{"Id":"2b918b1a-badb-4a85-9214-961607b21219","Tags":["phymem_ext64.sys"],"Verified":"TRUE","Author":"Takahiro Haruyama","Created":"2023-11-02","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create phymem_ext64sys binPath= C:\\windows\\temp\\phymem_ext64sys.sys type=kernel && sc.exe start phymem_ext64sys","Description":"The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"affe4764d880e78b2afb2643b15b8d41","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"928d26cce64ad458e1f602cc2aea848e0b04eaaf","SHA256":"4ec7af309a9359c332d300861655faeceb68bb1cd836dd66d10dd4fac9c01a28","Signature":"","Imphash":"05d3de62beab8e88de1dafd3b24a16f6","Authentihash":{"MD5":"8f3890ebc1854d6b014daf1cd58a683c","SHA1":"85f0ac83889df6d3feb439fe2026ce3a7968e263","SHA256":"d6cb3418c1a512aef6b15586bf5234689d4e471e854103a72d80a8597d263403"},"RichPEHeaderHash":{"MD5":"9c3a27e39a5e503f8e7a328f3d23c7d1","SHA1":"ad62f47b829e51043a7c1554326d1e7a64f69ece","SHA256":"d857baa340c7338dffd557b7409c2ddc259a88807a2583770407513e30ed7bbf"},"Sections":{".text":{"Entropy":6.075980194368059,"Virtual Size":"0xc90"},".rdata":{"Entropy":3.9931177119501067,"Virtual Size":"0x194"},".data":{"Entropy":0.46979092711892695,"Virtual Size":"0x130"},".pdata":{"Entropy":3.320601478050092,"Virtual Size":"0x6c"},"INIT":{"Entropy":5.129844326298507,"Virtual Size":"0x30a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-08-19 23:33:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapLockedPages","IoDeleteSymbolicLink","ExFreePoolWithTag","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","IoIs32bitProcess","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoAllocateMdl","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=CN, ST=Guangdong Province, L=Shenzhen, O=Shenzhen Moyea Software, CN=Shenzhen Moyea Software","ValidFrom":"2021-10-14 00:00:00","ValidTo":"2024-10-16 23:59:59","Signature":"3b0f3ae78dd863d21287b9c3c9b2708a857a104282d3dfe0f8a25e54015cd2b538e5952c295539447eaaaa6ff2804fcf737f62a633c090dc4d250a6738bed4f60ffea1aba18b6a1f2240b72b1c9ff3ffbb0e592178284d375dfdefb2c6f67675c6fe060b426811643081b74f433f473b80ae4918600bbde8f0cf8fa9d4237f3f89dd5bdbc8fb8698066307446fcedc640df539dd8b773ad5bda1d4b9083bc83c88fb3685fdde177bf80a1f1d66fdb492960a1334bd9b17141d1ff1c52b380aca6f092d746509ef5291b8a18f325871a51034cf51eaff0a7f54604ceb3ef9f64532326d28091aa4f4bfd93e0715b961c1b3fbdac691da09006dff68bf6148bb55979beceac4db9f47dda3958cd40b3013a1258974a25d7ba59ab118332dc848d2a60fb63b84e0796d80ab0f877351b1a0ce4a2c31de78acdcd38c44d63d0751abed776d0d86d62082f11c4d8c8c8a2c5b187db26bb551edb1ccdc8138478937ec522639b1c450318f16c0c9011ececbfcc1d12dfb270af59cb828bee6ec93623b5ef1e4e6083917047f3f7c2a199ae84653ec14f8749f105773e9a039764b087065aa1c77aa892b3ac33e9e1dcc03c7ef3a108a1d3477966d09aa5e0597a704b912842ebfaa7a19aeeda7fc9aca5a9fde4c0169bf1746d5a5567894d3f23a89ba90a44542de1c0ee6c09f227fc87c07c76eb9834bffe79d50bdfc5482b13f51ee","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"71dd0345e896c6033cef5840c28346ba","SHA1":"a8f17de69b591a80015e33f290808d5072f5fb4a","SHA256":"01be120134997087d356bd5d50fa89eed3447aeff1b66d7327373693e4879d42","SHA384":"269e4987cca4027fe44741ac54963d53289aea17cd951cffbf014790a02639417cd7e489b409dea04c41c630abff6da0"}}],"Signer":[{"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"a664904f69756834049e9e272abb6fea","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"c45d03076fa6e66c1b8b74b020ad84712755e3df","SHA256":"793a26c5c4c154a40f84c3d3165deb807062b26796acaae94b72f453e95230d5","Signature":"","Imphash":"05d3de62beab8e88de1dafd3b24a16f6","Authentihash":{"MD5":"8f3890ebc1854d6b014daf1cd58a683c","SHA1":"85f0ac83889df6d3feb439fe2026ce3a7968e263","SHA256":"d6cb3418c1a512aef6b15586bf5234689d4e471e854103a72d80a8597d263403"},"RichPEHeaderHash":{"MD5":"9c3a27e39a5e503f8e7a328f3d23c7d1","SHA1":"ad62f47b829e51043a7c1554326d1e7a64f69ece","SHA256":"d857baa340c7338dffd557b7409c2ddc259a88807a2583770407513e30ed7bbf"},"Sections":{".text":{"Entropy":6.075980194368059,"Virtual Size":"0xc90"},".rdata":{"Entropy":3.9931177119501067,"Virtual Size":"0x194"},".data":{"Entropy":0.46979092711892695,"Virtual Size":"0x130"},".pdata":{"Entropy":3.320601478050092,"Virtual Size":"0x6c"},"INIT":{"Entropy":5.129844326298507,"Virtual Size":"0x30a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-08-19 23:33:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapLockedPages","IoDeleteSymbolicLink","ExFreePoolWithTag","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","IoIs32bitProcess","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoAllocateMdl","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=CN, ST=Guangdong Province, L=Shenzhen, O=Shenzhen Moyea Software, CN=Shenzhen Moyea Software","ValidFrom":"2021-10-14 00:00:00","ValidTo":"2024-10-16 23:59:59","Signature":"3b0f3ae78dd863d21287b9c3c9b2708a857a104282d3dfe0f8a25e54015cd2b538e5952c295539447eaaaa6ff2804fcf737f62a633c090dc4d250a6738bed4f60ffea1aba18b6a1f2240b72b1c9ff3ffbb0e592178284d375dfdefb2c6f67675c6fe060b426811643081b74f433f473b80ae4918600bbde8f0cf8fa9d4237f3f89dd5bdbc8fb8698066307446fcedc640df539dd8b773ad5bda1d4b9083bc83c88fb3685fdde177bf80a1f1d66fdb492960a1334bd9b17141d1ff1c52b380aca6f092d746509ef5291b8a18f325871a51034cf51eaff0a7f54604ceb3ef9f64532326d28091aa4f4bfd93e0715b961c1b3fbdac691da09006dff68bf6148bb55979beceac4db9f47dda3958cd40b3013a1258974a25d7ba59ab118332dc848d2a60fb63b84e0796d80ab0f877351b1a0ce4a2c31de78acdcd38c44d63d0751abed776d0d86d62082f11c4d8c8c8a2c5b187db26bb551edb1ccdc8138478937ec522639b1c450318f16c0c9011ececbfcc1d12dfb270af59cb828bee6ec93623b5ef1e4e6083917047f3f7c2a199ae84653ec14f8749f105773e9a039764b087065aa1c77aa892b3ac33e9e1dcc03c7ef3a108a1d3477966d09aa5e0597a704b912842ebfaa7a19aeeda7fc9aca5a9fde4c0169bf1746d5a5567894d3f23a89ba90a44542de1c0ee6c09f227fc87c07c76eb9834bffe79d50bdfc5482b13f51ee","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"71dd0345e896c6033cef5840c28346ba","SHA1":"a8f17de69b591a80015e33f290808d5072f5fb4a","SHA256":"01be120134997087d356bd5d50fa89eed3447aeff1b66d7327373693e4879d42","SHA384":"269e4987cca4027fe44741ac54963d53289aea17cd951cffbf014790a02639417cd7e489b409dea04c41c630abff6da0"}}],"Signer":[{"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"a125390293d50091b643cfa096c2148c","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"ff9887cfd695916a06319b3a96f7ab2e6343a20e","SHA256":"e26a21e1b79ecaee7033e05edb0bd72aca463c23bd6fdf5835916ce2dfdf1a63","Signature":"","Imphash":"05d3de62beab8e88de1dafd3b24a16f6","Authentihash":{"MD5":"8f3890ebc1854d6b014daf1cd58a683c","SHA1":"85f0ac83889df6d3feb439fe2026ce3a7968e263","SHA256":"d6cb3418c1a512aef6b15586bf5234689d4e471e854103a72d80a8597d263403"},"RichPEHeaderHash":{"MD5":"9c3a27e39a5e503f8e7a328f3d23c7d1","SHA1":"ad62f47b829e51043a7c1554326d1e7a64f69ece","SHA256":"d857baa340c7338dffd557b7409c2ddc259a88807a2583770407513e30ed7bbf"},"Sections":{".text":{"Entropy":6.075980194368059,"Virtual Size":"0xc90"},".rdata":{"Entropy":3.9931177119501067,"Virtual Size":"0x194"},".data":{"Entropy":0.46979092711892695,"Virtual Size":"0x130"},".pdata":{"Entropy":3.320601478050092,"Virtual Size":"0x6c"},"INIT":{"Entropy":5.129844326298507,"Virtual Size":"0x30a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-08-19 23:33:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapLockedPages","IoDeleteSymbolicLink","ExFreePoolWithTag","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","IoIs32bitProcess","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoAllocateMdl","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Timestamping CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"4e5e56901e46b4d94931f3bb1739281bc216ddfd41dc0905049b6fb2a29ad6992e40990055b5ea3fa52076d38634d417cc553ac782eeefa8babcd8069f1550dfcd167b523a02d7191afdaff0785ce04bc518df3a241edaacb8a95804020730dbb0125efe31bef00448f4f070f83a5e5683cf3dfb0dbcf4c5ed979db9d4dba52784e3389b8ba735864420a43b6da46a0ba183fd28ebdaef28f6cc885dfb0a3b00abe021ebe22f356c0f8e344597eba2f79933357ecb9a8abb454de73f9fc2d98afa65b26ec77e65ffe892e12c31a2f7b02736488f266f3bee4d761f79c3e57f9635bc2d0ecc01b08e7fff518080a792d4b34446648c874f166307314b63b0dff3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee152d7","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"e140543fe3256027cfa79fc3c19c1776","SHA1":"c655f94eb1ecc93de319fc0c9a2dc6c5ec063728","SHA256":"3ca71e85908ff67368e4dc00253f5691b9e6d50c966e7784143d75fb92aa3448","SHA384":"d9d366f9328f2b55ee19a32cc5fd5148b81d764282fe5dc196c872ae249caa51d2c212ef39f33945dfe0cda81925e326"}},{"Subject":"C=SG, O=GMO GlobalSign Pte Ltd, CN=GlobalSign TSA for MS Authenticode , G1","ValidFrom":"2013-08-23 00:00:00","ValidTo":"2024-09-23 00:00:00","Signature":"0231142e5857644185e8af12753c881cc35eec2ce9a13cf5baaa531db9d12963dc436786d439dadec6c9ffbe4585f4a4d7c151ea18ee40585ee67bcca241291338c8ea21169cce90a62efba6cad994df401df902182bbef65d4f9fff9a48dbc50509ca80cea0f9dc4bc323e6038fb4b4af5b71296191181a6b7af2fd0dd1cd7d5e98ebba705ee5f4ea43de353dc514818adb3e105ebb72faa1a093ab031cc1653c91138b045d2bc4b9161bcc55c50ce8abe743c9b28328a5531347ab3964b91cea3430b176009521f1d43da8fda00032d76e983ca69c3b0b83becbb8bb2a268c59b8b9aeaf26ace234a2dc210d810b3813f745a3e3dbc4aca16d1bb7e5615cd7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1121405c1f0ed258882be54d8686ba11ea45","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"b95cbc184d388718612d5933f7b36770","SHA1":"ff124c5d160710720108616ffee99bbe090ed363","SHA256":"13027620255363f07bbf85ae7d0dc06c07d8b0f4368b12f983ee3f4fce605733","SHA384":"f42ed00f615f2822dcd3d33794477428afb52ddab932ebcde3586f92a27e18f9faba6b3334ca4e59e0cb24bdbf8395a6"}},{"Subject":"C=CN, ST=GuangDong, L=ShenZhen, O=Shenzhen Moyea Software, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Shenzhen Moyea Software","ValidFrom":"2013-06-26 00:00:00","ValidTo":"2015-07-26 23:59:59","Signature":"9fae06239933edda24c66ceed64d273ced1af9e27f353ca00c242ddda14e2ed348797fe4ac70004ed786c4861c489cac5c166c3cdd1df2b55f19270dfa38ae21ee464154efb02c00a384ed1c59f3978438341a8cd5aa4d99e477d7a63dbb48f928ce43e9551b1ef9282a411f07dab2bd773dd55e074397c64ec677d060b1c64027f56d9c65d1e3714dd204361abe1e39af47fad59068172a89625f600f52517e833af5a88dd4e3d5c6c11c7721ec854f522ec1b504d7ef458f3431c4a8525f1a0e9fdc4d3fe030aacbafebc0a817ca9e407dc6f4e1b0022778bde96f274cc791834239fa131570fb4ad8a2a62cc7703e2905ea60e33f456516796b680d31060f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3c4080057de4b37a48e6a7ba6ccf0e07","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7c755dc4cf3054f9ccaf400c6dde5e3e","SHA1":"bc3f88dc6acdfdcce7ca7f6703dab970bcd88c36","SHA256":"37dab5ac1313736d65f5b08813415b85f13d6265ba97edf8e1d965059710de77","SHA384":"b9302fba34d79663aa82dfd35063d8a710a30cf88dc82dd015b6cdaf5db827116fd017780ad458c9b4a844b861b06778"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"3c4080057de4b37a48e6a7ba6ccf0e07","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"0c55128c301921ce71991a6d546756ad","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"ef8de780cfe839ecf6dc0dc161ae645bff9b853c","SHA256":"fc3e8554602c476e2edfa92ba4f6fb2e5ba0db433b9fbd7d8be1036e454d2584","Signature":"","Imphash":"05d3de62beab8e88de1dafd3b24a16f6","Authentihash":{"MD5":"8f3890ebc1854d6b014daf1cd58a683c","SHA1":"85f0ac83889df6d3feb439fe2026ce3a7968e263","SHA256":"d6cb3418c1a512aef6b15586bf5234689d4e471e854103a72d80a8597d263403"},"RichPEHeaderHash":{"MD5":"9c3a27e39a5e503f8e7a328f3d23c7d1","SHA1":"ad62f47b829e51043a7c1554326d1e7a64f69ece","SHA256":"d857baa340c7338dffd557b7409c2ddc259a88807a2583770407513e30ed7bbf"},"Sections":{".text":{"Entropy":6.075980194368059,"Virtual Size":"0xc90"},".rdata":{"Entropy":3.9931177119501067,"Virtual Size":"0x194"},".data":{"Entropy":0.46979092711892695,"Virtual Size":"0x130"},".pdata":{"Entropy":3.320601478050092,"Virtual Size":"0x6c"},"INIT":{"Entropy":5.129844326298507,"Virtual Size":"0x30a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-08-19 23:33:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapLockedPages","IoDeleteSymbolicLink","ExFreePoolWithTag","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","IoIs32bitProcess","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoAllocateMdl","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2021","ValidFrom":"2021-01-01 00:00:00","ValidTo":"2031-01-06 00:00:00","Signature":"481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d424ae0be3a88ff604021ce1400f0dd","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c0189c338449a42fe8358c2c1fbecc60","SHA1":"b8ac0ee6875594b80ad86a6df6dd1fa3048c187c","SHA256":"a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5","SHA384":"76d3a316a5a106050298418cce3beea16100524723d9e3220b0de51bfb6f1c35a5d4c7cd10b358fef7bf94c3e3562150"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Timestamping CA","ValidFrom":"2016-01-07 12:00:00","ValidTo":"2031-01-07 12:00:00","Signature":"719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0aa125d6d6321b7e41e405da3697c215","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8d26184fc613f89aba1cefb30fce1b53","SHA1":"63a7e376bad5ec2e419d514a403bcf46c8d31d95","SHA256":"56b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c","SHA384":"d8c9691fe9dbe182f07b49b07fbb4f589fa7b38b5c4d21f265d3a2e818f4b1bfb39e03faab2ec05bb10333a99914fb8a"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4","ValidFrom":"2013-08-01 12:00:00","ValidTo":"2038-01-15 12:00:00","Signature":"bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"059b1b579e8e2132e23907bda777755c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"41b622dd54995550fdc2f31ea12f8d9b","SHA1":"420704040c93dfe9d3ad01a26c07f2be1f4888c1","SHA256":"4816e2e9e37ba61e1def6f7a4c623e981c7af355e51349b5554a3d56c5252e24","SHA384":"4ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=CN, ST=Guangdong Province, L=Shenzhen, O=Shenzhen Moyea Software, CN=Shenzhen Moyea Software","ValidFrom":"2021-10-14 00:00:00","ValidTo":"2024-10-16 23:59:59","Signature":"3b0f3ae78dd863d21287b9c3c9b2708a857a104282d3dfe0f8a25e54015cd2b538e5952c295539447eaaaa6ff2804fcf737f62a633c090dc4d250a6738bed4f60ffea1aba18b6a1f2240b72b1c9ff3ffbb0e592178284d375dfdefb2c6f67675c6fe060b426811643081b74f433f473b80ae4918600bbde8f0cf8fa9d4237f3f89dd5bdbc8fb8698066307446fcedc640df539dd8b773ad5bda1d4b9083bc83c88fb3685fdde177bf80a1f1d66fdb492960a1334bd9b17141d1ff1c52b380aca6f092d746509ef5291b8a18f325871a51034cf51eaff0a7f54604ceb3ef9f64532326d28091aa4f4bfd93e0715b961c1b3fbdac691da09006dff68bf6148bb55979beceac4db9f47dda3958cd40b3013a1258974a25d7ba59ab118332dc848d2a60fb63b84e0796d80ab0f877351b1a0ce4a2c31de78acdcd38c44d63d0751abed776d0d86d62082f11c4d8c8c8a2c5b187db26bb551edb1ccdc8138478937ec522639b1c450318f16c0c9011ececbfcc1d12dfb270af59cb828bee6ec93623b5ef1e4e6083917047f3f7c2a199ae84653ec14f8749f105773e9a039764b087065aa1c77aa892b3ac33e9e1dcc03c7ef3a108a1d3477966d09aa5e0597a704b912842ebfaa7a19aeeda7fc9aca5a9fde4c0169bf1746d5a5567894d3f23a89ba90a44542de1c0ee6c09f227fc87c07c76eb9834bffe79d50bdfc5482b13f51ee","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"71dd0345e896c6033cef5840c28346ba","SHA1":"a8f17de69b591a80015e33f290808d5072f5fb4a","SHA256":"01be120134997087d356bd5d50fa89eed3447aeff1b66d7327373693e4879d42","SHA384":"269e4987cca4027fe44741ac54963d53289aea17cd951cffbf014790a02639417cd7e489b409dea04c41c630abff6da0"}}],"Signer":[{"SerialNumber":"07c1044c6a0de08e13cc1b5e2c6d1fc0","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}],"LoadsDespiteHVCI":"FALSE"}]}