{"Id":"e5f12b82-8d07-474e-9587-8c7b3714d60c","Tags":["zam64.sys","zamguard32.sys","zamguard64.sys"],"Verified":"TRUE","Author":"Michael Haag, Nasreddine Bencherchali","Created":"2023-01-09","MitreID":"T1068","CVE":["CVE-2018-5713"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create zam64.sys binPath=C:\\windows\\temp\\zam64.sys type=kernel && sc.exe start zam64.sys","Description":"","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["Internal Research","https://www.reddit.com/r/crowdstrike/comments/13wjrgn/20230531_situational_awareness_spyboy_defense/","https://github.com/elastic/protections-artifacts/search?q=VulnDriver","https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html","https://github.com/ZeroMemoryEx/Terminator"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"zam64.sys","MD5":"2a3ce41bb2a7894d939fbd1b20dae5a0","SHA1":"cd248648eafca6ef77c1b76237a6482f449f13be","SHA256":"2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1","Authentihash":{"MD5":"689e0587c7821c19c711424fa619dbad","SHA1":"b9b230bb66c82e15f563ac0873a3a1db25995064","SHA256":"1997b7217dfddd8fbd4924e86b58fe585ef4bd91c3069d3deeb34ea70eb82d60"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.18.371","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","ZwCreateFile","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","PsGetProcessId","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","IoCreateFileSpecifyDeviceObjectHint","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"5e737552d7162062a00f6f22da1133c4","SHA1":"4b43c25befb85e28d65bac423a06403c6043fd79","SHA256":"b53db7580900ee00aaed432b8a5b36169f820f16bbf6d85d34ef641b1e5bfdcb"},"Sections":{".text":{"Entropy":6.311575029098583,"Virtual Size":"0x20975"},".hook":{"Entropy":5.097466333253085,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.539147413432647,"Virtual Size":"0x463c"},".data":{"Entropy":4.8888094657184,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.125727272335482,"Virtual Size":"0x84c"},"INIT":{"Entropy":5.341472095080265,"Virtual Size":"0xf2e"},".rsrc":{"Entropy":3.1200681658662868,"Virtual Size":"0x270"},".reloc":{"Entropy":4.004251703727133,"Virtual Size":"0x58"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-11-20 16:27:25","Imphash":"b35d1d3faa6c97b106b343823d5df867","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"db46c56849bbce9a55a03283efc8c280","SHA1":"8f4b79b8026da7f966d38a8ba494c113c5e3894b","SHA256":"3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b","Authentihash":{"MD5":"a7d940958aa06308dfb68ed67e6ae18c","SHA1":"ddb4d31681eb2e8e95aa33b78d454b29542d2a98","SHA256":"ab1290211250af83be645072d346693890f3f29feda5a3a23ea97758247f7ba1"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.16.928","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ObfDereferenceObject","ZwCreateFile","ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","ZwQueryInformationProcess","__C_specific_handler","DbgPrint","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsSetCreateProcessNotifyRoutine","PsGetProcessImageFileName","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","RtlAppendUnicodeToString","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","ObReferenceObjectByHandle","FsRtlGetFileSize","ZwDeleteFile","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","PsGetProcessId","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","IoGetDeviceAttachmentBaseRef","strstr"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"ae5755ef6edfaf47c756c813503d9491","SHA1":"12e5b706039cb80653dac2ed809faf430e392b64","SHA256":"9cb52aae7fdcaabee6e2e9b8640a4a386e7610f0fdedd53413fd1a9d1e7c044b"},"Sections":{".text":{"Entropy":6.394396532876167,"Virtual Size":"0xb374"},".hook":{"Entropy":5.038393262108047,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.496538814940608,"Virtual Size":"0x4354"},".data":{"Entropy":4.885486089888766,"Virtual Size":"0x95b0"},".pdata":{"Entropy":4.837204199996544,"Virtual Size":"0x774"},"INIT":{"Entropy":5.364871219090765,"Virtual Size":"0xcea"},".rsrc":{"Entropy":3.1167029968436752,"Virtual Size":"0x270"},".reloc":{"Entropy":4.005527221234636,"Virtual Size":"0x5c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-07-23 05:10:50","Imphash":"7fba20994f76fb31b9f5a2b3f0c00055","LoadsDespiteHVCI":"TRUE"},{"Filename":"zamguard64.sys","MD5":"99c131567c10c25589e741e69a8f8aa3","SHA1":"3b8ddf860861cc4040dea2d2d09f80582547d105","SHA256":"45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef","Authentihash":{"MD5":"38757cf8a65976f362f287c3e94f8c1b","SHA1":"87cdb7698822d92a070b83b732fffa0ea99e34a2","SHA256":"950b672d3300bcacefe568156fbc8b16fa09da13df2f6ecda31254faaaf041f9"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.20.865","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ObQueryNameString","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","PsLookupProcessByProcessId","ZwOpenProcess","PsGetCurrentProcessId","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySystemInformation","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"c0210f91c028886456549a7aa78f8147","SHA1":"ea5478898d988d1bfa1287940ad74e5445f80a8d","SHA256":"820b53e3b20277040944a1286a3f401ca8fb24b4f93535dc570e2261632e2f26"},"Sections":{".text":{"Entropy":6.318184968025881,"Virtual Size":"0x217a5"},".hook":{"Entropy":5.11576244605271,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.528539978421143,"Virtual Size":"0x4744"},".data":{"Entropy":4.888903009535537,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.14656609792469,"Virtual Size":"0x8d0"},"INIT":{"Entropy":5.334266463396646,"Virtual Size":"0x1106"},".rsrc":{"Entropy":3.1014865335947537,"Virtual Size":"0x270"},".reloc":{"Entropy":4.064239284774715,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-05-24 03:38:42","Imphash":"3edc60bda68569cac7ad7604728ff40d","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"e5f8fcdfb52155ed4dffd8a205b3d091","SHA1":"90abd7670c84c47e6ffc45c67d676db8c12b1939","SHA256":"76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a","Authentihash":{"MD5":"ad2c4382390a8740dcea8b0aef5552c2","SHA1":"0740faffcb163f4c8cd204c367b9492f2e361207","SHA256":"b529550e8d2ec6133be50d7139179654301ff84ba09da0cd256c5dec924a185c"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.18.229","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwCreateFile","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","PsGetProcessId","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySymbolicLinkObject","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"9b5178d71a0cb5373b4990094392a528","SHA1":"155e20603f42078857e8d77b8729385f21b38222","SHA256":"20fee3293ed1f05bc11ae72145db01fabac5b03a5373d99becc657699f98b330"},"Sections":{".text":{"Entropy":6.311766074951009,"Virtual Size":"0x20925"},".hook":{"Entropy":5.1040723684174,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.537965882188229,"Virtual Size":"0x464c"},".data":{"Entropy":4.8888094657184,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.128533673234583,"Virtual Size":"0x84c"},"INIT":{"Entropy":5.3440427741633085,"Virtual Size":"0xf04"},".rsrc":{"Entropy":3.11127988172195,"Virtual Size":"0x270"},".reloc":{"Entropy":4.004251703727133,"Virtual Size":"0x58"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-11-03 07:00:59","Imphash":"c6a0f65ba653ee78255cc9e314abc442","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"707ab1170389eba44ffd4cfad01b5969","SHA1":"b99a5396094b6b20cea72fbf0c0083030155f74e","SHA256":"7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21","Authentihash":{"MD5":"fb3161dd2e402cfdd3495278974f4181","SHA1":"9c7deb9def09bca28c37211992c76880f575b9ef","SHA256":"a59ad5be59f73f2a138c70d8aa634bf5f3364a67e072b64ff2a6d4627514a9ad"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"3.0.0.000","Product":"ZAM","ProductVersion":"3.0.0.000","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ObQueryNameString","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","PsLookupProcessByProcessId","ZwOpenProcess","PsGetCurrentProcessId","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySystemInformation","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:07","ValidTo":"2023-06-01 18:08:07","Signature":"4c967b89d7f96aa22dbaa9eee6cdc8dad16669620cd9c5c84bf3ca1ec4eaa4a67df9fafb84ba75fcec635f0a3d484541d890d65542406e5792504ecb8fd428068837b11d8e9d4cdb503608d0842dea48428247b46364746dc86b79cdc3379acb229e67b749ed31d3c6bcc88624bff3e066355d59b7ef9e715d3c3270506d1e794959edd8df2572505c15876ac0f42ed0d05f70214f50fb109627ab192b217d6a2bf503fe35811f6ffcf0585ae508c37589dc8015eea615f36ea2f1105c0f677a6758cb4898b57458cab4fc2e1c60f8af32baf51cb41b775e79815713693db878a935b1fb8232232310bba545e57c74d63a406968c36818974ea1e425839b83e81c94897f1b896d2974e32ff5a47f8bcefdebfde84a4d01c5918bf98aececb8edb2ef9dc697054676a10c04313f3a131469c978f2e7839f11a28e436936cc07e227fd705becbb54ba67c2eeaaa025658811de22f37e4ce51109c10ed94a65583cc4e4024432cedf41b3b18b175360b1f4e12a0cc9d562e7fabd80bacb78a74e9262a9a46c3d0a7757f71e4202522cb70d9591c77e1a4b0ca24739a9cef78f7d2fb376c4cf56a35b58deb7dba458bee058254bc3883ba356c79f458815e3bbcac600b063594db47ffdbb215783bf5c38c74a1fc6271a093aab79b4cf253c14b1eeb89f9c607d7956203166fa4420482b52ab4f3bd3f0e6bda4a13a018f0ecdb0a0","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000058e7c589c068dca727000000000058","Version":3,"TBS":{"MD5":"d83c9268bb1f35e4ea0f81b7b876b4f8","SHA1":"6a784e02bf67f5791a85567716aa2d0fd701fcd0","SHA256":"00dab92fcb3753ac06147a6d8888b5731877d84979e3f178f572e3a1dff33fa8","SHA384":"75264b08d0862968698b184e6049337dbb3ddaab64c4cb71aaa8b990f10bc8b8660e2b1044da616784559b92f6b45280"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000058e7c589c068dca727000000000058","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"RichPEHeaderHash":{"MD5":"c0210f91c028886456549a7aa78f8147","SHA1":"ea5478898d988d1bfa1287940ad74e5445f80a8d","SHA256":"820b53e3b20277040944a1286a3f401ca8fb24b4f93535dc570e2261632e2f26"},"Sections":{".text":{"Entropy":6.31806175189807,"Virtual Size":"0x217b5"},".hook":{"Entropy":5.11599521430575,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.529476686216564,"Virtual Size":"0x4744"},".data":{"Entropy":4.888903009535537,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.138271966562841,"Virtual Size":"0x8d0"},"INIT":{"Entropy":5.334070329167121,"Virtual Size":"0x1106"},".rsrc":{"Entropy":3.1501576835148613,"Virtual Size":"0x298"},".reloc":{"Entropy":4.064239284774715,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-08-17 11:06:53","Imphash":"3edc60bda68569cac7ad7604728ff40d","LoadsDespiteHVCI":"FALSE"},{"Filename":"zam64.sys","MD5":"9e0659d443a2b9d1afc75a160f500605","SHA1":"09f117d83f2f206ee37f1eb19eea576a0ac9bdcc","SHA256":"8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a","Authentihash":{"MD5":"536527a09edbc7e8c174f7f7423a79a1","SHA1":"60d4d82640d4550c3e2cfba69f00b5c7472e4926","SHA256":"dcf9bc1e511993fd8c87b8cab5c23366cc818cccc40617cabc8f242d4a8751d7"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.17.115","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ObfDereferenceObject","ZwCreateFile","ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","ZwQueryInformationProcess","__C_specific_handler","DbgPrint","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsSetCreateProcessNotifyRoutine","PsGetProcessImageFileName","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","RtlAppendUnicodeToString","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","ObReferenceObjectByHandle","FsRtlGetFileSize","ZwDeleteFile","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","PsGetProcessId","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","IoGetDeviceAttachmentBaseRef","strstr"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"ae5755ef6edfaf47c756c813503d9491","SHA1":"12e5b706039cb80653dac2ed809faf430e392b64","SHA256":"9cb52aae7fdcaabee6e2e9b8640a4a386e7610f0fdedd53413fd1a9d1e7c044b"},"Sections":{".text":{"Entropy":6.39444173923497,"Virtual Size":"0xb374"},".hook":{"Entropy":5.038393262108047,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.49649919697251,"Virtual Size":"0x4354"},".data":{"Entropy":4.885486089888766,"Virtual Size":"0x95b0"},".pdata":{"Entropy":4.837204199996544,"Virtual Size":"0x774"},"INIT":{"Entropy":5.364871219090765,"Virtual Size":"0xcea"},".rsrc":{"Entropy":3.1027914592928436,"Virtual Size":"0x270"},".reloc":{"Entropy":4.005527221234636,"Virtual Size":"0x5c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-08-30 06:52:48","Imphash":"7fba20994f76fb31b9f5a2b3f0c00055","LoadsDespiteHVCI":"TRUE"},{"Filename":"zamguard64.sys","MD5":"51e7b58f6e9b776568ffbd4dd9972a60","SHA1":"2cf75df00c69d907cfe683cb25077015d05be65d","SHA256":"9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c","Authentihash":{"MD5":"e03436e22127cd75a132169b627e5a3f","SHA1":"b8d8e15e952b3fd2a510699d2124253565ecd611","SHA256":"082adcdc2d246d2291bcf135a7519840a84f27cfa3143d1372a9e2aa5e514dbd"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.16.287","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["strstr","wcsstr","RtlInitUnicodeString","RtlCopyUnicodeString","RtlGetVersion","KeDelayExecutionThread","ExAllocatePoolWithTag","ExFreePoolWithTag","ProbeForRead","ObReferenceObjectByHandle","ObfDereferenceObject","ZwCreateFile","ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","ZwQueryInformationProcess","__C_specific_handler","DbgPrint","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsSetCreateProcessNotifyRoutine","PsGetProcessImageFileName","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","RtlAppendUnicodeToString","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwDeleteFile","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","PsGetProcessId","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"e0c0e404602172aa48774d25d95566a0","SHA1":"0063132555d9e0100f871f754fde426fbd9ad317","SHA256":"abed6bb7959144a794ce1a624a4c333b89d73ac622d253fca9f3aab4a3505783"},"Sections":{".text":{"Entropy":6.385878636968825,"Virtual Size":"0xb224"},".hook":{"Entropy":5.044794310603694,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.531467293507371,"Virtual Size":"0x41d4"},".data":{"Entropy":4.886572228837024,"Virtual Size":"0x8f58"},".pdata":{"Entropy":4.807436318496407,"Virtual Size":"0x75c"},"INIT":{"Entropy":5.3696053533373425,"Virtual Size":"0xcea"},".rsrc":{"Entropy":3.1111150668737135,"Virtual Size":"0x270"},".reloc":{"Entropy":3.8191100346914766,"Virtual Size":"0x54"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-06-30 07:29:29","Imphash":"0e9dfd08346bbe128159bff440d13389","LoadsDespiteHVCI":"TRUE"},{"Filename":"zamguard32.sys","MD5":"06897b431c07886454e0681723dd53e6","SHA1":"40d29aa7b3fafd27c8b27c7ca7a3089ccb88d69b","SHA256":"ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd","Authentihash":{"MD5":"4e0b0bd19c0f3c4a2a75e786474d9d06","SHA1":"c5388c61135c7fe5617607206d663ac3eaef649c","SHA256":"de99cea1cb680816afa10d2629a8067af1dc289d2d162a21b9dba71eb0e47745"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.21.63","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"I386","Imports":["ntoskrnl.exe","HAL.dll","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["_allmul","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","KeQuerySystemTime","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","KeGetCurrentThread","RtlIntegerToUnicodeString","RtlCompareMemory","KeInitializeEvent","KeSetEvent","KefAcquireSpinLockAtDpcLevel","KefReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwQuerySystemInformation","IoFileObjectType","ZwQueryInformationProcess","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExfInterlockedInsertHeadList","ExfInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","KeServiceDescriptorTable","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","RtlUnwind","PsGetProcessImageFileName","FsRtlIsNameInExpression","ObQueryNameString","PsLookupProcessByProcessId","PsGetCurrentProcessId","ZwOpenProcess","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","strstr","_aullshr","memcpy","KeReadStateEvent","memset","KfRaiseIrql","KfLowerIrql","KfReleaseSpinLock","KfAcquireSpinLock","KeGetCurrentIrql","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"bf4174b7e1b1688fc834924419fb2346","SHA1":"829a54d3ecb838b80db5f3231a409664bff1b987","SHA256":"da5b2c2f97975f75865da42c25ff8a3f10f02a2eb3f7a80ccb37de3f16118e12"},"Sections":{".text":{"Entropy":6.572668371587258,"Virtual Size":"0x1b995"},".hook":{"Entropy":4.580963402374781,"Virtual Size":"0x889"},".rdata":{"Entropy":5.467252707390709,"Virtual Size":"0x3934"},".data":{"Entropy":4.880345457711278,"Virtual Size":"0x3668c"},"INIT":{"Entropy":5.638118044252383,"Virtual Size":"0xf8c"},".rsrc":{"Entropy":3.132774613745373,"Virtual Size":"0x268"},".reloc":{"Entropy":6.750936493564276,"Virtual Size":"0x222c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-08-17 11:07:02","Imphash":"a49a51d7f2ae972483961eb64d17888e","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"d4a10447fdaff7a001715191c1f914b6","SHA1":"628e63caf72c29042e162f5f7570105d2108e3c2","SHA256":"d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0","Authentihash":{"MD5":"8ff959801623fcaf37f6fde89a4aeec1","SHA1":"b24f8e34221cb7eaa5bed2f177f6701380a0e71f","SHA256":"1a166e70dcaf3ef12836db1927953ee528e532cdae8165e67d776971e4cbc48c"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"2.11.1.510","Product":"ZAM","ProductVersion":"2.11.1.510","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["strstr","wcsstr","RtlInitUnicodeString","RtlCopyUnicodeString","RtlGetVersion","KeDelayExecutionThread","ExAllocatePoolWithTag","ExFreePoolWithTag","ProbeForRead","ObReferenceObjectByHandle","ObfDereferenceObject","ZwCreateFile","ZwClose","RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","ZwQueryInformationProcess","__C_specific_handler","DbgPrint","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsSetCreateProcessNotifyRoutine","PsGetProcessImageFileName","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","RtlAppendUnicodeToString","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwDeleteFile","ZwQuerySystemInformation","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","PsGetProcessId","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"03ecbde4b65b5fc87f13e1aac3284168","SHA1":"40790d40c391b7325d1843e2c39597720c8c4f69","SHA256":"86aa19cd5e2beaf013e66553b916cc39a8c456d7000e46bcfc4719eda41206b5"},"Sections":{".text":{"Entropy":6.391414310346214,"Virtual Size":"0xaf64"},".hook":{"Entropy":5.064996868770916,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.536191925684008,"Virtual Size":"0x414c"},".data":{"Entropy":4.88510732017845,"Virtual Size":"0x8f58"},".pdata":{"Entropy":4.8352396491085745,"Virtual Size":"0x720"},"INIT":{"Entropy":5.371003736727007,"Virtual Size":"0xcba"},".rsrc":{"Entropy":3.2000366091764283,"Virtual Size":"0x2a8"},".reloc":{"Entropy":3.7715246176915187,"Virtual Size":"0x54"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-05-12 07:14:11","Imphash":"089e8a8f2bb007852c63b64e66430293","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"75e50ae2e0f783e0caf912f45e15248a","SHA1":"a3d612a5ea3439ba72157bd96e390070bdddbbf3","SHA256":"de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c","Authentihash":{"MD5":"cf4707d1cc2b1d1344058ac750e4e61e","SHA1":"3bd3de766013c31d87545bd7affd8e52c4e24f72","SHA256":"e5316670c0bddc0519ef96b2db89285a8620a260429a97f9d2cf5b58b0287d91"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.20.104","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ObQueryNameString","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","PsLookupProcessByProcessId","ZwOpenProcess","PsGetCurrentProcessId","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","strstr","ZwQuerySystemInformation","DbgPrint","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"de13056bb6ad645db28aad154de62bbd","SHA1":"fab3d62fdad6b298341cc10935165f8e565b4f0b","SHA256":"a0d4900197b774247b0cb136ab600bfdb16e2ea139e80b8ee4bd0cc768223a5a"},"Sections":{".text":{"Entropy":5.993512424846143,"Virtual Size":"0x2c275"},".hook":{"Entropy":5.054306709915981,"Virtual Size":"0x9cf"},".rdata":{"Entropy":5.401668155372347,"Virtual Size":"0x43d4"},".data":{"Entropy":4.886684982431987,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.218831215225971,"Virtual Size":"0xa38"},"INIT":{"Entropy":5.34672539398453,"Virtual Size":"0x1106"},".rsrc":{"Entropy":3.099017887403996,"Virtual Size":"0x270"},".reloc":{"Entropy":4.067679213183045,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-04-01 04:23:58","Imphash":"5f6fd4ffba177389f414dd1a6ded24b4","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"5054083cf29649a76c94658ba7ff5bce","SHA1":"dd4cd182192b43d4105786ba87f55a036ec45ef2","SHA256":"e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f","Authentihash":{"MD5":"8d4a371e8da97e8dfd254e7b860bf147","SHA1":"d2a888f664ffa91e876dbd797ca1fc95c511c5bc","SHA256":"27f5c5eb9a5fc9e02d3ac3cd83fc26b07f3d0143b03db69d6dcf7554d0c50fb6"},"Description":"ZAM","Company":"Zemana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.17.984","Copyright":"Zemana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlUpperString","RtlUpcaseUnicodeString","PsGetCurrentProcessId","ZwOpenProcess","PsLookupProcessByProcessId","ObQueryNameString","FsRtlIsNameInExpression","ZwQueryInformationProcess","__C_specific_handler","DbgPrint","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsSetCreateProcessNotifyRoutine","PsGetProcessImageFileName","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","RtlAppendUnicodeToString","KeInitializeEvent","KeSetEvent","KeWaitForSingleObject","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ZwDeleteFile","ZwClose","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","PsGetProcessId","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","MmSystemRangeStart","KeBugCheckEx","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySystemInformation","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"665ad4c00f9eec6edc1f766ccac676f0","SHA1":"08d0338ae7414b104b0fa26a31d46b90e001bd19","SHA256":"02f7c54750b6c80addc5b62d3517dfc10363a27e0277cc87d5c12136d341d484"},"Sections":{".text":{"Entropy":6.399466980549077,"Virtual Size":"0xbae4"},".hook":{"Entropy":5.065053175214044,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.476727334664607,"Virtual Size":"0x43ec"},".data":{"Entropy":4.8858201894451,"Virtual Size":"0x30398"},".pdata":{"Entropy":4.828897068133496,"Virtual Size":"0x7c8"},"INIT":{"Entropy":5.313494891405246,"Virtual Size":"0xe24"},".rsrc":{"Entropy":3.118718502578378,"Virtual Size":"0x270"},".reloc":{"Entropy":3.983795976674783,"Virtual Size":"0x58"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-10-22 05:36:54","Imphash":"519cf5394541bf5e2869edeec81521e1","LoadsDespiteHVCI":"TRUE"},{"Filename":"zam64.sys","MD5":"21e13f2cb269defeae5e1d09887d47bb","SHA1":"16d7ecf09fc98798a6170e4cef2745e0bee3f5c7","SHA256":"543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91","Signature":["Zemana Ltd.","DigiCert High Assurance Code Signing CA-1","DigiCert"],"Date":"","Publisher":"","Company":"Zemana Ltd.","Description":"ZAM","Product":"ZAM","ProductVersion":"2.21.63","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Authentihash":{"MD5":"3f2771b22553380efcee72a27dc4d96c","SHA1":"0d15b7de0f1129b540f48d7a3cba2c6bf5d44112","SHA256":"ceb1bf90d8652dac481fba362e5c3a6548a116897e729733f2be27f4edc5fc1f"},"InternalName":"","Copyright":"Zemana Ltd. All rights reserved.","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ObQueryNameString","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","PsLookupProcessByProcessId","ZwOpenProcess","PsGetCurrentProcessId","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySystemInformation","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=TR, L=Edirne, O=Zemana Ltd., CN=Zemana Ltd.","ValidFrom":"2014-12-16 00:00:00","ValidTo":"2017-12-20 12:00:00","Signature":"8a60d49cf93c42e609a5fc51877e8caee77cdc7848d3db41a9556d186c795f8f20e825c3be29056670c4414f35dc24e538606c0b1404c9b751e1fad91e2c136a5970c3c0edbb5a2391c47bb1d2782ff673636c6ec7bc2a69d06011f07dc957039835f50b6d5f342e75e00564be8edc0035aa4ae92d412dd38f347abff1d8ec9059ef25af4f5d1e20d6c5b2a5e69c7cba53c0f88901f7db044f11724be5a04b0d689c4f4fccef40d4a654954b67d5ecacf272c48a3d81ac0056c1d252f42bb403291f674642bd001d99b3846f0270b070d1487ef42e939193c949feb162e29ca5ad41d8d195b8e8f6e4c8dd79c46f27b06f9e15906df8f8fd9a850ba28f169468","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0210230fd364b469091b8a4440145e18","Version":3,"TBS":{"MD5":"17e68f0650db3d4d698ef88ef963b47e","SHA1":"00162854ea07ea0a83aa941767277a5c3ab03c9d","SHA256":"7caefa120bfce12d33df6ed4ffefcb069a7290c90b378deca4ef2d66947eb18d","SHA384":"e26234d027fe70850cbb5efc9c4e61196cdaa00339a64d729c6d4a57bd04d148b16c00e2855b79979787a76f4b860a25"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"0210230fd364b469091b8a4440145e18","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"RichPEHeaderHash":{"MD5":"c0210f91c028886456549a7aa78f8147","SHA1":"ea5478898d988d1bfa1287940ad74e5445f80a8d","SHA256":"820b53e3b20277040944a1286a3f401ca8fb24b4f93535dc570e2261632e2f26"},"Sections":{".text":{"Entropy":6.318212914980563,"Virtual Size":"0x217b5"},".hook":{"Entropy":5.11599521430575,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.529476686216564,"Virtual Size":"0x4744"},".data":{"Entropy":4.888903009535537,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.138271966562841,"Virtual Size":"0x8d0"},"INIT":{"Entropy":5.334070329167121,"Virtual Size":"0x1106"},".rsrc":{"Entropy":3.11126789304551,"Virtual Size":"0x268"},".reloc":{"Entropy":4.064239284774715,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-08-17 11:06:53","Imphash":"3edc60bda68569cac7ad7604728ff40d","LoadsDespiteHVCI":"TRUE"},{"Filename":"tProtect.dll","SHA256":"078e7fb479ad6f0734682d41a17d41518de35bf4f6c5c212643b7d37e641041e","MD5":"a87587ee2f2281297f24bbd96902faa5","SHA1":"63399ac91e92f0c92ffaeac43616e1b7c77a9791","Imphash":"3edc60bda68569cac7ad7604728ff40d","Authentihash":{"MD5":"096b2f20901609e482340d5f8cbc79ac","SHA1":"1c6501199c9d759970a11cc41b9077a946c3c276","SHA256":"196c803aa8217eb8d2783ad9750cd27bbe540a449480c842cc128cc7a5a64f04"},"RichPEHeaderHash":{"MD5":"c0210f91c028886456549a7aa78f8147","SHA1":"ea5478898d988d1bfa1287940ad74e5445f80a8d","SHA256":"820b53e3b20277040944a1286a3f401ca8fb24b4f93535dc570e2261632e2f26"},"Sections":{".text":{"Entropy":6.318212914980563,"Virtual Size":"0x217b5"},".hook":{"Entropy":5.11599521430575,"Virtual Size":"0x9af"},".rdata":{"Entropy":5.529476686216564,"Virtual Size":"0x4744"},".data":{"Entropy":4.888903009535537,"Virtual Size":"0x53c88"},".pdata":{"Entropy":5.138271966562841,"Virtual Size":"0x8d0"},"INIT":{"Entropy":5.334070329167121,"Virtual Size":"0x1106"},".rsrc":{"Entropy":3.1311542715985277,"Virtual Size":"0x25c"},".reloc":{"Entropy":4.064239284774715,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-08-17 19:06:53","Description":"ZAM","Company":"Zmana Ltd.","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"ZAM","ProductVersion":"2.21.63","Copyright":"Zmana Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FsRtlIsNameInExpression","PsGetProcessImageFileName","ZwQueryInformationProcess","__C_specific_handler","strchr","RtlAppendUnicodeToString","KeInitializeSemaphore","KeReleaseSemaphore","KeWaitForSingleObject","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","PsCreateSystemThread","PsTerminateSystemThread","ZwQueryInformationFile","ZwWriteFile","PsGetCurrentThreadId","ZwDeleteFile","_vsnprintf","PsThreadType","PsSetCreateProcessNotifyRoutine","PsGetProcessSessionId","RtlAppendUnicodeStringToString","ZwDeleteValueKey","ZwSetValueKey","towupper","RtlIntegerToUnicodeString","KeInitializeEvent","KeSetEvent","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","MmProbeAndLockPages","IoAllocateIrp","IoAllocateMdl","IofCallDriver","IoFreeIrp","IoFreeMdl","IoGetDeviceObjectPointer","IoGetRelatedDeviceObject","ObCloseHandle","ObfReferenceObject","ZwSetInformationFile","ZwReadFile","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoCreateFileSpecifyDeviceObjectHint","IoGetDeviceAttachmentBaseRef","FsRtlGetFileSize","ObQueryNameString","IoFileObjectType","KeReadStateEvent","ExQueueWorkItem","ExGetPreviousMode","MmGetSystemRoutineAddress","NtOpenProcess","ZwCreateEvent","ZwWaitForSingleObject","ZwSetEvent","NtQuerySystemInformation","ExEventObjectType","NtBuildNumber","ZwDeleteKey","ObReferenceObjectByName","IoDriverObjectType","MmIsDriverVerifying","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","RtlSetDaclSecurityDescriptor","MmMapLockedPagesSpecifyCache","PsGetProcessId","IoThreadToProcess","PsGetCurrentProcessSessionId","ZwTerminateProcess","KeStackAttachProcess","KeUnstackDetachProcess","ZwOpenThread","PsProcessType","ExInterlockedInsertHeadList","ExInterlockedRemoveHeadList","CmRegisterCallback","CmUnRegisterCallback","RtlCreateRegistryKey","ZwOpenKey","ZwEnumerateKey","ZwQueryKey","ZwQueryValueKey","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","ProbeForWrite","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetProcessSectionBaseAddress","MmSystemRangeStart","KeBugCheckEx","PsLookupProcessByProcessId","ZwOpenProcess","PsGetCurrentProcessId","RtlUpcaseUnicodeString","RtlUpperString","ZwClose","ZwCreateFile","ObfDereferenceObject","ObReferenceObjectByHandle","ProbeForRead","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","RtlGetVersion","DbgPrint","RtlCopyUnicodeString","RtlInitUnicodeString","wcsstr","ZwQuerySystemInformation","strstr","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltReleaseContext","FltGetStreamHandleContext","FltSetStreamHandleContext","FltAllocateContext","FltCancelFileOpen","FltQueryInformationFile","FltReadFile","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltFreePoolAlignedWithTag","FltAllocatePoolAlignedWithTag","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltBuildDefaultSecurityDescriptor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign","ValidFrom":"2018-09-19 00:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"2370e9cfe2bef559ae94426fc44333aacd3f3ab96417f262064b48f140880617a1feabd15f3cc633f2f38edd1f1d3ecc1a6099820bacc7fc7e9a872aa57d0fa657eeac3b6a85d6debd4063f8ada6c888b012fcf641df0f09971e38ea539fbe05f43eead39f501276be098bc20b487d1e2e51f68d53d3ab1f401b8a8eed7dfb4f7956705f0cd38e1bb3a7700d372b9795abdae0126b1c40cec5c77eedc26258ec77ed7322c28af5864388adea136efdd8fe422fb97d5ead18ef9490ca3d27ab26949975c7cbd37bf7ca4cd3af5121925b847d2b9f153f74cb51e89e830e166f1be746ce23bdf9e4a28bd2396baa791c912ce261242d8e2a487090c41ec5e8e070","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"01ee5f169dff97352b6465d66a","Version":3,"TBS":{"MD5":"51c3959a45cecf3d21a3effb05762573","SHA1":"ecfcd25fd0525448a74875ba271566bc0bfbf061","SHA256":"de1da11668f0a8d5e13346ed3ab2755f5d25bebffcfd1d0bde5b9f87bc292c91","SHA384":"f0eab75baf1f24a53d63bd795cd07292a312f603513c8cb0f40fe5acbdb477ed72607d309fad21471a16f6223fb3a838"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4","ValidFrom":"2022-08-01 00:00:00","ValidTo":"2031-11-09 23:59:59","Signature":"70a0bf435c55e7385fa0a3741b3db616d7f7bf5707bd9aaca1872cec855ea91abb22f8871a695422eda488776dbd1a14f4134a7a2f2db738eff4ff80b9f8a1f7f272de24bc5203c84ed02adefa2d56cff9f4f7ac307a9a8bb25ed4cfd143449b4321eb9672a148b499cb9d4fa7060313772744d4e77fe859a8f0bf2f0ba6e9f2343cecf703c787a8d24c401935466a6954b0b8a1568eeca4d53de8b1dcfd1cd8f4775a5c548c6fefa1503dfc760968849f6fcadb208d35601c0203cb20b0ac58a00e4063c59822c1b259f5556bcf27ab6c76ce6f232df47e716a236b22ff12b8542d277ed83ad9f0b68796fd5bd15cac18c34d9f73b701a99f57aa5e28e2b994","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"0e9b188ef9d02de7efdb50e20840185a","Version":3,"TBS":{"MD5":"21a266bd49f2778b24d13d95641ea6ac","SHA1":"21319f341fdf06bf6a104427afa8b7823b1ea7f3","SHA256":"e933dc68ee65abd1f9b1aa6738eff60a6895d3d8cc4accf0c69069aa3decd757","SHA384":"11533efd6b326a4e065a936de300fe0586a479f93d569d2403bd62c7ad35f1b2199daee3adb510f429c4fc97b4b024e3"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Code Signing Root R45","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2029-03-18 00:00:00","Signature":"acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7803184245708a41cf6f01b8eeb4a954","Version":3,"TBS":{"MD5":"a33260428269bc902bc1cd280e4b1837","SHA1":"254209ca172cffcc67bd2a88996556d2f09538f0","SHA256":"a67411358594f2cf016741a63fd49f36de917f86531b3e3a43eb6a421c654868","SHA384":"fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA","ValidFrom":"2022-03-23 00:00:00","ValidTo":"2037-03-22 23:59:59","Signature":"7d598ec093b66f98a94422017e66d6d82142e1b0182e104d13cf3053cebf18fbc7505de24b29fb708a0daa2969fc69c1cf1d07e93e60c8d80be55c5bd76d87fa842025343167cdb612966fc4504c621d0c0882a816bda956cf15738d012225ce95693f4777fb727414d7ffab4f8a2c7aab85cd435fed60b6aa4f91669e2c9ee08aace5fd8cbc6426876c92bd9d7cd0700a7cefa8bc754fba5af7a910b25de9ff285489f0d58a717665daccf072a323fac0278244ae99271bab241e26c1b7de2aebf69eb1799981a35686ab0a45c9dfc48da0e798fbfba69d72afc4c7c1c16a71d9c6138009c4b69fcd878724bb4fa349b9776691f1729ce94b0252a7377e9353ac3b1d08490f94cd397addff256399272c3d3f6ba7f166c341cd4fb6409b212140d0b71324cddc1d783ae49eade5347192d7266be43873aba6014fbd3f3b78ad4cadfbc4957bed0a5f33398741787a38e99ce1dd23fd1d28d3c7f9e8f1985ffb2bd87ef2469d752c1e272c26db6f157b1e198b36b893d4e6f2179959ca70f037bf9800df20164f27fb606716a166badd55c03a2986b098a02bed9541b73ad5159831b462090f0abd81d913febfa4d1f357d9bc04fa82de32df0489f000cd5dc2f9d0237f000be4760226d9f0657642a6298709472be67f1aa4850ffc9896f655542b1f80fac0f20e2be5d6fba92f44154ae7130e1ddb37381aa12bf6edd67cfc","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"073637b724547cd847acfd28662a5e5b","Version":3,"TBS":{"MD5":"e4b8ad9932ff9205f580cf8fb2afbb86","SHA1":"5301f7044d78bf94dd2b6e4871083a17fdba1dcc","SHA256":"c3d01499a5d1d2f71e0f44e78fbfa4b8aadb43dd4f226401e0c1d7a6d53357fa","SHA384":"84b5f399da5a4f4387269adfd951ef7d2197c29552ed2d2e449060664c3825d6bdb2acc3e563d999e54652f7384f445e"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2023","ValidFrom":"2023-07-14 00:00:00","ValidTo":"2034-10-13 23:59:59","Signature":"811ad6dea0a9b59817bc708d4f8a3c689cd825ffcb2ce4cdea5d2292ec8c2202a9b8cf80a8d9e7e3c5ed26828a712f18dd4eb6de6cd7e1609c2beded3d488eb86bba7c5dbdc26137684977a3eb90aa12d72785f38e1e92dac240389f5dc8a02e2578259d2a057a842998b657798fdb26562bb0f3a7bd370cd898764f56b952c2b69d38a981e76d415c8c69d1b92bc4c67bcf9cfa78e2931a76a26975d350e44412be200d9ea944d0f8e54977085a21c5b4cf98951a54bab9bcc16919bacf16f28337346eb04126ddde5a974f338dd48d777d7545a1a558266a0345ded950b5508caf56bd4cc5e146c528d3ade7430070decc989e198903ead49137ef4d52f3c96021c45647edda114b8c32c388e658e2b6db3ef95fb042d68fe31791d1aac055e386bfac272c41d09a334aa836d4b972967e977938485fcac2dc3d32df75d636675a89f8f6a7c7e54f353c00bdbe9c2a6c7901dcda44e63ade383b075e3958f47c733155a08011cb140c7eaebcfea4eb7965aa68d622ca3beb9a8235572816cb69f2329ab2d2d83ab8b146866bba17fdc4776c156caeabaf733ae84946b7d57fccb638c0d8ec1cf5b6a1b8432cdf4e4c7d1e6870c0770ad402e05c60bb28ff38e5525ad6ac1722234ef4ecd317fb506bff07771f71974441c9b846d36c327c582f674765e51b73b699f96b2c0646ef411ef0f05fe0dbd9ad908044af8010418a","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0544aff3949d0839a6bfdb3f5fe56116","Version":3,"TBS":{"MD5":"7630cbd02cc6732394e9fdfe99d0d8f8","SHA1":"bc1890d694f9d392c4cbae6a174e35d70e7ec8b1","SHA256":"594a02de632b3a08ed6644c36994025e57f35bc8e7bd16cec5d347883390d1d8","SHA384":"31d9fb75262762d17046f31e5c54509f58a295d505e411019544000b64f607b44b3346b708fa50d48f199dba56f0c0b1"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2030-07-28 00:00:00","Signature":"2575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"77bd0e05b7590bb61d4761531e3f75ed","Version":3,"TBS":{"MD5":"65fd1dac1f115d9507f4e1840c8cb36a","SHA1":"c7cf5607e19b22fe60c055e71d9b555d70f71f66","SHA256":"d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe","SHA384":"defe810317bd1215b4d1ee0ec8a5fb38b21d094ef1173cae670956cd899232638e4f9473fd947bd550a4a77300bbb2ab"}},{"Subject":"??=Private Organization, serialNumber=91440300MA5FD6WK46, ??=CN, ??=Guangdong, ??=Shenzhen, C=CN, ST=Guangdong, L=Shenzhen, O=CleverSoar Electronic Technology Co., Ltd., CN=CleverSoar Electronic Technology Co., Ltd.","ValidFrom":"2023-07-24 08:30:28","ValidTo":"2024-07-24 08:30:28","Signature":"81e71777c185f29a3d776650ad84c90e6419af36c0041dbf22561902437ea07c17adddd61992777afa3afa1868cd90b5c1b1a0539c8a23f03134ee0fbd128497f1dbcf42ba3bc2108c013dbdadbb8b8b4f8e1da4d38f6467a237726090c32399514c87099fe5e143462081dda34a986817de71808ac8b682ca973731156648fd38f20d8c5f3b3bff004098d1e0633bced928b8b708ea94104a227f2591794c12f82b45141bba1333f7f12c5c7e84be6b1773cda0745ef788d54af51e1639c2b00cd6986e4bb32840ff5925fa1e1deecdda8287d47b9ce51afa81baa5d62dfc07fbf8c96ae842a6cf299b0182a11eca956e6506deb18e48b3a0f635b1dc352b4a238aa01fe9d0b3a79b6596b572331e22dbbc734a745761d7d38889ad03690f8ac7531dc09ba0bdcb525af1ba58165c436c1005330f7cc3b44e1ede21e736e767bc2939d1acd00487bb5175ab2ad3d77d0b9ba75d472ed672b02f90c49dc453925f22265e66cd5ff872e80d554c016efb6377dcf61bf0eb04c0f0b697278f9c1e8c10f601e36ca9fd3b2dbfab74f66df00488995217394ee05c9b8b2af03a00589b7add6d10a341e36abf81898576cc6856ecd4443d2fa8bcdd5a4d79812d5a95ae19e69de79d6280eff57738c42f4ca318086ae54c3e47aeb0691b17bee017cfd272efd2d3a5efb6a7476b5fb1986ec1d5254741c683318a63affaf1ec2c0497","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"5b3b40442fc61bf39d4ad414","Version":3,"TBS":{"MD5":"69e097228223b745d14e726062ecbd27","SHA1":"aebee16d3f77ca075ede3e4896b6e46e2a9274f0","SHA256":"d54dc9cdcee1f196c17901082956b7be8d78bdd2cd91e72fbda164e4909341df","SHA384":"4749e6d5bc7cdb0ef47528b6bb927f9738f98b7cc2f14ede3424d601d6ec635b030ef97a278fe874dc65ceeb5ee83f18"}}],"Signer":[{"SerialNumber":"5b3b40442fc61bf39d4ad414","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","Version":1}]}]}]}