{"Id":"1a0fab94-f4a7-48c2-a2f4-72d19c382642","Tags":["PGPwded.sys","eedDiskEncryptionDriver.sys","Symantec Encryption Desktop","Symantec Endpoint Encryption"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-08-31","MitreID":"T1068","CVE":["CVE-2019-9702","CVE-2019-9703"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create PGPwded type= kernel binPath= C:\\\\windows\\\\temp\\\\PGPwded.sys && sc.exe start PGPwded","Description":"PGPwded.sys and eedDiskEncryptionDriver.sys are Symantec drive-encryption filters affected by CVE-2019-9702 and CVE-2019-9703. Symantec Endpoint Encryption releases before 11.3.0 and all Symantec Encryption Desktop releases are affected. The tracked filters expose raw-sector read and write controls. In the 11.1.1 eedDiskEncryptionDriver build, any-access IOCTLs 0x8002206C and 0x80022070 select a tracked volume and read or write sectors; its protected-range logic still permits writes beginning in sectors 0 through 2, leaving boot-sector modification possible.","Usecase":"Elevate privileges","Privileges":"User","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/0/0/symsa1485","https://nvd.nist.gov/vuln/detail/CVE-2019-9702","https://nvd.nist.gov/vuln/detail/CVE-2019-9703","https://github.com/DavidCarliez/CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC"],"Detection":[],"Acknowledgement":{"Person":"Kyriakos Economou, fluffycats31","Handle":"@kyREcon, @fluffycats31"},"KnownVulnerableSamples":[{"Filename":"PGPwded.sys","SHA256":"02579d833200abb641e476468bafd1f07d448f3d232f70cc34e2adad402b5c75","MD5":"cf433fa0463e9fba56102bc1436ef7f3","SHA1":"48f0e0856707e7cb82fd4e962dcac02a8625d8e0","Imphash":"a4359099176fcbc68e8bf3089cb9a264","Authentihash":{"MD5":"000df31531ddeff7cf6371a275488c13","SHA1":"8d0ec5ca2af79cbb5883830fe1906dbf81d150f6","SHA256":"23354a3a8bcc7d51afca16590c18d158f5eddc41379284d4ac373a76029efcab"},"RichPEHeaderHash":{"MD5":"ef617c4b4467cdcb5439d95de9c05868","SHA1":"868fbb2829b7e96d37df317eb08c75bc405e24e8","SHA256":"bef207ec5001c4dfc87c6da4f458bd7974cadb9aa1638fe87bbc3b4f24b36626"},"Sections":{".text":{"Entropy":6.318597491598212,"Virtual Size":"0x60b1"},"LOCKCODE":{"Entropy":6.421346950642412,"Virtual Size":"0x2ea4a"},".rdata":{"Entropy":5.468104622841902,"Virtual Size":"0x8794"},".data":{"Entropy":5.7066011936859145,"Virtual Size":"0x77c0"},".pdata":{"Entropy":5.4514229447027995,"Virtual Size":"0x2820"},"LOCKDATA":{"Entropy":4.584195516774655,"Virtual Size":"0x588"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},"INIT":{"Entropy":5.323100672104341,"Virtual Size":"0x1044"},".rsrc":{"Entropy":3.4196828992330603,"Virtual Size":"0x480"},".reloc":{"Entropy":5.224836911440139,"Virtual Size":"0x558"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-03-27 10:52:51","Description":"PGPwde NT/Win2k driver","Company":"CA, Inc., a Broadcom subsidiary","InternalName":"PGPwded","OriginalFilename":"PGPwded.sys","FileVersion":"11.0.1 (Build 640)","Product":"Symantec Encryption Desktop","ProductVersion":"11.0.1 (Build 640)","Copyright":"Copyright (C) 2025 Broadcom. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["NtFsControlFile","DbgPrint","RtlInitializeBitMap","RtlClearBits","RtlSetBits","RtlAreBitsClear","RtlAreBitsSet","RtlInitUnicodeString","RtlEqualUnicodeString","KeEnterCriticalRegion","KeLeaveCriticalRegion","MmBuildMdlForNonPagedPool","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","PsSetLoadImageNotifyRoutine","NtBuildNumber","KeInitializeEvent","KeWaitForSingleObject","ExInterlockedInsertTailList","ExInterlockedRemoveHeadList","IoBuildDeviceIoControlRequest","IofCallDriver","IoGetDeviceObjectPointer","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExInitializeNPagedLookasideList","KeInitializeDpc","KeInitializeTimer","KeCancelTimer","KeSetTimer","ExAllocatePoolWithTag","ExFreePoolWithTag","ExQueueWorkItem","ExCreateCallback","ExRegisterCallback","ObfDereferenceObject","ZwPowerInformation","RtlInitAnsiString","RtlDeleteRegistryValue","RtlCompareUnicodeString","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlGetVersion","KeSetEvent","ExAllocatePool","MmGetSystemRoutineAddress","ObReferenceObjectByHandle","ObfReferenceObject","ZwClose","ZwCreateKey","ZwOpenKey","ZwDeleteValueKey","ZwQueryValueKey","ZwSetValueKey","PsGetCurrentProcessId","ObOpenObjectByPointer","ObQueryNameString","IoGetDeviceProperty","KeClearEvent","KeResetEvent","IoInitializeRemoveLockEx","InitSafeBootMode","_purecall","IoBuildSynchronousFsdRequest","KeReleaseSemaphore","MmMapIoSpace","MmUnmapIoSpace","PsGetVersion","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoGetCurrentProcess","IoRegisterShutdownNotification","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","ZwDeviceIoControlFile","NtCreateFile","ZwCreateEvent","ExEventObjectType","MmMapLockedPagesSpecifyCache","KeInitializeSemaphore","ExAcquireFastMutex","ExReleaseFastMutex","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","PsCreateSystemThread","wcsstr","_wcsicmp","ZwCreateFile","ZwReadFile","ZwWriteFile","ZwQueryVolumeInformationFile","NtQueryInformationFile","NtSetInformationFile","NtClose","ZwDeleteFile","MmUnlockPages","MmUnmapLockedPages","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","ObReferenceObjectByPointer","PsThreadType","ObOpenObjectByName","ExSemaphoreObjectType","IoAttachDeviceToDeviceStack","IoDetachDevice","IoAcquireRemoveLockEx","IoReleaseRemoveLockEx","IoReleaseRemoveLockAndWaitEx","PoCallDriver","PoStartNextPowerIrp","VerSetConditionMask","RtlVerifyVersionInfo","tolower","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","_strnicmp","wcschr","RtlCheckRegistryKey","ZwOpenFile","_vsnwprintf","IoAllocateIrp","ZwDeleteKey","ZwEnumerateKey","ZwEnumerateValueKey","RtlFreeUnicodeString","RtlUpcaseUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc","ValidFrom":"2023-03-20 00:00:00","ValidTo":"2026-03-19 23:59:59","Signature":"c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"090c3aaa41901d6ad321fddea91e1366","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c5a9b13894baa951ef81c2b092800154","SHA1":"fcd2e70f37161140c551364aeda08fd0460212f2","SHA256":"2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e","SHA384":"e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"}}],"Signer":[{"SerialNumber":"090c3aaa41901d6ad321fddea91e1366","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"PGPwded.sys","SHA256":"2bb84d2b3af3d9ee0f2dbcdfe3574a5c576bc2c7dd2a5b3dbcb7784fbc9efec6","MD5":"555705000dd726b10432d3bcf9e36c54","SHA1":"72602fe173a375988b5c3d3a1bbb956fd8fe1f08","Imphash":"e676b7c75a8af537e52df8305bcb16c7","Authentihash":{"MD5":"cda325bb8b11396d637794e11c74f0d0","SHA1":"212d7c603c470f1a5c89bd66c774b01fa81f292c","SHA256":"7a0a29159ad02be390afc0759c8ab257d4fb32e156c0507503d32575e558c8fa"},"RichPEHeaderHash":{"MD5":"c6a47747861b9d17dd0f5ce99bf01315","SHA1":"a4d2e0d68d73799265b59637e5d745c890cad213","SHA256":"3b25275de17737bddf86cc532e0d40fd169a3c6f981ba24d3bf1078f07dcc3c1"},"Sections":{".text":{"Entropy":6.312375576894129,"Virtual Size":"0x8a37"},"LOCKCODE":{"Entropy":6.324790023319622,"Virtual Size":"0x3e33c"},"INIT":{"Entropy":4.865099454907139,"Virtual Size":"0x60"},".rdata":{"Entropy":5.474678542837479,"Virtual Size":"0xef44"},".data":{"Entropy":5.702251620819978,"Virtual Size":"0x77c0"},".pdata":{"Entropy":5.728438643736356,"Virtual Size":"0x50f4"},"LOCKDATA":{"Entropy":4.6450204867024585,"Virtual Size":"0x568"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},".rsrc":{"Entropy":4.165867207264706,"Virtual Size":"0x620"},".reloc":{"Entropy":3.927323486990769,"Virtual Size":"0x916"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-12-21 07:50:24","Description":"PGPwde NT/Win2k driver","Company":"CA, Inc., a Broadcom subsidiary","InternalName":"PGPwded","OriginalFilename":"PGPwded.sys","FileVersion":"10.5.0 (Build 1393)","Product":"Symantec Encryption Desktop","ProductVersion":"10.5.0 (Build 1393)","Copyright":"Copyright (C) 2020 Broadcom. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeLeaveCriticalRegion","KeEnterCriticalRegion","RtlEqualUnicodeString","RtlInitUnicodeString","NtBuildNumber","DbgPrint","MmBuildMdlForNonPagedPool","MmFreeContiguousMemory","IoAllocateMdl","MmAllocateContiguousMemory","PsSetLoadImageNotifyRoutine","KeWaitForSingleObject","IofCallDriver","IoBuildDeviceIoControlRequest","KeInitializeEvent","ExInterlockedRemoveHeadList","IoFreeWorkItem","IoGetDeviceObjectPointer","IoQueueWorkItem","IoAllocateWorkItem","ExInterlockedInsertTailList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExQueryDepthSList","ExDeleteNPagedLookasideList","ExInitializeNPagedLookasideList","ZwPowerInformation","ExUnregisterCallback","ExFreePoolWithTag","KeSetTimer","KeCancelTimer","ExQueueWorkItem","ExAllocatePoolWithTag","ObfDereferenceObject","ExRegisterCallback","ExCreateCallback","KeInitializeDpc","KeInitializeTimer","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlCompareUnicodeString","ZwOpenKey","ZwClose","ZwDeleteValueKey","ZwCreateKey","ZwSetValueKey","ZwQueryValueKey","ObReferenceObjectByHandle","KeSetEvent","ObOpenObjectByPointer","RtlGetVersion","RtlInitAnsiString","RtlDeleteRegistryValue","MmGetSystemRoutineAddress","PsGetCurrentProcessId","ObQueryNameString","ObfReferenceObject","KeDelayExecutionThread","IoGetDeviceProperty","IoInitializeRemoveLockEx","InitSafeBootMode","KeClearEvent","KeResetEvent","_purecall","IoBuildSynchronousFsdRequest","MmUnmapIoSpace","MmMapIoSpace","IoRegisterShutdownNotification","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","IoDeleteSymbolicLink","ExEventObjectType","ZwCreateEvent","ZwDeviceIoControlFile","NtCreateFile","KeReleaseSemaphore","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","PsGetVersion","IoGetCurrentProcess","PsCreateSystemThread","IofCompleteRequest","MmMapLockedPagesSpecifyCache","PsTerminateSystemThread","ExAcquireFastMutex","ExReleaseFastMutex","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeSemaphore","ExInitializeResourceLite","ExDeleteResourceLite","ExAcquireResourceSharedLite","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ObReferenceObjectByPointer","PsThreadType","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","MmUnlockPages","MmUnmapLockedPages","KeReadStateSemaphore","ExSemaphoreObjectType","ObInsertObject","ObCreateObject","ObOpenObjectByName","PoStartNextPowerIrp","PoCallDriver","IoAttachDeviceToDeviceStack","IoReleaseRemoveLockEx","IoDetachDevice","IoReleaseRemoveLockAndWaitEx","IoAcquireRemoveLockEx","RtlVerifyVersionInfo","VerSetConditionMask","KeQueryActiveProcessors","NtFsControlFile","RtlInitializeBitMap","RtlSetBits","RtlAreBitsClear","RtlClearBits","RtlAreBitsSet","_wcsicmp","ZwQueryVolumeInformationFile","tolower","NtQueryInformationFile","ZwReadFile","ZwCreateFile","wcsstr","ZwWriteFile","NtSetInformationFile","ZwDeleteFile","NtClose","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","_strnicmp","_vsnwprintf","RtlCheckRegistryKey","ZwOpenFile","wcschr","ZwEnumerateValueKey","ZwEnumerateKey","ZwDeleteKey","IoAllocateIrp","RtlFreeUnicodeString","RtlUpcaseUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=California, L=San Jose, O=Broadcom Inc, OU=SED, CN=Broadcom Inc","ValidFrom":"2020-04-28 00:00:00","ValidTo":"2023-04-29 23:59:59","Signature":"60ca4759f2eedd44d05c8a6193ee5a6c9aca971799bb4dccca2b7ab3bb902840b2b736d7d7986d8399c38fbc2be807afc9909006d369a1655acd6d9bd382541efe603ae0e4e37bbff1ebb613ca51d70417e27ced8a00752287345b68be75bcea31dc46d061a4f51d3ae593de1084057358880b4ef7a4e3fc8a2ff8bfc2ebacbfc70dd61db1baae141e82e34353aaafeaf82588016455b0a4e74ce17df499063ce09acd628362b8d502ea75e004244f5219b6ab504782a779de5a82ef2c309d55c3da675bb2225eb4883a6eeedb77a65d6165d0ebb92cd16c1981d3cb978b56057e78e2cb21292268bbe48cde423f77b83c3d6d80d6bebacd947c4a7f50dee112","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7b46246b3b56ee913595ac77d43f7239","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"253489f34f86f42e16b9ce03c1b9a65f","SHA1":"546abee7c949014efb7f8bb005d4219c62f6cc95","SHA256":"b16f9608f6e5d9137363713a045b43c00912464a201fa01bf2ef1d0ddc4dcd32","SHA384":"bb7a0cf295c4fcf531b9c9a38a35d18a2a5c931f43ebe57d7f90083479676faba9c9b4402627e3a08fe7135b67b69f8f"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7b46246b3b56ee913595ac77d43f7239","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}]},{"Filename":"PGPwded.sys","SHA256":"5247d4ab237e8fc486ce95d018bd92074b2a8cf1af351cd699a5b4a9355c7071","MD5":"99e8631183314b2bd136de34c02c7b09","SHA1":"1c13bc569c84a0616fad95bc65d63216e1169523","Imphash":"e676b7c75a8af537e52df8305bcb16c7","Authentihash":{"MD5":"7b12d85f3f90d4c593ceccbf500ff1dd","SHA1":"f6eddbb0c70c3f703720e5af99ec163afd9cc209","SHA256":"ba28cd5ddcd1cc4e5a0683f042600bd11f7023ccb31f060fcfcf8de7564d8ca3"},"RichPEHeaderHash":{"MD5":"34193e2139c7ca2f344e7723a09688bd","SHA1":"860a8ed1bb194edb967fafd94b1c6bffb91933b6","SHA256":"1db723d1dccfaa989daa13301c446dbf0e4c74e87b5bc455e9cedd91b3270441"},"Sections":{".text":{"Entropy":6.312012682456339,"Virtual Size":"0x8a37"},"LOCKCODE":{"Entropy":6.327213102883892,"Virtual Size":"0x3e28c"},"INIT":{"Entropy":4.865099454907139,"Virtual Size":"0x60"},".rdata":{"Entropy":5.471307520234824,"Virtual Size":"0xef84"},".data":{"Entropy":5.703522071433322,"Virtual Size":"0x77c0"},".pdata":{"Entropy":5.724700372546925,"Virtual Size":"0x50e8"},"LOCKDATA":{"Entropy":4.636393579097383,"Virtual Size":"0x568"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},".rsrc":{"Entropy":4.14644650793195,"Virtual Size":"0x620"},".reloc":{"Entropy":3.9138570925644647,"Virtual Size":"0x916"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-12-21 03:29:18","Description":"PGPwde NT/Win2k driver","Company":"Symantec Corporation","InternalName":"PGPwded","OriginalFilename":"PGPwded.sys","FileVersion":"10.4.2 (Build 463)","Product":"Symantec Encryption Desktop","ProductVersion":"10.4.2 (Build 463)","Copyright":"Copyright (C) 2018 Symantec Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeLeaveCriticalRegion","KeEnterCriticalRegion","RtlEqualUnicodeString","RtlInitUnicodeString","NtBuildNumber","DbgPrint","MmBuildMdlForNonPagedPool","MmFreeContiguousMemory","IoAllocateMdl","MmAllocateContiguousMemory","PsSetLoadImageNotifyRoutine","KeWaitForSingleObject","IofCallDriver","IoBuildDeviceIoControlRequest","KeInitializeEvent","ExInterlockedRemoveHeadList","IoFreeWorkItem","IoGetDeviceObjectPointer","IoQueueWorkItem","IoAllocateWorkItem","ExInterlockedInsertTailList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExQueryDepthSList","ExDeleteNPagedLookasideList","ExInitializeNPagedLookasideList","ZwPowerInformation","ExUnregisterCallback","ExFreePoolWithTag","KeSetTimer","KeCancelTimer","ExQueueWorkItem","ExAllocatePoolWithTag","ObfDereferenceObject","ExRegisterCallback","ExCreateCallback","KeInitializeDpc","KeInitializeTimer","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlCompareUnicodeString","ZwOpenKey","ZwClose","ZwDeleteValueKey","ZwCreateKey","ZwSetValueKey","ZwQueryValueKey","ObReferenceObjectByHandle","KeSetEvent","ObOpenObjectByPointer","RtlGetVersion","RtlInitAnsiString","RtlDeleteRegistryValue","MmGetSystemRoutineAddress","PsGetCurrentProcessId","ObQueryNameString","ObfReferenceObject","KeDelayExecutionThread","IoGetDeviceProperty","IoInitializeRemoveLockEx","InitSafeBootMode","KeClearEvent","KeResetEvent","_purecall","IoBuildSynchronousFsdRequest","MmUnmapIoSpace","MmMapIoSpace","IoRegisterShutdownNotification","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","IoDeleteSymbolicLink","ExEventObjectType","ZwCreateEvent","ZwDeviceIoControlFile","NtCreateFile","KeReleaseSemaphore","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","PsGetVersion","IoGetCurrentProcess","PsCreateSystemThread","IofCompleteRequest","MmMapLockedPagesSpecifyCache","PsTerminateSystemThread","ExAcquireFastMutex","ExReleaseFastMutex","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeSemaphore","ExInitializeResourceLite","ExDeleteResourceLite","ExAcquireResourceSharedLite","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ObReferenceObjectByPointer","PsThreadType","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","MmUnlockPages","MmUnmapLockedPages","KeReadStateSemaphore","ExSemaphoreObjectType","ObInsertObject","ObCreateObject","ObOpenObjectByName","PoStartNextPowerIrp","PoCallDriver","IoAttachDeviceToDeviceStack","IoReleaseRemoveLockEx","IoDetachDevice","IoReleaseRemoveLockAndWaitEx","IoAcquireRemoveLockEx","RtlVerifyVersionInfo","VerSetConditionMask","KeQueryActiveProcessors","NtFsControlFile","RtlInitializeBitMap","RtlSetBits","RtlAreBitsClear","RtlClearBits","RtlAreBitsSet","_wcsicmp","ZwQueryVolumeInformationFile","tolower","NtQueryInformationFile","ZwReadFile","ZwCreateFile","wcsstr","ZwWriteFile","NtSetInformationFile","ZwDeleteFile","NtClose","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","_strnicmp","_vsnwprintf","RtlCheckRegistryKey","ZwOpenFile","wcschr","ZwEnumerateValueKey","ZwEnumerateKey","ZwDeleteKey","IoAllocateIrp","RtlFreeUnicodeString","RtlUpcaseUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation","ValidFrom":"2017-11-06 00:00:00","ValidTo":"2019-01-07 23:59:59","Signature":"5acdc3eaa19eade70b40820009a656b92f556f97b05efc88cbf77e727fe5dfb9482cb1fe09b2ce81b5f35fca4a01bbd27436d2dd875968dfe764df0e5e8ba647d9788b2593ea5c61d0211c776568cc1a7bcbde4800fd9e05e16049edaa218c1d5db5e55ff4746ffdbe03c0f245c515e990cd65ec4b022f02f3075995c1afb584eba9ed74b28590819e8df515f3e7be4f87888d85e861d89be0e459259c00d3aaef420ecdcb2670a261d858ac639a07c47d4ba0891bfafd83f2fa2c112f77dcda1dc193f405b9ec1262e6b336998e18d28b8313f43ca0951d20ad422f3c594b79b9a9c27f8ea2594876b8c9d34843351cc6c6d7061ef663c45588d0f8ef96fe1d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"14baa0a5163f9626e487698c694a601c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b425014bae4d5988cedaae5d11f3e437","SHA1":"5be6aed597874b88e9ba5c5b97a634d208c7ac9f","SHA256":"65c7117461ee4aca3f4054db5654866449498f460a24e801268aac7f7128b567","SHA384":"d91c281c6ad8b8882001421846f5f29a7da3ef9292ff9cc4e3f6831ab809728392a659b291e09f2039e7254d78b0d1e6"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"14baa0a5163f9626e487698c694a601c","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"PGPwded.sys","SHA256":"6dd193dd6d60f08482a85e23d3c434f540fd38488281aea0f87ec5e9a1a8e4d9","MD5":"e7bc75d787e88ca7b6b3797ea8c4f376","SHA1":"33caf07739768023bf156cde226bd4d0ec85e864","Imphash":"e676b7c75a8af537e52df8305bcb16c7","Authentihash":{"MD5":"fe33dac8f6a616d62abf8f4103eacba9","SHA1":"4cec00b8168755893b8f08973aab477183706601","SHA256":"7a62b0aef4ffa0e0e20f02260d37bf507f5b5c04619ae880146ef4dbb3044a96"},"RichPEHeaderHash":{"MD5":"34193e2139c7ca2f344e7723a09688bd","SHA1":"860a8ed1bb194edb967fafd94b1c6bffb91933b6","SHA256":"1db723d1dccfaa989daa13301c446dbf0e4c74e87b5bc455e9cedd91b3270441"},"Sections":{".text":{"Entropy":6.312012682456339,"Virtual Size":"0x8a37"},"LOCKCODE":{"Entropy":6.327213102883892,"Virtual Size":"0x3e28c"},"INIT":{"Entropy":4.865099454907139,"Virtual Size":"0x60"},".rdata":{"Entropy":5.471268759164959,"Virtual Size":"0xef84"},".data":{"Entropy":5.703522071433322,"Virtual Size":"0x77c0"},".pdata":{"Entropy":5.724700372546925,"Virtual Size":"0x50e8"},"LOCKDATA":{"Entropy":4.636393579097383,"Virtual Size":"0x568"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},".rsrc":{"Entropy":4.142593291107993,"Virtual Size":"0x620"},".reloc":{"Entropy":3.9138570925644647,"Virtual Size":"0x916"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-07-16 00:47:12","Description":"PGPwde NT/Win2k driver","Company":"Symantec Corporation","InternalName":"PGPwded","OriginalFilename":"PGPwded.sys","FileVersion":"10.4.2 (Build 317)","Product":"Symantec Encryption Desktop","ProductVersion":"10.4.2 (Build 317)","Copyright":"Copyright (C) 2018 Symantec Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeLeaveCriticalRegion","KeEnterCriticalRegion","RtlEqualUnicodeString","RtlInitUnicodeString","NtBuildNumber","DbgPrint","MmBuildMdlForNonPagedPool","MmFreeContiguousMemory","IoAllocateMdl","MmAllocateContiguousMemory","PsSetLoadImageNotifyRoutine","KeWaitForSingleObject","IofCallDriver","IoBuildDeviceIoControlRequest","KeInitializeEvent","ExInterlockedRemoveHeadList","IoFreeWorkItem","IoGetDeviceObjectPointer","IoQueueWorkItem","IoAllocateWorkItem","ExInterlockedInsertTailList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExQueryDepthSList","ExDeleteNPagedLookasideList","ExInitializeNPagedLookasideList","ZwPowerInformation","ExUnregisterCallback","ExFreePoolWithTag","KeSetTimer","KeCancelTimer","ExQueueWorkItem","ExAllocatePoolWithTag","ObfDereferenceObject","ExRegisterCallback","ExCreateCallback","KeInitializeDpc","KeInitializeTimer","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlCompareUnicodeString","ZwOpenKey","ZwClose","ZwDeleteValueKey","ZwCreateKey","ZwSetValueKey","ZwQueryValueKey","ObReferenceObjectByHandle","KeSetEvent","ObOpenObjectByPointer","RtlGetVersion","RtlInitAnsiString","RtlDeleteRegistryValue","MmGetSystemRoutineAddress","PsGetCurrentProcessId","ObQueryNameString","ObfReferenceObject","KeDelayExecutionThread","IoGetDeviceProperty","IoInitializeRemoveLockEx","InitSafeBootMode","KeClearEvent","KeResetEvent","_purecall","IoBuildSynchronousFsdRequest","MmUnmapIoSpace","MmMapIoSpace","IoRegisterShutdownNotification","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","IoDeleteSymbolicLink","ExEventObjectType","ZwCreateEvent","ZwDeviceIoControlFile","NtCreateFile","KeReleaseSemaphore","ZwQuerySymbolicLinkObject","ZwOpenSymbolicLinkObject","PsGetVersion","IoGetCurrentProcess","PsCreateSystemThread","IofCompleteRequest","MmMapLockedPagesSpecifyCache","PsTerminateSystemThread","ExAcquireFastMutex","ExReleaseFastMutex","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeSemaphore","ExInitializeResourceLite","ExDeleteResourceLite","ExAcquireResourceSharedLite","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ObReferenceObjectByPointer","PsThreadType","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","MmUnlockPages","MmUnmapLockedPages","KeReadStateSemaphore","ExSemaphoreObjectType","ObInsertObject","ObCreateObject","ObOpenObjectByName","PoStartNextPowerIrp","PoCallDriver","IoAttachDeviceToDeviceStack","IoReleaseRemoveLockEx","IoDetachDevice","IoReleaseRemoveLockAndWaitEx","IoAcquireRemoveLockEx","RtlVerifyVersionInfo","VerSetConditionMask","KeQueryActiveProcessors","NtFsControlFile","RtlInitializeBitMap","RtlSetBits","RtlAreBitsClear","RtlClearBits","RtlAreBitsSet","_wcsicmp","ZwQueryVolumeInformationFile","tolower","NtQueryInformationFile","ZwReadFile","ZwCreateFile","wcsstr","ZwWriteFile","NtSetInformationFile","ZwDeleteFile","NtClose","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","_strnicmp","_vsnwprintf","RtlCheckRegistryKey","ZwOpenFile","wcschr","ZwEnumerateValueKey","ZwEnumerateKey","ZwDeleteKey","IoAllocateIrp","RtlFreeUnicodeString","RtlUpcaseUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation","ValidFrom":"2017-11-06 00:00:00","ValidTo":"2019-01-07 23:59:59","Signature":"5acdc3eaa19eade70b40820009a656b92f556f97b05efc88cbf77e727fe5dfb9482cb1fe09b2ce81b5f35fca4a01bbd27436d2dd875968dfe764df0e5e8ba647d9788b2593ea5c61d0211c776568cc1a7bcbde4800fd9e05e16049edaa218c1d5db5e55ff4746ffdbe03c0f245c515e990cd65ec4b022f02f3075995c1afb584eba9ed74b28590819e8df515f3e7be4f87888d85e861d89be0e459259c00d3aaef420ecdcb2670a261d858ac639a07c47d4ba0891bfafd83f2fa2c112f77dcda1dc193f405b9ec1262e6b336998e18d28b8313f43ca0951d20ad422f3c594b79b9a9c27f8ea2594876b8c9d34843351cc6c6d7061ef663c45588d0f8ef96fe1d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"14baa0a5163f9626e487698c694a601c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b425014bae4d5988cedaae5d11f3e437","SHA1":"5be6aed597874b88e9ba5c5b97a634d208c7ac9f","SHA256":"65c7117461ee4aca3f4054db5654866449498f460a24e801268aac7f7128b567","SHA384":"d91c281c6ad8b8882001421846f5f29a7da3ef9292ff9cc4e3f6831ab809728392a659b291e09f2039e7254d78b0d1e6"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"14baa0a5163f9626e487698c694a601c","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"PGPwded.sys","SHA256":"90c7fe509129a8095319c3d4ce7e867f503321a1d41d23b674dcf2adfd7424fa","MD5":"ef4d6fa6679fc8dfa9d223408124c884","SHA1":"8148913cb9a748b8d9d1ad5863e8075ceee6f10f","Imphash":"a4359099176fcbc68e8bf3089cb9a264","Authentihash":{"MD5":"d92486c7ae23002234964b8b403a69e6","SHA1":"ac40ff2c75649245653fe1230d6056371b040de4","SHA256":"01447fccc18760cdbe70f3eb020d5944d56926bcd16da2cc3a07236e87e89a9f"},"RichPEHeaderHash":{"MD5":"ef617c4b4467cdcb5439d95de9c05868","SHA1":"868fbb2829b7e96d37df317eb08c75bc405e24e8","SHA256":"bef207ec5001c4dfc87c6da4f458bd7974cadb9aa1638fe87bbc3b4f24b36626"},"Sections":{".text":{"Entropy":6.318597491598212,"Virtual Size":"0x60b1"},"LOCKCODE":{"Entropy":6.421346950642412,"Virtual Size":"0x2ea4a"},".rdata":{"Entropy":5.467881892201344,"Virtual Size":"0x8794"},".data":{"Entropy":5.7066011936859145,"Virtual Size":"0x77c0"},".pdata":{"Entropy":5.4514229447027995,"Virtual Size":"0x2820"},"LOCKDATA":{"Entropy":4.584195516774655,"Virtual Size":"0x588"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},"INIT":{"Entropy":5.323100672104341,"Virtual Size":"0x1044"},".rsrc":{"Entropy":3.417663555487869,"Virtual Size":"0x480"},".reloc":{"Entropy":5.224836911440139,"Virtual Size":"0x558"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-02-07 15:41:42","Description":"PGPwde NT/Win2k driver","Company":"CA, Inc., a Broadcom subsidiary","InternalName":"PGPwded","OriginalFilename":"PGPwded.sys","FileVersion":"11.0.0 (Build 976)","Product":"Symantec Encryption Desktop","ProductVersion":"11.0.0 (Build 976)","Copyright":"Copyright (C) 2024 Broadcom. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["NtFsControlFile","DbgPrint","RtlInitializeBitMap","RtlClearBits","RtlSetBits","RtlAreBitsClear","RtlAreBitsSet","RtlInitUnicodeString","RtlEqualUnicodeString","KeEnterCriticalRegion","KeLeaveCriticalRegion","MmBuildMdlForNonPagedPool","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","PsSetLoadImageNotifyRoutine","NtBuildNumber","KeInitializeEvent","KeWaitForSingleObject","ExInterlockedInsertTailList","ExInterlockedRemoveHeadList","IoBuildDeviceIoControlRequest","IofCallDriver","IoGetDeviceObjectPointer","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExInitializeNPagedLookasideList","KeInitializeDpc","KeInitializeTimer","KeCancelTimer","KeSetTimer","ExAllocatePoolWithTag","ExFreePoolWithTag","ExQueueWorkItem","ExCreateCallback","ExRegisterCallback","ObfDereferenceObject","ZwPowerInformation","RtlInitAnsiString","RtlDeleteRegistryValue","RtlCompareUnicodeString","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlGetVersion","KeSetEvent","ExAllocatePool","MmGetSystemRoutineAddress","ObReferenceObjectByHandle","ObfReferenceObject","ZwClose","ZwCreateKey","ZwOpenKey","ZwDeleteValueKey","ZwQueryValueKey","ZwSetValueKey","PsGetCurrentProcessId","ObOpenObjectByPointer","ObQueryNameString","IoGetDeviceProperty","KeClearEvent","KeResetEvent","IoInitializeRemoveLockEx","InitSafeBootMode","_purecall","IoBuildSynchronousFsdRequest","KeReleaseSemaphore","MmMapIoSpace","MmUnmapIoSpace","PsGetVersion","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoGetCurrentProcess","IoRegisterShutdownNotification","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","ZwDeviceIoControlFile","NtCreateFile","ZwCreateEvent","ExEventObjectType","MmMapLockedPagesSpecifyCache","KeInitializeSemaphore","ExAcquireFastMutex","ExReleaseFastMutex","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","PsCreateSystemThread","wcsstr","_wcsicmp","ZwCreateFile","ZwReadFile","ZwWriteFile","ZwQueryVolumeInformationFile","NtQueryInformationFile","NtSetInformationFile","NtClose","ZwDeleteFile","MmUnlockPages","MmUnmapLockedPages","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","ObReferenceObjectByPointer","PsThreadType","ObOpenObjectByName","ExSemaphoreObjectType","IoAttachDeviceToDeviceStack","IoDetachDevice","IoAcquireRemoveLockEx","IoReleaseRemoveLockEx","IoReleaseRemoveLockAndWaitEx","PoCallDriver","PoStartNextPowerIrp","VerSetConditionMask","RtlVerifyVersionInfo","tolower","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","_strnicmp","wcschr","RtlCheckRegistryKey","ZwOpenFile","_vsnwprintf","IoAllocateIrp","ZwDeleteKey","ZwEnumerateKey","ZwEnumerateValueKey","RtlFreeUnicodeString","RtlUpcaseUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc","ValidFrom":"2023-03-20 00:00:00","ValidTo":"2026-03-19 23:59:59","Signature":"c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"090c3aaa41901d6ad321fddea91e1366","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c5a9b13894baa951ef81c2b092800154","SHA1":"fcd2e70f37161140c551364aeda08fd0460212f2","SHA256":"2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e","SHA384":"e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"}}],"Signer":[{"SerialNumber":"090c3aaa41901d6ad321fddea91e1366","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"eedDiskEncryptionDriver.sys","SHA256":"435f56a1f5bf3f89a29125b4e42396bb8d1499d20a5d4db865a35df23c41844f","MD5":"d5f0f35134135206dd1986b4c8b19794","SHA1":"5c757a3f97b15fc44550c5853eefcd2cc5f90997","Imphash":"b99820bacc2b77dc46693f68369d79c1","Authentihash":{"MD5":"0093d69ee026ec06fbd518dfe0984e45","SHA1":"6a2d6498b6300061830208a7081dedfe3a7b19f8","SHA256":"792f87a87cef485e0d41c43096cf36233299ef6457688bb35b1f68c42dfb9831"},"RichPEHeaderHash":{"MD5":"922c838586773519d8094411dc598335","SHA1":"7f82fd611fd5461571372b61b6b016ad82ed3d4b","SHA256":"5f91815a137653469192eff988326ae24b75797d9a936bf3186d69a0b40ed561"},"Sections":{".text":{"Entropy":5.823136327947804,"Virtual Size":"0x9407"},"LOCKCODE":{"Entropy":5.732328915108522,"Virtual Size":"0x500e8"},".rdata":{"Entropy":5.1752258137831495,"Virtual Size":"0x50cc"},".data":{"Entropy":3.150635109814339,"Virtual Size":"0xb20"},".pdata":{"Entropy":5.4402261265655305,"Virtual Size":"0x40b0"},"LOCKDATA":{"Entropy":4.058028727597734,"Virtual Size":"0x6a1"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},"PAGE":{"Entropy":6.2452625709004925,"Virtual Size":"0x1987"},"INIT":{"Entropy":5.337058847150616,"Virtual Size":"0x1734"},".rsrc":{"Entropy":3.3555452835176753,"Virtual Size":"0x440"},".reloc":{"Entropy":5.389634183891276,"Virtual Size":"0x788"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-04-27 21:08:54","Description":"Disk Encryption Driver","Company":"Symantec Corporation","InternalName":"eedDiskEncryptionDriver.sys","OriginalFilename":"eedDiskEncryptionDriver.sys","FileVersion":"11.1.1 (Build 1200)","Product":"Client for Symantec Endpoint Encryption","ProductVersion":"11.1.1 (Build 1200)","Copyright":"Copyright (C) 2016 Symantec Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","PGPCE.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","IoBuildDeviceIoControlRequest","IofCallDriver","IoGetDeviceObjectPointer","ObfDereferenceObject","ZwCreateFile","ZwReadFile","ZwWriteFile","ZwQueryVolumeInformationFile","ZwDeviceIoControlFile","NtCreateFile","NtQueryInformationFile","NtSetInformationFile","NtClose","ZwDeleteFile","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","RtlCompareUnicodeString","wcschr","RtlCheckRegistryKey","ZwOpenFile","KeResetEvent","ExAllocatePoolWithTag","ExAllocatePoolWithTagPriority","ExFreePoolWithTag","ObReferenceObjectByPointer","RtlEqualUnicodeString","KeEnterCriticalRegion","KeLeaveCriticalRegion","MmBuildMdlForNonPagedPool","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","PsSetLoadImageNotifyRoutine","ExInterlockedInsertTailList","ExInterlockedRemoveHeadList","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","KeInitializeDpc","KeInitializeTimer","KeCancelTimer","KeSetTimer","ExQueueWorkItem","ExCreateCallback","ExRegisterCallback","ZwPowerInformation","RtlInitAnsiString","RtlDeleteRegistryValue","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlGetVersion","CmUnRegisterCallback","CmRegisterCallbackEx","ObReferenceObjectByHandle","ObfReferenceObject","ZwCreateKey","ZwOpenKey","ZwDeleteValueKey","ZwQueryValueKey","ZwSetValueKey","ObOpenObjectByPointer","ObQueryNameString","IoGetDeviceProperty","KeClearEvent","KeReadStateEvent","IoInitializeRemoveLockEx","ZwQueryInformationFile","InitSafeBootMode","_wcsicmp","ExAllocatePoolWithQuotaTag","KeReleaseSemaphore","MmGetSystemRoutineAddress","MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoGetCurrentProcess","IoRegisterShutdownNotification","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","ExEventObjectType","MmMapLockedPagesSpecifyCache","KeInitializeSemaphore","ExAcquireFastMutex","ExReleaseFastMutex","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","PsCreateSystemThread","PsTerminateSystemThread","MmUnlockPages","MmUnmapLockedPages","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","ObOpenObjectByName","ExSemaphoreObjectType","IoAttachDeviceToDeviceStack","IoDetachDevice","IoAcquireRemoveLockEx","IoReleaseRemoveLockEx","IoReleaseRemoveLockAndWaitEx","PoCallDriver","PoStartNextPowerIrp","VerSetConditionMask","RtlVerifyVersionInfo","KeQueryActiveProcessors","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlFreeUnicodeString","wcsstr","__C_specific_handler","ZwCreateEvent","ZwClose","NtBuildNumber","RtlAreBitsSet","RtlAreBitsClear","RtlSetBits","RtlClearBits","RtlInitializeBitMap","DbgPrint","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","strcmp","NtFsControlFile","ExDeleteNPagedLookasideList","ExInitializeNPagedLookasideList","ExpInterlockedPushEntrySList","KeBugCheckEx","ZwDeleteKey","ZwEnumerateKey","IoAllocateIrp","RtlUpcaseUnicodeString","ExpInterlockedPopEntrySList","ExQueryDepthSList","_purecall","_vsnwprintf","_vsnprintf","wcslen","IoBuildSynchronousFsdRequest","strlen","PGPceUnpack","PGPceGetDerivedKey","PGPceNewKDF","PGPcePeekContextMemoryMgr","PGPceFreeData","PGPceNewData","PGPceNewMemoryMgrExternalP2","PGPceDiskBlockEncryptionDecrypt","PGPceDiskBlockEncryptionEncrypt","PGPceInitDiskBlockEncryption","PGPceNewDiskBlockEncryptionContext","PGPceGetSymmetricCipherSizes","PGPceSymmetricCipherDecrypt","PGPceSymmetricCipherEncrypt","PGPceInitSymmetricCipher","PGPceNewSymmetricCipherContext","PGPceGetSDKErrorState","PGPceFinalizeHash","PGPceContinueHash","PGPceNewHashContext","PGPceFreeObject","PGPceFreeContext","PGPceNewContext","PGPceFreeMemoryMgr","PGPceNewMemoryMgrExternal","PGPcePack"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Symantec Corporation","ValidFrom":"2013-08-08 00:00:00","ValidTo":"2016-11-06 23:59:59","Signature":"4f98f0c2944dc1718f98e860924987d1428e5d8d9e88733eee6ccef0014655e860f461c8430efbd33dd69448a0a1f0489a79c27bf11415e945fc0ed346dfd59ea1a63ab1044efc2c130d3f8fe80da8dde7d4ca30e66a0f5c9703db2043afc4924f14b508e686148782d01c84bf538a36f722381e73ab806015af06d747857bf8bb52c014b2ab84a03981bee6a213609c0bfeece2b9ac22b1fe008a43480eba170cb6dbcb2ca4644c0630ccb6fa147ff0ed5dccd1b04a5d09e07a3dde2348e766a71009469da06c09f0a0943183e755e3bf8a0d9b9e7c180c84d28299ac7e7ed5307bbfde7704276e0f62c82c96bd4599c9a1c47db0cfa6b4bf43b61759eb54aa","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"20b44682a0de2a8026a1c3d781e63fc0","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"de8691740d00b889e29007e596f2ac08","SHA1":"932d2606a168b39b42094c75453b30dcad60af83","SHA256":"35b4c2f8a8402febb1e6864f1365ec623dd08fcfc9731d2c30889d962531ef67","SHA384":"f97582d5131a78d477523117261c4e00ef957c064b7de587f295d9429b1ebca950ec2b59a82d16df5ef2f3b6b46c5dde"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"20b44682a0de2a8026a1c3d781e63fc0","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]},{"Filename":"eedDiskEncryptionDriver.sys","SHA256":"fab797f9e498b078dbea8c05e7ddcf157db9aa902e2f7c0e89e21c1308867f16","MD5":"29b98854c8dbf6f7859ec913b09fc185","SHA1":"fceae2e110919fcbb953d75d460bc55e3e4165b9","Imphash":"b99820bacc2b77dc46693f68369d79c1","Authentihash":{"MD5":"511fecad28c220398c026a5730c9571b","SHA1":"f5bc1f93fb491cf96608959bdfd48d9d4d8319ac","SHA256":"c60e5c41c65ea34c8cda7eac06018fd33feb2b43d5b283275e87f161fd259fea"},"RichPEHeaderHash":{"MD5":"922c838586773519d8094411dc598335","SHA1":"7f82fd611fd5461571372b61b6b016ad82ed3d4b","SHA256":"5f91815a137653469192eff988326ae24b75797d9a936bf3186d69a0b40ed561"},"Sections":{".text":{"Entropy":5.818322841154296,"Virtual Size":"0x9487"},"LOCKCODE":{"Entropy":5.731063748461246,"Virtual Size":"0x50208"},".rdata":{"Entropy":5.166730885664501,"Virtual Size":"0x5128"},".data":{"Entropy":3.23675925338182,"Virtual Size":"0xb60"},".pdata":{"Entropy":5.475660249021004,"Virtual Size":"0x40b0"},"LOCKDATA":{"Entropy":4.035801552534526,"Virtual Size":"0x6a1"},"bghkprms":{"Entropy":0.20172878108732903,"Virtual Size":"0x400"},"PAGE":{"Entropy":6.245907845559353,"Virtual Size":"0x1987"},"INIT":{"Entropy":5.336420188016948,"Virtual Size":"0x1734"},".rsrc":{"Entropy":3.3703494347525456,"Virtual Size":"0x440"},".reloc":{"Entropy":5.387868726017709,"Virtual Size":"0x790"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-06-20 13:34:09","Description":"Disk Encryption Driver","Company":"Symantec Corporation","InternalName":"eedDiskEncryptionDriver.sys","OriginalFilename":"eedDiskEncryptionDriver.sys","FileVersion":"11.1.3 (Build 554)","Product":"Client for Symantec Endpoint Encryption","ProductVersion":"11.1.3 (Build 554)","Copyright":"Copyright (C) 2017 Symantec Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","PGPCE.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","IoBuildDeviceIoControlRequest","IofCallDriver","IoGetDeviceObjectPointer","ObfDereferenceObject","ZwCreateFile","ZwReadFile","ZwWriteFile","ZwQueryVolumeInformationFile","ZwDeviceIoControlFile","NtCreateFile","NtQueryInformationFile","NtSetInformationFile","NtClose","ZwDeleteFile","RtlTimeFieldsToTime","ExSystemTimeToLocalTime","RtlCompareUnicodeString","wcschr","RtlCheckRegistryKey","ZwOpenFile","KeResetEvent","ExAllocatePoolWithTag","ExAllocatePoolWithTagPriority","ExFreePoolWithTag","ObReferenceObjectByPointer","RtlEqualUnicodeString","KeEnterCriticalRegion","KeLeaveCriticalRegion","MmBuildMdlForNonPagedPool","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","PsSetLoadImageNotifyRoutine","ExInterlockedInsertTailList","ExInterlockedRemoveHeadList","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","KeInitializeDpc","KeInitializeTimer","KeCancelTimer","KeSetTimer","ExQueueWorkItem","ExCreateCallback","ExRegisterCallback","ZwPowerInformation","RtlInitAnsiString","RtlDeleteRegistryValue","RtlCopyUnicodeString","RtlAppendUnicodeStringToString","RtlGetVersion","CmUnRegisterCallback","CmRegisterCallbackEx","ObReferenceObjectByHandle","ObfReferenceObject","ZwCreateKey","ZwOpenKey","ZwDeleteValueKey","ZwQueryValueKey","ZwSetValueKey","ObOpenObjectByPointer","ObQueryNameString","IoGetDeviceProperty","KeClearEvent","KeReadStateEvent","IoInitializeRemoveLockEx","ZwQueryInformationFile","InitSafeBootMode","_wcsicmp","ExAllocatePoolWithQuotaTag","KeReleaseSemaphore","MmGetSystemRoutineAddress","MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoGetCurrentProcess","IoRegisterShutdownNotification","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","ExEventObjectType","MmMapLockedPagesSpecifyCache","KeInitializeSemaphore","ExAcquireFastMutex","ExReleaseFastMutex","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","PsCreateSystemThread","PsTerminateSystemThread","MmUnlockPages","MmUnmapLockedPages","IoBuildAsynchronousFsdRequest","IoFreeIrp","IoFreeMdl","ObOpenObjectByName","ExSemaphoreObjectType","IoAttachDeviceToDeviceStack","IoDetachDevice","IoAcquireRemoveLockEx","IoReleaseRemoveLockEx","IoReleaseRemoveLockAndWaitEx","PoCallDriver","PoStartNextPowerIrp","VerSetConditionMask","RtlVerifyVersionInfo","KeQueryActiveProcessors","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlFreeUnicodeString","wcsstr","__C_specific_handler","ZwCreateEvent","ZwClose","NtBuildNumber","RtlAreBitsSet","RtlAreBitsClear","RtlSetBits","RtlClearBits","RtlInitializeBitMap","DbgPrint","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","strcmp","NtFsControlFile","ExDeleteNPagedLookasideList","ExInitializeNPagedLookasideList","ExpInterlockedPushEntrySList","KeBugCheckEx","ZwDeleteKey","ZwEnumerateKey","IoAllocateIrp","RtlUpcaseUnicodeString","ExpInterlockedPopEntrySList","ExQueryDepthSList","_purecall","_vsnwprintf","_vsnprintf","wcslen","IoBuildSynchronousFsdRequest","strlen","PGPceUnpack","PGPceGetDerivedKey","PGPceNewKDF","PGPcePeekContextMemoryMgr","PGPceFreeData","PGPceNewData","PGPceNewMemoryMgrExternalP2","PGPceDiskBlockEncryptionDecrypt","PGPceDiskBlockEncryptionEncrypt","PGPceInitDiskBlockEncryption","PGPceNewDiskBlockEncryptionContext","PGPceGetSymmetricCipherSizes","PGPceSymmetricCipherDecrypt","PGPceSymmetricCipherEncrypt","PGPceInitSymmetricCipher","PGPceNewSymmetricCipherContext","PGPceGetSDKErrorState","PGPceFinalizeHash","PGPceContinueHash","PGPceNewHashContext","PGPceFreeObject","PGPceFreeContext","PGPceNewContext","PGPceFreeMemoryMgr","PGPceNewMemoryMgrExternal","PGPcePack"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=San Francisco, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation","ValidFrom":"2016-10-18 00:00:00","ValidTo":"2018-01-01 23:59:59","Signature":"ad012225094fdb9c9350d249bc3ea97801503eaf00316a887a3d71aec777c7ba620dfc45cfe2362232f1f63c56c3de93b173fcbf4e66e446be32bf2cd95559516278e9cd63f033b721ece440ca556ac7506db206e4dd7b3b86f8f327566c21fc6e2b2f6401891711aaa97e23935adcced32dce9113051434a56e1e5f45d1cf65c7f3c95c6c0a5b0699af73dbb58d9f1d186a2c747fcc71c6031e8fe564cbab54ce2b312b9c6689a83c19ebad25b17e3c885b485721f5d822c00103635fe6b2984e04bc714796715e2bb572cd8c655a804b059fbfb83bb9cf025ac76061ec4d36ce34be1b8b41690b83c9796f7becdaf709090dfd6f6f47451c3c9f1109dd46ef","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0f2d17e62e571f288acb5666fd3c5230","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"bf3e672d7cdd9596fe28d02c40aaa83b","SHA1":"5c1ccf094c7e4627d5a60c368a134416cea1d2fd","SHA256":"63eadd5ecf45a5e861c4e62f0e4c7dad04dde0ff2a2a9ef05daa43d517d421ad","SHA384":"03c9bcf64c6d61f82f92ef94b9970dbe2a42de0d2ed818117ad0f30bc02e46e9d743f3c796448ee3e24108397fe94ce5"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"0f2d17e62e571f288acb5666fd3c5230","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]}]}