{"Id":"2da3a276-9e38-4ee6-903d-d15f7c355e7c","Tags":["vboxdrv.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create vboxdrv.sys binPath=C:\\windows\\temp\\vboxdrv.sys type=kernel && sc.exe start vboxdrv.sys","Description":"Used by unknown actor in Acid Rain malware. vboxdrv.sys is a vulnerable driver.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://unit42.paloaltonetworks.com/acidbox-rare-malware/","https://www.coresecurity.com/core-labs/advisories/virtualbox-privilege-escalation-vulnerability","https://unit42.paloaltonetworks.com/acidbox-rare-malware/"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"368a4f14c62575191a0f1f3464513964","SHA1":"3ce88266cfc41e8980d4c185235fd55999f5a67a","SHA256":"a5a2fe8ab935cf47f21e0c5e0de11a98271054109827dc930293b947d3b05079"},"Company":"Sun Microsystems, Inc.","Copyright":"Copyright (C) 2009 Sun Microsystems, Inc.","CreationTimestamp":"2009-04-07 14:30:47","Date":"","Description":"VirtualBox Support Driver","ExportedFunctions":["AssertMsg1","AssertMsg2","RTAssertShouldPanic","RTErrConvertFromNtStatus","RTLogCloneRC","RTLogComPrintf","RTLogComPrintfV","RTLogCopyGroupsAndFlags","RTLogCreate","RTLogCreateEx","RTLogCreateExV","RTLogDefaultInit","RTLogDefaultInstance","RTLogDestroy","RTLogFlags","RTLogFlush","RTLogFlushRC","RTLogFlushToLogger","RTLogFormatV","RTLogGetDefaultInstance","RTLogGroupSettings","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogLoggerV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogRelLoggerV","RTLogRelPrintfV","RTLogRelSetDefaultInstance","RTLogSetDefaultInstance","RTLogSetDefaultInstanceThread","RTLogWriteCom","RTLogWriteDebugger","RTLogWriteStdErr","RTLogWriteStdOut","RTLogWriteUser","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemDup","RTMemDupEx","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpIsCpuPossible","RTMpIsCpuWorkPending","RTMpNotificationDeregister","RTMpNotificationRegister","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTPowerNotificationDeregister","RTPowerNotificationRegister","RTPowerSignalEvent","RTProcSelf","RTR0Init","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapKernelEx","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTR0Term","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTStrFormat","RTStrFormatNumber","RTStrFormatTypeDeregister","RTStrFormatTypeRegister","RTStrFormatTypeSetUser","RTStrFormatV","RTStrPrintf","RTStrPrintfEx","RTStrPrintfExV","RTStrPrintfV","RTStrToInt16","RTStrToInt16Ex","RTStrToInt16Full","RTStrToInt32","RTStrToInt32Ex","RTStrToInt32Full","RTStrToInt64","RTStrToInt64Ex","RTStrToInt64Full","RTStrToInt8","RTStrToInt8Ex","RTStrToInt8Full","RTStrToUInt16","RTStrToUInt16Ex","RTStrToUInt16Full","RTStrToUInt32","RTStrToUInt32Ex","RTStrToUInt32Full","RTStrToUInt64","RTStrToUInt64Ex","RTStrToUInt64Full","RTStrToUInt8","RTStrToUInt8Ex","RTStrToUInt8Full","RTThreadNativeSelf","RTThreadPreemptDisable","RTThreadPreemptIsEnabled","RTThreadPreemptRestore","RTThreadSleep","RTThreadYield","RTTimeMilliTS","RTTimeNanoTS","RTTimeNow","RTTimeSystemMilliTS","RTTimeSystemNanoTS","RTTimerCreateEx","RTTimerDestroy","RTTimerGetSystemGranularity","RTTimerReleaseSystemGranularity","RTTimerRequestSystemGranularity","RTTimerStart","RTTimerStop","SUPR0ComponentDeregisterFactory","SUPR0ComponentQueryFactory","SUPR0ComponentRegisterFactory","SUPR0ContAlloc","SUPR0ContFree","SUPR0EnableVTx","SUPR0GetPagingMode","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjAddRefEx","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageAllocEx","SUPR0PageFree","SUPR0PageMapKernel","SUPR0UnlockMem","g_szRTAssertMsg1","g_szRTAssertMsg2"],"FileVersion":"2.2.0.r45846","Filename":"vboxdrv.sys","ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","ObfDereferenceObject","ExUnregisterCallback","IofCompleteRequest","DbgPrint","IoIs32bitProcess","ExRegisterCallback","ExCreateCallback","IoCreateSymbolicLink","IoCreateDevice","IoGetStackLimits","memchr","strncmp","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeWaitForSingleObject","KeResetEvent","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeDelayExecutionThread","ZwYieldExecution","ExFreePoolWithTag","KeInsertQueueDpc","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","ExAllocatePoolWithTag","KeQueryActiveProcessors","strchr","PsGetCurrentProcessId","IoGetCurrentProcess","KeSetTimerEx","KeRemoveQueueDpc","KeCancelTimer","KeInitializeTimerEx","KeQueryTimeIncrement","MmGetSystemRoutineAddress","MmFreeContiguousMemory","MmGetPhysicalAddress","MmAllocateContiguousMemory","MmUnmapIoSpace","MmUnlockPages","IoFreeMdl","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmUnmapLockedPages","MmProtectMdlSystemAddress","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocatePagesForMdl","__C_specific_handler","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","MmMapLockedPagesSpecifyCache"],"Imports":["ntoskrnl.exe"],"InternalName":"VBoxDrv.sys","MD5":"bce7f34912ff59a3926216b206deb09f","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"VBoxDrv.sys","Product":"Sun VirtualBox","ProductVersion":"2.2.0.r45846","Publisher":"","RichPEHeaderHash":{"MD5":"778da7e612af67a3de121ab863ceed34","SHA1":"4c054a77104d0843f0a0f79ba3cdd6f7a500a261","SHA256":"c7ad11fb172299df62c32563cb4c0c6c44c833b76897b86057a544ce552b39ca"},"SHA1":"696d68bdbe1d684029aaad2861c49af56694473a","SHA256":"78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f","Sections":{".text":{"Entropy":6.374436237194225,"Virtual Size":"0x14d26"},".rdata":{"Entropy":5.492063385586473,"Virtual Size":"0x6ca4"},".data":{"Entropy":2.136306008585543,"Virtual Size":"0x35b4"},".pdata":{"Entropy":5.201973567849435,"Virtual Size":"0x1f20"},".edata":{"Entropy":5.704943815176372,"Virtual Size":"0x14d5"},"INIT":{"Entropy":4.983784792331664,"Virtual Size":"0x6fc"},".rsrc":{"Entropy":3.308916632980912,"Virtual Size":"0x398"},".reloc":{"Entropy":4.900332523869931,"Virtual Size":"0x672"}},"Signature":["Sun Microsystems, Inc.","VeriSign Class 3 Code Signing 2004 CA","VeriSign Class 3 Public Primary CA"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=California, L=Menlo Park, O=Sun Microsystems, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Sun Microsystems, Inc.","ValidFrom":"2008-06-11 00:00:00","ValidTo":"2011-06-11 23:59:59","Signature":"537c2adf2d3f7cf7cfc86476029fe81f7b8f12596a595cda0d5fbbfd227cce6bce2f8ad1af7fbb1a92a8b8de23a8797748094aae39bc845308e3ccd8fb9dc09b51bdf7b26c4eb8fb4052a8bdc714eaf36fca04d720e06798e36308c2fcaf50c48e61087a3ba0c4b0e77972a69af1ecc9d05e3f001e02ad94db98aa5e1453b541b0c257337fd78bb0372dc7841987424e0abce9cb1f0102a934bd037475b39cfe29dc27e77b3eb89fe805f8c6b1574d768dd2805d1a4b98143b7b6208abfebe7645a607084b1fd13ec7f088ac49cd5adc916090bcebe2e63786a7b80a009abd81349a9f34e135a7f4a2d569be474fe316b1b9f06ddf4d90a6650f7340181a27e1","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"50b256a55cdc23561dd4aa76abed4fd9","SHA1":"b3ee591b9218cfdcd394180558bd01bb674df627","SHA256":"fc1c2199740f069b26f02d81313408734051ecb7fa216b2a86458938fac6a909","SHA384":"81c9c8b202f6fe3354dd5503ef9ee6d418b9a28064968506bc2c49d7bd0efbaa9da9ce51d7c384992aa531ca905442a7"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"693a64818c1e086b1b15aee63fa054a2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"Imphash":"6723b1d5bd0f1fc13216cb44541e619e","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d146876f270e848875465ed081396d3b","SHA1":"c54fe31ff5c3cfe1937b7b0906882a1786f453b6","SHA256":"597e7d5feb149d9087888926d1454dc06f1078ab18c948b44f090910da8645f8"},"Company":"","Copyright":"","CreationTimestamp":"2008-05-30 22:18:53","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"vboxdrv.sys","ImportedFunctions":["IofCompleteRequest","DbgPrint","IoIs32bitProcess","MmFreeContiguousMemory","IoFreeMdl","MmGetSystemRoutineAddress","RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","__C_specific_handler","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","KeSetTimerEx","ExSetTimerResolution","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","KeQueryActiveProcessors","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","memchr","strncmp","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","ZwYieldExecution","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","ExAcquireFastMutex","ExReleaseFastMutex","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmProtectMdlSystemAddress","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"eaea9ccb40c82af8f3867cd0f4dd5e9d","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"3b563e832ffe657653773aabadea926a","SHA1":"910da2f8bdc0e1356a2a9f1b160740665b223894","SHA256":"d782f2dfed49e4cd3b9496d9190619a0984ef2c034a6f866915323122f3a036f"},"SHA1":"7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c","SHA256":"cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986","Sections":{".text":{"Entropy":6.2039165195201695,"Virtual Size":"0x856e"},".rdata":{"Entropy":5.607114485004288,"Virtual Size":"0x2a58"},".data":{"Entropy":1.9666645281474864,"Virtual Size":"0x1d00"},".pdata":{"Entropy":4.674336635214751,"Virtual Size":"0xcf0"},".edata":{"Entropy":5.350712994836838,"Virtual Size":"0xa72"},"INIT":{"Entropy":4.871003292573194,"Virtual Size":"0x638"},".reloc":{"Entropy":3.745971599596066,"Virtual Size":"0x13c"}},"Signature":["innotek GmbH","GlobalSign ObjectSign CA","GlobalSign Primary Object Publishing CA","GlobalSign Root CA - R1"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"b262e8d078ede007ebd0aa71b9152863","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"8dee0a554d557c93b06a9f03f028c7f6","SHA1":"cbe79825ff30fef67ee1f9ba01e7b880759f1f25","SHA256":"1d1bd2235d422954506b1bdb3070d9d8bada3fb7f9e4f658036031294b3a95df"},"Company":"","Copyright":"","CreationTimestamp":"2008-05-30 22:18:53","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"","ImportedFunctions":["IofCompleteRequest","DbgPrint","IoIs32bitProcess","MmFreeContiguousMemory","IoFreeMdl","MmGetSystemRoutineAddress","RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","__C_specific_handler","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","KeSetTimerEx","ExSetTimerResolution","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","KeQueryActiveProcessors","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","memchr","strncmp","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","ZwYieldExecution","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","ExAcquireFastMutex","ExReleaseFastMutex","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmProtectMdlSystemAddress","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","Space"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"154fd286c96665946d55a7d49923ad7e","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"3b563e832ffe657653773aabadea926a","SHA1":"910da2f8bdc0e1356a2a9f1b160740665b223894","SHA256":"d782f2dfed49e4cd3b9496d9190619a0984ef2c034a6f866915323122f3a036f"},"SHA1":"2ae1456bb0fa5a016954b03967878fb6db4d81eb","SHA256":"b50b11e2203942695380869c6072e15479290bc57da2ec5df3481a36b8a8561e","Sections":{".text":{"Entropy":6.2039165195201695,"Virtual Size":"0x856e"},".rdata":{"Entropy":5.607114485004288,"Virtual Size":"0x2a58"},".data":{"Entropy":1.9666645281474864,"Virtual Size":"0x1d00"},".pdata":{"Entropy":4.674336635214751,"Virtual Size":"0xcf0"},".edata":{"Entropy":5.350712994836838,"Virtual Size":"0xa72"},"INIT":{"Entropy":4.872259573980229,"Virtual Size":"0x638"},".reloc":{"Entropy":3.745971599596066,"Virtual Size":"0x13c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"4c5fc4519f1417f0630c3343aab7c9d2","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"a16b80ddf8f535c1ff695f7eaf0cdcc5","SHA1":"1ed5e0fadb97e30fa8708833f19ccf5e717f48e2","SHA256":"4ef8c776a6acd4fd360b22e7d053bba961d687c36ec4fcc0b3e2ff1ef7be967e"},"Company":"","Copyright":"","CreationTimestamp":"2008-05-30 19:34:52","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"","ImportedFunctions":["RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","_allshl","MmMapLockedPagesSpecifyCache","_except_handler3","MmUnmapLockedPages","KeSetTimerEx","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","KeQueryActiveProcessors","ExSetTimerResolution","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","strncmp","IoFreeMdl","MmFreeContiguousMemory","_allmul","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeGetCurrentThread","KeDelayExecutionThread","ZwYieldExecution","KeInitializeSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","KeQueryInterruptTime","DbgPrint","memchr","IofCompleteRequest","ExReleaseFastMutex","KfReleaseSpinLock","KfAcquireSpinLock","KfRaiseIrql","KfLowerIrql","ExAcquireFastMutex"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"ee91da973bebe6442527b3d1abcc3c80","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"5f57854adbd1e5c955b74bee2a0da686","SHA1":"744192af8f346e24f067553de75ff27e89fdd71b","SHA256":"b1f609edc9ffa87173741f486213b75d472e9d7446fcfcc9b21101d36d22e0b2"},"SHA1":"b7fa8278ab7bc485727d075e761a72042c4595f7","SHA256":"d998ea6d0051e17c1387c9f295b1c79bacb2f61c23809903445f60313d36c7fd","Sections":{".text":{"Entropy":6.333734197575781,"Virtual Size":"0x7094"},".rdata":{"Entropy":5.531194049051287,"Virtual Size":"0x68c"},".data":{"Entropy":3.929686423189371,"Virtual Size":"0x2e00"},".edata":{"Entropy":5.3508787714387545,"Virtual Size":"0xa72"},"INIT":{"Entropy":5.277979675350674,"Virtual Size":"0x5d0"},".reloc":{"Entropy":6.15094236572427,"Virtual Size":"0x488"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"c17c0bd619c1e188ffe27bd328dd7d08","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"4b67c5cc8038b488359fbd1c08779fcf","SHA1":"a5b298457abe85bfb86b289328ef82823b0cc173","SHA256":"a2d9f91ede8aed51960ca67318ea337152bb311c03275c0650e4421e6af6b7ee"},"Company":"","Copyright":"","CreationTimestamp":"2008-05-30 22:18:53","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"","ImportedFunctions":["IofCompleteRequest","DbgPrint","IoIs32bitProcess","MmFreeContiguousMemory","IoFreeMdl","MmGetSystemRoutineAddress","RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","__C_specific_handler","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","KeSetTimerEx","ExSetTimerResolution","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","KeQueryActiveProcessors","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","memchr","strncmp","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","ZwYieldExecution","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","ExAcquireFastMutex","ExReleaseFastMutex","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmProtectMdlSystemAddress","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"3b23808de1403961205352e94b8f2f9b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"3b563e832ffe657653773aabadea926a","SHA1":"910da2f8bdc0e1356a2a9f1b160740665b223894","SHA256":"d782f2dfed49e4cd3b9496d9190619a0984ef2c034a6f866915323122f3a036f"},"SHA1":"eaddeefe13bca118369faf95eee85b0a2a553221","SHA256":"775000c4083c8e4dcfc879d83fcd27b40b46820c9834ae4662861386a4d81fe9","Sections":{".text":{"Entropy":6.2039165195201695,"Virtual Size":"0x856e"},".rdata":{"Entropy":5.607114485004288,"Virtual Size":"0x2a58"},".data":{"Entropy":1.9666645281474864,"Virtual Size":"0x1d00"},".pdata":{"Entropy":4.674336635214751,"Virtual Size":"0xcf0"},".edata":{"Entropy":5.350712994836838,"Virtual Size":"0xa72"},"INIT":{"Entropy":4.862248023480571,"Virtual Size":"0x638"},".reloc":{"Entropy":0,"Virtual Size":"0x13c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"b262e8d078ede007ebd0aa71b9152863","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"d97b34a86af237bc03339236b32e78d1","SHA1":"3aaf86c2b226b5f8901af51c9bb37b1847430250","SHA256":"8561c82c5ae1ab2a5d9214adc620875d83ed7cb9a01253988f5e5aceffe7a901"},"Company":"","Copyright":"","CreationTimestamp":"2008-05-30 22:18:53","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"","ImportedFunctions":["IofCompleteRequest","DbgPrint","IoIs32bitProcess","MmFreeContiguousMemory","IoFreeMdl","MmGetSystemRoutineAddress","RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","__C_specific_handler","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","KeSetTimerEx","ExSetTimerResolution","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","KeQueryActiveProcessors","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","memchr","strncmp","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeDelayExecutionThread","ZwYieldExecution","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","ExAcquireFastMutex","ExReleaseFastMutex","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmProtectMdlSystemAddress","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"9f94028cbcf6789103cb5bb6fcef355d","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"3b563e832ffe657653773aabadea926a","SHA1":"910da2f8bdc0e1356a2a9f1b160740665b223894","SHA256":"d782f2dfed49e4cd3b9496d9190619a0984ef2c034a6f866915323122f3a036f"},"SHA1":"356172a2e12fd3d54e758aaa4ff0759074259144","SHA256":"d44848d3e845f8293974e8b621b72a61ec00c8d3cf95fcf41698bbbd4bdf5565","Sections":{".text":{"Entropy":6.2039165195201695,"Virtual Size":"0x856e"},".rdata":{"Entropy":5.607114485004288,"Virtual Size":"0x2a58"},".data":{"Entropy":1.9666645281474864,"Virtual Size":"0x1d00"},".pdata":{"Entropy":4.672051855182832,"Virtual Size":"0xcf0"},".edata":{"Entropy":5.350712994836838,"Virtual Size":"0xa72"},"INIT":{"Entropy":4.871003292573194,"Virtual Size":"0x638"},".reloc":{"Entropy":3.745971599596066,"Virtual Size":"0x13c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"b262e8d078ede007ebd0aa71b9152863","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"da7c063c8f8dab54afddd9b05c602bfd","SHA1":"24d47cea65e118d12c6896fdf141bb5dcfe31b98","SHA256":"b5d0849fc567c169176c2002dd358240d75ca0aacfca92c79d252006c6e0444e"},"Company":"","Copyright":"","CreationTimestamp":"2008-04-30 16:07:13","Date":"","Description":"","ExportedFunctions":["AssertMsg1","RTAssertDoBreakpoint","RTErrConvertFromNtStatus","RTLogDefaultInstance","RTLogLogger","RTLogLoggerEx","RTLogLoggerExV","RTLogPrintf","RTLogPrintfV","RTLogRelDefaultInstance","RTLogSetDefaultInstanceThread","RTMemAlloc","RTMemAllocZ","RTMemContAlloc","RTMemContFree","RTMemExecAlloc","RTMemExecFree","RTMemFree","RTMemRealloc","RTMemTmpAlloc","RTMemTmpAllocZ","RTMemTmpFree","RTMpCpuId","RTMpCpuIdFromSetIndex","RTMpCpuIdToSetIndex","RTMpDoesCpuExist","RTMpGetCount","RTMpGetMaxCpuId","RTMpGetOnlineCount","RTMpGetOnlineSet","RTMpGetSet","RTMpIsCpuOnline","RTMpOnAll","RTMpOnOthers","RTMpOnSpecific","RTProcSelf","RTR0MemObjAddress","RTR0MemObjAddressR3","RTR0MemObjAllocCont","RTR0MemObjAllocLow","RTR0MemObjAllocPage","RTR0MemObjAllocPhys","RTR0MemObjAllocPhysNC","RTR0MemObjEnterPhys","RTR0MemObjFree","RTR0MemObjGetPagePhysAddr","RTR0MemObjIsMapping","RTR0MemObjLockKernel","RTR0MemObjLockUser","RTR0MemObjMapKernel","RTR0MemObjMapUser","RTR0MemObjReserveKernel","RTR0MemObjReserveUser","RTR0MemObjSize","RTR0ProcHandleSelf","RTSemEventCreate","RTSemEventDestroy","RTSemEventMultiCreate","RTSemEventMultiDestroy","RTSemEventMultiReset","RTSemEventMultiSignal","RTSemEventMultiWait","RTSemEventMultiWaitNoResume","RTSemEventSignal","RTSemEventWait","RTSemEventWaitNoResume","RTSemFastMutexCreate","RTSemFastMutexDestroy","RTSemFastMutexRelease","RTSemFastMutexRequest","RTSpinlockAcquire","RTSpinlockAcquireNoInts","RTSpinlockCreate","RTSpinlockDestroy","RTSpinlockRelease","RTSpinlockReleaseNoInts","RTThreadNativeSelf","RTThreadSleep","RTThreadYield","SUPR0ContAlloc","SUPR0ContFree","SUPR0GipMap","SUPR0GipUnmap","SUPR0LockMem","SUPR0LowAlloc","SUPR0LowFree","SUPR0MemAlloc","SUPR0MemFree","SUPR0MemGetPhys","SUPR0ObjAddRef","SUPR0ObjRegister","SUPR0ObjRelease","SUPR0ObjVerifyAccess","SUPR0PageAlloc","SUPR0PageFree","SUPR0UnlockMem"],"FileVersion":"","Filename":"","ImportedFunctions":["RtlInitUnicodeString","KeCancelTimer","KeInsertQueueDpc","KeQueryActiveProcessors","_allshl","MmMapLockedPagesSpecifyCache","_except_handler3","MmUnmapLockedPages","KeSetTimerEx","IoDeleteDevice","IoDeleteSymbolicLink","KeSetTargetProcessorDpc","KeSetImportanceDpc","KeInitializeDpc","KeInitializeTimerEx","MmGetPhysicalAddress","ExSetTimerResolution","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmAllocateContiguousMemory","IoCreateSymbolicLink","IoCreateDevice","MmGetSystemRoutineAddress","strncmp","IoFreeMdl","MmFreeContiguousMemory","_allmul","PsGetCurrentProcessId","IoGetCurrentProcess","ExFreePoolWithTag","ExAllocatePoolWithTag","KeGetCurrentThread","KeDelayExecutionThread","ZwYieldExecution","KeInitializeSpinLock","KeInitializeEvent","KeSetEvent","KeResetEvent","KeWaitForSingleObject","MmUnmapIoSpace","MmUnlockPages","MmFreePagesFromMdl","MmUnsecureVirtualMemory","MmAllocatePagesForMdl","MmSecureVirtualMemory","MmProbeAndLockPages","MmMapIoSpace","KeQueryInterruptTime","DbgPrint","memchr","IofCompleteRequest","ExReleaseFastMutex","KfReleaseSpinLock","KfAcquireSpinLock","KfRaiseIrql","KfLowerIrql","ExAcquireFastMutex"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"1c31d4e9ad2d2b5600ae9d0c0969fe59","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"5f57854adbd1e5c955b74bee2a0da686","SHA1":"744192af8f346e24f067553de75ff27e89fdd71b","SHA256":"b1f609edc9ffa87173741f486213b75d472e9d7446fcfcc9b21101d36d22e0b2"},"SHA1":"c8ec23066a50800d42913d5e439700c5cd6a2287","SHA256":"73fddd441a764e808ed6d6b8f3d0d13713e61221aa3cfef7da91cdaf112fe061","Sections":{".text":{"Entropy":6.337013968704709,"Virtual Size":"0x7064"},".rdata":{"Entropy":5.495656091270382,"Virtual Size":"0x670"},".data":{"Entropy":3.933952480103163,"Virtual Size":"0x2dd8"},".edata":{"Entropy":5.371945361152913,"Virtual Size":"0xa72"},"INIT":{"Entropy":5.289533643406638,"Virtual Size":"0x5d0"},".reloc":{"Entropy":6.153118387701222,"Virtual Size":"0x488"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de","ValidFrom":"2007-12-27 14:37:17","ValidTo":"2010-12-27 14:37:17","Signature":"2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"010000000001171c092665","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5cfd8530475b20ed5a2bed70b37ee977","SHA1":"4761dbd41ba2b01f21b9306ca21e8add93a30f09","SHA256":"219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f","SHA384":"46dcdf272bf47e608519abe5183dae12858d1b3763b78d7f5212be2adc021325e7f7a2ff3e18cc9b5307f43a61b184c5"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"010000000001171c092665","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"a7ff164c1ee5113a0a09e66b2cd03544","LoadsDespiteHVCI":"FALSE"}]}