fe2f68e1-e459-4802-9a9a-23bb3c2fd331

kEvP64.sys

Description

kEvP64.sys is a vulnerable driver and more information will be added as found.

UUID: fe2f68e1-e459-4802-9a9a-23bb3c2fd331
Created: 2023-01-09
Author: Michael Haag
Acknowledgement: |

This download link contains the vulnerable driver!

Commands

sc.exe create kEvP64.sys binPath=C:\windows\temp\kEvP64.sys type=kernel &amp;&amp; sc.exe start kEvP64.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://github.com/elastic/protections-artifacts/search?q=VulnDriver

Known Vulnerable Samples

Property	Value
Filename
Creation Timestamp	2015-08-11 22:47:01
MD5	3ae11bde32cdbd8637124ada866a5a7e
SHA1	4a2e034d2702aba6bca5d9405ba533ed1274ff0c
SHA256	7462b7ae48ae9469474222d4df2f0c4f72cdef7f3a69a524d4fccc5ed0fd343f
Authentihash MD5	dd340bd4626e61ca6b85d8be496cf474
Authentihash SHA1	2890346c9be7683fe8c111c0a9ccef8f8734f05c
Authentihash SHA256	7a1dfe962c0c714c35827f7cf19bbca693bb1e769037b06b5f86d7f33b723f72
RichPEHeaderHash MD5	4d1db9cac7ab13390ea7d7ec35eddf7b
RichPEHeaderHash SHA1	228e64d99fe82f4916f10dce9b4fd301b71e5116
RichPEHeaderHash SHA256	c5cb014591ad8b30275f0b0f5d846669fef5bead29f1c85e984ef149b3cbe166
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExAcquireRundownProtection
ObQueryNameString
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ExEnumHandleTable
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2015-12-08 19:11:57
MD5	1c9001dcd34b4db414f0c54242fedf49
SHA1	56af49e030eb85528e82849d7d1b6147f3c4973e
SHA256	2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d
Authentihash MD5	f921aff2b09e5b82787b7f84c0d57e2d
Authentihash SHA1	1f046fae17d77909883f4dcfd13459e1db2768eb
Authentihash SHA256	be690e8bbc4b0ba4b37c1a331294655dff0c73be530428a447e318c06ec06d57
RichPEHeaderHash MD5	fcdc85906fc0d379ce5bd1f99cd4ec0e
RichPEHeaderHash SHA1	862a2c25721e0e4bd332fd64324d347d1bcdc617
RichPEHeaderHash SHA256	3b55a7c6f619060d5a89038de0943b3fe83d4653e92b8062581f97ba14bf51ea
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExEnumHandleTable
ExAcquireRundownProtection
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ZwTerminateProcess
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ObQueryNameString
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2015-12-21 00:56:08
MD5	23b807c09b9b6ea85ed5c508aab200b7
SHA1	e5114fd50904c7fb75d8c86367b9a2dd4f79dfb1
SHA256	97363f377aaf3c01641ac04a15714acbec978afb1219ac8f22c7e5df7f2b2d56
Authentihash MD5	bd0b58bcd07ce5e3de35a47317c751e0
Authentihash SHA1	5c9e742280da8bd96a5ff6cbfb70641f8d29e179
Authentihash SHA256	340ab79ca0f9f2c2448e936621ffe937fb200270c2f7f5197b4a669dcdd69c7b
RichPEHeaderHash MD5	fcdc85906fc0d379ce5bd1f99cd4ec0e
RichPEHeaderHash SHA1	862a2c25721e0e4bd332fd64324d347d1bcdc617
RichPEHeaderHash SHA256	3b55a7c6f619060d5a89038de0943b3fe83d4653e92b8062581f97ba14bf51ea
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExEnumHandleTable
ExAcquireRundownProtection
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ZwTerminateProcess
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ObQueryNameString
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2015-12-08 19:11:57
MD5	2c1045bb133b7c9f5115e7f2b20c267a
SHA1	a380aeb3ffaecc53ca48bb1d4d622c46f1de7962
SHA256	e61004335dfe7349f2b2252baa1e111fb47c0f2d6c78a060502b6fcc92f801e4
Authentihash MD5	1b48e3ebf24bc8c648e7eca9219d1484
Authentihash SHA1	ae06eb14cd837b37a02c066e7892802900b4ecc4
Authentihash SHA256	ecd1412340d618be39c4ac26d442ed66c0fd1ff6a7641cda404e970fb6c48bad
RichPEHeaderHash MD5	fcdc85906fc0d379ce5bd1f99cd4ec0e
RichPEHeaderHash SHA1	862a2c25721e0e4bd332fd64324d347d1bcdc617
RichPEHeaderHash SHA256	3b55a7c6f619060d5a89038de0943b3fe83d4653e92b8062581f97ba14bf51ea
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExEnumHandleTable
ExAcquireRundownProtection
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ZwTerminateProcess
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ObQueryNameString
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	kEvP64.sys
Creation Timestamp	2016-02-01 22:35:30
MD5	20125794b807116617d43f02b616e092
SHA1	f3db629cfe37a73144d5258e64d9dd8b38084cf4
SHA256	1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c
Authentihash MD5	89184d56336f62fecc67f644b1ec4219
Authentihash SHA1	cd773a4b5aef78bda651069b9304e4d5e2033cb9
Authentihash SHA256	c7ba2720675aada538c47fa9e8950a81b6df23f63fa181680e6232651abffbef
RichPEHeaderHash MD5	ee24a08c66067b7389e848a1516b7f6b
RichPEHeaderHash SHA1	7ce681e20a56a600cddb99f37cbac905c154b675
RichPEHeaderHash SHA256	413bc2d3e455ffd744f2e89687f72effab31c743e326bcb766b79ede0f6b265b
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
MmUnmapIoSpace
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExEnumHandleTable
ObQueryNameString
ExAllocatePoolWithTag
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
MmMapIoSpace
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ZwTerminateProcess
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
IoThreadToProcess
ExAcquireRundownProtection
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
IoFileObjectType
__C_specific_handler
HalSetBusDataByOffset
KeStallExecutionProcessor
HalGetBusDataByOffset
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2015-12-06 22:16:36
MD5	81b72492d45982cd7a4a138676329fd6
SHA1	569f4605c65c2a217b28aefeb8570f9ea663e4b7
SHA256	d9500af86bf129d06b47bcfbc4b23fcc724cfbd2af58b03cdb13b26f8f50d65e
Authentihash MD5	f9ec21687228b70cfe92917d228b5c89
Authentihash SHA1	693b84a12ac160d492f50b7dc261aa081224313d
Authentihash SHA256	15d44fa77f8d922b5cf03425116c394eefc20ae9a082d3d7f10e68b832be36e7
RichPEHeaderHash MD5	51445ed2912d766161533161cca45d1b
RichPEHeaderHash SHA1	eef41f3b8d8bd395a56293c837b2c19b7b97f201
RichPEHeaderHash SHA256	38391ca80386fbe97bc4eef7f1a6e6889a6e6100e069f584b3689ce6ef69b8c0
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExAcquireRundownProtection
ObQueryNameString
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ExEnumHandleTable
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2015-12-08 19:11:57
MD5	2a5ccd95292f03f0dd4899d18b55b428
SHA1	4927d843577bada119a17b249ff4e7f5e9983a92
SHA256	7c0f77d103015fc29379ba75d133dc3450d557b0ba1f7495c6b43447abdae230
Authentihash MD5	6450bc1b911cd59bdc4a3c8643b98d39
Authentihash SHA1	84b16f661e1899c09a2e3f3fe98b55c5f41e53bd
Authentihash SHA256	36238dc2e5236fca63e81a81855e46218f5bc52591bb4f74996a2aaeadc581a1
RichPEHeaderHash MD5	fcdc85906fc0d379ce5bd1f99cd4ec0e
RichPEHeaderHash SHA1	862a2c25721e0e4bd332fd64324d347d1bcdc617
RichPEHeaderHash SHA256	3b55a7c6f619060d5a89038de0943b3fe83d4653e92b8062581f97ba14bf51ea
Company	PowerTool
Description	PowerTool
Product	PowerTool
OriginalFilename	kEvP64.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 195c5f9885214bfb4f88dd2ad1f0be8c

Field	Value
ToBeSigned (TBS) MD5	29354273ffa68d860d2e9deb5fe3d602
ToBeSigned (TBS) SHA1	fa3d720490408dcaad3762167515dd5023710e1a
ToBeSigned (TBS) SHA256	f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0
Subject	C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=
ValidFrom	2015-07-27 00:00:00
ValidTo	2016-08-25 23:59:59
Signature	cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	195c5f9885214bfb4f88dd2ad1f0be8c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
FLTMGR.SYS

Imported Functions

Expand

IoThreadToProcess
ExAllocatePoolWithTag
ProbeForRead
KeClearEvent
PsProcessType
IoReuseIrp
ObRegisterCallbacks
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
ObUnRegisterCallbacks
PsGetProcessImageFileName
PsRemoveCreateThreadNotifyRoutine
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
SeCreateAccessState
KeInitializeApc
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExGetPreviousMode
ProbeForWrite
IoGetFileObjectGenericMapping
swprintf
ObCreateObject
ObGetFilterVersion
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetVersion
ZwQuerySystemInformation
ExReleaseRundownProtection
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
KeUnstackDetachProcess
ExInitializeRundownProtection
ZwOpenDirectoryObject
IoVolumeDeviceToDosName
KeDelayExecutionThread
RtlFreeUnicodeString
ExEnumHandleTable
ExAcquireRundownProtection
IoFileObjectType
IoDriverObjectType
ZwCreateFile
wcsstr
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
IoStopTimer
ExAllocatePool
IoUnregisterShutdownNotification
IoGetCurrentProcess
NtClose
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
ZwQueryDirectoryObject
PsRemoveLoadImageNotifyRoutine
IoFreeIrp
MmProbeAndLockPages
PsThreadType
RtlCompareUnicodeString
IoAllocateIrp
ObSetHandleAttributes
MmUnlockPages
ZwQueryInformationProcess
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ZwTerminateProcess
RtlAssert
KeCancelTimer
CmUnRegisterCallback
ObOpenObjectByPointer
DbgPrint
KeStackAttachProcess
PsGetProcessWow64Process
IoAllocateMdl
IofCallDriver
KeBugCheckEx
sprintf
PsGetProcessPeb
ExWaitForRundownProtectionRelease
_wcsicmp
_stricmp
ObQueryNameString
__C_specific_handler
KeStallExecutionProcessor
FltUnregisterFilter
FltEnumerateFilters
FltObjectDereference
FltRegisterFilter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Signature": "cb382c80e762f190213e6d4d24123b8e2851f2775f1df964e29655c927f1395c81bd01aa4106ceba3895b1db2744a41d4b0bc9b4305f7f5826764c038808d14dd7d3429ffbf6cbac8462d86c176c36ca145a8b9298eed05a55f84731eff3f5e98f6d4d0d7bda39e2a1e8854362dff3bd1b9be33f4f34f97e1e74354f5afd2689260230c61481f8cc6bbba9659f47dd114e9991e9c0d9cb91453001dd604edd328454ecb389c37ebbfb4ed2477a9abbca65723363ffd0814ddff8248ff33129df16bcd5a47c4140d1ff4d245c2b3f2cbf39ca68fcba6377cfb455d3a564ebe8af38855b4482176763e1d9a63777a1112972edf7f0b7ebaecde68653b23acd229d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Beijing, L=Beijing, O=, OU=RD, CN=",
      "TBS": {
        "MD5": "29354273ffa68d860d2e9deb5fe3d602",
        "SHA1": "fa3d720490408dcaad3762167515dd5023710e1a",
        "SHA256": "f2be523e7f4c60d579119a390a4bfc10c4400b4e5104bc1187dd67cdde7491e0",
        "SHA384": "c5706cd33379ce04bf38d2ad2016b09a5a53da722a8998b6387c8bd5fcda06bad32415c7b1ab1a09a1f1b76a85fbb03b"
      },
      "ValidFrom": "2015-07-27 00:00:00",
      "ValidTo": "2016-08-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "195c5f9885214bfb4f88dd2ad1f0be8c",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-04-09