandleTableDestroy","RTHandleTableFreeWithCtx","RTHandleTableLookupWithCtx","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCopyGroupsAndFlags","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDestroy","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetDefaultInstance","RTLogSetCustomPrefixCallback","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemDup","RTMemDupEx","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTMpPokeCpu","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0Init","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapKernelEx","RTR0MemObjMapUser","RTR0MemObjProtect","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTR0Term","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTThreadCreate","RTThreadCreateF","RTThreadCreateV","RTThreadFromNative","RTThreadGetName","RTThreadGetNative","RTThreadGetType","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptIsPending","RTThreadPreemptIsPendingTrusty","RTThreadPreemptRestore","RTThreadSelf","RTThreadSelfName","RTThreadSetName","RTThreadSetType","RTThreadSleep","RTThreadUserReset","RTThreadUserSignal","RTThreadUserWait","RTThreadUserWaitNoResume","RTThreadWait","RTThreadWaitNoResume","RTThreadYield","RTTimeMilliTS","RTTimeNanoTS","RTTimeNow","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetPagingMode","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0PageProtect","SUPR0UnlockMem","SUPSemEventClose","SUPSemEventCreate","SUPSemEventMultiClose","SUPSemEventMultiCreate","SUPSemEventMultiReset","SUPSemEventMultiSignal","SUPSemEventMultiWait","SUPSemEventMultiWaitNoResume","SUPSemEventSignal","SUPSemEventWait","SUPSemEventWaitNoResume","g_szRTAssertMsg1","g_szRTAssertMsg2"],"ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","DbgPrint","IoIs32bitProcess","ExRegisterCallback","ExCreateCallback","IoCreateSymbolicLink","IoCreateDevice","IoGetStackLimits","memchr","strncmp","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeWaitForSingleObject","KeResetEvent","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeDelayExecutionThread","ZwYieldExecution","ExFreePoolWithTag","KeInsertQueueDpc","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","ExAllocatePoolWithTag","KeQueryActiveProcessors","strchr","PsGetCurrentProcessId","IoGetCurrentProcess","KeSetTimerEx","KeRemoveQueueDpc","KeCancelTimer","KeInitializeTimerEx","KeQueryTimeIncrement","__C_specific_handler","PsGetVersion","MmGetSystemRoutineAddress","MmFreeContiguousMemory","MmGetPhysicalAddress","MmAllocateContiguousMemory","MmUnmapIoSpace","MmUnlockPages","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache","KeSetPriorityThread","ZwClose","ObReferenceObjectByHandle","PsCreateSystemThread"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=California, L=Menlo Park, O=Sun Microsystems, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Sun Microsystems, Inc.","ValidFrom":"2008-06-11 00:00:00","ValidTo":"2011-06-11 23:59:59","Signature":"537c2adf2d3f7cf7cfc86476029fe81f7b8f12596a595cda0d5fbbfd227cce6bce2f8ad1af7fbb1a92a8b8de23a8797748094aae39bc845308e3ccd8fb9dc09b51bdf7b26c4eb8fb4052a8bdc714eaf36fca04d720e06798e36308c2fcaf50c48e61087a3ba0c4b0e77972a69af1ecc9d05e3f001e02ad94db98aa5e1453b541b0c257337fd78bb0372dc7841987424e0abce9cb1f0102a934bd037475b39cfe29dc27e77b3eb89fe805f8c6b1574d768dd2805d1a4b98143b7b6208abfebe7645a607084b1fd13ec7f088ac49cd5adc916090bcebe2e63786a7b80a009abd81349a9f34e135a7f4a2d569be474fe316b1b9f06ddf4d90a6650f7340181a27e1","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"50b256a55cdc23561dd4aa76abed4fd9","SHA1":"b3ee591b9218cfdcd394180558bd01bb674df627","SHA256":"fc1c2199740f069b26f02d81313408734051ecb7fa216b2a86458938fac6a909","SHA384":"81c9c8b202f6fe3354dd5503ef9ee6d418b9a28064968506bc2c49d7bd0efbaa9da9ce51d7c384992aa531ca905442a7"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"261d758721838be6952a5d436ef49482","SHA1":"48fb54a77fa0accb2465db44427fa54dadb40c71","SHA256":"fc0103dc5d498962537d247bb47b20b3afcd43026871bda30382d13a5345e851"},"Sections":{".text":{"Entropy":6.370050981269774,"Virtual Size":"0x19504"},".rdata":{"Entropy":5.499324680689697,"Virtual Size":"0x7a7c"},".data":{"Entropy":1.867829218165165,"Virtual Size":"0x48d4"},".pdata":{"Entropy":5.337655653168031,"Virtual Size":"0x27c0"},".edata":{"Entropy":5.736737915363427,"Virtual Size":"0x1a66"},"INIT":{"Entropy":5.000542465514514,"Virtual Size":"0x788"},".rsrc":{"Entropy":3.301923093235062,"Virtual Size":"0x398"},".reloc":{"Entropy":4.803419428597937,"Virtual Size":"0x6ea"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-06-30 07:41:34","Imphash":"fd133033a24971502ff0b2f189215c56","LoadsDespiteHVCI":"FALSE"},{"Filename":"VBoxDrv.sys","MD5":"3e87e3346441539d3a90278a120766df","SHA1":"ce5681896e7631b6e83cccb7aa056a33e72a1bbe","SHA256":"9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4","Authentihash":{"MD5":"d8e8d4c6d5dd6ba5ca58979f569cba95","SHA1":"c9027b3e1c731d0a16acd94c947f446df1a23318","SHA256":"681de794238060ec929aa5cf6c4701069f113a8524d31fb2f411648968ca17de"},"Description":"VirtualBox Support Driver","Company":"Pinduoduo Ltd Corp","InternalName":"VBoxDrv","OriginalFilename":"VBoxDrv.sys","FileVersion":"1.2.0.137904","Product":"Pinduoduo Secure VDI","ProductVersion":"1.2.0.137904","Copyright":"Copyright (C) 2015-2021 Pinduoduo Corporation","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["?RTAsn1VideotexString_CheckSanity@@YAHPEBURTASN1STRING@@IPEAURTERRINFO@@PEBD@Z","?RTAsn1VideotexString_Clone@@YAHPEAURTASN1STRING@@PEBU1@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTAsn1VideotexString_Compare@@YAHPEBURTASN1STRING@@0@Z","?RTAsn1VideotexString_DecodeAsn1@@YAHPEAURTASN1CURSOR@@IPEAURTASN1STRING@@PEBD@Z","?RTAsn1VideotexString_Delete@@YAXPEAURTASN1STRING@@@Z","?RTAsn1VideotexString_Enum@@YAHPEAURTASN1STRING@@P6AHPEAURTASN1CORE@@PEBDIPEAX@ZI3@Z","?RTAsn1VideotexString_Init@@YAHPEAURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrPkcs7Cert_SetAcV1@@YAHPEAURTCRPKCS7CERT@@PEBURTASN1CORE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrPkcs7Cert_SetAcV2@@YAHPEAURTCRPKCS7CERT@@PEBURTASN1CORE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrPkcs7Cert_SetExtendedCert@@YAHPEAURTCRPKCS7CERT@@PEBURTASN1CORE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrPkcs7Cert_SetOtherCert@@YAHPEAURTCRPKCS7CERT@@PEBURTASN1CORE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrPkcs7Cert_SetX509Cert@@YAHPEAURTCRPKCS7CERT@@PEBURTCRX509CERTIFICATE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrSpcLink_SetFile@@YAHPEAURTCRSPCLINK@@PEBURTCRSPCSTRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrSpcLink_SetMoniker@@YAHPEAURTCRSPCLINK@@PEBURTCRSPCSERIALIZEDOBJECT@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrSpcLink_SetUrl@@YAHPEAURTCRSPCLINK@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrSpcString_SetAscii@@YAHPEAURTCRSPCSTRING@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrSpcString_SetUcs2@@YAHPEAURTCRSPCSTRING@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrTafTrustAnchorChoice_SetCertificate@@YAHPEAURTCRTAFTRUSTANCHORCHOICE@@PEBURTCRX509CERTIFICATE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrTafTrustAnchorChoice_SetTaInfo@@YAHPEAURTCRTAFTRUSTANCHORCHOICE@@PEBURTCRTAFTRUSTANCHORINFO@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrTafTrustAnchorChoice_SetTbsCert@@YAHPEAURTCRTAFTRUSTANCHORCHOICE@@PEBURTCRX509TBSCERTIFICATE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509AttributeTypeAndValue_MatchAsRdnByRfc5280@@YA_NPEBURTCRX509ATTRIBUTETYPEANDVALUE@@0@Z","?RTCrX509GeneralName_SetDirectoryName@@YAHPEAURTCRX509GENERALNAME@@PEBURTCRX509NAME@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetDnsType@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetEdiPartyName@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1DYNTYPE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetIpAddress@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1OCTETSTRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetOtherName@@YAHPEAURTCRX509GENERALNAME@@PEBURTCRX509OTHERNAME@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetRegisteredId@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1OBJID@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetRfc822@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetUri@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1STRING@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509GeneralName_SetX400Address@@YAHPEAURTCRX509GENERALNAME@@PEBURTASN1DYNTYPE@@PEBURTASN1ALLOCATORVTABLE@@@Z","?RTCrX509RelativeDistinguishedName_MatchByRfc5280@@YA_NPEBURTCRX509ATTRIBUTETYPEANDVALUES@@0@Z","ASMAtomicBitClear","ASMAtomicXchgU16","ASMAtomicXchgU8","ASMCpuIdExSlow","ASMGetCS","ASMGetDS","ASMGetES","ASMGetFS","ASMGetFlags","ASMGetGS","ASMGetIDTR","ASMGetSS","ASMMemFirstMismatchingU8","ASMMemFirstNonZero","ASMMultU64ByU32DivByU32","ASMNopPause","ASMSetFlags","RTAsn1BitString_AreContentBitsValid","RTAsn1BitString_CheckSanity","RTAsn1BitString_Clone","RTAsn1BitString_Compare","RTAsn1BitString_DecodeAsn1","RTAsn1BitString_DecodeAsn1Ex","RTAsn1BitString_Delete","RTAsn1BitString_Enum","RTAsn1BitString_GetAsUInt64","RTAsn1BitString_Init","RTAsn1BitString_RefreshContent","RTAsn1BmpString_CheckSanity","RTAsn1BmpString_Clone","RTAsn1BmpString_Compare","RTAsn1BmpString_DecodeAsn1","RTAsn1BmpString_Delete","RTAsn1BmpString_Enum","RTAsn1BmpString_Init","RTAsn1Boolean_CheckSanity","RTAsn1Boolean_Clone","RTAsn1Boolean_Compare","RTAsn1Boolean_DecodeAsn1","RTAsn1Boolean_Delete","RTAsn1Boolean_Enum","RTAsn1Boolean_Init","RTAsn1Boolean_InitDefault","RTAsn1Boolean_Set","RTAsn1ContentAllocZ","RTAsn1ContentDup","RTAsn1ContentFree","RTAsn1ContentReallocZ","RTAsn1ContextTagN_Clone","RTAsn1ContextTagN_Init","RTAsn1Core_ChangeTag","RTAsn1Core_CheckSanity","RTAsn1Core_Clone","RTAsn1Core_CloneContent","RTAsn1Core_CloneNoContent","RTAsn1Core_Compare","RTAsn1Core_CompareEx","RTAsn1Core_DecodeAsn1","RTAsn1Core_Delete","RTAsn1Core_Enum","RTAsn1Core_Init","RTAsn1Core_InitDefault","RTAsn1Core_InitEx","RTAsn1Core_ResetImplict","RTAsn1Core_SetTagAndFlags","RTAsn1CursorCheckEnd","RTAsn1CursorCheckOctStrEnd","RTAsn1CursorCheckSeqEnd","RTAsn1CursorCheckSetEnd","RTAsn1CursorGetBitString","RTAsn1CursorGetBitStringEx","RTAsn1CursorGetBmpString","RTAsn1CursorGetBoolean","RTAsn1CursorGetContextTagNCursor","RTAsn1CursorGetCore","RTAsn1CursorGetDynType","RTAsn1CursorGetIa5String","RTAsn1CursorGetInteger","RTAsn1CursorGetNull","RTAsn1CursorGetObjId","RTAsn1CursorGetOctetString","RTAsn1CursorGetSequenceCursor","RTAsn1CursorGetSetCursor","RTAsn1CursorGetString","RTAsn1CursorGetTime","RTAsn1CursorGetUtf8String","RTAsn1CursorInitAllocation","RTAsn1CursorInitArrayAllocation","RTAsn1CursorInitPrimary","RTAsn1CursorInitSub","RTAsn1CursorInitSubFromCore","RTAsn1CursorIsEnd","RTAsn1CursorIsNextEx","RTAsn1CursorMatchTagClassFlagsEx","RTAsn1CursorPeek","RTAsn1CursorReadHdr","RTAsn1CursorSetInfo","RTAsn1CursorSetInfoV","RTAsn1Dummy_InitEx","RTAsn1Dump","RTAsn1DynType_CheckSanity","RTAsn1DynType_Clone","RTAsn1DynType_Compare","RTAsn1DynType_DecodeAsn1","RTAsn1DynType_Delete","RTAsn1DynType_Enum","RTAsn1DynType_Init","RTAsn1EncodePrepare","RTAsn1EncodeRecalcHdrSize","RTAsn1EncodeToBuffer","RTAsn1EncodeWrite","RTAsn1EncodeWriteHeader","RTAsn1GeneralString_CheckSanity","RTAsn1GeneralString_Clone","RTAsn1GeneralString_Compare","RTAsn1GeneralString_DecodeAsn1","RTAsn1GeneralString_Delete","RTAsn1GeneralString_Enum","RTAsn1GeneralString_Init","RTAsn1GeneralizedTime_CheckSanity","RTAsn1GeneralizedTime_Clone","RTAsn1GeneralizedTime_Compare","RTAsn1GeneralizedTime_DecodeAsn1","RTAsn1GeneralizedTime_Delete","RTAsn1GeneralizedTime_Enum","RTAsn1GeneralizedTime_Init","RTAsn1GraphicString_CheckSanity","RTAsn1GraphicString_Clone","RTAsn1GraphicString_Compare","RTAsn1GraphicString_DecodeAsn1","RTAsn1GraphicString_Delete","RTAsn1GraphicString_Enum","RTAsn1GraphicString_Init","RTAsn1Ia5String_CheckSanity","RTAsn1Ia5String_Clone","RTAsn1Ia5String_Compare","RTAsn1Ia5String_DecodeAsn1","RTAsn1Ia5String_Delete","RTAsn1Ia5String_Enum","RTAsn1Ia5String_Init","RTAsn1Integer_CheckSanity","RTAsn1Integer_Clone","RTAsn1Integer_Compare","RTAsn1Integer_DecodeAsn1","RTAsn1Integer_Delete","RTAsn1Integer_Enum","RTAsn1Integer_FromBigNum","RTAsn1Integer_Init","RTAsn1Integer_InitDefault","RTAsn1Integer_InitU64","RTAsn1Integer_ToBigNum","RTAsn1Integer_ToString","RTAsn1Integer_UnsignedCompare","RTAsn1Integer_UnsignedCompareWithU32","RTAsn1Integer_UnsignedCompareWithU64","RTAsn1Integer_UnsignedLastBit","RTAsn1MemAllocZ","RTAsn1MemDup","RTAsn1MemFree","RTAsn1MemFreeArray","RTAsn1MemInitAllocation","RTAsn1MemInitArrayAllocation","RTAsn1MemResizeArray","RTAsn1Null_CheckSanity","RTAsn1Null_Clone","RTAsn1Null_Compare","RTAsn1Null_DecodeAsn1","RTAsn1Null_Delete","RTAsn1Null_Enum","RTAsn1Null_Init","RTAsn1NumericString_CheckSanity","RTAsn1NumericString_Clone","RTAsn1NumericString_Compare","RTAsn1NumericString_DecodeAsn1","RTAsn1NumericString_Delete","RTAsn1NumericString_Enum","RTAsn1NumericString_Init","RTAsn1ObjIdCountComponents","RTAsn1ObjIdGetComponentsAsUInt32","RTAsn1ObjIdGetLastComponentsAsUInt32","RTAsn1ObjId_CheckSanity","RTAsn1ObjId_Clone","RTAsn1ObjId_Compare","RTAsn1ObjId_CompareWithString","RTAsn1ObjId_DecodeAsn1","RTAsn1ObjId_Delete","RTAsn1ObjId_Enum","RTAsn1ObjId_Init","RTAsn1ObjId_InitFromString","RTAsn1ObjId_StartsWith","RTAsn1OctetString_AreContentBytesValid","RTAsn1OctetString_CheckSanity","RTAsn1OctetString_Clone","RTAsn1OctetString_Compare","RTAsn1OctetString_DecodeAsn1","RTAsn1OctetString_Delete","RTAsn1OctetString_Enum","RTAsn1OctetString_Init","RTAsn1OctetString_RefreshContent","RTAsn1PrintableString_CheckSanity","RTAsn1PrintableString_Clone","RTAsn1PrintableString_Compare","RTAsn1PrintableString_DecodeAsn1","RTAsn1PrintableString_Delete","RTAsn1PrintableString_Enum","RTAsn1PrintableString_Init","RTAsn1QueryObjIdName","RTAsn1SeqOfBitStrings_CheckSanity","RTAsn1SeqOfBitStrings_Clone","RTAsn1SeqOfBitStrings_Compare","RTAsn1SeqOfBitStrings_DecodeAsn1","RTAsn1SeqOfBitStrings_Delete","RTAsn1SeqOfBitStrings_Enum","RTAsn1SeqOfBitStrings_Erase","RTAsn1SeqOfBitStrings_Init","RTAsn1SeqOfBitStrings_InsertEx","RTAsn1SeqOfBooleans_CheckSanity","RTAsn1SeqOfBooleans_Clone","RTAsn1SeqOfBooleans_Compare","RTAsn1SeqOfBooleans_DecodeAsn1","RTAsn1SeqOfBooleans_Delete","RTAsn1SeqOfBooleans_Enum","RTAsn1SeqOfBooleans_Erase","RTAsn1SeqOfBooleans_Init","RTAsn1SeqOfBooleans_InsertEx","RTAsn1SeqOfCore_Clone","RTAsn1SeqOfCore_Init","RTAsn1SeqOfCores_CheckSanity","RTAsn1SeqOfCores_Clone","RTAsn1SeqOfCores_Compare","RTAsn1SeqOfCores_DecodeAsn1","RTAsn1SeqOfCores_Delete","RTAsn1SeqOfCores_Enum","RTAsn1SeqOfCores_Erase","RTAsn1SeqOfCores_Init","RTAsn1SeqOfCores_InsertEx","RTAsn1SeqOfIntegers_CheckSanity","RTAsn1SeqOfIntegers_Clone","RTAsn1SeqOfIntegers_Compare","RTAsn1SeqOfIntegers_DecodeAsn1","RTAsn1SeqOfIntegers_Delete","RTAsn1SeqOfIntegers_Enum","RTAsn1SeqOfIntegers_Erase","RTAsn1SeqOfIntegers_Init","RTAsn1SeqOfIntegers_InsertEx","RTAsn1SeqOfObjIds_CheckSanity","RTAsn1SeqOfObjIds_Clone","RTAsn1SeqOfObjIds_Compare","RTAsn1SeqOfObjIds_DecodeAsn1","RTAsn1SeqOfObjIds_Delete","RTAsn1SeqOfObjIds_Enum","RTAsn1SeqOfObjIds_Erase","RTAsn1SeqOfObjIds_Init","RTAsn1SeqOfObjIds_InsertEx","RTAsn1SeqOfOctetStrings_CheckSanity","RTAsn1SeqOfOctetStrings_Clone","RTAsn1SeqOfOctetStrings_Compare","RTAsn1SeqOfOctetStrings_DecodeAsn1","RTAsn1SeqOfOctetStrings_Delete","RTAsn1SeqOfOctetStrings_Enum","RTAsn1SeqOfOctetStrings_Erase","RTAsn1SeqOfOctetStrings_Init","RTAsn1SeqOfOctetStrings_InsertEx","RTAsn1SeqOfStrings_CheckSanity","RTAsn1SeqOfStrings_Clone","RTAsn1SeqOfStrings_Compare","RTAsn1SeqOfStrings_DecodeAsn1","RTAsn1SeqOfStrings_Delete","RTAsn1SeqOfStrings_Enum","RTAsn1SeqOfStrings_Erase","RTAsn1SeqOfStrings_Init","RTAsn1SeqOfStrings_InsertEx","RTAsn1SeqOfTimes_CheckSanity","RTAsn1SeqOfTimes_Clone","RTAsn1SeqOfTimes_Compare","RTAsn1SeqOfTimes_DecodeAsn1","RTAsn1SeqOfTimes_Delete","RTAsn1SeqOfTimes_Enum","RTAsn1SeqOfTimes_Erase","RTAsn1SeqOfTimes_Init","RTAsn1SeqOfTimes_InsertEx","RTAsn1SequenceCore_Clone","RTAsn1SequenceCore_Init","RTAsn1SetCore_Clone","RTAsn1SetCore_Init","RTAsn1SetOfBitStrings_CheckSanity","RTAsn1SetOfBitStrings_Clone","RTAsn1SetOfBitStrings_Compare","RTAsn1SetOfBitStrings_DecodeAsn1","RTAsn1SetOfBitStrings_Delete","RTAsn1SetOfBitStrings_Enum","RTAsn1SetOfBitStrings_Erase","RTAsn1SetOfBitStrings_Init","RTAsn1SetOfBitStrings_InsertEx","RTAsn1SetOfBooleans_CheckSanity","RTAsn1SetOfBooleans_Clone","RTAsn1SetOfBooleans_Compare","RTAsn1SetOfBooleans_DecodeAsn1","RTAsn1SetOfBooleans_Delete","RTAsn1SetOfBooleans_Enum","RTAsn1SetOfBooleans_Erase","RTAsn1SetOfBooleans_Init","RTAsn1SetOfBooleans_InsertEx","RTAsn1SetOfCore_Clone","RTAsn1SetOfCore_Init","RTAsn1SetOfCores_CheckSanity","RTAsn1SetOfCores_Clone","RTAsn1SetOfCores_Compare","RTAsn1SetOfCores_DecodeAsn1","RTAsn1SetOfCores_Delete","RTAsn1SetOfCores_Enum","RTAsn1SetOfCores_Erase","RTAsn1SetOfCores_Init","RTAsn1SetOfCores_InsertEx","RTAsn1SetOfIntegers_CheckSanity","RTAsn1SetOfIntegers_Clone","RTAsn1SetOfIntegers_Compare","RTAsn1SetOfIntegers_DecodeAsn1","RTAsn1SetOfIntegers_Delete","RTAsn1SetOfIntegers_Enum","RTAsn1SetOfIntegers_Erase","RTAsn1SetOfIntegers_Init","RTAsn1SetOfIntegers_InsertEx","RTAsn1SetOfObjIdSeqs_CheckSanity","RTAsn1SetOfObjIdSeqs_Clone","RTAsn1SetOfObjIdSeqs_Compare","RTAsn1SetOfObjIdSeqs_DecodeAsn1","RTAsn1SetOfObjIdSeqs_Delete","RTAsn1SetOfObjIdSeqs_Enum","RTAsn1SetOfObjIdSeqs_Erase","RTAsn1SetOfObjIdSeqs_Init","RTAsn1SetOfObjIdSeqs_InsertEx","RTAsn1SetOfObjIds_CheckSanity","RTAsn1SetOfObjIds_Clone","RTAsn1SetOfObjIds_Compare","RTAsn1SetOfObjIds_DecodeAsn1","RTAsn1SetOfObjIds_Delete","RTAsn1SetOfObjIds_Enum","RTAsn1SetOfObjIds_Erase","RTAsn1SetOfObjIds_Init","RTAsn1SetOfObjIds_InsertEx","RTAsn1SetOfOctetStrings_CheckSanity","RTAsn1SetOfOctetStrings_Clone","RTAsn1SetOfOctetStrings_Compare","RTAsn1SetOfOctetStrings_DecodeAsn1","RTAsn1SetOfOctetStrings_Delete","RTAsn1SetOfOctetStrings_Enum","RTAsn1SetOfOctetStrings_Erase","RTAsn1SetOfOctetStrings_Init","RTAsn1SetOfOctetStrings_InsertEx","RTAsn1SetOfStrings_CheckSanity","RTAsn1SetOfStrings_Clone","RTAsn1SetOfStrings_Compare","RTAsn1SetOfStrings_DecodeAsn1","RTAsn1SetOfStrings_Delete","RTAsn1SetOfStrings_Enum","RTAsn1SetOfStrings_Erase","RTAsn1SetOfStrings_Init","RTAsn1SetOfStrings_InsertEx","RTAsn1SetOfTimes_CheckSanity","RTAsn1SetOfTimes_Clone","RTAsn1SetOfTimes_Compare","RTAsn1SetOfTimes_DecodeAsn1","RTAsn1SetOfTimes_Delete","RTAsn1SetOfTimes_Enum","RTAsn1SetOfTimes_Erase","RTAsn1SetOfTimes_Init","RTAsn1SetOfTimes_InsertEx","RTAsn1String_CheckSanity","RTAsn1String_Clone","RTAsn1String_Compare","RTAsn1String_CompareEx","RTAsn1String_CompareValues","RTAsn1String_CompareWithString","RTAsn1String_DecodeAsn1","RTAsn1String_Delete","RTAsn1String_Enum","RTAsn1String_Init","RTAsn1String_InitEx","RTAsn1String_InitWithValue","RTAsn1String_QueryUtf8","RTAsn1String_QueryUtf8Len","RTAsn1String_RecodeAsUtf8","RTAsn1T61String_CheckSanity","RTAsn1T61String_Clone","RTAsn1T61String_Compare","RTAsn1T61String_DecodeAsn1","RTAsn1T61String_Delete","RTAsn1T61String_Enum","RTAsn1T61String_Init","RTAsn1Time_CheckSanity","RTAsn1Time_Clone","RTAsn1Time_Compare","RTAsn1Time_CompareWithTimeSpec","RTAsn1Time_DecodeAsn1","RTAsn1Time_Delete","RTAsn1Time_Enum","RTAsn1Time_Init","RTAsn1Time_InitEx","RTAsn1UniversalString_CheckSanity","RTAsn1UniversalString_Clone","RTAsn1UniversalString_Compare","RTAsn1UniversalString_DecodeAsn1","RTAsn1UniversalString_Delete","RTAsn1UniversalString_Enum","RTAsn1UniversalString_Init","RTAsn1UtcTime_CheckSanity","RTAsn1UtcTime_Clone","RTAsn1UtcTime_Compare","RTAsn1UtcTime_DecodeAsn1","RTAsn1UtcTime_Delete","RTAsn1UtcTime_Enum","RTAsn1UtcTime_Init","RTAsn1Utf8String_CheckSanity","RTAsn1Utf8String_Clone","RTAsn1Utf8String_Compare","RTAsn1Utf8String_DecodeAsn1","RTAsn1Utf8String_Delete","RTAsn1Utf8String_Enum","RTAsn1Utf8String_Init","RTAsn1VisibleString_CheckSanity","RTAsn1VisibleString_Clone","RTAsn1VisibleString_Compare","RTAsn1VisibleString_DecodeAsn1","RTAsn1VisibleString_Delete","RTAsn1VisibleString_Enum","RTAsn1VisibleString_Init","RTAsn1VtCheckSanity","RTAsn1VtClone","RTAsn1VtCompare","RTAsn1VtDeepEnum","RTAsn1VtDelete","RTAssertAreQuiet","RTAssertMayPanic","RTAssertMsg1","RTAssertMsg1Weak","RTAssertMsg2AddV","RTAssertMsg2V","RTAssertMsg2Weak","RTAssertMsg2WeakV","RTAssertSetMayPanic","RTAssertSetQuiet","RTAssertShouldPanic","RTAvlPVDestroy","RTAvlPVDoWithAll","RTAvlPVGet","RTAvlPVGetBestFit","RTAvlPVInsert","RTAvlPVRemove","RTAvlPVRemoveBestFit","RTBigNumAdd","RTBigNumAssign","RTBigNumBitWidth","RTBigNumByteWidth","RTBigNumClone","RTBigNumCompare","RTBigNumCompareWithS64","RTBigNumCompareWithU64","RTBigNumDestroy","RTBigNumDivide","RTBigNumDivideLong","RTBigNumExponentiate","RTBigNumInit","RTBigNumInitZero","RTBigNumModExp","RTBigNumModulo","RTBigNumMultiply","RTBigNumNegate","RTBigNumNegateThis","RTBigNumShiftLeft","RTBigNumShiftRight","RTBigNumSubtract","RTBigNumToBytesBigEndian","RTCrCertCtxRelease","RTCrCertCtxRetain","RTCrDigestClone","RTCrDigestCreate","RTCrDigestCreateByObjId","RTCrDigestCreateByObjIdString","RTCrDigestCreateByType","RTCrDigestFinal","RTCrDigestFindByObjId","RTCrDigestFindByObjIdString","RTCrDigestFindByType","RTCrDigestGetAlgorithmOid","RTCrDigestGetConsumedSize","RTCrDigestGetFlags","RTCrDigestGetHash","RTCrDigestGetHashSize","RTCrDigestGetType","RTCrDigestIsFinalized","RTCrDigestMatch","RTCrDigestRelease","RTCrDigestReset","RTCrDigestRetain","RTCrDigestTypeToAlgorithmOid","RTCrDigestTypeToHashSize","RTCrDigestTypeToName","RTCrDigestUpdate","RTCrKeyCreateFromPublicAlgorithmAndBits","RTCrKeyCreateFromSubjectPublicKeyInfo","RTCrKeyGetBitCount","RTCrKeyGetType","RTCrKeyHasPrivatePart","RTCrKeyHasPublicPart","RTCrKeyQueryRsaModulus","RTCrKeyQueryRsaPrivateExponent","RTCrKeyRelease","RTCrKeyRetain","RTCrPkcs7Attribute_CheckSanity","RTCrPkcs7Attribute_Clone","RTCrPkcs7Attribute_Compare","RTCrPkcs7Attribute_DecodeAsn1","RTCrPkcs7Attribute_Delete","RTCrPkcs7Attribute_Enum","RTCrPkcs7Attribute_Init","RTCrPkcs7Attributes_CheckSanity","RTCrPkcs7Attributes_Clone","RTCrPkcs7Attributes_Compare","RTCrPkcs7Attributes_DecodeAsn1","RTCrPkcs7Attributes_Delete","RTCrPkcs7Attributes_Enum","RTCrPkcs7Attributes_Erase","RTCrPkcs7Attributes_Init","RTCrPkcs7Attributes_InsertEx","RTCrPkcs7Cert_CheckSanity","RTCrPkcs7Cert_Clone","RTCrPkcs7Cert_Compare","RTCrPkcs7Cert_DecodeAsn1","RTCrPkcs7Cert_Delete","RTCrPkcs7Cert_Enum","RTCrPkcs7Cert_Init","RTCrPkcs7ContentInfo_CheckSanity","RTCrPkcs7ContentInfo_Clone","RTCrPkcs7ContentInfo_Compare","RTCrPkcs7ContentInfo_DecodeAsn1","RTCrPkcs7ContentInfo_Delete","RTCrPkcs7ContentInfo_Enum","RTCrPkcs7ContentInfo_Init","RTCrPkcs7ContentInfo_IsSignedData","RTCrPkcs7DigestInfo_CheckSanity","RTCrPkcs7DigestInfo_Clone","RTCrPkcs7DigestInfo_Compare","RTCrPkcs7DigestInfo_DecodeAsn1","RTCrPkcs7DigestInfo_Delete","RTCrPkcs7DigestInfo_Enum","RTCrPkcs7DigestInfo_Init","RTCrPkcs7IssuerAndSerialNumber_CheckSanity","RTCrPkcs7IssuerAndSerialNumber_Clone","RTCrPkcs7IssuerAndSerialNumber_Compare","RTCrPkcs7IssuerAndSerialNumber_DecodeAsn1","RTCrPkcs7IssuerAndSerialNumber_Delete","RTCrPkcs7IssuerAndSerialNumber_Enum","RTCrPkcs7IssuerAndSerialNumber_Init","RTCrPkcs7SetOfCerts_CheckSanity","RTCrPkcs7SetOfCerts_Clone","RTCrPkcs7SetOfCerts_Compare","RTCrPkcs7SetOfCerts_DecodeAsn1","RTCrPkcs7SetOfCerts_Delete","RTCrPkcs7SetOfCerts_Enum","RTCrPkcs7SetOfCerts_Erase","RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber","RTCrPkcs7SetOfCerts_Init","RTCrPkcs7SetOfCerts_InsertEx","RTCrPkcs7SetOfContentInfos_CheckSanity","RTCrPkcs7SetOfContentInfos_Clone","RTCrPkcs7SetOfContentInfos_Compare","RTCrPkcs7SetOfContentInfos_DecodeAsn1","RTCrPkcs7SetOfContentInfos_Delete","RTCrPkcs7SetOfContentInfos_Enum","RTCrPkcs7SetOfContentInfos_Erase","RTCrPkcs7SetOfContentInfos_Init","RTCrPkcs7SetOfContentInfos_InsertEx","RTCrPkcs7SetOfSignedData_CheckSanity","RTCrPkcs7SetOfSignedData_Clone","RTCrPkcs7SetOfSignedData_Compare","RTCrPkcs7SetOfSignedData_DecodeAsn1","RTCrPkcs7SetOfSignedData_Delete","RTCrPkcs7SetOfSignedData_Enum","RTCrPkcs7SetOfSignedData_Erase","RTCrPkcs7SetOfSignedData_Init","RTCrPkcs7SetOfSignedData_InsertEx","RTCrPkcs7SignedData_CheckSanity","RTCrPkcs7SignedData_Clone","RTCrPkcs7SignedData_Compare","RTCrPkcs7SignedData_DecodeAsn1","RTCrPkcs7SignedData_Delete","RTCrPkcs7SignedData_Enum","RTCrPkcs7SignedData_Init","RTCrPkcs7SignerInfo_CheckSanity","RTCrPkcs7SignerInfo_Clone","RTCrPkcs7SignerInfo_Compare","RTCrPkcs7SignerInfo_DecodeAsn1","RTCrPkcs7SignerInfo_Delete","RTCrPkcs7SignerInfo_Enum","RTCrPkcs7SignerInfo_GetMsTimestamp","RTCrPkcs7SignerInfo_GetSigningTime","RTCrPkcs7SignerInfo_Init","RTCrPkcs7SignerInfos_CheckSanity","RTCrPkcs7SignerInfos_Clone","RTCrPkcs7SignerInfos_Compare","RTCrPkcs7SignerInfos_DecodeAsn1","RTCrPkcs7SignerInfos_Delete","RTCrPkcs7SignerInfos_Enum","RTCrPkcs7SignerInfos_Erase","RTCrPkcs7SignerInfos_Init","RTCrPkcs7SignerInfos_InsertEx","RTCrPkcs7VerifyCertCallbackCodeSigning","RTCrPkcs7VerifyCertCallbackDefault","RTCrPkcs7VerifySignedData","RTCrPkcs7VerifySignedDataWithExternalData","RTCrPkixGetCiperOidFromSignatureAlgorithm","RTCrPkixPubKeyVerifySignature","RTCrPkixPubKeyVerifySignedDigest","RTCrPkixPubKeyVerifySignedDigestByCertPubKeyInfo","RTCrPkixSignatureCreate","RTCrPkixSignatureCreateByObjId","RTCrPkixSignatureCreateByObjIdString","RTCrPkixSignatureRelease","RTCrPkixSignatureRetain","RTCrPkixSignatureSign","RTCrPkixSignatureVerify","RTCrPkixSignatureVerifyBitString","RTCrPkixSignatureVerifyOctetString","RTCrRsaDigestInfo_CheckSanity","RTCrRsaDigestInfo_Clone","RTCrRsaDigestInfo_Compare","RTCrRsaDigestInfo_DecodeAsn1","RTCrRsaDigestInfo_Delete","RTCrRsaDigestInfo_Enum","RTCrRsaDigestInfo_Init","RTCrRsaOtherPrimeInfo_CheckSanity","RTCrRsaOtherPrimeInfo_Clone","RTCrRsaOtherPrimeInfo_Compare","RTCrRsaOtherPrimeInfo_DecodeAsn1","RTCrRsaOtherPrimeInfo_Delete","RTCrRsaOtherPrimeInfo_Enum","RTCrRsaOtherPrimeInfo_Init","RTCrRsaOtherPrimeInfos_CheckSanity","RTCrRsaOtherPrimeInfos_Clone","RTCrRsaOtherPrimeInfos_Compare","RTCrRsaOtherPrimeInfos_DecodeAsn1","RTCrRsaOtherPrimeInfos_Delete","RTCrRsaOtherPrimeInfos_Enum","RTCrRsaOtherPrimeInfos_Erase","RTCrRsaOtherPrimeInfos_Init","RTCrRsaOtherPrimeInfos_InsertEx","RTCrRsaPrivateKey_CheckSanity","RTCrRsaPrivateKey_Clone","RTCrRsaPrivateKey_Compare","RTCrRsaPrivateKey_DecodeAsn1","RTCrRsaPrivateKey_Delete","RTCrRsaPrivateKey_Enum","RTCrRsaPrivateKey_Init","RTCrRsaPublicKey_CheckSanity","RTCrRsaPublicKey_Clone","RTCrRsaPublicKey_Compare","RTCrRsaPublicKey_DecodeAsn1","RTCrRsaPublicKey_Delete","RTCrRsaPublicKey_Enum","RTCrRsaPublicKey_Init","RTCrSpcAttributeTypeAndOptionalValue_CheckSanity","RTCrSpcAttributeTypeAndOptionalValue_Clone","RTCrSpcAttributeTypeAndOptionalValue_Compare","RTCrSpcAttributeTypeAndOptionalValue_DecodeAsn1","RTCrSpcAttributeTypeAndOptionalValue_Delete","RTCrSpcAttributeTypeAndOptionalValue_Enum","RTCrSpcAttributeTypeAndOptionalValue_Init","RTCrSpcIndirectDataContent_CheckSanity","RTCrSpcIndirectDataContent_CheckSanityEx","RTCrSpcIndirectDataContent_Clone","RTCrSpcIndirectDataContent_Compare","RTCrSpcIndirectDataContent_DecodeAsn1","RTCrSpcIndirectDataContent_Delete","RTCrSpcIndirectDataContent_Enum","RTCrSpcIndirectDataContent_GetPeImageObjAttrib","RTCrSpcIndirectDataContent_Init","RTCrSpcLink_CheckSanity","RTCrSpcLink_Clone","RTCrSpcLink_Compare","RTCrSpcLink_DecodeAsn1","RTCrSpcLink_Delete","RTCrSpcLink_Enum","RTCrSpcLink_Init","RTCrSpcPeImageData_CheckSanity","RTCrSpcPeImageData_Clone","RTCrSpcPeImageData_Compare","RTCrSpcPeImageData_DecodeAsn1","RTCrSpcPeImageData_Delete","RTCrSpcPeImageData_Enum","RTCrSpcPeImageData_Init","RTCrSpcSerializedObjectAttribute_CheckSanity","RTCrSpcSerializedObjectAttribute_Clone","RTCrSpcSerializedObjectAttribute_Compare","RTCrSpcSerializedObjectAttribute_DecodeAsn1","RTCrSpcSerializedObjectAttribute_Delete","RTCrSpcSerializedObjectAttribute_Enum","RTCrSpcSerializedObjectAttribute_Init","RTCrSpcSerializedObjectAttributes_CheckSanity","RTCrSpcSerializedObjectAttributes_Clone","RTCrSpcSerializedObjectAttributes_Compare","RTCrSpcSerializedObjectAttributes_DecodeAsn1","RTCrSpcSerializedObjectAttributes_Delete","RTCrSpcSerializedObjectAttributes_Enum","RTCrSpcSerializedObjectAttributes_Erase","RTCrSpcSerializedObjectAttributes_Init","RTCrSpcSerializedObjectAttributes_InsertEx","RTCrSpcSerializedObject_CheckSanity","RTCrSpcSerializedObject_Clone","RTCrSpcSerializedObject_Compare","RTCrSpcSerializedObject_DecodeAsn1","RTCrSpcSerializedObject_Delete","RTCrSpcSerializedObject_Enum","RTCrSpcSerializedObject_Init","RTCrSpcSerializedPageHashes_CheckSanity","RTCrSpcSerializedPageHashes_Clone","RTCrSpcSerializedPageHashes_Compare","RTCrSpcSerializedPageHashes_DecodeAsn1","RTCrSpcSerializedPageHashes_Delete","RTCrSpcSerializedPageHashes_Enum","RTCrSpcSerializedPageHashes_Init","RTCrSpcSerializedPageHashes_UpdateDerivedData","RTCrSpcString_CheckSanity","RTCrSpcString_Clone","RTCrSpcString_Compare","RTCrSpcString_DecodeAsn1","RTCrSpcString_Delete","RTCrSpcString_Enum","RTCrSpcString_Init","RTCrStoreCertAddEncoded","RTCrStoreCertByIssuerAndSerialNo","RTCrStoreCertCount","RTCrStoreCertFindAll","RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280","RTCrStoreCertSearchDestroy","RTCrStoreCertSearchNext","RTCrStoreCreateInMem","RTCrStoreRelease","RTCrStoreRetain","RTCrTafCertPathControls_CheckSanity","RTCrTafCertPathControls_Clone","RTCrTafCertPathControls_Compare","RTCrTafCertPathControls_DecodeAsn1","RTCrTafCertPathControls_Delete","RTCrTafCertPathControls_Enum","RTCrTafCertPathControls_Init","RTCrTafTrustAnchorChoice_CheckSanity","RTCrTafTrustAnchorChoice_Clone","RTCrTafTrustAnchorChoice_Compare","RTCrTafTrustAnchorChoice_DecodeAsn1","RTCrTafTrustAnchorChoice_Delete","RTCrTafTrustAnchorChoice_Enum","RTCrTafTrustAnchorChoice_Init","RTCrTafTrustAnchorInfo_CheckSanity","RTCrTafTrustAnchorInfo_Clone","RTCrTafTrustAnchorInfo_Compare","RTCrTafTrustAnchorInfo_DecodeAsn1","RTCrTafTrustAnchorInfo_Delete","RTCrTafTrustAnchorInfo_Enum","RTCrTafTrustAnchorInfo_Init","RTCrTafTrustAnchorList_CheckSanity","RTCrTafTrustAnchorList_Clone","RTCrTafTrustAnchorList_Compare","RTCrTafTrustAnchorList_DecodeAsn1","RTCrTafTrustAnchorList_Delete","RTCrTafTrustAnchorList_Enum","RTCrTafTrustAnchorList_Erase","RTCrTafTrustAnchorList_Init","RTCrTafTrustAnchorList_InsertEx","RTCrTspAccuracy_CheckSanity","RTCrTspAccuracy_Clone","RTCrTspAccuracy_Compare","RTCrTspAccuracy_DecodeAsn1","RTCrTspAccuracy_Delete","RTCrTspAccuracy_Enum","RTCrTspAccuracy_Init","RTCrTspMessageImprint_CheckSanity","RTCrTspMessageImprint_Clone","RTCrTspMessageImprint_Compare","RTCrTspMessageImprint_DecodeAsn1","RTCrTspMessageImprint_Delete","RTCrTspMessageImprint_Enum","RTCrTspMessageImprint_Init","RTCrTspTstInfo_CheckSanity","RTCrTspTstInfo_Clone","RTCrTspTstInfo_Compare","RTCrTspTstInfo_DecodeAsn1","RTCrTspTstInfo_Delete","RTCrTspTstInfo_Enum","RTCrTspTstInfo_Init","RTCrX509AlgorithmIdentifier_CheckSanity","RTCrX509AlgorithmIdentifier_Clone","RTCrX509AlgorithmIdentifier_CombineEncryptionAndDigest","RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid","RTCrX509AlgorithmIdentifier_Compare","RTCrX509AlgorithmIdentifier_CompareDigestAndEncryptedDigest","RTCrX509AlgorithmIdentifier_CompareDigestOidAndEncryptedDigestOid","RTCrX509AlgorithmIdentifier_CompareWithString","RTCrX509AlgorithmIdentifier_DecodeAsn1","RTCrX509AlgorithmIdentifier_Delete","RTCrX509AlgorithmIdentifier_Enum","RTCrX509AlgorithmIdentifier_Init","RTCrX509AlgorithmIdentifier_QueryDigestSize","RTCrX509AlgorithmIdentifier_QueryDigestType","RTCrX509AlgorithmIdentifiers_CheckSanity","RTCrX509AlgorithmIdentifiers_Clone","RTCrX509AlgorithmIdentifiers_Compare","RTCrX509AlgorithmIdentifiers_DecodeAsn1","RTCrX509AlgorithmIdentifiers_Delete","RTCrX509AlgorithmIdentifiers_Enum","RTCrX509AlgorithmIdentifiers_Erase","RTCrX509AlgorithmIdentifiers_Init","RTCrX509AlgorithmIdentifiers_InsertEx","RTCrX509AttributeTypeAndValue_CheckSanity","RTCrX509AttributeTypeAndValue_Clone","RTCrX509AttributeTypeAndValue_Compare","RTCrX509AttributeTypeAndValue_DecodeAsn1","RTCrX509AttributeTypeAndValue_Delete","RTCrX509AttributeTypeAndValue_Enum","RTCrX509AttributeTypeAndValue_Init","RTCrX509AttributeTypeAndValues_CheckSanity","RTCrX509AttributeTypeAndValues_Clone","RTCrX509AttributeTypeAndValues_Compare","RTCrX509AttributeTypeAndValues_DecodeAsn1","RTCrX509AttributeTypeAndValues_Delete","RTCrX509AttributeTypeAndValues_Enum","RTCrX509AttributeTypeAndValues_Erase","RTCrX509AttributeTypeAndValues_Init","RTCrX509AttributeTypeAndValues_InsertEx","RTCrX509AuthorityKeyIdentifier_CheckSanity","RTCrX509AuthorityKeyIdentifier_Clone","RTCrX509AuthorityKeyIdentifier_Compare","RTCrX509AuthorityKeyIdentifier_DecodeAsn1","RTCrX509AuthorityKeyIdentifier_Delete","RTCrX509AuthorityKeyIdentifier_Enum","RTCrX509AuthorityKeyIdentifier_Init","RTCrX509BasicConstraints_CheckSanity","RTCrX509BasicConstraints_Clone","RTCrX509BasicConstraints_Compare","RTCrX509BasicConstraints_DecodeAsn1","RTCrX509BasicConstraints_Delete","RTCrX509BasicConstraints_Enum","RTCrX509BasicConstraints_Init","RTCrX509CertPathsBuild","RTCrX509CertPathsCreate","RTCrX509CertPathsCreateEx","RTCrX509CertPathsDumpAll","RTCrX509CertPathsDumpOne","RTCrX509CertPathsGetPathCount","RTCrX509CertPathsGetPathLength","RTCrX509CertPathsGetPathNodeCert","RTCrX509CertPathsGetPathVerifyResult","RTCrX509CertPathsQueryPathInfo","RTCrX509CertPathsRelease","RTCrX509CertPathsRetain","RTCrX509CertPathsSetTrustedStore","RTCrX509CertPathsSetUntrustedArray","RTCrX509CertPathsSetUntrustedSet","RTCrX509CertPathsSetUntrustedStore","RTCrX509CertPathsSetValidTime","RTCrX509CertPathsSetValidTimeSpec","RTCrX509CertPathsValidateAll","RTCrX509CertPathsValidateOne","RTCrX509CertificatePolicies_CheckSanity","RTCrX509CertificatePolicies_Clone","RTCrX509CertificatePolicies_Compare","RTCrX509CertificatePolicies_DecodeAsn1","RTCrX509CertificatePolicies_Delete","RTCrX509CertificatePolicies_Enum","RTCrX509CertificatePolicies_Erase","RTCrX509CertificatePolicies_Init","RTCrX509CertificatePolicies_InsertEx","RTCrX509Certificate_CheckSanity","RTCrX509Certificate_Clone","RTCrX509Certificate_Compare","RTCrX509Certificate_DecodeAsn1","RTCrX509Certificate_Delete","RTCrX509Certificate_Enum","RTCrX509Certificate_Init","RTCrX509Certificate_IsSelfSigned","RTCrX509Certificate_MatchIssuerAndSerialNumber","RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280","RTCrX509Certificate_VerifySignature","RTCrX509Certificate_VerifySignatureSelfSigned","RTCrX509Certificates_CheckSanity","RTCrX509Certificates_Clone","RTCrX509Certificates_Compare","RTCrX509Certificates_DecodeAsn1","RTCrX509Certificates_Delete","RTCrX509Certificates_Enum","RTCrX509Certificates_Erase","RTCrX509Certificates_FindByIssuerAndSerialNumber","RTCrX509Certificates_Init","RTCrX509Certificates_InsertEx","RTCrX509Extension_CheckSanity","RTCrX509Extension_Clone","RTCrX509Extension_Compare","RTCrX509Extension_DecodeAsn1","RTCrX509Extension_Delete","RTCrX509Extension_Enum","RTCrX509Extension_ExtnValue_DecodeAsn1","RTCrX509Extension_Init","RTCrX509Extensions_CheckSanity","RTCrX509Extensions_Clone","RTCrX509Extensions_Compare","RTCrX509Extensions_DecodeAsn1","RTCrX509Extensions_Delete","RTCrX509Extensions_Enum","RTCrX509Extensions_Erase","RTCrX509Extensions_Init","RTCrX509Extensions_InsertEx","RTCrX509GeneralName_CheckSanity","RTCrX509GeneralName_Clone","RTCrX509GeneralName_Compare","RTCrX509GeneralName_ConstraintMatch","RTCrX509GeneralName_DecodeAsn1","RTCrX509GeneralName_Delete","RTCrX509GeneralName_Enum","RTCrX509GeneralName_Init","RTCrX509GeneralNames_CheckSanity","RTCrX509GeneralNames_Clone","RTCrX509GeneralNames_Compare","RTCrX509GeneralNames_DecodeAsn1","RTCrX509GeneralNames_Delete","RTCrX509GeneralNames_Enum","RTCrX509GeneralNames_Erase","RTCrX509GeneralNames_Init","RTCrX509GeneralNames_InsertEx","RTCrX509GeneralSubtree_CheckSanity","RTCrX509GeneralSubtree_Clone","RTCrX509GeneralSubtree_Compare","RTCrX509GeneralSubtree_ConstraintMatch","RTCrX509GeneralSubtree_DecodeAsn1","RTCrX509GeneralSubtree_Delete","RTCrX509GeneralSubtree_Enum","RTCrX509GeneralSubtree_Init","RTCrX509GeneralSubtrees_CheckSanity","RTCrX509GeneralSubtrees_Clone","RTCrX509GeneralSubtrees_Compare","RTCrX509GeneralSubtrees_DecodeAsn1","RTCrX509GeneralSubtrees_Delete","RTCrX509GeneralSubtrees_Enum","RTCrX509GeneralSubtrees_Erase","RTCrX509GeneralSubtrees_Init","RTCrX509GeneralSubtrees_InsertEx","RTCrX509NameConstraints_CheckSanity","RTCrX509NameConstraints_Clone","RTCrX509NameConstraints_Compare","RTCrX509NameConstraints_DecodeAsn1","RTCrX509NameConstraints_Delete","RTCrX509NameConstraints_Enum","RTCrX509NameConstraints_Init","RTCrX509Name_CheckSanity","RTCrX509Name_Clone","RTCrX509Name_Compare","RTCrX509Name_ConstraintMatch","RTCrX509Name_DecodeAsn1","RTCrX509Name_Delete","RTCrX509Name_Enum","RTCrX509Name_Erase","RTCrX509Name_FormatAsString","RTCrX509Name_GetShortRdn","RTCrX509Name_Init","RTCrX509Name_InsertEx","RTCrX509Name_MatchByRfc5280","RTCrX509Name_MatchWithString","RTCrX509Name_RecodeAsUtf8","RTCrX509OldAuthorityKeyIdentifier_CheckSanity","RTCrX509OldAuthorityKeyIdentifier_Clone","RTCrX509OldAuthorityKeyIdentifier_Compare","RTCrX509OldAuthorityKeyIdentifier_DecodeAsn1","RTCrX509OldAuthorityKeyIdentifier_Delete","RTCrX509OldAuthorityKeyIdentifier_Enum","RTCrX509OldAuthorityKeyIdentifier_Init","RTCrX509OtherName_CheckSanity","RTCrX509OtherName_Clone","RTCrX509OtherName_Compare","RTCrX509OtherName_DecodeAsn1","RTCrX509OtherName_Delete","RTCrX509OtherName_Enum","RTCrX509OtherName_Init","RTCrX509PolicyConstraints_CheckSanity","RTCrX509PolicyConstraints_Clone","RTCrX509PolicyConstraints_Compare","RTCrX509PolicyConstraints_DecodeAsn1","RTCrX509PolicyConstraints_Delete","RTCrX509PolicyConstraints_Enum","RTCrX509PolicyConstraints_Init","RTCrX509PolicyInformation_CheckSanity","RTCrX509PolicyInformation_Clone","RTCrX509PolicyInformation_Compare","RTCrX509PolicyInformation_DecodeAsn1","RTCrX509PolicyInformation_Delete","RTCrX509PolicyInformation_Enum","RTCrX509PolicyInformation_Init","RTCrX509PolicyMapping_CheckSanity","RTCrX509PolicyMapping_Clone","RTCrX509PolicyMapping_Compare","RTCrX509PolicyMapping_DecodeAsn1","RTCrX509PolicyMapping_Delete","RTCrX509PolicyMapping_Enum","RTCrX509PolicyMapping_Init","RTCrX509PolicyMappings_CheckSanity","RTCrX509PolicyMappings_Clone","RTCrX509PolicyMappings_Compare","RTCrX509PolicyMappings_DecodeAsn1","RTCrX509PolicyMappings_Delete","RTCrX509PolicyMappings_Enum","RTCrX509PolicyMappings_Erase","RTCrX509PolicyMappings_Init","RTCrX509PolicyMappings_InsertEx","RTCrX509PolicyQualifierInfo_CheckSanity","RTCrX509PolicyQualifierInfo_Clone","RTCrX509PolicyQualifierInfo_Compare","RTCrX509PolicyQualifierInfo_DecodeAsn1","RTCrX509PolicyQualifierInfo_Delete","RTCrX509PolicyQualifierInfo_Enum","RTCrX509PolicyQualifierInfo_Init","RTCrX509PolicyQualifierInfos_CheckSanity","RTCrX509PolicyQualifierInfos_Clone","RTCrX509PolicyQualifierInfos_Compare","RTCrX509PolicyQualifierInfos_DecodeAsn1","RTCrX509PolicyQualifierInfos_Delete","RTCrX509PolicyQualifierInfos_Enum","RTCrX509PolicyQualifierInfos_Erase","RTCrX509PolicyQualifierInfos_Init","RTCrX509PolicyQualifierInfos_InsertEx","RTCrX509SubjectPublicKeyInfo_CheckSanity","RTCrX509SubjectPublicKeyInfo_Clone","RTCrX509SubjectPublicKeyInfo_Compare","RTCrX509SubjectPublicKeyInfo_DecodeAsn1","RTCrX509SubjectPublicKeyInfo_Delete","RTCrX509SubjectPublicKeyInfo_Enum","RTCrX509SubjectPublicKeyInfo_Init","RTCrX509TbsCertificate_CheckSanity","RTCrX509TbsCertificate_Clone","RTCrX509TbsCertificate_Compare","RTCrX509TbsCertificate_DecodeAsn1","RTCrX509TbsCertificate_Delete","RTCrX509TbsCertificate_Enum","RTCrX509TbsCertificate_Init","RTCrX509TbsCertificate_ReprocessExtensions","RTCrX509Validity_CheckSanity","RTCrX509Validity_Clone","RTCrX509Validity_Compare","RTCrX509Validity_DecodeAsn1","RTCrX509Validity_Delete","RTCrX509Validity_Enum","RTCrX509Validity_Init","RTCrX509Validity_IsValidAtTimeSpec","RTCrc32","RTCrc32Finish","RTCrc32Process","RTCrc32Start","RTErrConvertFromErrno","RTErrConvertFromNtStatus","RTErrConvertToErrno","RTErrInfoAdd","RTErrInfoAddF","RTErrInfoAddV","RTErrInfoLogAndAdd","RTErrInfoLogAndAddF","RTErrInfoLogAndAddV","RTErrInfoLogAndSet","RTErrInfoLogAndSetF","RTErrInfoLogAndSetV","RTErrInfoSet","RTErrInfoSetF","RTErrInfoSetV","RTErrVarsAreEqual","RTErrVarsHaveChanged","RTErrVarsRestore","RTErrVarsSave","RTHandleTableAllocWithCtx","RTHandleTableCreate","RTHandleTableCreateEx","RTHandleTableDestroy","RTHandleTableFreeWithCtx","RTHandleTableLookupWithCtx","RTLatin1CalcUtf8Len","RTLatin1CalcUtf8LenEx","RTLatin1ToUtf8ExTag","RTLatin1ToUtf8Tag","RTLdrArchName","RTLdrClose","RTLdrEnumDbgInfo","RTLdrEnumSegments","RTLdrEnumSymbols","RTLdrGetArch","RTLdrGetBits","RTLdrGetEndian","RTLdrGetFormat","RTLdrGetFunction","RTLdrGetHostArch","RTLdrGetSymbol","RTLdrGetSymbolEx","RTLdrGetType","RTLdrHashImage","RTLdrLinkAddressToRva","RTLdrLinkAddressToSegOffset","RTLdrOpenWithReader","RTLdrQueryForwarderInfo","RTLdrQueryProp","RTLdrQueryPropEx","RTLdrRelocate","RTLdrRvaToSegOffset","RTLdrSegOffsetToRva","RTLdrSize","RTLdrUnwindFrame","RTLdrVerifySignature","RTLogClearFileDelayFlag","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDefaultInstanceEx","RTLogDestinations","RTLogDestroy","RTLogDumpPrintfV","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGetDefaultInstanceEx","RTLogGetDestinations","RTLogGetFlags","RTLogGetGroupSettings","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelGetDefaultInstance","RTLogRelGetDefaultInstanceEx","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetBuffering","RTLogRelSetDefaultInstance","RTLogSetBuffering","RTLogSetCustomPrefixCallback","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMd2","RTMd2Final","RTMd2Init","RTMd2Update","RTMd5","RTMd5Final","RTMd5FromString","RTMd5Init","RTMd5ToString","RTMd5Update","RTMemAllocExTag","RTMemAllocTag","RTMemAllocVarTag","RTMemAllocZTag","RTMemAllocZVarTag","RTMemContAlloc","RTMemContFree","RTMemDupExTag","RTMemDupTag","RTMemExecAllocTag","RTMemExecFree","RTMemFree","RTMemFreeEx","RTMemFreeZ","RTMemReallocTag","RTMemReallocZTag","RTMemSaferAllocZExTag","RTMemSaferAllocZTag","RTMemSaferFree","RTMemSaferReallocZExTag","RTMemSaferReallocZTag","RTMemSaferScramble","RTMemSaferUnscramble","RTMemTmpAllocTag","RTMemTmpAllocZTag","RTMemTmpFree","RTMemTmpFreeZ","RTMemWipeThoroughly","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpCurSetIndex","RTMpCurSetIndexAndId","RTMpGetArraySize","RTMpGetCount","RTMpGetCpuGroupCounts","RTMpGetMaxCpuGroupCount","RTMpGetMaxCpuId","RTMpGetOnlineCoreCount","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetPresentCoreCount","RTMpGetPresentCount","RTMpGetPresentSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuPresent","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnAllIsConcurrentSafe","RTMpOnOthers","RTMpOnPair","RTMpOnPairIsConcurrentExecSupported","RTMpOnSpecific","RTMpPokeCpu","RTMpSetIndexFromCpuGroupMember","RTNetIPv4AddDataChecksum","RTNetIPv4AddTCPChecksum","RTNetIPv4AddUDPChecksum","RTNetIPv4FinalizeChecksum","RTNetIPv4HdrChecksum","RTNetIPv4IsDHCPValid","RTNetIPv4IsHdrValid","RTNetIPv4IsTCPSizeValid","RTNetIPv4IsTCPValid","RTNetIPv4IsUDPSizeValid","RTNetIPv4IsUDPValid","RTNetIPv4PseudoChecksum","RTNetIPv4PseudoChecksumBits","RTNetIPv4TCPChecksum","RTNetIPv4UDPChecksum","RTNetIPv6PseudoChecksum","RTNetIPv6PseudoChecksumBits","RTNetIPv6PseudoChecksumEx","RTNetTCPChecksum","RTNetUDPChecksum","RTNtPathExpand8dot3Path","RTNtPathExpand8dot3PathA","RTNtPathFindPossible8dot3Name","RTOnceReset","RTOnceSlow","RTPathChangeToUnixSlashes","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0AssertPanicSystem","RTR0DbgKrnlInfoGetSymbol","RTR0DbgKrnlInfoOpen","RTR0DbgKrnlInfoQueryMember","RTR0DbgKrnlInfoQuerySize","RTR0DbgKrnlInfoQuerySymbol","RTR0DbgKrnlInfoRelease","RTR0DbgKrnlInfoRetain","RTR0Init","RTR0MemAreKrnlAndUsrDifferent","RTR0MemKernelCopyFrom","RTR0MemKernelCopyTo","RTR0MemKernelIsValidAddr","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocContTag","RTR0MemObjAllocLowTag","RTR0MemObjAllocPageTag","RTR0MemObjAllocPhysExTag","RTR0MemObjAllocPhysNCTag","RTR0MemObjAllocPhysTag","RTR0MemObjEnterPhysTag","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernelTag","RTR0MemObjLockUserTag","RTR0MemObjMapKernelExTag","RTR0MemObjMapKernelTag","RTR0MemObjMapUserExTag","RTR0MemObjMapUserTag","RTR0MemObjProtect","RTR0MemObjReserveKernelTag","RTR0MemObjReserveUserTag","RTR0MemObjSize","RTR0MemUserCopyFrom","RTR0MemUserCopyTo","RTR0MemUserIsValidAddr","RTR0ProcHandleSelf","RTR0Term","RTR0TermForced","RTRandAdvBytes","RTRandAdvCreateParkMiller","RTRandAdvCreateSystemFaster","RTRandAdvDestroy","RTRandAdvRestoreState","RTRandAdvS32","RTRandAdvS32Ex","RTRandAdvS64","RTRandAdvS64Ex","RTRandAdvSaveState","RTRandAdvSeed","RTRandAdvU32","RTRandAdvU32Ex","RTRandAdvU64","RTRandAdvU64Ex","RTRandBytes","RTRandS32","RTRandS32Ex","RTRandS64","RTRandS64Ex","RTRandU32","RTRandU32Ex","RTRandU64","RTRandU64Ex","RTSemEventCreate","RTSemEventCreateEx","RTSemEventDestroy","RTSemEventGetResolution","RTSemEventMultiCreate","RTSemEventMultiCreateEx","RTSemEventMultiDestroy","RTSemEventMultiGetResolution","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitEx","RTSemEventMultiWaitExDebug","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitEx","RTSemEventWaitExDebug","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSemMutexCreate","RTSemMutexCreateEx","RTSemMutexDestroy","RTSemMutexIsOwned","RTSemMutexRelease","RTSemMutexRequest","RTSemMutexRequestDebug","RTSemMutexRequestNoResume","RTSemMutexRequestNoResumeDebug","RTSemSpinMutexCreate","RTSemSpinMutexDestroy","RTSemSpinMutexRelease","RTSemSpinMutexRequest","RTSemSpinMutexTryRequest","RTSha1","RTSha1Check","RTSha1Final","RTSha1FromString","RTSha1Init","RTSha1ToString","RTSha1Update","RTSha224","RTSha224Check","RTSha224Final","RTSha224Init","RTSha224Update","RTSha256","RTSha256Check","RTSha256Final","RTSha256FromString","RTSha256Init","RTSha256ToString","RTSha256Update","RTSha384","RTSha384Check","RTSha384Final","RTSha384Init","RTSha384Update","RTSha512","RTSha512Check","RTSha512Final","RTSha512FromString","RTSha512Init","RTSha512ToString","RTSha512Update","RTSha512t224","RTSha512t224Check","RTSha512t224Final","RTSha512t224Init","RTSha512t224Update","RTSha512t256","RTSha512t256Check","RTSha512t256Final","RTSha512t256Init","RTSha512t256Update","RTSpinlockAcquire","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTStrAAppendNTag","RTStrAAppendTag","RTStrATruncateTag","RTStrAllocExTag","RTStrAllocTag","RTStrCalcLatin1Len","RTStrCalcLatin1LenEx","RTStrCalcUtf16Len","RTStrCalcUtf16LenEx","RTStrCat","RTStrCmp","RTStrConvertHexBytes","RTStrConvertHexBytesEx","RTStrCopy","RTStrCopyEx","RTStrCopyP","RTStrDupExTag","RTStrDupNTag","RTStrDupTag","RTStrFormat","RTStrFormatNumber","RTStrFormatR80","RTStrFormatR80u2","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatU128","RTStrFormatU16","RTStrFormatU256","RTStrFormatU32","RTStrFormatU512","RTStrFormatU64","RTStrFormatU8","RTStrFormatV","RTStrFree","RTStrGetCpExInternal","RTStrGetCpInternal","RTStrGetCpNExInternal","RTStrICmp","RTStrICmpAscii","RTStrIStr","RTStrIsValidEncoding","RTStrNCmp","RTStrNICmp","RTStrNLen","RTStrPrevCp","RTStrPrintHexBytes","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrPurgeComplementSet","RTStrPurgeEncoding","RTStrPutCpInternal","RTStrReallocTag","RTStrStrip","RTStrStripL","RTStrStripR","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToLatin1ExTag","RTStrToLatin1Tag","RTStrToLower","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTStrToUni","RTStrToUniEx","RTStrToUpper","RTStrToUtf16BigExTag","RTStrToUtf16BigTag","RTStrToUtf16ExTag","RTStrToUtf16Tag","RTStrUniLen","RTStrUniLenEx","RTStrValidateEncoding","RTStrValidateEncodingEx","RTTermDeregisterCallback","RTTermRegisterCallback","RTTermRunCallbacks","RTThreadCreate","RTThreadCreateF","RTThreadCreateV","RTThreadCtxHookCreate","RTThreadCtxHookDestroy","RTThreadCtxHookDisable","RTThreadCtxHookEnable","RTThreadCtxHookIsEnabled","RTThreadFromNative","RTThreadGetName","RTThreadGetNative","RTThreadGetType","RTThreadIsInInterrupt","RTThreadIsInitialized","RTThreadIsMain","RTThreadIsSelfAlive","RTThreadIsSelfKnown","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptIsPending","RTThreadPreemptIsPendingTrusty","RTThreadPreemptIsPossible","RTThreadPreemptRestore","RTThreadSelf","RTThreadSelfName","RTThreadSetName","RTThreadSetType","RTThreadSleep","RTThreadUserReset","RTThreadUserSignal","RTThreadUserWait","RTThreadUserWaitNoResume","RTThreadWait","RTThreadWaitNoResume","RTThreadYield","RTTimeCompare","RTTimeConvertToZulu","RTTimeExplode","RTTimeFromRfc2822","RTTimeFromString","RTTimeImplode","RTTimeIsLeapYear","RTTimeLocalNormalize","RTTimeMilliTS","RTTimeNanoTS","RTTimeNormalize","RTTimeNow","RTTimeSpecFromString","RTTimeSpecToString","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimeToRfc2822","RTTimeToString","RTTimeToStringEx","RTTimerCanDoHighResolution","RTTimerChangeInterval","RTTimerCreate","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","RTUInt128MulByU64","RTUtf16AllocTag","RTUtf16BigCalcUtf8Len","RTUtf16BigCalcUtf8LenEx","RTUtf16BigGetCpExInternal","RTUtf16BigToUtf8ExTag","RTUtf16BigToUtf8Tag","RTUtf16CalcUtf8Len","RTUtf16CalcUtf8LenEx","RTUtf16CatAscii","RTUtf16Cmp","RTUtf16CmpUtf8","RTUtf16CopyAscii","RTUtf16DupExTag","RTUtf16DupTag","RTUtf16End","RTUtf16Free","RTUtf16GetCpExInternal","RTUtf16GetCpInternal","RTUtf16ICmpAscii","RTUtf16IsValidEncoding","RTUtf16Len","RTUtf16LittleCalcUtf8Len","RTUtf16LittleCalcUtf8LenEx","RTUtf16LittleToUtf8ExTag","RTUtf16LittleToUtf8Tag","RTUtf16PurgeComplementSet","RTUtf16PutCpInternal","RTUtf16ReallocTag","RTUtf16ToUtf8ExTag","RTUtf16ToUtf8Tag","RTUtf16ValidateEncoding","RTUtf16ValidateEncodingEx","RTUuidClear","RTUuidCompare","RTUuidCompare2Strs","RTUuidCompareStr","RTUuidFromStr","RTUuidFromUtf16","RTUuidIsNull","RTUuidToStr","RTUuidToUtf16","SUPGetCpuHzFromGipForAsyncMode","SUPGetGIP","SUPGetTscDeltaSlow","SUPIsTscFreqCompatible","SUPIsTscFreqCompatibleEx","SUPR0BadContext","SUPR0ChangeCR4","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetCurrentGdtRw","SUPR0GetDefaultLogInstanceEx","SUPR0GetDefaultLogRelInstanceEx","SUPR0GetHwvirtMsrs","SUPR0GetKernelFeatures","SUPR0GetPagingMode","SUPR0GetSessionGVM","SUPR0GetSessionVM","SUPR0GetSvmUsability","SUPR0GetVTSupport","SUPR0GetVmxUsability","SUPR0GipMap","SUPR0GipUnmap","SUPR0IoCtlCleanup","SUPR0IoCtlPerform","SUPR0IoCtlSetupForHandle","SUPR0LdrIsLockOwnerByMod","SUPR0LdrLock","SUPR0LdrModByName","SUPR0LdrModRelease","SUPR0LdrModRetain","SUPR0LdrUnlock","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0PageProtect","SUPR0Printf","SUPR0QueryUcodeRev","SUPR0QueryVTCaps","SUPR0ResumeVTxOnCpu","SUPR0SetSessionVM","SUPR0SuspendVTxOnCpu","SUPR0TracerDeregisterDrv","SUPR0TracerDeregisterImpl","SUPR0TracerFireProbe","SUPR0TracerRegisterDrv","SUPR0TracerRegisterImpl","SUPR0TracerRegisterModule","SUPR0TracerUmodProbeFire","SUPR0TscDeltaMeasureBySetIndex","SUPR0UnlockMem","SUPReadTscWithDelta","SUPSemEventClose","SUPSemEventCreate","SUPSemEventGetResolution","SUPSemEventMultiClose","SUPSemEventMultiCreate","SUPSemEventMultiGetResolution","SUPSemEventMultiReset","SUPSemEventMultiSignal","SUPSemEventMultiWait","SUPSemEventMultiWaitNoResume","SUPSemEventMultiWaitNsAbsIntr","SUPSemEventMultiWaitNsRelIntr","SUPSemEventSignal","SUPSemEventWait","SUPSemEventWaitNoResume","SUPSemEventWaitNsAbsIntr","SUPSemEventWaitNsRelIntr","g_RTAsn1BitString_Vtable","g_RTAsn1Boolean_Vtable","g_RTAsn1Core_Vtable","g_RTAsn1DefaultAllocator","g_RTAsn1Integer_Vtable","g_RTAsn1Null_Vtable","g_RTAsn1ObjId_Vtable","g_RTAsn1OctetString_Vtable","g_RTAsn1SaferAllocator","g_RTAsn1String_Vtable","g_RTAsn1Time_Vtable","g_aRTUniLowerRanges","g_aRTUniUpperRanges","g_abRTZero16K","g_abRTZero32K","g_abRTZero4K","g_abRTZero64K","g_abRTZero8K","g_abRTZeroPage","g_pSUPGlobalInfoPage","g_pszRTAssertExpr","g_pszRTAssertFile","g_pszRTAssertFunction","g_szRTAssertMsg1","g_szRTAssertMsg2","g_u32RTAssertLine"],"ImportedFunctions":["strchr","IoDeleteDevice","IoCreateDevice","RtlInitUnicodeString","IofCompleteRequest","PsGetCurrentProcessId","PsGetCurrentThreadId","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","KeWaitForSingleObject","IofCallDriver","IoBuildDeviceIoControlRequest","KeInitializeEvent","ObQueryNameString","PsGetProcessImageFileName","ZwClose","PsGetProcessId","IoGetCurrentProcess","LpcPortObjectType","__C_specific_handler","PsLookupProcessByProcessId","ZwQuerySystemInformation","ObReferenceObjectByName","PsGetProcessSessionId","PsThreadType","PsLookupThreadByThreadId","ObOpenObjectByPointer","PsProcessType","PsInitialSystemProcess","PsIsProcessBeingDebugged","ExFreePoolWithTag","ExAllocatePoolWithTag","IoIs32bitProcess","ZwSetSystemInformation","ObfReferenceObject","ExGetPreviousMode","PsGetProcessInheritedFromUniqueProcessId","IoThreadToProcess","PsSetCreateProcessNotifyRoutine","DbgPrint","ZwRequestWaitReplyPort","MmGetSystemRoutineAddress","PsGetVersion","ExUnregisterCallback","ExRegisterCallback","ExCreateCallback","RtlQueryRegistryValues","ZwReadFile","ZwQueryInformationFile","RtlEqualSid","ZwQuerySecurityObject","ZwQueryObject","ZwCreateFile","RtlSubAuthoritySid","RtlInitializeSid","__chkstk","ZwQueryInformationThread","ZwQueryInformationProcess","KeSetTimerEx","KeInsertQueueDpc","KeRemoveQueueDpc","KeCancelTimer","KeInitializeDpc","KeInitializeTimer","KeQueryTimeIncrement","KeDelayExecutionThread","ZwYieldExecution","KeSetPriorityThread","PsCreateSystemThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeMutex","KeReleaseMutex","KeReadStateMutex","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeResetEvent","ProbeForRead","ProbeForWrite","MmHighestUserAddress","MmSystemRangeStart","KeNumberProcessors","ZwQueryDirectoryFile","MmIsAddressValid","MmUnmapIoSpace","MmUnlockPages","MmFreeContiguousMemory","IoFreeMdl","ExFreePool","MmUnmapLockedPages","MmBuildMdlForNonPagedPool","IoAllocateMdl","ExAllocatePool","MmProtectMdlSystemAddress","MmAllocateContiguousMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPages","IoBuildPartialMdl","MmGetPhysicalAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Guangdong, L=Heyuan, O=No Organization Affiliation, OU=Individual Developer, CN=Huiping Zhong","ValidFrom":"2013-07-18 00:00:00","ValidTo":"2014-07-18 23:59:59","Signature":"b0adb278c1270674ee67a03d06eae088afed344bb288e3ee4374147d355eed1ad772a5217c265921af4b61b4e582ddbe3f09682ea4dc7f8fc250945aaf2099899dbc855ff62d5f4ac58536f542b0d1f5a0e1ed5a039bbcd0f89f6286fb5cfe8daf551661b2685c7b61db150cb4dce8f0b0cdf5a4747c67ae1b363e5f58c90c48318145dd6609fc5b31e734d0ab3fa09a4ee243018ff40a82b223b99fcbece516fb04e0e1785939df2ffc6f74bcf54f818fa340534c55db6086a8352edba5323477dea3e7341782f969cf26f12d224cb2ae462fe50527da03c96cde8c262b10fee42da29a6271d2b6cbb21bd9625e451f63d54b88ccf4395ff6339582362aad87","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"77769240d819a3f2eb2e7f8baffecd26","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"1922bd7053ed4bb7a7fb5ea723b2caae","SHA1":"db658eba418c008978ed8e7be3da0545d0eaaa35","SHA256":"93abf46847d3ecf10002b85d19f02b34c99cae9ce7e62692f35e649406a96cb3","SHA384":"090ed57bfcd73abded056cb32e7cfe4031dd9ff5462590b1d0c7ad8eb618511ae1a90b44f8a5dc1f6cd8bbfecb0414bf"}},{"Subject":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"56fe535ce1c79ebca7ed7e536d6a144b518c405e805faaa4e82fef38c804c9ca3ecfdf3a584eb0d4b663c52957fa02059a454d68db2a1bd4343d9f00c35acb9549a56ee1b0c5fc414d414a6fd377c8d7388de419de18f31f1565836d450c53f90a9a2ea55dbf6f32811892196a5500ad631c52067e55d92968ae4a7c189a79886b2323d827382a298776cafbc7b662231fed7a564cdd9c325bf53d0c4618953b2a2368836441d9006d0f1924156872bdc571676eac4cdb90eb51a51a6207d0be6a00473c722fec4f613e7385ce5a0ab7bac01c1375e3223928dd6d1d09469d4fbae8408191c6a4ce94721b01cf2a6e15679589ae7db7b7cdf90a3d75b66b3c25","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47974d7873a5bcab0d2fb370192fce5e","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e3a93dc2a8a8a668fdbb286bfe9afab5","SHA1":"95795d2aa2a554a423bc8c6e5b0a016d14887d35","SHA256":"d8844186775bddbccaf3dc017064df7d760fd4b85c5d07561a3efd7da950f89e","SHA384":"78d972495720b43a6470b18ae1226bcca20707628087717a9364c14ca053ba264e6d149718b103542d9942200138a69d"}},{"Subject":"C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. , For authorized use only, CN=thawte Primary Root CA","ValidFrom":"2011-02-22 19:31:57","ValidTo":"2021-02-22 19:41:57","Signature":"2dcc71b5e8ba94ff5ee64467007b6afc412c3ee70e41855ab12a932ba95b89f2f72b499c8003f297b8e760a80ed7fd5de545467594f4ed1c9de166228b61fb29f2c6a8bdf387c98f7f47e1c058b64a1aa2e7f718606969e083069e26c775c40c0d79da746b52b9fae8ea3359b9bb18dd291a14dfd36a37277a9da0dacffffc22c4faf009ff33e93e17ba1cc742cfce2743d30c0c5581303db96060ce02ece19ee81ddc852ce0a18d966d95ac17a4713ea16741b6281d2ce3b615e5b7e5a2f6256d86e320acf9f8314f8e629b9833376d6af735523e90feb03b5fc5b852a9e06ea0479a279e97aea24a9e531939ec357ec659de3ae0aaf533f06abda0821812dea18c4570ca2bd62e959145995a5c240049bd23b30ceca43df5b9e1d1b1825a38eea3fba1ab483a8c5dffa065223fd3d3fe4990db1446a3852e8a554b09ab38b2ab63a008d1fdad48e273d812bcc26ca516fad09ac05e38383a2b718e553aac42197a1f0d4220e7ab5d8c6880524ca1c0d488d02321fb901309007b4937afa9df486022abf4f6c2363bf8513c34bbc586e43ae19f4b90fe5461024b159c34176aa94b8d4cb69d2326c83af1d6b805cdda1d6240183a2f1b41cd3a993a0aa9d1d77eb8c4aff7b8c980105ed55df6ce7a9a02c50f6381efb564e9fc5bd8d2619a68c37cf9c78df91e87d5fa2cf816ae9dab068fc86dc741cda14e84e3dac26ebcfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611fb0a400000000001d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a3f222107d4e1085e73b5b589c2f480b","SHA1":"b94aa26cd77c48d91a53ac44506cbd255e1d362c","SHA256":"a39ed0d6fd4eb1a6f7fed60f726e23eae668b7591bc004644625d22c701213fa","SHA384":"64b7643e4146016cbf83c911eb67e4601b6bb8d66f8ee8dcee67b815f91770d86ab23678b984430f22a963e5484881b7"}}],"Signer":[{"SerialNumber":"77769240d819a3f2eb2e7f8baffecd26","Issuer":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","Version":1}]}],"RichPEHeaderHash":{"MD5":"e881e9812edfc587557fdf092f5ed1b3","SHA1":"e996f7f323aba3f36f07686de8fe5962968613d8","SHA256":"a5d2323fd5a7cd2cde7bd7d7544a7d2b6b9fc64ffc9101cd32f55604d4a1b80f"},"Sections":{".text":{"Entropy":6.078871446594794,"Virtual Size":"0x9cf80"},".rdata":{"Entropy":5.919734586176505,"Virtual Size":"0x329ac"},".data":{"Entropy":4.235626395827553,"Virtual Size":"0x20be8"},".pdata":{"Entropy":5.978428144405096,"Virtual Size":"0xae48"},".edata":{"Entropy":6.050660464332838,"Virtual Size":"0xf1dd"},"INIT":{"Entropy":5.191528166334399,"Virtual Size":"0xc28"},".rsrc":{"Entropy":3.3885006610569786,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.995412021920204,"Virtual Size":"0x1e0a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-05-30 11:08:50","Imphash":"2a20cc9578bb34a4bb10b87b49b24982","LoadsDespiteHVCI":"TRUE"},{"Filename":"VBoxDrv.sys","MD5":"e3bdb307b32b13b8f7e621e8d5cc8cd3","SHA1":"58fe23f1bb9d4bcc1b07b102222a7d776cc90f6c","SHA256":"c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924","Authentihash":{"MD5":"eb532e54636f61b9af61f97d46ca8cae","SHA1":"018d626382f2453ef584b732e1e03ceab51e84db","SHA256":"6ab14c5c89759695dbb4b310b7cad68d9ec2007277e3b4f3abb883bd05ef557c"},"Description":"VirtualBox Support Driver","Company":"Sun Microsystems, Inc.","InternalName":"VBoxDrv.sys","OriginalFilename":"VBoxDrv.sys","FileVersion":"2.2.0.r45846","Product":"Sun VirtualBox","ProductVersion":"2.2.0.r45846","Copyright":"Copyright (C) 2009 Sun Microsystems, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["AssertMsg1","AssertMsg2","RTAssertShouldPanic","RTErrConvertFromNtStatus","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCopyGroupsAndFlags","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDestroy","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetDefaultInstance","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemDup","RTMemDupEx","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0Init","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapKernelEx","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTR0Term","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptRestore","RTThreadSleep","RTThreadYield","RTTimeMilliTS","RTTimeNanoTS","RTTimeNow","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetPagingMode","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0UnlockMem","g_szRTAssertMsg1","g_szRTAssertMsg2"],"ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","DbgPrint","IoIs32bitProcess","ExRegisterCallback","ExCreateCallback","IoCreateSymbolicLink","IoCreateDevice","IoGetStackLimits","memchr","strncmp","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeWaitForSingleObject","KeResetEvent","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeDelayExecutionThread","ZwYieldExecution","ExFreePoolWithTag","KeInsertQueueDpc","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","ExAllocatePoolWithTag","KeQueryActiveProcessors","strchr","PsGetCurrentProcessId","IoGetCurrentProcess","KeSetTimerEx","KeRemoveQueueDpc","KeCancelTimer","KeInitializeTimerEx","KeQueryTimeIncrement","MmGetSystemRoutineAddress","MmFreeContiguousMemory","MmGetPhysicalAddress","MmAllocateContiguousMemory","MmUnmapIoSpace","MmUnlockPages","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocatePagesForMdl","__C_specific_handler","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows","ValidFrom":"2021-09-02 18:23:41","ValidTo":"2022-09-01 18:23:41","Signature":"699045742c403812de1bdf9ea2be22132e82a7c006ab278e0c9f460bd435386348031a6b5cbdf450ae5a243331dcb2cc7eace8371cf71ec35a6f663147bd211ea357614e6a611eeacca6486a778d4cd788106ade12d6625574e7a89ecab4eb0bb99295c498dd5f565680a2d26bf2545e727c4204023c48d8021b608fd901c6fefd16ce0c3a669fb0ce758dc671f2cdd7434c163f9de9453e5523d94a78205c828a4615e50330d9f52a8a77f7683d2b61ff1324382d40d31001c518b56b286fbb8c754f6940590c2071385ed0a9387b529c06bf71fff89c74634550fc331b389d558696ace05787144e5af53d20a75a84981bf8380ddac3743f407d8ff27c089e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000033c89c66a7b45bb1fbd00000000033c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"46f57c3b860b08484cb79066ac1014ad","SHA1":"c1fe3ab97b834a98460e4ae92fe2468d16f61a92","SHA256":"d78e6b22fec42de5200f6c56731dd6742c79fa2bf7c01c8dc04d3d5738474c9b","SHA384":"d64e2d7f3cf0c23601d2d260f80e767d2e2a92fc43d93fdae6006987af96b6706d0c1e60e573e207a49334269e178e87"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","ValidFrom":"2011-10-19 18:41:42","ValidTo":"2026-10-19 18:51:42","Signature":"14fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"61077656000000000008","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"30a3f0b64324ed7f465e7fc618cb69e7","SHA1":"002de3561519b662c5e3f5faba1b92c403fb7c41","SHA256":"4e80be107c860de896384b3eff50504dc2d76ac7151df3102a4450637a032146","SHA384":"4f9a02c3eac5e83c38074d54c0bf270e03a1d668e0001c9812c509eb08a19075ee778a7630e65598e4608fc66e2d1c66"}}],"Signer":[{"SerialNumber":"330000033c89c66a7b45bb1fbd00000000033c","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","Version":1}]}],"RichPEHeaderHash":{"MD5":"778da7e612af67a3de121ab863ceed34","SHA1":"4c054a77104d0843f0a0f79ba3cdd6f7a500a261","SHA256":"c7ad11fb172299df62c32563cb4c0c6c44c833b76897b86057a544ce552b39ca"},"Sections":{".text":{"Entropy":6.374436237194225,"Virtual Size":"0x14d26"},".rdata":{"Entropy":5.492063385586473,"Virtual Size":"0x6ca4"},".data":{"Entropy":2.136306008585543,"Virtual Size":"0x35b4"},".pdata":{"Entropy":5.201973567849435,"Virtual Size":"0x1f20"},".edata":{"Entropy":5.704943815176372,"Virtual Size":"0x14d5"},"INIT":{"Entropy":4.983784792331664,"Virtual Size":"0x6fc"},".rsrc":{"Entropy":3.308916632980912,"Virtual Size":"0x398"},".reloc":{"Entropy":4.900332523869931,"Virtual Size":"0x672"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-04-07 14:30:47","Imphash":"6723b1d5bd0f1fc13216cb44541e619e","LoadsDespiteHVCI":"TRUE"},{"Filename":"VBoxDrv.sys","MD5":"443689645455987cb347154b391f734d","SHA1":"2fed7eddd63f10ed4649d9425b94f86140f91385","SHA256":"c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada","Authentihash":{"MD5":"ed53ea124ed4c30df39c29a4f5b01182","SHA1":"2903352a4e038c68c044a48edebd118af7e80098","SHA256":"79e3b14b68f1fcf805ccfe7bc2dc81b98346d2e83a6335816b276970e2e2691a"},"Description":"VirtualBox Support Driver","Company":"Sun Microsystems, Inc.","InternalName":"VBoxDrv.sys","OriginalFilename":"VBoxDrv.sys","FileVersion":"2.2.4.r47978","Product":"Sun VirtualBox","ProductVersion":"2.2.4.r47978","Copyright":"Copyright (C) 2009 Sun Microsystems, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["AssertMsg1","AssertMsg2","RTAssertShouldPanic","RTErrConvertFromNtStatus","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCopyGroupsAndFlags","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDestroy","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetDefaultInstance","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemDup","RTMemDupEx","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0Init","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapKernelEx","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTR0Term","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptRestore","RTThreadSleep","RTThreadYield","RTTimeMilliTS","RTTimeNanoTS","RTTimeNow","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetPagingMode","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0UnlockMem","g_szRTAssertMsg1","g_szRTAssertMsg2"],"ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","DbgPrint","IoIs32bitProcess","ExRegisterCallback","ExCreateCallback","IoCreateSymbolicLink","IoCreateDevice","IoGetStackLimits","memchr","strncmp","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeWaitForSingleObject","KeResetEvent","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeDelayExecutionThread","ZwYieldExecution","ExFreePoolWithTag","KeInsertQueueDpc","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","ExAllocatePoolWithTag","KeQueryActiveProcessors","strchr","PsGetCurrentProcessId","IoGetCurrentProcess","KeSetTimerEx","KeRemoveQueueDpc","KeCancelTimer","KeInitializeTimerEx","KeQueryTimeIncrement","MmGetSystemRoutineAddress","MmFreeContiguousMemory","MmGetPhysicalAddress","MmAllocateContiguousMemory","MmUnmapIoSpace","MmUnlockPages","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocatePagesForMdl","__C_specific_handler","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=California, L=Menlo Park, O=Sun Microsystems, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Sun Microsystems, Inc.","ValidFrom":"2008-06-11 00:00:00","ValidTo":"2011-06-11 23:59:59","Signature":"537c2adf2d3f7cf7cfc86476029fe81f7b8f12596a595cda0d5fbbfd227cce6bce2f8ad1af7fbb1a92a8b8de23a8797748094aae39bc845308e3ccd8fb9dc09b51bdf7b26c4eb8fb4052a8bdc714eaf36fca04d720e06798e36308c2fcaf50c48e61087a3ba0c4b0e77972a69af1ecc9d05e3f001e02ad94db98aa5e1453b541b0c257337fd78bb0372dc7841987424e0abce9cb1f0102a934bd037475b39cfe29dc27e77b3eb89fe805f8c6b1574d768dd2805d1a4b98143b7b6208abfebe7645a607084b1fd13ec7f088ac49cd5adc916090bcebe2e63786a7b80a009abd81349a9f34e135a7f4a2d569be474fe316b1b9f06ddf4d90a6650f7340181a27e1","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"50b256a55cdc23561dd4aa76abed4fd9","SHA1":"b3ee591b9218cfdcd394180558bd01bb674df627","SHA256":"fc1c2199740f069b26f02d81313408734051ecb7fa216b2a86458938fac6a909","SHA384":"81c9c8b202f6fe3354dd5503ef9ee6d418b9a28064968506bc2c49d7bd0efbaa9da9ce51d7c384992aa531ca905442a7"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"778da7e612af67a3de121ab863ceed34","SHA1":"4c054a77104d0843f0a0f79ba3cdd6f7a500a261","SHA256":"c7ad11fb172299df62c32563cb4c0c6c44c833b76897b86057a544ce552b39ca"},"Sections":{".text":{"Entropy":6.374380491704822,"Virtual Size":"0x14d26"},".rdata":{"Entropy":5.4914437952124455,"Virtual Size":"0x6ca4"},".data":{"Entropy":2.136306008585543,"Virtual Size":"0x35b4"},".pdata":{"Entropy":5.201973567849435,"Virtual Size":"0x1f20"},".edata":{"Entropy":5.703304599123732,"Virtual Size":"0x14d5"},"INIT":{"Entropy":4.983784792331664,"Virtual Size":"0x6fc"},".rsrc":{"Entropy":3.3208922490557096,"Virtual Size":"0x398"},".reloc":{"Entropy":4.900332523869931,"Virtual Size":"0x672"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-05-29 13:54:09","Imphash":"6723b1d5bd0f1fc13216cb44541e619e","LoadsDespiteHVCI":"FALSE"},{"Filename":"VBoxDrv.sys","MD5":"6beb1d8146f5a4aaa2f7b8c0c9bced30","SHA1":"07f62d9b6321bed0008e106e9ce4240cb3f76da2","SHA256":"cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40","Authentihash":{"MD5":"71bbd7b5164d35bc41d5a7f61a2d81f0","SHA1":"eec7692de436743eed432729fb620c5da3d5318f","SHA256":"1c9c86ba5ae540bb5729626cdaec89ca421f8129e4bbf6e1ea49c532b44ea0c9"},"Description":"VirtualBox Support Driver","Company":"Vektor T13 Security Service","InternalName":"VBoxDrv","OriginalFilename":"VBoxDrv.sys","FileVersion":"1.4.0.119230","Product":"Antidetect 2019 Public","ProductVersion":"1.4.0.119230","Copyright":"Copyright (C) 2009-2019 Oracle Corporation","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["ASMAtomicBitClear","ASMAtomicXchgU16","ASMAtomicXchgU8","ASMGetCS","ASMGetDS","ASMGetES","ASMGetFS","ASMGetGS","ASMGetIDTR","ASMGetSS","ASMMultU64ByU32DivByU32","ASMNopPause","RTAssertAreQuiet","RTAssertMayPanic","RTAssertMsg1","RTAssertMsg1Weak","RTAssertMsg2AddV","RTAssertMsg2V","RTAssertMsg2Weak","RTAssertMsg2WeakV","RTAssertSetMayPanic","RTAssertSetQuiet","RTAssertShouldPanic","RTAvlPVDestroy","RTAvlPVDoWithAll","RTAvlPVGet","RTAvlPVGetBestFit","RTAvlPVInsert","RTAvlPVRemove","RTAvlPVRemoveBestFit","RTCrc32","RTCrc32Finish","RTCrc32Process","RTCrc32Start","RTErrConvertFromErrno","RTErrConvertFromNtStatus","RTErrConvertToErrno","RTErrInfoAdd","RTErrInfoAddF","RTErrInfoAddV","RTErrInfoSet","RTErrInfoSetF","RTErrInfoSetV","RTErrVarsAreEqual","RTErrVarsHaveChanged","RTErrVarsRestore","RTErrVarsSave","RTHandleTableAllocWithCtx","RTHandleTableCreate","RTHandleTableCreateEx","RTHandleTableDestroy","RTHandleTableFreeWithCtx","RTHandleTableLookupWithCtx","RTLatin1CalcUtf8Len","RTLatin1CalcUtf8LenEx","RTLatin1ToUtf8ExTag","RTLatin1ToUtf8Tag","RTLogClearFileDelayFlag","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDefaultInstanceEx","RTLogDestinations","RTLogDestroy","RTLogDumpPrintfV","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGetDefaultInstanceEx","RTLogGetDestinations","RTLogGetFlags","RTLogGetGroupSettings","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelGetDefaultInstance","RTLogRelGetDefaultInstanceEx","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetBuffering","RTLogRelSetDefaultInstance","RTLogSetBuffering","RTLogSetCustomPrefixCallback","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAllocExTag","RTMemAllocTag","RTMemAllocVarTag","RTMemAllocZTag","RTMemAllocZVarTag","RTMemContAlloc","RTMemContFree","RTMemDupExTag","RTMemDupTag","RTMemExecAllocTag","RTMemExecFree","RTMemFree","RTMemFreeEx","RTMemReallocTag","RTMemTmpAllocTag","RTMemTmpAllocZTag","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpCurSetIndex","RTMpCurSetIndexAndId","RTMpGetArraySize","RTMpGetCount","RTMpGetCpuGroupCounts","RTMpGetMaxCpuGroupCount","RTMpGetMaxCpuId","RTMpGetOnlineCoreCount","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetPresentCoreCount","RTMpGetPresentCount","RTMpGetPresentSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuPresent","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnAllIsConcurrentSafe","RTMpOnOthers","RTMpOnPair","RTMpOnPairIsConcurrentExecSupported","RTMpOnSpecific","RTMpPokeCpu","RTMpSetIndexFromCpuGroupMember","RTNetIPv4AddDataChecksum","RTNetIPv4AddTCPChecksum","RTNetIPv4AddUDPChecksum","RTNetIPv4FinalizeChecksum","RTNetIPv4HdrChecksum","RTNetIPv4IsDHCPValid","RTNetIPv4IsHdrValid","RTNetIPv4IsTCPSizeValid","RTNetIPv4IsTCPValid","RTNetIPv4IsUDPSizeValid","RTNetIPv4IsUDPValid","RTNetIPv4PseudoChecksum","RTNetIPv4PseudoChecksumBits","RTNetIPv4TCPChecksum","RTNetIPv4UDPChecksum","RTNetIPv6PseudoChecksum","RTNetIPv6PseudoChecksumBits","RTNetIPv6PseudoChecksumEx","RTNetTCPChecksum","RTNetUDPChecksum","RTOnceReset","RTOnceSlow","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0AssertPanicSystem","RTR0Init","RTR0MemAreKrnlAndUsrDifferent","RTR0MemKernelCopyFrom","RTR0MemKernelCopyTo","RTR0MemKernelIsValidAddr","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocContTag","RTR0MemObjAllocLowTag","RTR0MemObjAllocPageTag","RTR0MemObjAllocPhysExTag","RTR0MemObjAllocPhysNCTag","RTR0MemObjAllocPhysTag","RTR0MemObjEnterPhysTag","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernelTag","RTR0MemObjLockUserTag","RTR0MemObjMapKernelExTag","RTR0MemObjMapKernelTag","RTR0MemObjMapUserTag","RTR0MemObjProtect","RTR0MemObjReserveKernelTag","RTR0MemObjReserveUserTag","RTR0MemObjSize","RTR0MemUserCopyFrom","RTR0MemUserCopyTo","RTR0MemUserIsValidAddr","RTR0ProcHandleSelf","RTR0Term","RTR0TermForced","RTSemEventCreate","RTSemEventCreateEx","RTSemEventDestroy","RTSemEventGetResolution","RTSemEventMultiCreate","RTSemEventMultiCreateEx","RTSemEventMultiDestroy","RTSemEventMultiGetResolution","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitEx","RTSemEventMultiWaitExDebug","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitEx","RTSemEventWaitExDebug","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSemMutexCreate","RTSemMutexCreateEx","RTSemMutexDestroy","RTSemMutexIsOwned","RTSemMutexRelease","RTSemMutexRequest","RTSemMutexRequestDebug","RTSemMutexRequestNoResume","RTSemMutexRequestNoResumeDebug","RTSemSpinMutexCreate","RTSemSpinMutexDestroy","RTSemSpinMutexRelease","RTSemSpinMutexRequest","RTSemSpinMutexTryRequest","RTSpinlockAcquire","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTStrAAppendNTag","RTStrAAppendTag","RTStrATruncateTag","RTStrAllocExTag","RTStrAllocTag","RTStrCalcLatin1Len","RTStrCalcLatin1LenEx","RTStrCalcUtf16Len","RTStrCalcUtf16LenEx","RTStrCat","RTStrConvertHexBytes","RTStrCopy","RTStrCopyEx","RTStrCopyP","RTStrDupExTag","RTStrDupNTag","RTStrDupTag","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrFree","RTStrGetCpExInternal","RTStrGetCpInternal","RTStrGetCpNExInternal","RTStrIsValidEncoding","RTStrNCmp","RTStrPrevCp","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrPurgeComplementSet","RTStrPurgeEncoding","RTStrPutCpInternal","RTStrReallocTag","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToLatin1ExTag","RTStrToLatin1Tag","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTStrToUni","RTStrToUniEx","RTStrToUtf16BigExTag","RTStrToUtf16BigTag","RTStrToUtf16ExTag","RTStrToUtf16Tag","RTStrUniLen","RTStrUniLenEx","RTStrValidateEncoding","RTStrValidateEncodingEx","RTTermDeregisterCallback","RTTermRegisterCallback","RTTermRunCallbacks","RTThreadCreate","RTThreadCreateF","RTThreadCreateV","RTThreadCtxHookCreate","RTThreadCtxHookDestroy","RTThreadCtxHookDisable","RTThreadCtxHookEnable","RTThreadCtxHookIsEnabled","RTThreadFromNative","RTThreadGetName","RTThreadGetNative","RTThreadGetType","RTThreadIsInInterrupt","RTThreadIsInitialized","RTThreadIsMain","RTThreadIsSelfAlive","RTThreadIsSelfKnown","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptIsPending","RTThreadPreemptIsPendingTrusty","RTThreadPreemptIsPossible","RTThreadPreemptRestore","RTThreadSelf","RTThreadSelfName","RTThreadSetName","RTThreadSetType","RTThreadSleep","RTThreadUserReset","RTThreadUserSignal","RTThreadUserWait","RTThreadUserWaitNoResume","RTThreadWait","RTThreadWaitNoResume","RTThreadYield","RTTimeExplode","RTTimeFromString","RTTimeImplode","RTTimeIsLeapYear","RTTimeMilliTS","RTTimeNanoTS","RTTimeNormalize","RTTimeNow","RTTimeSpecFromString","RTTimeSpecToString","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimeToString","RTTimerCanDoHighResolution","RTTimerChangeInterval","RTTimerCreate","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","RTUuidClear","RTUuidCompare","RTUuidCompare2Strs","RTUuidCompareStr","RTUuidFromStr","RTUuidFromUtf16","RTUuidIsNull","RTUuidToStr","RTUuidToUtf16","SUPGetCpuHzFromGipForAsyncMode","SUPGetGIP","SUPGetTscDeltaSlow","SUPIsTscFreqCompatible","SUPIsTscFreqCompatibleEx","SUPR0BadContext","SUPR0ChangeCR4","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetCurrentGdtRw","SUPR0GetKernelFeatures","SUPR0GetPagingMode","SUPR0GetSessionGVM","SUPR0GetSessionVM","SUPR0GetSvmUsability","SUPR0GetVmxUsability","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0PageProtect","SUPR0Printf","SUPR0QueryUcodeRev","SUPR0QueryVTCaps","SUPR0ResumeVTxOnCpu","SUPR0SetSessionVM","SUPR0SuspendVTxOnCpu","SUPR0TracerDeregisterDrv","SUPR0TracerDeregisterImpl","SUPR0TracerFireProbe","SUPR0TracerRegisterDrv","SUPR0TracerRegisterImpl","SUPR0TracerRegisterModule","SUPR0TracerUmodProbeFire","SUPR0TscDeltaMeasureBySetIndex","SUPR0UnlockMem","SUPReadTscWithDelta","SUPSemEventClose","SUPSemEventCreate","SUPSemEventGetResolution","SUPSemEventMultiClose","SUPSemEventMultiCreate","SUPSemEventMultiGetResolution","SUPSemEventMultiReset","SUPSemEventMultiSignal","SUPSemEventMultiWait","SUPSemEventMultiWaitNoResume","SUPSemEventMultiWaitNsAbsIntr","SUPSemEventMultiWaitNsRelIntr","SUPSemEventSignal","SUPSemEventWait","SUPSemEventWaitNoResume","SUPSemEventWaitNsAbsIntr","SUPSemEventWaitNsRelIntr","g_pSUPGlobalInfoPage","g_pszRTAssertExpr","g_pszRTAssertFile","g_pszRTAssertFunction","g_szRTAssertMsg1","g_szRTAssertMsg2","g_u32RTAssertLine"],"ImportedFunctions":["strchr","IoDeleteDevice","IoCreateDevice","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","__C_specific_handler","ExFreePoolWithTag","ExAllocatePoolWithTag","IoIs32bitProcess","ZwSetSystemInformation","ExRegisterCallback","ExCreateCallback","MmGetSystemRoutineAddress","RtlQueryRegistryValues","DbgPrint","KeSetTimerEx","KeInsertQueueDpc","KeRemoveQueueDpc","KeCancelTimer","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","KeQueryTimeIncrement","KeDelayExecutionThread","ZwYieldExecution","KeSetPriorityThread","KeWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","PsCreateSystemThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeMutex","KeReleaseMutex","KeReadStateMutex","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeResetEvent","PsGetCurrentProcessId","IoGetCurrentProcess","ProbeForRead","ProbeForWrite","MmHighestUserAddress","MmSystemRangeStart","KeSetTargetProcessorDpc","KeNumberProcessors","PsGetVersion","MmIsAddressValid","MmUnmapIoSpace","MmUnlockPages","MmFreeContiguousMemory","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemorySpecifyCache","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache","MmGetPhysicalAddress","MmAllocateContiguousMemory"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"CN=Vektor T13 Technology","ValidFrom":"2018-08-10 07:42:52","ValidTo":"2039-12-31 23:59:59","Signature":"4819acb135277102eb22d1ebf53707b6651b1dac668cbe264acefb52a0567dee778627ae98f2f8a69142e210ed9a585a826bea9339108f6cc8567a8a0d3b471dde8e932b4d7b466e657e0592faa7578e548c1d1f3b746190fac243e75735ad18bb9cf901d94d92ed4bfbe7729d439bdd300a6cb5fb75d17364033f92a8d15398","SignatureAlgorithmOID":"1.3.14.3.2.29","IsCertificateAuthority":true,"SerialNumber":"4d87df1b3d1e239b405dc85d0a0bad22","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"fbe18b58073fb49c37c5790f1e2065f0","SHA1":"a0a8778312b53234bbf75e19e10664c52e0c524c","SHA256":"42da0182b3119325ebc53f870276cc8b9f6f4d7248d6223372fea7fc994d85a8","SHA384":"12140c817a8d0771e3ee4c8e1eecda708c7203c537b4a702175fb370098e2bc704fca98b9b65cf346d80845fd961ed03"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"4d87df1b3d1e239b405dc85d0a0bad22","Issuer":"CN=Vektor T13 Technology","Version":1}]}],"RichPEHeaderHash":{"MD5":"2699d722188f4664155df5d5ec416047","SHA1":"1d9a8b11fbf151fc371dcb9a1a3b333f0dadb1e0","SHA256":"6292be78ca89765e09fcf9a02d007dd8adafbf18a032d9d71e35686f922cd1f6"},"Sections":{".text":{"Entropy":6.419823737384689,"Virtual Size":"0x2bc30"},".rdata":{"Entropy":5.946377532455778,"Virtual Size":"0xf8c8"},".data":{"Entropy":4.260596456256825,"Virtual Size":"0x12a40"},".pdata":{"Entropy":5.559894875195939,"Virtual Size":"0x32c4"},".edata":{"Entropy":5.804189453998891,"Virtual Size":"0x34f8"},"INIT":{"Entropy":5.082239885482413,"Virtual Size":"0x856"},".rsrc":{"Entropy":3.407529902677342,"Virtual Size":"0x400"},".reloc":{"Entropy":4.078099091032765,"Virtual Size":"0xfb8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-02-04 17:27:31","Imphash":"9470f56376e665fb981a35b303436041","LoadsDespiteHVCI":"TRUE"}]}