{"Id":"e368efc7-cf69-47ae-8204-f69dac000b22","Tags":["iobitunlocker.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"0a3c811c84c0731bb691dd1c2f51d932","SHA1":"9cfe5fdbdd41c4d4e026a588fc8df412cc4620fc","SHA256":"c025ec72d4b8297ee2e0fac7747f39d256aad26fbf0554e3729e3e381bc6ea86"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:37","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","ExAllocatePoolWithTag","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExFreePoolWithTag","DbgPrint","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"","MD5":"05ad4a6ef441e94acb1a1a9a11a26f3a","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"5b4d8c2b8c149dbd5d949b7937d828d8","SHA1":"64d5063b776d4a59b8a8cbb7852d9afb61df93f5","SHA256":"2c1db2adc3c9d42ce0e0ded5b469406d8748cb851639f3826a5bc8120e7398ae"},"SHA1":"d7f12c8d515a0ad401fa02cc8ac42b11b5b7fa55","SHA256":"7a1feb8649a5c0679e1073e6d8a02c8a6ebc5825f02999f16c9459284f1b198b","Sections":{".text":{"Entropy":6.355989058358682,"Virtual Size":"0x3d85"},".rdata":{"Entropy":4.2685062053422165,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.415106162348945,"Virtual Size":"0x5e8"},".reloc":{"Entropy":5.590213587032387,"Virtual Size":"0x3ca"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"a9e02912a3b2915e7bd0d33d49adc21e","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"edc928500093686626e4d82a09eb5681","SHA1":"3221d04a27d9ba6646668bea02fe9538e6eec58d","SHA256":"ce12d9c2996a6626f6fc68415f8a94851b3468c9c62cc408dbdc0227cf77939d"},"Company":"","Copyright":"","CreationTimestamp":"2011-03-03 02:01:12","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IofCompleteRequest","ExFreePoolWithTag","ExAllocatePoolWithTag","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","IoDeleteSymbolicLink","_wcsnicmp","_vsnwprintf","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","IoQueryFileDosDeviceName","ZwQueryInformationFile","KeTickCount","KeBugCheckEx","RtlUnwind","IoDeleteDevice","KeGetCurrentIrql"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"a7c2bc345d60cddf2cf4f5dd416a127b","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"25711a205330f105d8e1b00638fe7c65","SHA1":"3e18ce9b3a49b93de45088dc4b4b61ff6971e8eb","SHA256":"202a7a99049f60e8147e0c06f761af35f71afdd57862a6a6b388081172bbb8bb"},"SHA1":"dcf6ee994e23893ac3b5e90a08003e026cc1fd8e","SHA256":"698353791261d5a9ca3245ae8f86334493df554690ec7962895c2affe4050db2","Sections":{".text":{"Entropy":6.317048717136059,"Virtual Size":"0x39c0"},".rdata":{"Entropy":4.073332945379357,"Virtual Size":"0x2ec"},".data":{"Entropy":2.4133339967645213,"Virtual Size":"0x50"},"INIT":{"Entropy":5.394756309196413,"Virtual Size":"0x50c"},".reloc":{"Entropy":5.367759325264859,"Virtual Size":"0x3b6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"81c7c94c8652b882268a4770e95a5b03","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"fca73e05e6e7e72590d9b79ce05ac73e","SHA1":"6954d40b1e566c42a720ee5c8e32d73cdb7dc36f","SHA256":"a298cc166fe3bac9e9e4cae967f8e3bb41b08a6a97117ca4f8e5c4f198dbcffa"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:19","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["ExFreePoolWithTag","ExAllocatePoolWithTag","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","DbgPrint","_vsnwprintf","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","RtlUnwind","IofCompleteRequest","IoDeleteSymbolicLink","_wcsnicmp","IoDeleteDevice","KeGetCurrentIrql"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"2491a4ddb3f7a6688669831969b47669","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"1e3feaa9c8f5818242e61732bda2b3f2","SHA1":"5fe2ed4fdc06aedbee2593404f4353ba09790c2b","SHA256":"c3d3d60b87d8bac39d2996f6c599054442381256bfffdb303cec8aa1a0feedee"},"SHA1":"239e41b1a860c2b12225be48930312773726e7fc","SHA256":"831b62145c21557928a694e6261e830f1545b5756ad51dcbd28a15fde570f4e7","Sections":{".text":{"Entropy":6.320092681683187,"Virtual Size":"0x3ddd"},".rdata":{"Entropy":4.301024031936047,"Virtual Size":"0x28c"},".data":{"Entropy":1.5279258901075148,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.426730341906403,"Virtual Size":"0x5c2"},".reloc":{"Entropy":5.573657266134847,"Virtual Size":"0x3e6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"c12936f479be6928286027facebe1c59","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"ac13d57700837c8613f9d94f175242d0","SHA1":"7fb190dfa6cc3e34937991c839353331998b532f","SHA256":"1fe70267698ba60012ca4c2c0f21325236bafc7b42fa977a09afa6a0c5ed3784"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:46","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["ExFreePoolWithTag","ExAllocatePoolWithTag","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","DbgPrint","_vsnwprintf","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","RtlUnwind","IofCompleteRequest","IoDeleteSymbolicLink","_wcsnicmp","IoDeleteDevice","KeGetCurrentIrql"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"724a9e06f0a846f2556f2e3edd251cc4","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"cd2bd2df115786d1be082c11816bb8bf","SHA1":"9bbc6747d36b2e9386835a13e6e77003ba04fc02","SHA256":"51b7f6c1d7f3582e201c9903196ee57fa3de962c4b1d451bc2dae4467bd6576a"},"SHA1":"ac593c6f4d2ad88bfca455a3a189af6d3cdace32","SHA256":"11bc55c0771d692279298211c1d434c04168e7c7f7c4328bfd600215b88c819b","Sections":{".text":{"Entropy":6.320386750174537,"Virtual Size":"0x3ddd"},".rdata":{"Entropy":4.2873446237083135,"Virtual Size":"0x28c"},".data":{"Entropy":1.5279258901075148,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.424229057057279,"Virtual Size":"0x5c2"},".reloc":{"Entropy":5.573657266134847,"Virtual Size":"0x3e6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"c12936f479be6928286027facebe1c59","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d41b2c41b706e2cd26952b00c30d7f64","SHA1":"68ec1d226dc2314c5f2ecc949c662b1f4d504824","SHA256":"773dc9256c4eada182a5b41179a522740ba994eff30f868641bc91574705b8e3"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:22","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","DbgPrint","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"67f6d2a931f194396bda9b05690008d2","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"ad9b91dbaee6be999d6506faf9a50496","SHA1":"38ea8a4d751919b531f6169cab585b4e935d6711","SHA256":"8f3ff18b13421201854683eaf11f9a5a1497126ef99bddf602c4eee5b66d2a50"},"SHA1":"c90d334d807a0dc7f15ecff38e8f0137a378504b","SHA256":"a7416a7d9573f1d8873ec1b3109ec683e85412ba817e0001c3ab2d2c92043d4d","Sections":{".text":{"Entropy":6.20613778782764,"Virtual Size":"0x5226"},".rdata":{"Entropy":4.766241993256806,"Virtual Size":"0x59c"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.261400850513,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.206339371292222,"Virtual Size":"0x64c"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"711b758670a45a9eda505018717c0966","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"89f98b999217b326cc86ac494de536c6","SHA1":"6093dcbb29df29d365286d8d86b80e1027cf7d0a","SHA256":"e73bb03d54b40035558df2e990367a1c4e9c1ef8e980df6380a63f3bc23e6740"},"Company":"","Copyright":"","CreationTimestamp":"2011-09-05 02:35:34","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","ZwCreateFile","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler","__chkstk"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"b2ada4eb20649839a54db078fa6bb1bd","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b7475c5a12b5a230bc38af8999024009","SHA1":"f0641a90dd7fbceddca5a1d1ff4adcabcc8cc5ee","SHA256":"ca2a5d85f9030bc3a6e3128b6a6dc5f52b7e43be10b83b57951c289b80bf16d3"},"SHA1":"db649f5adb5e857b2167925f270df56e5f8e5612","SHA256":"0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556","Sections":{".text":{"Entropy":6.170150629427797,"Virtual Size":"0x5556"},".rdata":{"Entropy":4.712345522450135,"Virtual Size":"0x5b4"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.216695986753876,"Virtual Size":"0x258"},"INIT":{"Entropy":5.179242948978909,"Virtual Size":"0x678"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"c89216a982b8a3b67a507c41afa93c04","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"0a3c811c84c0731bb691dd1c2f51d932","SHA1":"9cfe5fdbdd41c4d4e026a588fc8df412cc4620fc","SHA256":"c025ec72d4b8297ee2e0fac7747f39d256aad26fbf0554e3729e3e381bc6ea86"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:37","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","ExAllocatePoolWithTag","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExFreePoolWithTag","DbgPrint","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"","MD5":"2f6cf948117cbd383315ebf070d27aa4","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"5b4d8c2b8c149dbd5d949b7937d828d8","SHA1":"64d5063b776d4a59b8a8cbb7852d9afb61df93f5","SHA256":"2c1db2adc3c9d42ce0e0ded5b469406d8748cb851639f3826a5bc8120e7398ae"},"SHA1":"338679dfda8828c6aa98e0a5c9fa9e0a1fe9e9e8","SHA256":"29cf2d374d7afe009bbf60ba5f50db7016314de682cf3a6f90c0996810c821ef","Sections":{".text":{"Entropy":6.355989058358682,"Virtual Size":"0x3d85"},".rdata":{"Entropy":4.2685062053422165,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.415106162348945,"Virtual Size":"0x5e8"},".reloc":{"Entropy":5.590213587032387,"Virtual Size":"0x3ca"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"a9e02912a3b2915e7bd0d33d49adc21e","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"0c8ced073b358dbd77b932d76929685b","SHA1":"f96942de94a05f1ee53f49ca4e806790c0aa780e","SHA256":"5f4b06327ffbec2a59725a57c357daf54ea2f58aef5dc7ff3f5370168af09fb0"},"Company":"","Copyright":"","CreationTimestamp":"2011-06-27 23:49:43","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","DbgPrint","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"e6ed15980616aa706bf85e6f256d2ebe","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"fb793a110cd04a70e63e24ded69cda69","SHA1":"295f35683dd5b0da34dbacd59ee8ce840aa013f0","SHA256":"9ff3c3e172cdf69134a6728f7031a6c1d17cdfe2548037099ba7ea2703b99cf7"},"SHA1":"b589662db0d96993cd83e97b11e9238d3d70dc2d","SHA256":"e41d4fd99252fcf9aea529b6e148b311aa26a4ab04f6b79cce4cd19c61db0c87","Sections":{".text":{"Entropy":6.217525540626368,"Virtual Size":"0x51c6"},".rdata":{"Entropy":4.819949617753762,"Virtual Size":"0x588"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.229977191275536,"Virtual Size":"0x234"},"INIT":{"Entropy":5.159128460560333,"Virtual Size":"0x64c"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=CN, ST=SiChuan, L=ChengDu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2009-12-08 00:00:00","ValidTo":"2013-01-04 23:59:59","Signature":"121505a16515db672b7a89c4490a50abc3acde2385c839538892a2927a188d02e43d4379e2781145750af1c075c111023d550c0a06285a62ea1d08cfd95cb4e48fb20550a8ec23b5ea180eb802c4c72cc54217787a3fad704c685e43364efb48020458bd61f57498dbb4dc4c9181f72debe1667592515c6217a82c54c96e16266bb4cb9af759ca32aceb7b196bfe951c810d30bf879417fd1de08b8fbca8b45c223bda4feaedd82e8d73c4fd485c71b7271f3e2f225fa2a2a4a4bdd325f1f1d392676122ec7106e4f8c5addc92d89b0b902df56447bd1be2750a1a21a71cc783a65777153a7d1b3ed2d899702a4b53aed227dfabf762cbaf007ab0aa4228ea61","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Version":3,"TBS":{"MD5":"dcd6726e69a9158dd03eb7deec112756","SHA1":"639f767702630ca2a0756c3b2d3c07914c75d8ce","SHA256":"9a3ca6cae4be1d87bc9836355b5348aa9736a99250653ff9279136c0be63b7c7","SHA384":"0ce3d053c4d09a47ad02a0d6381d3199cfe38dd465413403cb03ba89c6ca5830a530a1d90ab4f2a7d96f7619804b661d"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"2b8f44226c2d9e0edf5765b0d7a21b51","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"711b758670a45a9eda505018717c0966","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d865b8b11ee0f2ddc9095e3249015abf","SHA1":"0aa57861ba15db6dc026c87f503fbe9635a29629","SHA256":"14e6f0d5f93dc52471af549de1c91c1fc1d9dbd175d5932c17e58e6b186694c9"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:47","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","IoCreateSymbolicLink","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExAllocatePoolWithTag","ExFreePoolWithTag","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"IObitUnlocker.sys","MD5":"9c14315e086882e89a01c9700c4b5530","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"45e8197e8972ce1575cb59ba47bbca6b","SHA1":"1c05376b51b700befeedb5e91c2b046898e5e955","SHA256":"613e1f251c62380c70363a484341431d05279fd28749c36173025f0a7108e138"},"SHA1":"2446597bd4fd1f67657425310bec5db5614a8616","SHA256":"0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09","Sections":{".text":{"Entropy":6.352640579869565,"Virtual Size":"0x3d9c"},".rdata":{"Entropy":4.184352632111533,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.4156598647971395,"Virtual Size":"0x5e8"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.526376244216933,"Virtual Size":"0x3d6"}},"Signature":"","Signatures":{},"Imphash":"51957e796400bc7de3cfa02db5a95bce","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d08742729d8b2acaf972fcea6df3bf09","SHA1":"d7fe09f414ea3a9f2b979c6d883079f0ed563a4b","SHA256":"89d96210bf36a88acb14086c96e916b790d21b7adf81d0907c823ca2afbe0ce3"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:53","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"ad6ec006e29343c466f73bf47fe0caf3","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"772fe1b9794caabb89ee0b78335e3f98","SHA1":"877c7c33339b6359e6c366e9c4744b779f24f542","SHA256":"aed7ad05867110783a74d2c2d4c7a0d2c84075f8a3626e45df6e8f021ea3f592"},"SHA1":"7f4bef1dbc56974f36c25e37b344213d144ffcb4","SHA256":"d8096325bfe81b093dd522095b6153d9c4850ba2eaa790e12e7056ef160d0432","Sections":{".text":{"Entropy":6.210028479836042,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.788425060525102,"Virtual Size":"0x584"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.165113468119247,"Virtual Size":"0x234"},"INIT":{"Entropy":5.162190008807952,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"751c91ae91cb43aadaeaa1bb187c593a","SHA1":"dd220acea885a954085e614b94da2b5bba5c0cc3","SHA256":"e0aff24a54400fe9f86564b8ce9f874e7ff51e96085ff950baff05844cff2bd1"},"Company":"IObit Information Technology","Copyright":"© IObit. All rights reserved.","CreationTimestamp":"2022-08-17 02:18:15","Date":"","Description":"Unlocker Driver","ExportedFunctions":"","FileVersion":"1.3.0.10","Filename":"IObitUnlocker.sys","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwCreateFile","ExAllocatePool","IoGetCurrentProcess","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwQueryInformationFile","ZwWriteFile","ObOpenObjectByPointer","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","RtlAppendUnicodeToString","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","RtlAppendUnicodeStringToString","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","PsGetCurrentProcessId","MmIsAddressValid","ZwTerminateProcess","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"2391fb461b061d0e5fccb050d4af7941","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","Product":"Unlocker","ProductVersion":"1.3.0.10","Publisher":"","RichPEHeaderHash":{"MD5":"35ffa69ed506b3a5d24d6e9c10f88070","SHA1":"a5d21268d58eebe7c8e0921d0079974d8541ffb7","SHA256":"7068185b0f6869fa20b8c64c2e6f2c3bedc161bc4118e602df47da640013cb62"},"SHA1":"7c6cad6a268230f6e08417d278dda4d66bb00d13","SHA256":"f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004","Sections":{".text":{"Entropy":6.174805563267683,"Virtual Size":"0x5976"},".rdata":{"Entropy":4.74536885813998,"Virtual Size":"0x644"},".data":{"Entropy":0.8079955727472559,"Virtual Size":"0x170"},".pdata":{"Entropy":4.257735635509842,"Virtual Size":"0x27c"},"INIT":{"Entropy":5.202412460125397,"Virtual Size":"0x72a"},".rsrc":{"Entropy":3.2596097351980737,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":["IObit CO., LTD","DigiCert EV Code Signing CA","DigiCert"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-30 12:00:00","Signature":"89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Version":3,"TBS":{"MD5":"d0ba095f2bdb679cea084b4106479484","SHA1":"80aba0ecbd2b71c84bc73ac42963bc9ce247a020","SHA256":"a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa","SHA384":"8293c567ba382434adab5899693e47e5d6e06c0b9f3c158bf17675d5a1476627db51d00dc9573bf4b89412617e651ba6"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"Imphash":"b4627789883457d50964a248104cb4c2","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"979c3d1cb589639a129b4e4cec243e73","SHA1":"3a54be5a75468b20ef8e182a7af6e6f314a5d633","SHA256":"afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:41:05","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"f58e9309d8251a3010ee022aa5a6e377","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"fff3d2887cf0d6b4e4c9e7d3140d1f80","SHA1":"885e1b2eba8bd38ea2838313f851ce33455454e4","SHA256":"51b62dce85767011acfae48ba8fb023efcf56ff687cc3207762652b9bea36013"},"SHA1":"40cfe5793a25722aaf47388f8059af53e77a4b22","SHA256":"b6ae324b84a4632cf690dd565954d64b205104fc3fa42181612c3f5b830579c6","Sections":{".text":{"Entropy":6.202075133120773,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.769811652238958,"Virtual Size":"0x594"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.179297571785238,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.2106778004138254,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"979c3d1cb589639a129b4e4cec243e73","SHA1":"3a54be5a75468b20ef8e182a7af6e6f314a5d633","SHA256":"afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:41:05","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"3a3d54e49cae4b51f5231d3ae6724fcd","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"fff3d2887cf0d6b4e4c9e7d3140d1f80","SHA1":"885e1b2eba8bd38ea2838313f851ce33455454e4","SHA256":"51b62dce85767011acfae48ba8fb023efcf56ff687cc3207762652b9bea36013"},"SHA1":"8d404be8d892e5a073eca1d872a5023014dd0b73","SHA256":"d3e95b8d8cbb0c4c3bb78d929408b37fd3b8f305b6234f7f03954465d52454eb","Sections":{".text":{"Entropy":6.202075133120773,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.769811652238958,"Virtual Size":"0x594"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.179297571785238,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.2106778004138254,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"979c3d1cb589639a129b4e4cec243e73","SHA1":"3a54be5a75468b20ef8e182a7af6e6f314a5d633","SHA256":"afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:41:05","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"57fdf2cc39a2865dd67dcf762d2c0b7f","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"fff3d2887cf0d6b4e4c9e7d3140d1f80","SHA1":"885e1b2eba8bd38ea2838313f851ce33455454e4","SHA256":"51b62dce85767011acfae48ba8fb023efcf56ff687cc3207762652b9bea36013"},"SHA1":"8628a983d81e5df59187d3272b509a5a8e12137a","SHA256":"5ea5f339b2e40dea57378626790ca7e9a82777aacdada5bc61ebb7d82043fa07","Sections":{".text":{"Entropy":6.202075133120773,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.769811652238958,"Virtual Size":"0x594"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.179297571785238,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.2106778004138254,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":{},"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"910e58c2580f8eb3efacae948c39e947","SHA1":"f96bc840dde4d24fcd3f2f4712fdb8143aeedf99","SHA256":"198a4dc1c4bd7eff31ff4d1952a592170b25bfb5fedcd9d5d4c4fd3707337e42"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:56","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","ExFreePoolWithTag","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","RtlUnwind","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"IObitUnlocker.sys","MD5":"98eaed36ba245047410a19c191cd1a69","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"5ed41271591cfd1188e26860c867cd71","SHA1":"5659e97f0a3d6b4b5cc6db7922ce3b1a5d2a2d62","SHA256":"96f9617c2e249fd97c13b33fc62066abc19a3dfc63913f8b7f680423c7d80e63"},"SHA1":"e1aa2dcd6702f26c14805bb117acfb4a99b9d673","SHA256":"969f73a1da331e43777a3c1f08ec0734e7cf8c8136e5d469cbad8035fbfe3b47","Sections":{".text":{"Entropy":6.315433318536223,"Virtual Size":"0x3d80"},".rdata":{"Entropy":4.189271224540514,"Virtual Size":"0x28c"},".data":{"Entropy":1.5279258901075148,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.418516536382236,"Virtual Size":"0x5c2"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.472046791762154,"Virtual Size":"0x3f6"}},"Signature":"","Signatures":{},"Imphash":"df732a700824119a3aa46e52712d50e1","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"910e58c2580f8eb3efacae948c39e947","SHA1":"f96bc840dde4d24fcd3f2f4712fdb8143aeedf99","SHA256":"198a4dc1c4bd7eff31ff4d1952a592170b25bfb5fedcd9d5d4c4fd3707337e42"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:56","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","ExFreePoolWithTag","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","RtlUnwind","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"IObitUnlocker.sys","MD5":"3a41edc1dda049a1b8aa411f728831e0","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"5ed41271591cfd1188e26860c867cd71","SHA1":"5659e97f0a3d6b4b5cc6db7922ce3b1a5d2a2d62","SHA256":"96f9617c2e249fd97c13b33fc62066abc19a3dfc63913f8b7f680423c7d80e63"},"SHA1":"abc5bbd11f26232bab2a68ecbff3cbb05f59701b","SHA256":"507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29","Sections":{".text":{"Entropy":6.315433318536223,"Virtual Size":"0x3d80"},".rdata":{"Entropy":4.189271224540514,"Virtual Size":"0x28c"},".data":{"Entropy":1.5279258901075148,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.418516536382236,"Virtual Size":"0x5c2"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.472046791762154,"Virtual Size":"0x3f6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"df732a700824119a3aa46e52712d50e1","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d865b8b11ee0f2ddc9095e3249015abf","SHA1":"0aa57861ba15db6dc026c87f503fbe9635a29629","SHA256":"14e6f0d5f93dc52471af549de1c91c1fc1d9dbd175d5932c17e58e6b186694c9"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:47","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","IoCreateSymbolicLink","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExAllocatePoolWithTag","ExFreePoolWithTag","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"IObitUnlocker.sys","MD5":"848690ca707b4850c967e3217f285fcc","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"45e8197e8972ce1575cb59ba47bbca6b","SHA1":"1c05376b51b700befeedb5e91c2b046898e5e955","SHA256":"613e1f251c62380c70363a484341431d05279fd28749c36173025f0a7108e138"},"SHA1":"9e8c4fea1f2bc9fce1e08a6e0a448e567b504f66","SHA256":"b0dd55b4dc7e561dfe413b029673674e2a5381f5f4daede03ddf3484310a6e11","Sections":{".text":{"Entropy":6.352640579869565,"Virtual Size":"0x3d9c"},".rdata":{"Entropy":4.184352632111533,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.4156598647971395,"Virtual Size":"0x5e8"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.526376244216933,"Virtual Size":"0x3d6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"51957e796400bc7de3cfa02db5a95bce","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"979c3d1cb589639a129b4e4cec243e73","SHA1":"3a54be5a75468b20ef8e182a7af6e6f314a5d633","SHA256":"afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:41:05","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"a8dd685a6afb748c9f487a139c9c367b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"fff3d2887cf0d6b4e4c9e7d3140d1f80","SHA1":"885e1b2eba8bd38ea2838313f851ce33455454e4","SHA256":"51b62dce85767011acfae48ba8fb023efcf56ff687cc3207762652b9bea36013"},"SHA1":"d032ad51c9d12e08709e7b31ea705585a52cbf23","SHA256":"a92d2736c8cd99195a1ef4d0d9a3412bee481acf585944e3b5946b465361a3e7","Sections":{".text":{"Entropy":6.202075133120773,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.769811652238958,"Virtual Size":"0x594"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.179297571785238,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.2106778004138254,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d865b8b11ee0f2ddc9095e3249015abf","SHA1":"0aa57861ba15db6dc026c87f503fbe9635a29629","SHA256":"14e6f0d5f93dc52471af549de1c91c1fc1d9dbd175d5932c17e58e6b186694c9"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:47","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","IoCreateSymbolicLink","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExAllocatePoolWithTag","ExFreePoolWithTag","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"IObitUnlocker.sys","MD5":"501945a3f0055033edc64be09717eef2","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"45e8197e8972ce1575cb59ba47bbca6b","SHA1":"1c05376b51b700befeedb5e91c2b046898e5e955","SHA256":"613e1f251c62380c70363a484341431d05279fd28749c36173025f0a7108e138"},"SHA1":"373d015e5faa183edc164821f68f6bf172f8b364","SHA256":"a38c26c0754f6c9389ea43dd0149db26b95742c1b37468fcf0d8ced66da1dcb9","Sections":{".text":{"Entropy":6.352640579869565,"Virtual Size":"0x3d9c"},".rdata":{"Entropy":4.184352632111533,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.4156598647971395,"Virtual Size":"0x5e8"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.526376244216933,"Virtual Size":"0x3d6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"51957e796400bc7de3cfa02db5a95bce","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d865b8b11ee0f2ddc9095e3249015abf","SHA1":"0aa57861ba15db6dc026c87f503fbe9635a29629","SHA256":"14e6f0d5f93dc52471af549de1c91c1fc1d9dbd175d5932c17e58e6b186694c9"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:47","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["IoCreateDevice","MmGetSystemRoutineAddress","ExfInterlockedPopEntryList","DbgPrint","KeWaitForSingleObject","IofCallDriver","KeGetCurrentThread","KeInitializeEvent","IoAllocateIrp","ZwClose","ObfDereferenceObject","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","IoFileObjectType","memcpy","ZwWriteFile","ZwReadFile","ZwWaitForSingleObject","memset","RtlCompareUnicodeString","KeDelayExecutionThread","_wcsnicmp","IoCreateSymbolicLink","IoCreateFile","ZwQueryDirectoryFile","IoFreeIrp","KeSetEvent","ZwOpenProcess","ZwTerminateProcess","_wcsicmp","wcsrchr","ZwDuplicateObject","ExfInterlockedPushEntryList","KeUnstackDetachProcess","MmIsAddressValid","PsGetProcessPeb","KeStackAttachProcess","PsLookupProcessByProcessId","ZwQuerySystemInformation","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","RtlInitUnicodeString","ZwQueryInformationFile","ObQueryNameString","KeTickCount","KeBugCheckEx","ExAllocatePoolWithTag","ExFreePoolWithTag","IofCompleteRequest","IoDeleteSymbolicLink","_vsnwprintf","IoDeleteDevice","KeGetCurrentIrql","RtlUnwind"],"Imports":["ntoskrnl.exe","HAL.dll","NTOSKRNL.EXE"],"InternalName":"IObitUnlocker.sys","MD5":"5cc5fc8ce149dca1d05fb47c0aec9497","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"45e8197e8972ce1575cb59ba47bbca6b","SHA1":"1c05376b51b700befeedb5e91c2b046898e5e955","SHA256":"613e1f251c62380c70363a484341431d05279fd28749c36173025f0a7108e138"},"SHA1":"14488a51c38e647c2347928f675a167acec8fbd6","SHA256":"faa9aa7118ecf9bb6594281f6b582f1ced0cc62d5db09a2fbf9b7ce70c532285","Sections":{".text":{"Entropy":6.352640579869565,"Virtual Size":"0x3d9c"},".rdata":{"Entropy":4.184352632111533,"Virtual Size":"0x29c"},".data":{"Entropy":1.5672229185382367,"Virtual Size":"0x8c"},"INIT":{"Entropy":5.4156598647971395,"Virtual Size":"0x5e8"},".rsrc":{"Entropy":3.287732512533589,"Virtual Size":"0x370"},".reloc":{"Entropy":5.526376244216933,"Virtual Size":"0x3d6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"51957e796400bc7de3cfa02db5a95bce","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d08742729d8b2acaf972fcea6df3bf09","SHA1":"d7fe09f414ea3a9f2b979c6d883079f0ed563a4b","SHA256":"89d96210bf36a88acb14086c96e916b790d21b7adf81d0907c823ca2afbe0ce3"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:40:53","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"3b967b644881ccb5a95f06e903d8b218","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"772fe1b9794caabb89ee0b78335e3f98","SHA1":"877c7c33339b6359e6c366e9c4744b779f24f542","SHA256":"aed7ad05867110783a74d2c2d4c7a0d2c84075f8a3626e45df6e8f021ea3f592"},"SHA1":"3a97b4f93c69cbf25fa4c4696e44577524c3c9a0","SHA256":"c2e1a3dd0dfb3477a3e855368b23d12b8818df8fa3bc3508abf069a0873d6bf8","Sections":{".text":{"Entropy":6.210028479836042,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.788425060525102,"Virtual Size":"0x584"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.165113468119247,"Virtual Size":"0x234"},"INIT":{"Entropy":5.162190008807952,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":{},"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"979c3d1cb589639a129b4e4cec243e73","SHA1":"3a54be5a75468b20ef8e182a7af6e6f314a5d633","SHA256":"afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1"},"Company":"IObit","Copyright":"IObit Copyright © 2005-2013","CreationTimestamp":"2013-09-27 03:41:05","Date":"","Description":"IObitUnlocker Driver","ExportedFunctions":"","FileVersion":"1.2.0.0 built by: WinDDK","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"IObitUnlocker.sys","MD5":"d7b749051da5fb4604f4141f19c47660","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"IObitUnlocker.sys","PDBPath":"","Product":"IObitUnlocker","ProductVersion":"1.2.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"fff3d2887cf0d6b4e4c9e7d3140d1f80","SHA1":"885e1b2eba8bd38ea2838313f851ce33455454e4","SHA256":"51b62dce85767011acfae48ba8fb023efcf56ff687cc3207762652b9bea36013"},"SHA1":"288daefd1ce65fb01011dc8a64491111207d3965","SHA256":"2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae","Sections":{".text":{"Entropy":6.202075133120773,"Virtual Size":"0x5186"},".rdata":{"Entropy":4.769811652238958,"Virtual Size":"0x594"},".data":{"Entropy":0.7812641672999111,"Virtual Size":"0x170"},".pdata":{"Entropy":4.179297571785238,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.2106778004138254,"Virtual Size":"0x64c"},".rsrc":{"Entropy":3.288590339240593,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=IObit Information Technology","ValidFrom":"2013-01-15 00:00:00","ValidTo":"2016-02-14 23:59:59","Signature":"a09ea7ad2e5d67136d3a8d90878294843292af15103d0bca0dfb6091aa98d35d2bbda19f7b67e8c60ec5650d5d9edfaa0f61e744c2f3f3df12d07a68429127e2a7c5e262ab6bac51cb4287cc131aac3e115f7b1a0c57bfd901f5aff0555c981017d7670952c661bb07d1349af20539651e5789c99682a314d8beba080acfd9baa442db7b5df21b250ce44649d6b942c7a76d2d45744d3c24b26cc6433790ee5b0d7b54d6151245e0284177afeae7196f59b13718be94ed54e9ba5c84a330f8f39f277ed2be7424dd45dfb9c758566e7aaf4fd7eb45f9c5b10073379de1dc5af34f78727dfc0473a0c7ff2ccab6dc9c0ddba5a602013010ee789dfcaac21d0fa9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Version":3,"TBS":{"MD5":"6767e14c32c32562d2ed0feeccf02a40","SHA1":"84fdcb3f59b6c50918daea4a7cc3b200d6d5c91e","SHA256":"264d50b6b2be1acd6642f3f5f7d938820937ecae24a93891c6b45366f3b8d152","SHA384":"3b54ba34d3580c8f058565de007864534c2b3ce448d24aea78a5c6ad5186f8664082944db974bcf608dc4b4b7c17aec9"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"11cadaf29da4c3cb113bf1877b120103","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"0627ee7f7d86e0c552a7bc8ee31a1b18","LoadsDespiteHVCI":"FALSE"},{"Filename":"","MD5":"47aa03a10ac3a407f8f30f1088edcbc9","SHA1":"b5d78a1d3ae93bd343c6d65e64c0945d1d558758","SHA256":"c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66","Signature":"","Date":"","Publisher":"","Company":"IObit","Description":"IObitUnlocker Driver","Product":"IObitUnlocker","ProductVersion":"1.2.0.1","FileVersion":"1.2.0.1 built by: WinDDK","MachineType":"AMD64","OriginalFilename":"IObitUnlocker.sys","Imphash":"878e0ad08d61b8eeabe5f33873401f2d","Authentihash":{"MD5":"1ed0cb218c469ce7bb2917cde85fb4dd","SHA1":"5193f41b2787d16decf7d50891fde34dd1162f4f","SHA256":"3ee89c1e8738d465d241630ccca4ce218afc02421461e6de91e4dc8133e9501c"},"RichPEHeaderHash":{"MD5":"87e7284a82caf3f9332dfaff2f515994","SHA1":"ba095313dc4473516b91f8c36af612b7355c31d3","SHA256":"2b061aa8bc49bc9cce9ba24952a5e0e1a581f7d693db1aef26aa44049811beba"},"Sections":{".text":{"Entropy":5.405554072789149,"Virtual Size":"0x7fed"},".rdata":{"Entropy":4.194087376463995,"Virtual Size":"0x4e8"},".data":{"Entropy":0.8079955727472559,"Virtual Size":"0x170"},".pdata":{"Entropy":4.175415725903598,"Virtual Size":"0x3a8"},"INIT":{"Entropy":5.217151964086442,"Virtual Size":"0x6e6"},".rsrc":{"Entropy":3.3103115449532003,"Virtual Size":"0x370"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-06-15 00:26:50","InternalName":"IObitUnlocker.sys","Copyright":"IObit Copyright © 2005-2013","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","RtlAssert","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","RtlAppendUnicodeToString","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","ZwCreateFile","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","RtlAppendUnicodeStringToString","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","PsGetCurrentProcessId","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CN, ST=Sichuan, L=Chengdu, O=IObit Information Technology, CN=IObit Information Technology","ValidFrom":"2015-12-23 00:00:00","ValidTo":"2018-03-23 23:59:59","Signature":"1eca1dc77a22ba11722bcc6c270cd10fd37c3d8222397413c95649e8785fb1bdf1dc1469688cb7ab3bb4691243c5041b3e44994a21838069d3c272f8104ad6ddbba62a3f4383107e770135da9f63e0f8a10f873db3ca001e08cad9de3b93ffd2932c2709db34f8c08de22388abe76109d78fa23adce1c13b139ab1b0d5df60ff8c337f97d6c174fe4351c5eb1875c2e2633d49e5416074e3d3971e3c3afc6369d1f9294365b97a1676dbf3db4e99b8bce5f45374c29a2c7af48e2e55df3d7e299c0ffab20515d2cc8c6e1641880a5a266702b55549a537dd4c744f98ffcd4e28a98e953c905b78bd1739d4c16391f47bc5dd03473d6ffe9452ed41d899cd790f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"454a6cd2e1e63ca9d542dfdab518fed9","Version":3,"TBS":{"MD5":"dc758b37359f3efd673d2a20e9d65970","SHA1":"b7293447deac1ede27c037804acf694e00262d28","SHA256":"e1f3ec931d84ca3ebf315235e9d6b203c49b53cc2fea8a3317a7f5d9717be934","SHA384":"e14f9b9f001c64204054a84fde7d18b84f217cf42bd19d30ef1b26d399adc01a17d031f763a981ba99539d80ac8b1abe"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"454a6cd2e1e63ca9d542dfdab518fed9","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Filename":"IObitUnlocker.sys","SHA256":"2ba404c50684d59b701959a1732617dec6a6a25c8005294c0d2b3822b38479a4","MD5":"85def55323cfc4a04a270127a20f4d2c","SHA1":"0e6ef35f6f68be6d72e4a225494c02557d39cacc","Imphash":"1dcbb2cd7749f70f37329cb3e15406f8","Authentihash":{"MD5":"155f7930fae72378e7efe52ba679b69a","SHA1":"d389fa80da574506516aa49b70a8be946744edbc","SHA256":"e35d11538406dd03ac93236be37c16b2da3ad1d38fb59b70b85c484804546b6d"},"RichPEHeaderHash":{"MD5":"4bced431c6abb303e6bb74e69153fc03","SHA1":"3662ab731022d9217b1af69a69c114660492ba31","SHA256":"9a3bd07ed6821b4b33ef5c86f3e848d811b60341711a54c3ef6323c6868756f4"},"Sections":{".text":{"Entropy":6.175954592086079,"Virtual Size":"0x5586"},".rdata":{"Entropy":4.78340156437448,"Virtual Size":"0x5f4"},".data":{"Entropy":0.8079955727472564,"Virtual Size":"0x170"},".pdata":{"Entropy":4.231501285963187,"Virtual Size":"0x258"},"INIT":{"Entropy":5.20589742734384,"Virtual Size":"0x6d2"},".rsrc":{"Entropy":3.263395141973913,"Virtual Size":"0x368"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-10-10 10:04:32","Description":"Unlocker Driver","Company":"IObit Information Technology","InternalName":"IObitUnlocker.sys","OriginalFilename":"IObitUnlocker.sys","FileVersion":"1.2.0.2","Product":"Unlocker","ProductVersion":"1.2.0.2","Copyright":"IObit Copyright © 2005-2018","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoDeleteDevice","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","_wcsnicmp","ZwReadFile","IoGetRelatedDeviceObject","MmGetSystemRoutineAddress","KeInitializeEvent","ExInterlockedPopEntryList","KeDelayExecutionThread","IoFileObjectType","ZwWaitForSingleObject","ZwClose","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlCompareUnicodeString","IoAllocateIrp","ObfDereferenceObject","ZwWriteFile","DbgPrint","IofCallDriver","_wcsicmp","PsGetProcessPeb","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","RtlInitUnicodeString","KeSetEvent","RtlAppendUnicodeToString","IoCreateFile","ZwQuerySystemInformation","ZwOpenSymbolicLinkObject","KeUnstackDetachProcess","ObQueryNameString","ZwCreateFile","wcsrchr","ZwQueryDirectoryFile","_vsnwprintf","RtlAppendUnicodeStringToString","ZwDuplicateObject","IoFreeIrp","ZwOpenProcess","PsGetCurrentProcessId","MmIsAddressValid","ZwTerminateProcess","ZwQueryInformationFile","ExInterlockedPushEntryList","KeStackAttachProcess","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-30 12:00:00","Signature":"89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Version":3,"TBS":{"MD5":"d0ba095f2bdb679cea084b4106479484","SHA1":"80aba0ecbd2b71c84bc73ac42963bc9ce247a020","SHA256":"a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa","SHA384":"8293c567ba382434adab5899693e47e5d6e06c0b9f3c158bf17675d5a1476627db51d00dc9573bf4b89412617e651ba6"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}]}]}