home

ZfkeyMonitor.EXE

ZfkeyMonitor 应用程序

CFCA Operation CA2

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ZfkeyMonitor’.
Publisher:
CFCA Operation CA2  (signed and verified)

Product:
ZfkeyMonitor 应用程序

Description:
ZfkeyMonitor Microsoft 基础类应用程序

Version:
1, 0, 0, 1

MD5:
290c796308ba653fb9ed075a7716ff0b

SHA-1:
229347842cf0a5a92cfe107840ff5edfa9624f6c

SHA-256:
2673c567ffa0550e2a42ec72e43d1f54a31700ad24701847dbba73718da48b2d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/1/2024 6:13:45 PM UTC  (today)

File size:
38.7 KB (39,664 bytes)

Product version:
1, 0, 0, 1

Copyright:
版权所有 (C) 2008

Original file name:
ZfkeyMonitor.EXE

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\sdzf ukey tools\sdzf\zfkeymonitor.exe

Digital Signature
Signed by:
CFCA Operation CA2

Authority:
CFCA Operation CA2

Valid from:
5/6/2011 8:00:14 PM

Valid to:
5/6/2016 8:00:14 PM

Subject:
CN=96668e0000587941, OU=Customers, OU=YUZHI, O=CFCA Operation CA2, C=CN

Issuer:
O=CFCA Operation CA2, C=CN

Serial number:
7D43B0B870E2807376108CE7AE6A0A7E

File PE Metadata
Compilation timestamp:
4/21/2010 4:36:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
384:YrkyB6MduXBXeNMRYVKCimXtnHfDqTmWvntVNW1:mkyBwRXVRYVlimXdfDqTmWvtb0

Entry address:
0x2E7A

Entry point:
6A, 70, 68, 48, 46, 40, 00, E8, D2, 02, 00, 00, 33, DB, 89, 5D, FC, 8D, 45, 80, 50, FF, 15, 04, 40, 40, 00, 83, CF, FF, 89, 7D, FC, 66, 81, 3D, 00, 00, 40, 00, 4D, 5A, 75, 27, A1, 3C, 00, 40, 00, 8D, 80, 00, 00, 40, 00, 81, 38, 50, 45, 00, 00, 75, 14, 0F, B7, 48, 18, 81, F9, 0B, 01, 00, 00, 74, 20, 81, F9, 0B, 02, 00, 00, 74, 05, 89, 5D, E4, EB, 27, 83, B8, 84, 00, 00, 00, 0E, 76, F2, 33, C9, 39, 98, F8, 00, 00, 00, EB, 0E, 83, 78, 74, 0E, 76, E2, 33, C9, 39, 98, E8, 00, 00, 00, 0F, 95, C1, 89, 4D, E4, C7...
 
[+]

Entropy:
3.9478

Developed / compiled with:
Microsoft Visual C++ v7.1

Code size:
12 KB (12,288 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ZfkeyMonitor

Command:
C:\Program Files\sdzf ukey tools\sdzf\zfkeymonitor.exe


Scan ZfkeyMonitor.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.