{"Id":"47fe1aaf-02cd-4a41-8bf5-0047015a2a6e","Tags":["phymem64.sys","phymem.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create phymem64.sys binPath=C:\\windows\\temp\\phymem64.sys type=kernel && sc.exe start phymem64.sys","Description":"Supermicro phymem drivers expose direct physical-memory operations to user mode. In the tracked 2.3.0.0 build, IOCTL 0x80002000 accepts a physical address and length, maps the range with MmMapIoSpace, builds an MDL, and maps the pages to user mode with MmMapLockedPagesSpecifyCache; 0x80002004 releases the mapping. Adjacent paths provide direct physical-memory reads and port I/O. An administrator with device access can use these primitives to inspect or modify kernel state.","OperatingSystem":"Windows 10","Privileges":"Administrator","Usecase":"Read and write physical memory"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"aa43aa9f88e2fed984077a8852d85a4f","SHA1":"52a8cd44646973b59c244b5f7b04b33a412634a2","SHA256":"6ed3379d7ac1ad8bcfd13cd2502420569088ee7f1e04522ada48481d9a545a08"},"Company":"Super Micro Computer, Inc.","Copyright":"Copyright(c) 1993-2015 Super Micro Computer, Inc.","CreationTimestamp":"2015-04-09 02:40:09","Date":"","Description":"phymem Application","ExportedFunctions":"","FileVersion":"1, 0, 0, 0","Filename":"phymem64.sys","ImportedFunctions":["KeWaitForSingleObject","IofCallDriver","IoBuildSynchronousFsdRequest","KeInitializeEvent","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","ExAllocatePool","IofCompleteRequest","ExFreePoolWithTag","IoFreeMdl","MmUnmapLockedPages","MmUnmapIoSpace","ExReleaseFastMutex","ExAcquireFastMutex","MmMapLockedPages","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmMapIoSpace","IoDeleteSymbolicLink","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer"],"Imports":["NTOSKRNL.exe"],"InternalName":"phymem","MD5":"2c54859a67306e20bfdc8887b537de72","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"phymem.sys","Product":"phymem","ProductVersion":"1, 0, 0, 0","Publisher":"","RichPEHeaderHash":{"MD5":"bd33f84d81742c17cfc029ea6abe4802","SHA1":"633f4488d46ab5179e9077c28f5f311b3710a84f","SHA256":"c5e9cb841597fe8ccfab8e3e9ec59a3ab7df0c4cc78e5f890ceca5cdfbf823d9"},"SHA1":"d7f7594ff084201c0d9fa2f4ef1626635b67bce5","SHA256":"1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52","Sections":{".text":{"Entropy":5.325588962543002,"Virtual Size":"0x1304"},".rdata":{"Entropy":2.9789372580558635,"Virtual Size":"0x124"},".data":{"Entropy":4.0189779389354525,"Virtual Size":"0x378"},".pdata":{"Entropy":3.4505600621755907,"Virtual Size":"0x9c"},"INIT":{"Entropy":4.476869723241912,"Virtual Size":"0x2e6"},".rsrc":{"Entropy":3.2030597101899123,"Virtual Size":"0x3b8"}},"Signature":["Super Micro Computer, Inc.","VeriSign Class 3 Code Signing 2010 CA","VeriSign"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2006-11-08 00:00:00","ValidTo":"2021-11-07 23:59:59","Signature":"1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"250ce8e030612e9f2b89f7054d7cf8fd","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"918d9eb6a6cd36c531eceb926170a7e1","SHA1":"0ae95700d65e6f59715aa47048993ca7858e676a","SHA256":"47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166","SHA384":"e54017c93ba52f012cc15aeb3bcbce1e90a0006ff8dca231a24fc572926770f63213343f538003407bed3463fa9c4a85"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}},{"Subject":"C=US, ST=California, L=San Jose, O=Super Micro Computer, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Software, CN=Super Micro Computer, Inc.","ValidFrom":"2012-09-14 00:00:00","ValidTo":"2015-11-13 23:59:59","Signature":"47334026faeeba8c5d59d4971b4bfccff0fdf0a606adfb714c7ece1a3ddc350f198097d2ba6079ca9eabe64f03f7375b78366baa8ac1e9295c31d03b9fca004b8fb5f70d9c98b7905f4b151edc16ca82731498451fcc28f31665c1850d887f0ece1ef0fad9ffd0dd7b1515fa1e121e2575e6a31f25010f0306df2b81ddf291c9f17b3d582c0af97d219c007ec03b1a38a8794ab447b5cdb8637a8f6704124f9776eda3af121ab980a2525f0f09accea3213c6fa4d606d7e48580db97aee01a048ad3420d205b99b0023b59a4f8df1b3013e4e8bc496b73cd950e297202bd09a6c77011deecb43cbffb7038344e025dad84099324518c5a2deb3c6728b4346603","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3676642ba91b1d0bdf1d3ad0a6efaf4b","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"bfcec1bbe031a317daa44e460285dd9a","SHA1":"d13da09d7cbd0317a33467adf2b9f7a409b2f625","SHA256":"e516875ff4800faea06f2ffa8041eb78e5842ebd01a390a7a2093b6bd02c8db8","SHA384":"cbe90df0e08462d6b1b7d4b8ac012c0f70c6cbef2b538ede17dd32e0b0f615a604f43c1934fdc21200e63b19076dae8c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"3676642ba91b1d0bdf1d3ad0a6efaf4b","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"69260cce3156aa2dc0540fb78f5fe826","LoadsDespiteHVCI":"FALSE"},{"Filename":"phymem64.sys","SHA256":"4f9d38567f3a2ac47ae1d8ac5e34a8c99a42a2ca3afc5f1ace44a4cd1097e814","MD5":"50493aa68b56d96cf2493f7f18006933","SHA1":"8dd8033c50b75c8f33b1f860f4ea1c605fc69ebb","Imphash":"6bf6c7ee793a089775db504944eb267e","Authentihash":{"MD5":"4361ef663928b5fe414946bb2a831611","SHA1":"6bae7e847d119a2012eaed98bb7b06da19ed25e6","SHA256":"d7bbb86ccc9c1f4e0c47b2d98c54e73e6915d68d560525e62817205434b01fb6"},"RichPEHeaderHash":{"MD5":"dcfb3408a43287615a36996ce13c7d9d","SHA1":"ea444085c9b1638227923cafa27b526a202776dd","SHA256":"6c37612dabc26fb87a369a84879cdbf13b83021f394a8f895040e0dc0839285f"},"Sections":{".text":{"Entropy":5.508710400956982,"Virtual Size":"0x25b2"},".rdata":{"Entropy":5.365654927108557,"Virtual Size":"0x784"},".data":{"Entropy":4.978852824955872,"Virtual Size":"0x6b8"},".pdata":{"Entropy":3.752061421099071,"Virtual Size":"0x108"},"INIT":{"Entropy":4.703751829381467,"Virtual Size":"0x434"},".rsrc":{"Entropy":3.239027880442994,"Virtual Size":"0x6a8"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-09-03 02:37:42","Description":"phymem Application","Company":"Super Micro Computer, Inc.","InternalName":"phymem","OriginalFilename":"phymem.sys","FileVersion":"2, 3, 0, 0","Product":"phymem","ProductVersion":"2, 3, 0, 0","Copyright":"Copyright(c) Super Micro Computer, Inc. All rights reserved. ","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","IofCallDriver","IoBuildSynchronousFsdRequest","KeInitializeEvent","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","ExAllocatePool","RtlInitUnicodeString","InitSafeBootMode","IofCompleteRequest","ExFreePoolWithTag","MmUnmapLockedPages","ExReleaseFastMutex","ExAcquireFastMutex","IoFreeMdl","MmFreePagesFromMdl","MmMapLockedPagesSpecifyCache","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmUnmapIoSpace","MmMapIoSpace","IoDeleteSymbolicLink","IoReleaseRemoveLockEx","IoAcquireRemoveLockEx","PoCallDriver","PoStartNextPowerIrp","IoDetachDevice","IoReleaseRemoveLockAndWaitEx","KeSetEvent","IoInitializeRemoveLockEx","IoAttachDeviceToDeviceStack","PsGetVersion","MmGetSystemRoutineAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2019-06-05 18:06:32","ValidTo":"2020-06-03 18:06:32","Signature":"11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000857f83dc2a6ca979b8000000000085","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"85e8c40624a19ac2076dd91f49d8fb53","SHA1":"621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca","SHA256":"442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a","SHA384":"19b80fb83482cdb42c94c2eabac29e4db7777988905aab348bd7ed62e325d2ea1f4c80df0d7275abcb2b67585cfc7c36"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000857f83dc2a6ca979b8000000000085","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]},{"Filename":"phymem64.sys","SHA256":"e7ecb1c259bb0e2b91f3b0a5f1970f4cfe68c59730f762cb3bb068db79e3612e","MD5":"57a1995aa572caee922a8ea19ccd7802","SHA1":"1c5e40117b0175392c0e90733f82ab626394e5f4","Imphash":"d722e65a33b35166122d0e2871f6710c","Authentihash":{"MD5":"fe8fac73718b86156996635a4d7b1f6d","SHA1":"afceb95cbc759eeb5dbafffc2a6ad8affadbfa00","SHA256":"206f6277ce57bd0e7d0a29820cb6adb733f92473789605ae41f4e79016e614de"},"RichPEHeaderHash":{"MD5":"34525dd21f3adcbaf5d4e45db0b3a29b","SHA1":"22e0f95ca0c0b16e87bf436ebd00f9521d4cfc35","SHA256":"e607d80e342eebc2df56179fe22125416264c8bcd67923e1081de070d107482c"},"Sections":{".text":{"Entropy":5.494924236560177,"Virtual Size":"0x23d2"},".rdata":{"Entropy":5.391131259681137,"Virtual Size":"0x78c"},".data":{"Entropy":4.524432230854527,"Virtual Size":"0x618"},".pdata":{"Entropy":3.7190186505227603,"Virtual Size":"0x108"},"INIT":{"Entropy":4.710104704841271,"Virtual Size":"0x458"},".rsrc":{"Entropy":3.252609404293686,"Virtual Size":"0x690"},".reloc":{"Entropy":1.2987909647818572,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-11-24 09:20:30","Description":"phymem Application","Company":"Super Micro Computer, Inc.","InternalName":"phymem","OriginalFilename":"phymem.sys","FileVersion":"2, 2, 0, 0","Product":"phymem","ProductVersion":"2, 2, 0, 0","Copyright":"Copyright(c) 1993-2017 Super Micro Computer, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeWaitForSingleObject","IofCallDriver","IoBuildSynchronousFsdRequest","KeInitializeEvent","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","ExAllocatePool","RtlInitUnicodeString","InitSafeBootMode","IofCompleteRequest","ExFreePoolWithTag","MmUnmapLockedPages","MmUnmapIoSpace","ExReleaseFastMutex","ExAcquireFastMutex","IoFreeMdl","MmFreePagesFromMdl","MmMapLockedPagesSpecifyCache","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmMapIoSpace","IoDeleteSymbolicLink","IoGetDeviceObjectPointer","IoReleaseRemoveLockEx","IoAcquireRemoveLockEx","PoCallDriver","PoStartNextPowerIrp","IoDetachDevice","IoReleaseRemoveLockAndWaitEx","KeSetEvent","IoInitializeRemoveLockEx","IoAttachDeviceToDeviceStack","PsGetVersion","MmGetSystemRoutineAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2017-11-01 19:18:41","ValidTo":"2018-11-01 19:18:41","Signature":"1da5255a0c9534c4f9e8b78d6e26bd833cce8e78df19ebfa79026fef69abe1e77b68dabacef2774ce4352b4d1572cf67e81c171c1efea5cf5a43f4384619c82bf7e114158506b302665f4f0e661517318186a4424f86725a9bfa6f7d36740d2ea64aa7871599dc5b432d903fc524f89f1ebc39ddaf94c97afaa217f8fa2a59607eb8c704af09d03f4803c18df958c2fd0e951e54ca14695b2a1f2e6b98a17bb42d20b91e3243f514eeca3e9c64ba4e05a8ec69ab5f7b66953f308ed4ddf7daca9278bd49ada9739c8e51734dc20d06be283cfdcc2d2a55cd87a591f5c587a76aa00adf3b7bd282ca1330a42fb1b25ef533254ec96c0e7c3fd63edd434daaff88","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000573ed49abe493f9d4a000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7fd4ab7d01103dfa075bf921f93286a9","SHA1":"a784a4767fbc494cfda41dafb11e95737cf23f75","SHA256":"2b0d2128fb9426b04298d12631dfb8d080815408f5396daf9ad30498becec161","SHA384":"b04ae79695fbfed2e2cbb7b009ca83700a6ce22fd366bbf590db5593f31597902e30f095b0bceda4a8c0e50a7bb59acd"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000573ed49abe493f9d4a000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]}]}