{"Id":"4d365dd0-34c3-492e-a2bd-c16266796ae5","Tags":["ALSysIO64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create ALSysIO64.sys binPath=C:\\windows\\temp\\ALSysIO64.sys type=kernel && sc.exe start ALSysIO64.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/namazso/physmem_drivers"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d.yara"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa.yara"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Filename":"ALSysIO64.sys","MD5":"d9aafc513be1c4c57b9f9827e986039c","SHA1":"2c688a6e881d35df958cb8ff2e2bd8e21b8461bc","SHA256":"7a20ca8f9361eb892257b3693095ffeee61457dc4e22d9b119e3a9f3a1507069","Signature":"","Date":"","Publisher":"","Company":"Arthur Liberman","Description":"ALSysIO64","Product":"ALSysIO64","ProductVersion":"2.1.0.0","FileVersion":"2.1.0.0","MachineType":"AMD64","OriginalFilename":"ALSysIO64.sys","Imphash":"3a277d9c3f9238195ba009d38793f1c9","Authentihash":{"MD5":"6d94a4291a06775ebb473f592e3fb55a","SHA1":"3134c9c6f13a5694831121ae9c4b7e1e3adae7cc","SHA256":"d3966edd6b2291aad8ce21f35f85ea18a60e5c382891809bf4d4e07d0b0c61a8"},"RichPEHeaderHash":{"MD5":"46fabfa885306fecff5462a04f4f2c15","SHA1":"a476bb9f749ff067c7f8e4ed58d528f45f0e31d2","SHA256":"c2d3070e1a132f7cc2b243d8c1f81d395aa2e0335ce90af48c93fedd96a40898"},"Sections":{".text":{"Entropy":6.256048334943456,"Virtual Size":"0x59ec"},".rdata":{"Entropy":4.7880748949972505,"Virtual Size":"0x93c"},".data":{"Entropy":1.9489887848669418,"Virtual Size":"0x51c"},".pdata":{"Entropy":4.3395956370100155,"Virtual Size":"0x498"},"PAGE":{"Entropy":5.678775106180611,"Virtual Size":"0x178"},"INIT":{"Entropy":5.159426895019783,"Virtual Size":"0x4b6"},".rsrc":{"Entropy":3.314018107472502,"Virtual Size":"0x398"},".reloc":{"Entropy":1.584962500721156,"Virtual Size":"0xc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-10-18 10:38:31","InternalName":"ALSysIO64.sys","Copyright":"Copyright (C) 2003-2022 Arthur Liberman","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteDevice","ZwClose","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoBuildDeviceIoControlRequest","RtlAnsiStringToUnicodeString","MmGetSystemRoutineAddress","KeInitializeEvent","RtlInitAnsiString","RtlFreeUnicodeString","IoGetDeviceObjectPointer","KeWaitForSingleObject","MmIsAddressValid","ObfDereferenceObject","DbgPrint","RtlInitUnicodeString","ExAllocatePoolWithTag","ExFreePoolWithTag","KeLeaveCriticalRegion","strstr","MmUnmapIoSpace","KeEnterCriticalRegion","MmMapIoSpace","RtlEqualString","PsGetVersion","ExAllocatePoolWithQuotaTag","ZwQuerySystemInformation","KeBugCheckEx","__C_specific_handler","IofCallDriver","IoDeleteSymbolicLink","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:06","ValidTo":"2023-06-01 18:08:06","Signature":"0a835e40cdb627d4f0a0d3dbbf64a46a05c132d0b5df9d11cd9c195d7037737057d57a342732ae68d67de47f460e7211c7c40dc29b0a079caff871c4834a9a2fc85e759de9b78659ad6fd79b7320e538e9ba5d52227ad67cc00b0a770ef662af3d743a558643ad89cfb015591709a69b6271a9b65db71898e7cb9964c6376dc474898301a6133198b486b518fdd9d7b9723dcffc441e026833f7c72e27986026c97b9184a0048b10d1fe6847ae467f02173f7a69120be780e5b6b9e6399402cc58735a31b537cc33578fbea443135a4a612359150bcf9ab316f6a9248bc71ef3f3480b9b3fa2341692bc3a121d80214688f7bd87d5ec56dcbd0ea61abf2c7ed2b739a07590adb596d401735d955f5f94c591d69ab4363a42f9fca549d439495711ff7990448c03724792ed4acf31f2b35b136c1b2f37aa82b1aabf7daf059dcb2e976e95311ec6e9cc53876dd09632cf512d39c801849a7c1088a565691953e07c7ff17b22518e982dd2dcc0feda8c834ca1f5e247aef1c3af5f13cd4b8cc1b6c0179bc876db88d677047c34366533e349796dbdea86389ad640710b7742ae8cc4ec88f10fa80ede4b1c93f81b55480fc8228216d54813df0327e74b3db9f3512a40c0568e4215827f9b7a2613deea72a7ec4df2def05e5559015049fe83edc83300526045cb128119e131b7d3573b268e24b0a25b9ad59f6301c8fc8f409322","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fdc11a5676aed4e9cc0c09eeb7450dfb","SHA1":"4902077d9a05d4231b791d3b05bafa4a79132f03","SHA256":"5db56c23d83bf67c7152e28ad4a684a7372b4ae4f52afe7a81ce91eef94caec3","SHA384":"c952d7f0e0ea5216ce4400601fb7c0829f0f3fcd6eb2b5b9112fbe45d133e00c4abd660f8e1794f7ac4ef95123e2c0ab"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"86be5dbedcfcd517b9b602436cd985eb","SHA1":"7a9981f1bca18e2f624fe806c753a14dfd970c4e","SHA256":"ca829178d01990c8d1d6a681dee074a53f0dd873fd8eef6f6161c682449ec8c5"},"Company":"Arthur Liberman","Copyright":"Copyright (C) 2003-2009 Arthur Liberman","CreationTimestamp":"2013-03-05 16:50:34","Date":"","Description":"ALSysIO","ExportedFunctions":"","FileVersion":"2.0.8.0","Filename":"ALSysIO64.sys","ImportedFunctions":["IoDeleteDevice","ZwClose","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoBuildDeviceIoControlRequest","RtlAnsiStringToUnicodeString","MmGetSystemRoutineAddress","KeInitializeEvent","RtlInitAnsiString","RtlFreeUnicodeString","RtlInitUnicodeString","KeWaitForSingleObject","MmIsAddressValid","ObfDereferenceObject","DbgPrint","IofCallDriver","ExAllocatePoolWithTag","ExFreePoolWithTag","strstr","MmUnmapIoSpace","MmMapIoSpace","KeBugCheckEx","IoGetDeviceObjectPointer","IoDeleteSymbolicLink","RtlUnwindEx","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"ALSysIO.sys","MD5":"13dda15ef67eb265869fc371c72d6ef0","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"ALSysIO.sys","Product":"ALSysIO","ProductVersion":"2.0.8.0","Publisher":"Artur Liberman","RichPEHeaderHash":{"MD5":"fa032a9e33f5f3a4125cfa9c178850f9","SHA1":"2956abd1741d40b754a0c26100d60415591fd887","SHA256":"0d234a1913ceeac6a2072152698734f7ae25cadb077db00d1a78b5bf376bac77"},"SHA1":"2f991435a6f58e25c103a657d24ed892b99690b8","SHA256":"7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d","Sections":{".text":{"Entropy":6.095274875783498,"Virtual Size":"0x3389"},".rdata":{"Entropy":4.296371217977882,"Virtual Size":"0x554"},".data":{"Entropy":0.5524918135800905,"Virtual Size":"0x184"},".pdata":{"Entropy":4.0236239083842475,"Virtual Size":"0x24c"},"INIT":{"Entropy":5.135904026607732,"Virtual Size":"0x3f0"},".rsrc":{"Entropy":3.2958125541040038,"Virtual Size":"0x388"}},"Signature":["Artur Liberman","GlobalSign CodeSigning CA - G2","GlobalSign Root CA - R1"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"OU=Timestamping CA, O=GlobalSign, CN=GlobalSign Timestamping CA","ValidFrom":"2009-03-18 11:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"5df6cb2b0d0140849f857a43706ae0c5e7aa0600d76713c9089131654f14a8a905dc389e6aa0300abd8dc78028ee4245ca94f3de5845a9803204f5595c6a70003927944df5b44634e81c5331b2b35416e9cc42abd5d959301cfb462725b88723b1e8758824831ec876377b01494548a4ede25dd27c9ca2dc2dba105a126265abae00c710343bcb72bd14240cdcc37627b4a7fee15829f20e169f91391d89a6e60f1c878ce258ac927e243eaaec14e73a33348bc63bac83ab0f14627aba1a2d4d4b1bc530f00b92797d3c78e0f8e6d215965999392b3061e8b8f8c0a1e9221411787dc4dc89bec0bb94e172aeebb540404fef171e585ed0a88996ac9228e9babf","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012019c19066","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"42023b9487cafe46c1b6a49c369a362e","SHA1":"7c7b524d269334b9f073c32e888e09544c6acd98","SHA256":"b7126567833f3daa4085ff41e73112daad3d1e3808a942c1936520e2d6c46c78","SHA384":"0ee4f63d6f157ec4f6990c3ebb411ccd76cb1e2123c7f692459e43f96c0da2dbf60a2bce6afeacc60621d3055028baea"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2019-04-13 10:00:00","Signature":"225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee1355c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f6a9e8eb8784f3f694b4e353c08a0ff5","SHA1":"589a7d4df869395601ba7538a65afae8c4616385","SHA256":"cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4","SHA384":"dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"}},{"Subject":"C=BE, O=GlobalSign NV, CN=GlobalSign Time Stamping Authority","ValidFrom":"2009-12-21 09:32:56","ValidTo":"2020-12-22 09:32:56","Signature":"bc89ecfee63655935c79d4117a86808f17b693b26d9b91a1561811c655eaf608edad9b9ef52b81c8bbdd607b1b47991e6d403e1d80c213d58e04052fdbe7ae529e688472a1e54a603cf89bd52f46d8c3b2b79353ac9b6c432424d1f1fce9562e3411581843eaefff34746ca0c06c7fad031969881e9560cabbbd0cbb76efc724b081c63831cf36ad0c38b89020849b2e8f28b99ff6ca9427cdac396157e0e3955a9c769230f5dea6973d721c2a6032a8334d8635338a5cf3a4fdf7062ce16b4b30f5cbd34362f841b9de7d20cb058c8e2cf65f35fd338d42896508362ca389f45a858bb0b97bdb6ccba1f8d20e1bbb977cd12779be9d7c3be6a75634d8c991a9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"01000000000125b0b4cc01","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e3369c8e5aec0504b3a50455f615d9f9","SHA1":"13c244a894b40ecd18aaf97c362f20385bd005a7","SHA256":"26da721a670c72836926032fee6920118bfb9bff89cc8d0ce30d9452c33f2532","SHA384":"1524902f0e25addc6d74039d439366d2b06199e215004fd8e145369f50ea94a021ce6312e8a62b35470da0309ccb975c"}},{"Subject":"C=IL, CN=Artur Liberman","ValidFrom":"2013-03-05 15:18:55","ValidTo":"2016-03-05 15:18:55","Signature":"affd93f5b3dc4e5d57868f2bdf7f88bc14dd94c0de331f2d4fb4712dd259d5636f7c0d06595fec79e3311d63ac012ed643277e63015bc7c87c904efb57e44eef681019638adb464e96dd90f71eee2122664c7e809b11624b1b5e472ed28d55196cfd6d1eeedaa6c1e93a9540675a8047caee8a153cecb97db6ad807061634c8989e44a66675d71ed68cf2261592b3c49e35d111f9c4f3eb290fde4830a92c4d88e65914f5b8c5133138f11ecc6d07c47499016a43ea5fca364f560db7b38337959455928e8ec7940e26dab3f33547b05c6bc73868eb5cb8473dba3f006f07638aa7c29f933d5479f33f611ab8af56350e50254b9de2bfa4be289d0d1abc2133d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"112124a45abbf7c551deb213b28633c3dcad","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"56627e70a0b871843f4c3244885a29b2","SHA1":"7425308f88b4b3d59f4f15c5b9399ee445142f85","SHA256":"8e1fcd00db7895ff671e93e4e92a98d902ee2afa2c46e0548b3c1bca605b54f0","SHA384":"1f0906f566cd9e09ccfa4b5cd6a10ce17755725f49764cd2ca7437a5bd26b7ef970136fb87880814554c3fd4e640aae9"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}}],"Signer":[{"SerialNumber":"112124a45abbf7c551deb213b28633c3dcad","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","Version":1}]}],"Imphash":"82f5b92ccd99d13f4dd6ed6aaf0441bc","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"966e1c16e1aa07044b733c5589f40fd7","SHA1":"7027b399daf84a7c24dd010c2806bf6048a230bd","SHA256":"ac22a7cce3795e58c974056a86a06444e831d52185f9f37db88c65e14cd5bb75"},"Company":"Arthur Liberman","Copyright":"Copyright (C) 2003-2009 Arthur Liberman","CreationTimestamp":"2016-02-19 17:24:23","Date":"","Description":"ALSysIO","ExportedFunctions":"","FileVersion":"2.0.9.0","Filename":"ALSysIO64.sys","ImportedFunctions":["IoDeleteDevice","ZwClose","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoBuildDeviceIoControlRequest","RtlAnsiStringToUnicodeString","MmGetSystemRoutineAddress","KeInitializeEvent","RtlInitAnsiString","RtlFreeUnicodeString","RtlInitUnicodeString","KeWaitForSingleObject","MmIsAddressValid","ObfDereferenceObject","DbgPrint","IofCallDriver","ExAllocatePoolWithTag","ExFreePoolWithTag","strstr","MmUnmapIoSpace","MmMapIoSpace","KeBugCheckEx","IoGetDeviceObjectPointer","IoDeleteSymbolicLink","RtlUnwindEx","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"ALSysIO.sys","MD5":"ba5f0f6347780c2ed911bbf888e75bef","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"ALSysIO.sys","Product":"ALSysIO","ProductVersion":"2.0.9.0","Publisher":"Artur Liberman","RichPEHeaderHash":{"MD5":"fa032a9e33f5f3a4125cfa9c178850f9","SHA1":"2956abd1741d40b754a0c26100d60415591fd887","SHA256":"0d234a1913ceeac6a2072152698734f7ae25cadb077db00d1a78b5bf376bac77"},"SHA1":"f02af84393e9627ba808d4159841854a6601cf80","SHA256":"7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa","Sections":{".text":{"Entropy":6.118126498568242,"Virtual Size":"0x2f95"},".rdata":{"Entropy":4.334329395963305,"Virtual Size":"0x4bc"},".data":{"Entropy":0.5401996588023142,"Virtual Size":"0x19c"},".pdata":{"Entropy":4.014945953829912,"Virtual Size":"0x1d4"},"INIT":{"Entropy":5.0865478764498455,"Virtual Size":"0x3f0"},".rsrc":{"Entropy":3.2944352172701143,"Virtual Size":"0x388"}},"Signature":["Artur Liberman","GlobalSign CodeSigning CA - G2","GlobalSign Root CA - R1"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Timestamping CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"4e5e56901e46b4d94931f3bb1739281bc216ddfd41dc0905049b6fb2a29ad6992e40990055b5ea3fa52076d38634d417cc553ac782eeefa8babcd8069f1550dfcd167b523a02d7191afdaff0785ce04bc518df3a241edaacb8a95804020730dbb0125efe31bef00448f4f070f83a5e5683cf3dfb0dbcf4c5ed979db9d4dba52784e3389b8ba735864420a43b6da46a0ba183fd28ebdaef28f6cc885dfb0a3b00abe021ebe22f356c0f8e344597eba2f79933357ecb9a8abb454de73f9fc2d98afa65b26ec77e65ffe892e12c31a2f7b02736488f266f3bee4d761f79c3e57f9635bc2d0ecc01b08e7fff518080a792d4b34446648c874f166307314b63b0dff3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee152d7","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"e140543fe3256027cfa79fc3c19c1776","SHA1":"c655f94eb1ecc93de319fc0c9a2dc6c5ec063728","SHA256":"3ca71e85908ff67368e4dc00253f5691b9e6d50c966e7784143d75fb92aa3448","SHA384":"d9d366f9328f2b55ee19a32cc5fd5148b81d764282fe5dc196c872ae249caa51d2c212ef39f33945dfe0cda81925e326"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2019-04-13 10:00:00","Signature":"225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee1355c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f6a9e8eb8784f3f694b4e353c08a0ff5","SHA1":"589a7d4df869395601ba7538a65afae8c4616385","SHA256":"cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4","SHA384":"dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"}},{"Subject":"C=IL, CN=Artur Liberman","ValidFrom":"2013-03-05 15:18:55","ValidTo":"2016-03-05 15:18:55","Signature":"affd93f5b3dc4e5d57868f2bdf7f88bc14dd94c0de331f2d4fb4712dd259d5636f7c0d06595fec79e3311d63ac012ed643277e63015bc7c87c904efb57e44eef681019638adb464e96dd90f71eee2122664c7e809b11624b1b5e472ed28d55196cfd6d1eeedaa6c1e93a9540675a8047caee8a153cecb97db6ad807061634c8989e44a66675d71ed68cf2261592b3c49e35d111f9c4f3eb290fde4830a92c4d88e65914f5b8c5133138f11ecc6d07c47499016a43ea5fca364f560db7b38337959455928e8ec7940e26dab3f33547b05c6bc73868eb5cb8473dba3f006f07638aa7c29f933d5479f33f611ab8af56350e50254b9de2bfa4be289d0d1abc2133d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"112124a45abbf7c551deb213b28633c3dcad","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"56627e70a0b871843f4c3244885a29b2","SHA1":"7425308f88b4b3d59f4f15c5b9399ee445142f85","SHA256":"8e1fcd00db7895ff671e93e4e92a98d902ee2afa2c46e0548b3c1bca605b54f0","SHA384":"1f0906f566cd9e09ccfa4b5cd6a10ce17755725f49764cd2ca7437a5bd26b7ef970136fb87880814554c3fd4e640aae9"}},{"Subject":"C=SG, O=GMO GlobalSign Pte Ltd, CN=GlobalSign TSA for MS Authenticode , G2","ValidFrom":"2015-02-03 00:00:00","ValidTo":"2026-03-03 00:00:00","Signature":"8032dc078d1ca09c9d3c2ae83d218b59a14d7ecc44ce03be7eaabcc4e67b73bb4bf188da904e7537283863b9d72b0f54a956ce7739973073cd9bd9d905451c8da4b8035d4fd91c2e98e0e988e6ecd7057e562a7bf7165ba3ad8f972512841bb25c634a0ad2ef10544782843569289c0ce41f141624fa75dc74726e4ecae36a43afcf7d3648d1bde906912c2fa6c871fdcfbdd89d2198fcafdbde228cafa7f377ef9ddca3704b441af078851ef2a58c39b5dc881c37edad14f5070b26bdbe6d025eb1b8b0586c853a0df6ff5a270cc5de53e7543c564cc94e4c30f6f25cfb1a8cc282bead5991f61b4d557bcf5b01dcfd7ad36f235c32479b01f3c15114468a9b","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"112106a081d33fd87ae5824cc16b52094e03","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a0ac4d48fe852f7b3ed4e623d59a825f","SHA1":"d4db9846bc4d7db142eeb364286f6de7c102420c","SHA256":"78d2e41a13eb4e9171bae2d2adb192cf39210b5231f77cda936bcfbe8c003bdf","SHA384":"990ed96dca5979deeedc98a012279f04efb5559d7e7f5084a12f3802ee9439326557aecefd081cff739b78515b5d7f50"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}}],"Signer":[{"SerialNumber":"112124a45abbf7c551deb213b28633c3dcad","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","Version":1}]}],"Imphash":"82f5b92ccd99d13f4dd6ed6aaf0441bc","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"7b9763c297936ce055a04790362cc75f","SHA1":"530dd2863a09dc57801d62551c48eb9e48476fe8","SHA256":"1c55b6620216c195ce24ef21e6ab7e181146fccf17c06606c4cd419fe3e45bd7"},"Company":"Arthur Liberman","Copyright":"Copyright (C) 2003-2019 Arthur Liberman","CreationTimestamp":"2019-02-01 12:48:41","Date":"","Description":"ALSysIO64","ExportedFunctions":"","FileVersion":"2.0.11.0","Filename":"ALSysIO64.sys","ImportedFunctions":["IoDeleteDevice","ZwClose","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IoBuildDeviceIoControlRequest","RtlAnsiStringToUnicodeString","MmGetSystemRoutineAddress","KeInitializeEvent","RtlInitAnsiString","RtlFreeUnicodeString","IoGetDeviceObjectPointer","KeWaitForSingleObject","MmIsAddressValid","ObfDereferenceObject","RtlInitUnicodeString","IofCallDriver","ExAllocatePoolWithTag","ExFreePoolWithTag","KeLeaveCriticalRegion","strstr","MmUnmapIoSpace","KeEnterCriticalRegion","MmMapIoSpace","PsGetVersion","ExAllocatePoolWithQuotaTag","ZwQuerySystemInformation","KeBugCheckEx","__C_specific_handler","DbgPrint","IoDeleteSymbolicLink","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"ALSysIO64.sys","MD5":"afc2448b4080f695e76e059a96958cab","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"ALSysIO64.sys","Product":"ALSysIO64","ProductVersion":"2.0.11.0","Publisher":"","RichPEHeaderHash":{"MD5":"b5b5bc6c59d1c8f098299b0c74a28bcd","SHA1":"c8f81a0224ea38ce7ac7d94c4259693c4fe5a88c","SHA256":"e9a21989acb90615e4ceece63e354a938056341eef27c69a1f174e2a11bc72cd"},"SHA1":"256d285347acd715ed8920e41e5ec928ae9201a8","SHA256":"119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280","Sections":{".text":{"Entropy":6.094646886255092,"Virtual Size":"0x3025"},".rdata":{"Entropy":4.4005847545275065,"Virtual Size":"0x554"},".data":{"Entropy":0.5086871497841102,"Virtual Size":"0x1ac"},".pdata":{"Entropy":4.077679652832968,"Virtual Size":"0x1e0"},"PAGE":{"Entropy":5.694732552989121,"Virtual Size":"0x178"},"INIT":{"Entropy":5.16258604036066,"Virtual Size":"0x49c"},".rsrc":{"Entropy":3.3268549437522807,"Virtual Size":"0x3a0"},".reloc":{"Entropy":1.584962500721156,"Virtual Size":"0xc"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=IL, ??=Business Entity, serialNumber=307609677, C=IL, L=Ramat Gan, O=ALCPU (Arthur Liberman), CN=ALCPU (Arthur Liberman)","ValidFrom":"2017-06-23 00:00:00","ValidTo":"2019-12-31 12:00:00","Signature":"56c962d4f516afe5fef5e2e0cc61d68e55253304491c860d686c4efb87705d2bffe8a76f5eac43cd653b71e33ea5ea4b271ba172274bc9dd56b2f4080b5ccdd5e9fabb0aafc281ff8eff90238fe3ac8c1ad0dade04b1fdba18c56f692db61d9c62111866bd91d9212548622002faf0858452e484e272798446ba1afe0667846a532734e12b891a69d27f1e46e241093893f3eb132af927f2c01dc2f420061e29485a84deec9aca85d2b7bd469343764ccd2e70b76bb3845017d600ab5724e2ddf6963ce1e4d94dc19f40aa8f1ee96c2ad17a7c315b9cf7c636436ae3b91524266d3aa917b590cd4ee8e8967e82cbafebb31b5c6f7905c5a21752ef1e6b453ed6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0fd092438045aa3e667a4952fd8e429a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c93e319e441fcfedcf9f02f39d65a2fa","SHA1":"c74ae2671c17ebd0cf2f0177e687f747b1f05de8","SHA256":"8eafc0fd89cba2f9ae664cb54e0b4e6d95d4802b63935cf570faec91e1081438","SHA384":"1d3b4464030e4d3e948d351965a7c7859456c7d042720fb53991a07d1da135ac0c711b1922c72b2f6d81b8c8f4f8c7a3"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"0fd092438045aa3e667a4952fd8e429a","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"Imphash":"2f7ea575cf15da16c8f117eee37046d8","LoadsDespiteHVCI":"TRUE"}]}