{"Id":"36227ce7-2bf6-4963-bfae-c399000a1079","Tags":["rtif.sys"],"Verified":"TRUE","Author":"Takahiro Haruyama","Created":"2023-11-02","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create rtifsys binPath= C:\\windows\\temp\\rtifsys.sys type=kernel && sc.exe start rtifsys","Description":"The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"a15235fcec1c9b65d736661d4bec0d38","MachineType":"AMD64","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.2.17052.1","Publisher":"","SHA1":"3c956b524e73586195d704b874e36d49fe42cb6a","SHA256":"0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180","Signature":"","Imphash":"3e8e7e5e779c7064e6bab177167e9e7a","Authentihash":{"MD5":"923686e31f947b09e375b0ff00ee04ee","SHA1":"efec1e9d398ace84337c6c47cb6faabf25306f61","SHA256":"42b528fdde50a21afed0cbdc07a6cb9d22d421eb0228d4782f18d22a83873223"},"RichPEHeaderHash":{"MD5":"bd1a1b47cc595b8cfb7149b488f3a97a","SHA1":"29f469189ca25d35b22c3247ea5b72e7329fe047","SHA256":"025aad79c2efdc5f9b9de29f3f0bbc8825374fb5322d6170f850af2d466f91e7"},"Sections":{".text":{"Entropy":6.42952308951736,"Virtual Size":"0xd732"},".rdata":{"Entropy":4.907391515300349,"Virtual Size":"0xb54"},".data":{"Entropy":2.4272508950715737,"Virtual Size":"0x1228"},".pdata":{"Entropy":4.473261789501917,"Virtual Size":"0x48c"},"fixupseg":{"Entropy":2.130565711500572,"Virtual Size":"0x90"},"INIT":{"Entropy":5.258083162724522,"Virtual Size":"0xb42"},".rsrc":{"Entropy":3.499774553813321,"Virtual Size":"0x868"},".reloc":{"Entropy":3.298022087682721,"Virtual Size":"0x18a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-02-23 02:38:34","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2017 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["vsprintf","KeSetImportanceDpc","IoWriteErrorLogEntry","KeSetTargetProcessorDpc","KeQueryActiveProcessors","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterShutdownNotification","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","ProbeForWrite","RtlCheckRegistryKey","MmGetSystemRoutineAddress","RtlAppendUnicodeToString","KeInitializeEvent","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","MmFreeContiguousMemory","IoDetachDevice","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","IoAllocateErrorLogEntry","KeDelayExecutionThread","MmGetPhysicalAddress","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ExAllocatePool","KeRegisterBugCheckCallback","ExInterlockedInsertTailList","PsTerminateSystemThread","MmMapIoSpace","PoStartNextPowerIrp","KeInsertQueueDpc","KeQueryTimeIncrement","ZwClose","IofCompleteRequest","IoConnectInterrupt","KeInitializeSemaphore","ProbeForRead","KeWaitForSingleObject","KeBugCheckEx","RtlWriteRegistryValue","MmProbeAndLockPages","IoAttachDeviceToDeviceStack","PoCallDriver","PsGetVersion","KeReleaseSemaphore","ExInterlockedRemoveHeadList","MmUnlockPages","IoCreateSymbolicLink","PsGetCurrentProcessId","ObfDereferenceObject","IoCreateDevice","IoDisconnectInterrupt","MmGetPhysicalMemoryRanges","ExSetTimerResolution","KeDeregisterBugCheckCallback","RtlCreateRegistryKey","MmAllocateContiguousMemorySpecifyCache","DbgPrint","IoAllocateMdl","MmAllocateContiguousMemory","IofCallDriver","KeAcquireSpinLockRaiseToDpc","qsort","ZwQueryValueKey","ZwEnumerateKey","ZwOpenKey","_strnicmp","ZwCreateKey","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwSetValueKey","RtlFreeUnicodeString","ZwEnumerateValueKey","RtlAppendUnicodeStringToString","ZwDeleteKey","ZwQueryKey","ExAllocatePoolWithTag","ObReferenceObjectByHandle","MmUnmapLockedPages","__C_specific_handler","KeStallExecutionProcessor","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=Oregon, L=Beaverton, O=TenAsys Corporation, CN=TenAsys Corporation","ValidFrom":"2016-01-26 00:00:00","ValidTo":"2019-02-24 23:59:59","Signature":"6bd65ca638e319d95314b25cd934e3b93dfe0fd0a45123b253614bf02fa046d4326211369af0b0f1988ad29782701d61af07f7f634efc70629fb1dd50516734e782eabcdc7f1ad6b8688c5c76d126d606d2682e47161beea2975cb77c2c8800461b8efdfd4bcb71f9a3bce4d05443986bf681844c23506bf93ffb898f9b10e4303357499b7796367fc830318dc56b858f1b176b59c85a3cc70f82f788ebb3c5eeeea61e4d6ef9ab459e72d2ed29fb2fd37c0bd4877fc20e72a5cb383e65eadf55d63f6a2e6826234998a2a89cb26026d952dd214be4b50019cc8d81d8d53140ed344c19d73ac5c8a409241a1de1439e6380d86fbb445d1866f6ebff417f5c619","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"48144e98914632372cfb97f19d0ee4be","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0e9a3389871e543043e804810ec35578","SHA1":"b9490c80c0c0eea4c32883344f8b7538baf933b4","SHA256":"1ae6947dea0d79584c9678bea92bae639831ccceb8123668f6999cc9595c4208","SHA384":"8d6517b399feaae8a88957a932f54f0e78ad577b94ea177acd7aa4ddabda5a69e93d44c6fa6824191e2c331ec581b910"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"48144e98914632372cfb97f19d0ee4be","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"1873a2ce2df273d409c47094bc269285","MachineType":"I386","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.2.17052.1","Publisher":"","SHA1":"f049e68720a5f377a5c529ca82d1147fe21b4c33","SHA256":"3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76","Signature":"","Imphash":"d61d30746681d0fda9bfd9e8af061b2a","Authentihash":{"MD5":"7af3a3a48cb2049abc8c62efcd984bd0","SHA1":"f679711f5625ce95c6ebaaf554e9c26d89db0564","SHA256":"f46c524b79b9b1eb7efd5275dd1604de94560b52edca70ba4e47037f4b55da47"},"RichPEHeaderHash":{"MD5":"8af78de3036a1a61c2f7960f304e2fd8","SHA1":"9b85ed0afe26a8379ad12783d99bfffaca008da0","SHA256":"bf1fc947f315f3d5b99704872d19fb65dbef65beeeeb9b72df2d998e6845ef63"},"Sections":{".text":{"Entropy":6.587141921945886,"Virtual Size":"0x10ac9"},".rdata":{"Entropy":4.617227098056416,"Virtual Size":"0x544"},".data":{"Entropy":2.302558601990261,"Virtual Size":"0x3eac"},"fixupseg":{"Entropy":3.876717193094394,"Virtual Size":"0x38"},"INIT":{"Entropy":5.660866508935075,"Virtual Size":"0xade"},".rsrc":{"Entropy":3.502457842619463,"Virtual Size":"0x868"},".reloc":{"Entropy":6.577761371802183,"Virtual Size":"0x1338"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-02-23 02:38:31","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2017 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["ProbeForWrite","memcpy","KeReleaseSemaphore","MmFreeContiguousMemory","MmUnmapIoSpace","_aullshr","KeSetEvent","KeWaitForSingleObject","IofCallDriver","KeInitializeEvent","MmBuildMdlForNonPagedPool","MmUnmapLockedPages","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoAllocateMdl","RtlQueryRegistryValues","memset","ExAllocatePoolWithTag","RtlWriteRegistryValue","RtlCreateRegistryKey","RtlCheckRegistryKey","RtlAppendUnicodeToString","memmove","RtlInitUnicodeString","IoWriteErrorLogEntry","IoAllocateErrorLogEntry","vsprintf","KeInsertQueueDpc","PsTerminateSystemThread","KeDelayExecutionThread","KeBugCheckEx","KeInitializeSemaphore","PsGetCurrentProcessId","ExSetTimerResolution","KeQueryTimeIncrement","ExfInterlockedInsertTailList","ExfInterlockedRemoveHeadList","MmUnlockPages","MmProbeAndLockPages","PsGetVersion","KeDeregisterBugCheckCallback","ExFreePoolWithTag","KeRegisterBugCheckCallback","ProbeForRead","ZwClose","ZwSetInformationThread","PsCreateSystemThread","_aulldiv","IoDisconnectInterrupt","ObfDereferenceObject","PoCallDriver","IofCompleteRequest","PoStartNextPowerIrp","IoConnectInterrupt","IoDeleteDevice","IoDetachDevice","IoDeleteSymbolicLink","IoRegisterShutdownNotification","IoAttachDeviceToDeviceStack","KeSetImportanceDpc","KeInitializeDpc","IoCreateSymbolicLink","IoCreateDevice","ObReferenceObjectByHandle","MmGetPhysicalMemoryRanges","KeSetTargetProcessorDpc","KeQueryActiveProcessors","MmGetSystemRoutineAddress","RtlFreeUnicodeString","ZwCreateKey","RtlAppendUnicodeStringToString","RtlxAnsiStringToUnicodeSize","NlsMbCodePageTag","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwEnumerateKey","ZwEnumerateValueKey","ZwOpenKey","ZwQueryKey","ZwQueryValueKey","ZwSetValueKey","ZwDeleteKey","qsort","_allshl","KeTickCount","RtlUnwind","MmMapIoSpace","MmAllocateContiguousMemorySpecifyCache","MmAllocateContiguousMemory","MmGetPhysicalAddress","DbgPrint","_allmul","KeGetCurrentThread","ExAllocatePool","Kei386EoiHelper","KfRaiseIrql","KfLowerIrql","KeStallExecutionProcessor","KfReleaseSpinLock","KfAcquireSpinLock","HalEndSystemInterrupt","HalBeginSystemInterrupt","KeGetCurrentIrql"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=Oregon, L=Beaverton, O=TenAsys Corporation, CN=TenAsys Corporation","ValidFrom":"2016-01-26 00:00:00","ValidTo":"2019-02-24 23:59:59","Signature":"6bd65ca638e319d95314b25cd934e3b93dfe0fd0a45123b253614bf02fa046d4326211369af0b0f1988ad29782701d61af07f7f634efc70629fb1dd50516734e782eabcdc7f1ad6b8688c5c76d126d606d2682e47161beea2975cb77c2c8800461b8efdfd4bcb71f9a3bce4d05443986bf681844c23506bf93ffb898f9b10e4303357499b7796367fc830318dc56b858f1b176b59c85a3cc70f82f788ebb3c5eeeea61e4d6ef9ab459e72d2ed29fb2fd37c0bd4877fc20e72a5cb383e65eadf55d63f6a2e6826234998a2a89cb26026d952dd214be4b50019cc8d81d8d53140ed344c19d73ac5c8a409241a1de1439e6380d86fbb445d1866f6ebff417f5c619","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"48144e98914632372cfb97f19d0ee4be","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0e9a3389871e543043e804810ec35578","SHA1":"b9490c80c0c0eea4c32883344f8b7538baf933b4","SHA256":"1ae6947dea0d79584c9678bea92bae639831ccceb8123668f6999cc9595c4208","SHA384":"8d6517b399feaae8a88957a932f54f0e78ad577b94ea177acd7aa4ddabda5a69e93d44c6fa6824191e2c331ec581b910"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"48144e98914632372cfb97f19d0ee4be","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"420 built by: WinDDK","Filename":"","MD5":"112b4a6d8c205c1287c66ad0009c3226","MachineType":"AMD64","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"4.2.11285.1","Publisher":"","SHA1":"0caf4e86b14aaab7e10815389fcd635988bc6637","SHA256":"4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0","Signature":"","Imphash":"c12f7aec6ebe84a8390c82720adfc237","Authentihash":{"MD5":"e6dc1afaf3f32d09e92e237291b0e634","SHA1":"7c594957e490db58473132f699b4bac82f4928ed","SHA256":"ba6c0c9b64fa739158b5f4465d53e67e574e4b954c8e143cf4e299f5daa65b60"},"RichPEHeaderHash":{"MD5":"997e86308bb3d4c9955a3f0e555bbb27","SHA1":"a8e0bae7f09f9a80fadb797b1b49e08365f0c100","SHA256":"0aff0c81695a78ab174c12bf46bea5496ea265cd6a997b22aa7b2299d38f420b"},"Sections":{".text":{"Entropy":6.44011759982148,"Virtual Size":"0xa5c6"},".rdata":{"Entropy":4.742166212153357,"Virtual Size":"0x9ac"},".data":{"Entropy":2.278701113566387,"Virtual Size":"0x112c"},".pdata":{"Entropy":4.385610410851554,"Virtual Size":"0x390"},"fixupseg":{"Entropy":2.1424575919897277,"Virtual Size":"0x90"},"INIT":{"Entropy":5.224428786014072,"Virtual Size":"0xace"},".rsrc":{"Entropy":3.491997169876269,"Virtual Size":"0x868"},".reloc":{"Entropy":3.3374282311041794,"Virtual Size":"0x158"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2011-10-12 13:36:49","InternalName":"rtif.sys","Copyright":"Copyright © 2000-2011 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoCreateDevice","vsprintf","KeReleaseSpinLock","IoDisconnectInterrupt","MmFreeContiguousMemory","IoConnectInterrupt","KeSetImportanceDpc","IoWriteErrorLogEntry","KeInitializeSemaphore","KeSetTargetProcessorDpc","IoDetachDevice","ObReferenceObjectByHandle","MmGetPhysicalMemoryRanges","KeWaitForSingleObject","MmUnmapIoSpace","KeBugCheckEx","ExSetTimerResolution","KeQueryActiveProcessors","MmBuildMdlForNonPagedPool","IoFreeMdl","KeDeregisterBugCheckCallback","IoAllocateErrorLogEntry","RtlWriteRegistryValue","IoDeleteSymbolicLink","RtlCreateRegistryKey","ExFreePoolWithTag","MmProbeAndLockPages","KeDelayExecutionThread","MmAllocateContiguousMemorySpecifyCache","IoRegisterShutdownNotification","MmGetPhysicalAddress","IoAttachDeviceToDeviceStack","DbgPrint","PoCallDriver","PsCreateSystemThread","IoAllocateMdl","PsGetVersion","MmAllocateContiguousMemory","MmMapLockedPagesSpecifyCache","IofCompleteRequest","IofCallDriver","ExAllocatePool","KeRegisterBugCheckCallback","ExInterlockedRemoveHeadList","KeAcquireSpinLockRaiseToDpc","RtlInitUnicodeString","IoDeleteDevice","ExInterlockedInsertTailList","KeSetEvent","MmUnlockPages","RtlCheckRegistryKey","PsTerminateSystemThread","MmMapIoSpace","PoStartNextPowerIrp","RtlAppendUnicodeToString","IoCreateSymbolicLink","KeInitializeEvent","KeInsertQueueDpc","PsGetCurrentProcessId","RtlQueryRegistryValues","KeQueryTimeIncrement","MmUnmapLockedPages","ZwClose","ObfDereferenceObject","qsort","ZwSetValueKey","RtlFreeUnicodeString","ZwQueryValueKey","ZwEnumerateValueKey","RtlAppendUnicodeStringToString","ZwDeleteKey","ZwEnumerateKey","ZwQueryKey","ZwOpenKey","_strnicmp","ZwCreateKey","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ExAllocatePoolWithTag","KeReleaseSemaphore","KeInitializeDpc","__C_specific_handler","KeStallExecutionProcessor","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, ST=Oregon, O=TenAsys Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TenAsys Corporation","ValidFrom":"2009-11-10 00:00:00","ValidTo":"2013-01-06 23:59:59","Signature":"262c2f37a476974743e60dea46e83c8b4f65e6080c0ad73557ae2262c5721ef497d887050c3750baaf8d442a40f94e45ea242af60d001e3a63b274125909eaf0a5ca5a1958e52b455e78709ec5e25edd7905501cd98a76dd067013f5f3097df87fc7640cdbfa2e927088ba6c802ce950ecd8b2d31b19844dab4fb762117b685443fadb0b98ec5ebfab39e258189876a130dd632db1a835098089efda7577f306a3fe0f98101c61fe3c47d982e49b15da79af2be683539ffbb0db498c828e26d181a2c870df943f3afcb6821a0c5f9d5c5738b37f76dea2a8edf5f616489325755ba599e893bfaab9db2d7b27f2fdfea22ff39d8ae67632ee0b05fed784519d8a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"51bcef5e74e1e3b240d5810567ce302c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"73212ac71d9ad2c80562d2b9c9731baf","SHA1":"56bc1887672e29ec35d3616eb18842f939f10189","SHA256":"d66372658e2b18b256863b7744069002eccb9cb315fc86709cf9d2721e6f70bc","SHA384":"458ceb8f5cd2b86fb13ca1c1ac1c69aa60c8848f3f1735bbeb59d4286eb73f1270513282e8144066b9e1fc641a881fb6"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"51bcef5e74e1e3b240d5810567ce302c","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"35fbc4c04c31c1a40e666be6529c6321","MachineType":"AMD64","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.4.21343.1","Publisher":"","SHA1":"f130e82524d8f5af403c3b0e0ffa4b64fedeec92","SHA256":"9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727","Signature":"","Imphash":"c61a46ffe79d3f7d6307c0d2ae5f391e","Authentihash":{"MD5":"290543f10941cfee914bdd8dda18265b","SHA1":"d5ecb45182c0abe8797cd44811e8149728c3be88","SHA256":"c662ed197a5849cf491ee099885f8855b4f8a3d0f5b664c772f2b89c0314b44e"},"RichPEHeaderHash":{"MD5":"d6fb66aaac430a7dc9c7713f79d69cca","SHA1":"d6b38a27252781d408366fedf64b511430abc6c4","SHA256":"216010c066da2a14201dd77209feba952fd16158edddee4747f2587041501963"},"Sections":{".text":{"Entropy":6.44001479611193,"Virtual Size":"0xe5b2"},".rdata":{"Entropy":4.918478454999801,"Virtual Size":"0xc7c"},".data":{"Entropy":2.439249315977124,"Virtual Size":"0x1558"},".pdata":{"Entropy":4.792418577201328,"Virtual Size":"0x4a4"},"fixupseg":{"Entropy":2.1620193574240503,"Virtual Size":"0x90"},"INIT":{"Entropy":5.281621749998813,"Virtual Size":"0xb32"},".rsrc":{"Entropy":3.496623662060939,"Virtual Size":"0x868"},".reloc":{"Entropy":3.2671345238840304,"Virtual Size":"0x194"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-12-09 16:10:02","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2021 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["vsprintf","KeSetImportanceDpc","IoWriteErrorLogEntry","KeSetTargetProcessorDpc","KeQueryActiveProcessors","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterShutdownNotification","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","ProbeForWrite","RtlCheckRegistryKey","MmGetSystemRoutineAddress","RtlAppendUnicodeToString","KeInitializeEvent","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","MmFreeContiguousMemory","IoDetachDevice","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","IoAllocateErrorLogEntry","KeDelayExecutionThread","MmGetPhysicalAddress","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ExAllocatePool","KeRegisterBugCheckCallback","ExInterlockedInsertTailList","PsTerminateSystemThread","MmMapIoSpace","PoStartNextPowerIrp","KeInsertQueueDpc","KeQueryTimeIncrement","ZwClose","IofCompleteRequest","IoConnectInterrupt","ProbeForRead","ObReferenceObjectByHandle","KeWaitForSingleObject","KeBugCheckEx","RtlWriteRegistryValue","MmProbeAndLockPages","IoAttachDeviceToDeviceStack","PoCallDriver","PsGetVersion","KeReleaseSemaphore","ExInterlockedRemoveHeadList","MmUnlockPages","IoCreateSymbolicLink","PsGetCurrentProcessId","ObfDereferenceObject","IoCreateDevice","IoDisconnectInterrupt","MmGetPhysicalMemoryRanges","ExSetTimerResolution","KeDeregisterBugCheckCallback","RtlCreateRegistryKey","MmAllocateContiguousMemorySpecifyCache","DbgPrint","IoAllocateMdl","MmAllocateContiguousMemory","IofCallDriver","KeAcquireSpinLockRaiseToDpc","ZwQueryValueKey","ZwEnumerateKey","ZwOpenKey","_strnicmp","ZwCreateKey","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwSetValueKey","RtlFreeUnicodeString","ZwEnumerateValueKey","RtlAppendUnicodeStringToString","ZwDeleteKey","ZwQueryKey","ExAllocatePoolWithTag","KeInitializeSemaphore","MmUnmapLockedPages","__C_specific_handler","KeStallExecutionProcessor","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Oregon, L=Hillsboro, O=TenAsys Corporation, CN=TenAsys Corporation","ValidFrom":"2019-02-05 00:00:00","ValidTo":"2022-03-11 23:59:59","Signature":"0ec0ec4f04c6912e3fa420ef365e84de1c2fcd1eba4f8b6e3524e045204247759ed47f8abe6c76d5d48eed16af8155b179f730f13dca29a43be524a3554d890a80544fe7b181a8764c7a305f0ed8c0917bc888e31539aab264236d9fb1c7198f8999c9902fc91e616f9390a7a31b3717d2efb4f2be4f24380baf625bd01623d75d3c1bb3f7affbecd3127a9c18cb467b12aefc3796ea0957a055c23d12dfaf756a9772e05c23543f3eefb5af751c8be2b2fdc6dfc062730042a8da50a76fb6a0204bba0452670860ff9e2326dfbc092f634d7735b6a7705dd5248734ed5705a60e964726c304ae4267e236a2332ce7e02a24733439f7a301fb33885c4115744a","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"37d0405e434278e6e7a0e83dc459f6a1","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"16a5271a8c1c607cb7f8e39f9983bfe1","SHA1":"674b0b16bf2685f979517b6337ecff57fb949821","SHA256":"881fcc016d5774f69cbd3610e8982804499226f7172b3ebd42a4f860e88f0a97","SHA384":"c3ed616e80e3efbbf9ff8a32718c8cafdac6b0f6f665a2d94f237937b8517c54ec2df471d6d305e773d331e868017ffd"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"37d0405e434278e6e7a0e83dc459f6a1","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"6c5e50ef2069896f408cdaaddd307893","MachineType":"I386","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.4.21343.1","Publisher":"","SHA1":"8d676504c2680cf71c0c91afb18af40ea83b6c22","SHA256":"a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e","Signature":"","Imphash":"e1d88d0526dfa369c3661355dbd8773d","Authentihash":{"MD5":"e8e61cae63a99c97074c083bca2b4231","SHA1":"2ab81656c1eece7b9b05e0d28257acdca216336a","SHA256":"a2dee316cd07963c2eb7ebb1b4189eca78786c835aaafeb6467b37c1353d821a"},"RichPEHeaderHash":{"MD5":"8af78de3036a1a61c2f7960f304e2fd8","SHA1":"9b85ed0afe26a8379ad12783d99bfffaca008da0","SHA256":"bf1fc947f315f3d5b99704872d19fb65dbef65beeeeb9b72df2d998e6845ef63"},"Sections":{".text":{"Entropy":6.611390928364727,"Virtual Size":"0x11bc1"},".rdata":{"Entropy":4.501948591854601,"Virtual Size":"0x634"},".data":{"Entropy":2.2875585804731453,"Virtual Size":"0x418c"},"fixupseg":{"Entropy":3.7598332194665756,"Virtual Size":"0x38"},"INIT":{"Entropy":5.6467030835991,"Virtual Size":"0xae2"},".rsrc":{"Entropy":3.497873641585053,"Virtual Size":"0x868"},".reloc":{"Entropy":6.589111544688887,"Virtual Size":"0x14ae"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-12-09 16:09:58","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2021 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["ProbeForWrite","memcpy","KeReleaseSemaphore","MmFreeContiguousMemory","MmUnmapIoSpace","_allshl","_aullshr","KeSetEvent","KeWaitForSingleObject","IofCallDriver","KeInitializeEvent","MmUnmapLockedPages","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoAllocateMdl","_aullrem","RtlQueryRegistryValues","memset","ExAllocatePoolWithTag","RtlWriteRegistryValue","RtlCreateRegistryKey","RtlCheckRegistryKey","ExFreePoolWithTag","RtlAppendUnicodeToString","memmove","RtlInitUnicodeString","IoWriteErrorLogEntry","IoAllocateErrorLogEntry","vsprintf","KeInsertQueueDpc","PsTerminateSystemThread","KeDelayExecutionThread","KeBugCheckEx","KeInitializeSemaphore","PsGetCurrentProcessId","ExSetTimerResolution","KeQueryTimeIncrement","ExfInterlockedInsertTailList","ExfInterlockedRemoveHeadList","MmUnlockPages","MmProbeAndLockPages","PsGetVersion","ProbeForRead","KeRegisterBugCheckCallback","ExAllocatePool","ZwClose","ZwSetInformationThread","PsCreateSystemThread","_aulldiv","IoDisconnectInterrupt","ObfDereferenceObject","PoCallDriver","IofCompleteRequest","PoStartNextPowerIrp","IoConnectInterrupt","IoDeleteDevice","IoDetachDevice","IoDeleteSymbolicLink","IoRegisterShutdownNotification","IoAttachDeviceToDeviceStack","KeSetImportanceDpc","KeInitializeDpc","IoCreateSymbolicLink","IoCreateDevice","ObReferenceObjectByHandle","MmGetPhysicalMemoryRanges","KeSetTargetProcessorDpc","KeQueryActiveProcessors","MmGetSystemRoutineAddress","RtlFreeUnicodeString","ZwCreateKey","RtlAppendUnicodeStringToString","RtlxAnsiStringToUnicodeSize","NlsMbCodePageTag","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwEnumerateKey","ZwEnumerateValueKey","ZwOpenKey","ZwQueryKey","ZwQueryValueKey","ZwSetValueKey","ZwDeleteKey","KeTickCount","RtlUnwind","MmMapIoSpace","MmAllocateContiguousMemorySpecifyCache","MmAllocateContiguousMemory","MmGetPhysicalAddress","DbgPrint","_allmul","KeGetCurrentThread","KeDeregisterBugCheckCallback","Kei386EoiHelper","KfRaiseIrql","KfLowerIrql","KeStallExecutionProcessor","KfReleaseSpinLock","KfAcquireSpinLock","HalEndSystemInterrupt","HalBeginSystemInterrupt","KeGetCurrentIrql"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Oregon, L=Hillsboro, O=TenAsys Corporation, CN=TenAsys Corporation","ValidFrom":"2019-02-05 00:00:00","ValidTo":"2022-03-11 23:59:59","Signature":"0ec0ec4f04c6912e3fa420ef365e84de1c2fcd1eba4f8b6e3524e045204247759ed47f8abe6c76d5d48eed16af8155b179f730f13dca29a43be524a3554d890a80544fe7b181a8764c7a305f0ed8c0917bc888e31539aab264236d9fb1c7198f8999c9902fc91e616f9390a7a31b3717d2efb4f2be4f24380baf625bd01623d75d3c1bb3f7affbecd3127a9c18cb467b12aefc3796ea0957a055c23d12dfaf756a9772e05c23543f3eefb5af751c8be2b2fdc6dfc062730042a8da50a76fb6a0204bba0452670860ff9e2326dfbc092f634d7735b6a7705dd5248734ed5705a60e964726c304ae4267e236a2332ce7e02a24733439f7a301fb33885c4115744a","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"37d0405e434278e6e7a0e83dc459f6a1","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"16a5271a8c1c607cb7f8e39f9983bfe1","SHA1":"674b0b16bf2685f979517b6337ecff57fb949821","SHA256":"881fcc016d5774f69cbd3610e8982804499226f7172b3ebd42a4f860e88f0a97","SHA384":"c3ed616e80e3efbbf9ff8a32718c8cafdac6b0f6f665a2d94f237937b8517c54ec2df471d6d305e773d331e868017ffd"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"37d0405e434278e6e7a0e83dc459f6a1","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"4b42a7a6327827a8dbdecf367832c0cd","MachineType":"AMD64","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.0.14175.1","Publisher":"","SHA1":"ce1d0ebaeaa4fe3ecb49242f1e80bc7a4e43fd8c","SHA256":"ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d","Signature":"","Imphash":"3e8e7e5e779c7064e6bab177167e9e7a","Authentihash":{"MD5":"41cb3bf0ce126d2e909ef8918312578c","SHA1":"54bed9a75d950714920d1415be6e273c0ac987e4","SHA256":"19595c3de596f8b705eef1b135768d3051305698ceed083401f8acfba4bd5393"},"RichPEHeaderHash":{"MD5":"bd1a1b47cc595b8cfb7149b488f3a97a","SHA1":"29f469189ca25d35b22c3247ea5b72e7329fe047","SHA256":"025aad79c2efdc5f9b9de29f3f0bbc8825374fb5322d6170f850af2d466f91e7"},"Sections":{".text":{"Entropy":6.410108417426959,"Virtual Size":"0xb9c2"},".rdata":{"Entropy":4.842622218133403,"Virtual Size":"0xa94"},".data":{"Entropy":2.687030222106283,"Virtual Size":"0x1160"},".pdata":{"Entropy":4.457711986438197,"Virtual Size":"0x420"},"fixupseg":{"Entropy":2.1424575919897277,"Virtual Size":"0x90"},"INIT":{"Entropy":5.313487977603218,"Virtual Size":"0xb42"},".rsrc":{"Entropy":3.4923506860842393,"Virtual Size":"0x868"},".reloc":{"Entropy":3.3188012062753227,"Virtual Size":"0x16c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-09-24 02:39:12","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2014 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["vsprintf","KeSetImportanceDpc","IoWriteErrorLogEntry","KeSetTargetProcessorDpc","KeQueryActiveProcessors","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterShutdownNotification","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","ProbeForWrite","RtlCheckRegistryKey","MmGetSystemRoutineAddress","RtlAppendUnicodeToString","KeInitializeEvent","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","MmFreeContiguousMemory","IoDetachDevice","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","IoAllocateErrorLogEntry","KeDelayExecutionThread","MmGetPhysicalAddress","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ExAllocatePool","KeRegisterBugCheckCallback","ExInterlockedInsertTailList","PsTerminateSystemThread","MmMapIoSpace","PoStartNextPowerIrp","KeInsertQueueDpc","KeQueryTimeIncrement","ZwClose","IofCompleteRequest","IoConnectInterrupt","KeInitializeSemaphore","ProbeForRead","KeWaitForSingleObject","KeBugCheckEx","RtlWriteRegistryValue","MmProbeAndLockPages","IoAttachDeviceToDeviceStack","PoCallDriver","PsGetVersion","KeReleaseSemaphore","ExInterlockedRemoveHeadList","MmUnlockPages","IoCreateSymbolicLink","PsGetCurrentProcessId","ObfDereferenceObject","IoCreateDevice","IoDisconnectInterrupt","MmGetPhysicalMemoryRanges","ExSetTimerResolution","KeDeregisterBugCheckCallback","RtlCreateRegistryKey","MmAllocateContiguousMemorySpecifyCache","DbgPrint","IoAllocateMdl","MmAllocateContiguousMemory","IofCallDriver","KeAcquireSpinLockRaiseToDpc","qsort","ZwQueryValueKey","ZwEnumerateKey","ZwOpenKey","_strnicmp","ZwCreateKey","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwSetValueKey","RtlFreeUnicodeString","ZwEnumerateValueKey","RtlAppendUnicodeStringToString","ZwDeleteKey","ZwQueryKey","ExAllocatePoolWithTag","ObReferenceObjectByHandle","MmUnmapLockedPages","__C_specific_handler","KeStallExecutionProcessor","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=Oregon, L=Beaverton, O=TenAsys Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TenAsys Corporation","ValidFrom":"2012-11-09 00:00:00","ValidTo":"2016-02-08 23:59:59","Signature":"cafd0647d75ebf938b2174bd975296645111e85e40a73ca4b6383ba868a76b7843d80b323b3b81c3b62bfc1c3b7c8ea6741feb755933dcb26a2aff220b485ad468b5535a4a679f30dbc91001356a5816f0a49884636bc7ea9d6b5e9c3f73d450dc495d5788f8f8c2ef34370354c0242919abe86223ce3b5460dc41a9335a9ba65c613a37c1801f268f9f10df31c11021d757cedbfd8ddad0acbced73bc41dc2b6f5fb55add1781b9cc8454d3c05d1399cbc37c6b92880069475fef20d1446b820eb11bd145e3dc3a7335bd7bff0be31cba3c5454d954084ca7214a598b398b449aafbe94bdf0c207e55a7d386d3e2b08866376727e23058c10bdb701d18aa333","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1dd16244250a5187fb55951ad3c3bc6b","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"280d8570801ef8d255171e7f7e2573d3","SHA1":"099a6d7560bef4c1b9a25e11a7298ec7e15b97da","SHA256":"af89dd187fff2c8aa46f7b79c9d4fa18cf2c6916ba124fec64b7cce5dfbcb299","SHA384":"c1a7273a8c438c778848868e347b0d030d674665580fb6abc794c0f09e4d0bf339dcb1cd3bea7bf3d78afbafeda2fe24"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"1dd16244250a5187fb55951ad3c3bc6b","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"TenAsys Corporation","Date":"","Description":"INtime PnP RT Kernel Interface Driver","FileVersion":"500 built by: WinDDK","Filename":"","MD5":"ff795e4f387c3e22291083b7d6b92ffb","MachineType":"AMD64","OriginalFilename":"rtif.sys","Product":"INtime","ProductVersion":"6.0.14091.1","Publisher":"","SHA1":"5eb693c9cc49c7d6a03f7960ddcfd8f468e5656b","SHA256":"eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed","Signature":"","Imphash":"3d42ff70269b824dd9d4a8cb905669f9","Authentihash":{"MD5":"0a889f7961b83dc1d637bcc92560074b","SHA1":"0e4691a2e125f4f61f37654252cd46bba76d9987","SHA256":"c9aeead632435bda4f5723fff5c48dc60451072bfc8649f2ad6e066ca910934a"},"RichPEHeaderHash":{"MD5":"d81e83b51349be2642cc2c864adf6c87","SHA1":"d6dbea33d7267fa631c0632aaff1c3e5142639c5","SHA256":"74739de917e2aebbe337b52ec0ccb104516a3df9b9b373802f0506a0d2a74abb"},"Sections":{".text":{"Entropy":6.414410444162882,"Virtual Size":"0xb692"},".rdata":{"Entropy":4.809552537003447,"Virtual Size":"0xa64"},".data":{"Entropy":2.680405412897324,"Virtual Size":"0x1160"},".pdata":{"Entropy":4.413489143500231,"Virtual Size":"0x420"},"fixupseg":{"Entropy":2.1424575919897277,"Virtual Size":"0x90"},"INIT":{"Entropy":5.3224584364088,"Virtual Size":"0xb12"},".rsrc":{"Entropy":3.49190189323868,"Virtual Size":"0x868"},".reloc":{"Entropy":3.3188012062753227,"Virtual Size":"0x16c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2014-04-01 23:08:39","InternalName":"rtif.sys","Copyright":"Copyright © 2002-2014 by TenAsys Corporation.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeSetImportanceDpc","IoWriteErrorLogEntry","KeSetTargetProcessorDpc","KeQueryActiveProcessors","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterShutdownNotification","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","RtlCheckRegistryKey","MmGetSystemRoutineAddress","RtlAppendUnicodeToString","KeInitializeEvent","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","MmFreeContiguousMemory","IoDetachDevice","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","IoFreeMdl","IoAllocateErrorLogEntry","KeDelayExecutionThread","MmGetPhysicalAddress","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ExAllocatePool","KeRegisterBugCheckCallback","ExInterlockedInsertTailList","PsTerminateSystemThread","MmMapIoSpace","PoStartNextPowerIrp","KeInsertQueueDpc","KeQueryTimeIncrement","ZwClose","IofCompleteRequest","IoConnectInterrupt","KeInitializeSemaphore","ObReferenceObjectByHandle","vsprintf","KeBugCheckEx","RtlWriteRegistryValue","MmProbeAndLockPages","IoAttachDeviceToDeviceStack","PoCallDriver","PsGetVersion","KeReleaseSemaphore","ExInterlockedRemoveHeadList","MmUnlockPages","IoCreateSymbolicLink","PsGetCurrentProcessId","ObfDereferenceObject","IoCreateDevice","IoDisconnectInterrupt","MmGetPhysicalMemoryRanges","ExSetTimerResolution","KeDeregisterBugCheckCallback","RtlCreateRegistryKey","MmAllocateContiguousMemorySpecifyCache","DbgPrint","IoAllocateMdl","MmAllocateContiguousMemory","IofCallDriver","KeAcquireSpinLockRaiseToDpc","qsort","ZwQueryValueKey","ZwEnumerateKey","ZwOpenKey","_strnicmp","ZwCreateKey","RtlAnsiStringToUnicodeString","RtlInitAnsiString","ZwDeleteValueKey","ZwSetValueKey","RtlFreeUnicodeString","ZwEnumerateValueKey","RtlAppendUnicodeStringToString","ZwDeleteKey","ZwQueryKey","ExAllocatePoolWithTag","KeWaitForSingleObject","MmUnmapLockedPages","__C_specific_handler","KeStallExecutionProcessor","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=Oregon, L=Beaverton, O=TenAsys Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TenAsys Corporation","ValidFrom":"2012-11-09 00:00:00","ValidTo":"2016-02-08 23:59:59","Signature":"cafd0647d75ebf938b2174bd975296645111e85e40a73ca4b6383ba868a76b7843d80b323b3b81c3b62bfc1c3b7c8ea6741feb755933dcb26a2aff220b485ad468b5535a4a679f30dbc91001356a5816f0a49884636bc7ea9d6b5e9c3f73d450dc495d5788f8f8c2ef34370354c0242919abe86223ce3b5460dc41a9335a9ba65c613a37c1801f268f9f10df31c11021d757cedbfd8ddad0acbced73bc41dc2b6f5fb55add1781b9cc8454d3c05d1399cbc37c6b92880069475fef20d1446b820eb11bd145e3dc3a7335bd7bff0be31cba3c5454d954084ca7214a598b398b449aafbe94bdf0c207e55a7d386d3e2b08866376727e23058c10bdb701d18aa333","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1dd16244250a5187fb55951ad3c3bc6b","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"280d8570801ef8d255171e7f7e2573d3","SHA1":"099a6d7560bef4c1b9a25e11a7298ec7e15b97da","SHA256":"af89dd187fff2c8aa46f7b79c9d4fa18cf2c6916ba124fec64b7cce5dfbcb299","SHA384":"c1a7273a8c438c778848868e347b0d030d674665580fb6abc794c0f09e4d0bf339dcb1cd3bea7bf3d78afbafeda2fe24"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"1dd16244250a5187fb55951ad3c3bc6b","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"}]}