{"Id":"57fc510a-e649-4599-b83e-8f3605e3d1d9","Tags":["aswArPot.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","CVE":["CVE-2022-26522","CVE-2022-26523"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create aswArPot.sys binPath=C:\\windows\\temp\\aswArPot.sys type=kernel && sc.exe start aswArPot.sys","Description":"Avast and AVG Anti Rootkit driver aswArPot.sys versions before 22.1 are affected by CVE-2022-26522 and CVE-2022-26523. Double-fetch races in kernel handlers allow a non-administrator user to corrupt kernel memory and execute code in kernel context, enabling local privilege escalation and security-product bypass.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules","https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://www.sentinelone.com/labs/vulnerabilities-in-avast-and-avg-put-millions-at-risk/","https://nvd.nist.gov/vuln/detail/CVE-2022-26522","https://nvd.nist.gov/vuln/detail/CVE-2022-26523"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"@mattnotmax","Person":""},"KnownVulnerableSamples":[{"Filename":"aswArPot.sys","SHA256":"bf5beb8560b85454ded94d2954c446970ab44dc2eeb83d80170ea3a68afa1787","MD5":"13e5678932fe26a7a7f864acbff40e82","SHA1":"090e5427ec21ee0d69f52ed2eb99bb5f806ce7d7","Imphash":"26150d69f50aa9247c3f3f17521d18a2","Authentihash":{"MD5":"be022cce821bd43c2a36b467bdc67b5c","SHA1":"3f5e1bc857083fd43bea9564d0ebe9970ca96384","SHA256":"b2da4e88826d1a4ea2532278c5bf2b9ad50ed3acd09d283c2a48fc661a72483e"},"RichPEHeaderHash":{"MD5":"4a4bb707ff227f40b5705d60b03db4d8","SHA1":"79e0519412092853e24ac36c731927675d228353","SHA256":"0006ab39b369b655cb104f55e22db7d626fe65d25e5810f0e8faf075e6e0e8de"},"Sections":{".text":{"Entropy":6.381427913338602,"Virtual Size":"0x21ca2"},".rdata":{"Entropy":5.726835849372502,"Virtual Size":"0x3b24"},".data":{"Entropy":2.7065350593404003,"Virtual Size":"0x259b0"},".pdata":{"Entropy":5.4123794304758315,"Virtual Size":"0x11dc"},"PAGE":{"Entropy":6.326203125529991,"Virtual Size":"0x1a35"},"INIT":{"Entropy":5.378030645814807,"Virtual Size":"0x13dc"},".rsrc":{"Entropy":3.5743498833414633,"Virtual Size":"0x438"},".reloc":{"Entropy":5.3833020583275815,"Virtual Size":"0x188"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-02-10 05:55:12","Description":"AVG anti rootkit","Company":"AVG Technologies CZ, s.r.o.","InternalName":"aswArPot.sys","OriginalFilename":"aswArPot.sys","FileVersion":"20.1.44.0","Product":"AVG Internet Security System ","ProductVersion":"20.1.44.0","Copyright":"Copyright (C) 2020 AVG Technologies CZ, s.r.o.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["__C_specific_handler","KeDelayExecutionThread","IoAllocateWorkItem","MmIsAddressValid","MmUnlockPages","ExAllocatePool","RtlAnsiStringToUnicodeString","KeAcquireSpinLockRaiseToDpc","ZwQuerySystemInformation","PsRemoveLoadImageNotifyRoutine","ZwUnmapViewOfSection","ZwQuerySymbolicLinkObject","MmProbeAndLockPages","RtlVolumeDeviceToDosName","PsSetLoadImageNotifyRoutine","IoGetRequestorProcessId","ZwReadFile","ObQueryNameString","ZwOpenThreadTokenEx","ZwOpenProcessTokenEx","towlower","NtBuildNumber","ExReleaseFastMutex","_wcsicmp","_snwprintf","RtlConvertSidToUnicodeString","ObfDereferenceObject","IoAllocateMdl","ZwCreateSection","ZwQueryInformationProcess","PsGetProcessId","PsCreateSystemThread","ZwQueryInformationThread","RtlInitUnicodeString","ZwOpenSymbolicLinkObject","tolower","PsRemoveCreateThreadNotifyRoutine","IoDeleteDevice","IoBuildDeviceIoControlRequest","wcsncpy","IoGetDeviceObjectPointer","IoGetCurrentProcess","ObOpenObjectByPointer","strncpy","KeReleaseSpinLock","_strnicmp","IoFileObjectType","KeStackAttachProcess","PsLookupProcessByProcessId","PsGetCurrentProcessId","KeSetEvent","PsThreadType","RtlUnicodeStringToAnsiString","ZwQueryInformationToken","ZwMapViewOfSection","strncmp","ObReferenceObjectByHandle","RtlGetVersion","PsGetThreadId","PsGetVersion","KeClearEvent","IoGetBaseFileSystemDeviceObject","wcschr","ZwSetInformationFile","ZwEnumerateKey","IoFreeMdl","wcsstr","ExAcquireFastMutex","MmGetSystemRoutineAddress","IoFreeWorkItem","_stricmp","ExAllocatePoolWithTag","RtlInitString","IofCallDriver","IoDeviceObjectType","_snprintf","ExFreePoolWithTag","ZwOpenFile","KeSetSystemAffinityThread","strstr","KeInitializeEvent","ObReferenceObjectByName","strchr","_wcsnicmp","KeQueryActiveProcessors","RtlEqualSid","IoQueueWorkItem","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","PsSetCreateThreadNotifyRoutine","PsGetCurrentThreadId","IofCompleteRequest","PsGetProcessWin32Process","ExEventObjectType","ZwQueryInformationFile","KeWaitForSingleObject","IoCreateSymbolicLink","PsSetCreateProcessNotifyRoutine","IoDriverObjectType","PsLookupThreadByThreadId","IoGetDeviceInterfaces","ZwClose","PsTerminateSystemThread","wcsrchr","strrchr","SeExports","KeUnstackDetachProcess","KeResetEvent","KeRevertToUserAffinityThread","ZwOpenProcess","wcsncmp","ZwOpenKey","PsGetThreadProcess","IoDetachDevice","IoAttachDeviceToDeviceStackSafe","IoThreadToProcess","PsInitialSystemProcess","IoCreateDevice","KeInsertQueueDpc","KeNumberProcessors","KeInitializeDpc","KeSetTargetProcessorDpc","PsProcessType","MmMapIoSpace","MmUnmapIoSpace","ZwDeleteFile","KeAttachProcess","KeDetachProcess","RtlCompareUnicodeString","ZwWriteFile","NtClose","ObfReferenceObject","IoBuildSynchronousFsdRequest","ZwOpenThread","ZwTerminateProcess","RtlEqualUnicodeString","IoFreeIrp","ZwQueryDirectoryObject","KeBugCheck","ZwOpenDirectoryObject","IoAllocateIrp","KdDebuggerNotPresent","ZwSetSecurityObject","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","RtlLengthSecurityDescriptor","RtlCreateSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","RtlQueryRegistryValues","RtlPrefixUnicodeString","ExRegisterCallback","ExCreateCallback","ExUnregisterCallback","strcmp"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, ST=North Carolina, L=Newton, O=AVG Technologies USA, LLC, OU=RE 999, CN=AVG Technologies USA, LLC","ValidFrom":"2020-01-27 00:00:00","ValidTo":"2022-10-20 12:00:00","Signature":"b02cbaf178caf97fa7c0182c25b4c97d4e68127e4d5634609757bcbc051eb94254bb50e112e72505e7f9c6dbd92622287bacbcd726fa911b3b3e36ccc88f8794e980c0b0409efc87fb04d88a15df20dedb23ced152779b799359e4d3b553eb4c6c6ea61216899a0d9cc97de7f7e21ce374d5430e2dcfbb3b6f653db2d236f59bb22bd65e0787a65610c4fde1463a5be08e4710fb4e1ae7c00080edb315995b06297431ce4a9821d1050aa7061ef26c182482d09ba42001ab103c882c01f312411130490aa7820ff72902e723a864b881066e2d7883afdb5ba9d3027550f6a3761669e42b425ad61f76e2add3dd012558bd769b76f8f37843243dfbd0a2efa363","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03ec0c9015079fab8a6f3fc9f839311c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"bf2831557abdf7e58917d0a2608080a5","SHA1":"24ece342e4c4f2f17f32e6924f48c240ad6300ff","SHA256":"1afa061865098b2da9d030bc9f5815ad98e59fa847903692e52d6ba0bbf260dd","SHA384":"0bed85528163e2befed14755c2dcaf02acea62bdf352d3f964cfeaa2883bebea3e186aa26ce12e4df1dfd6d235bf9bb6"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"03ec0c9015079fab8a6f3fc9f839311c","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}]},{"Filename":"aswArPot.sys","SHA256":"421cb64792a32ce79db7c8c07db4fb58bf105e58a7acf3cf1e6b5135e37795cf","MD5":"54d015e3c3f31090db762f0dd5ad43c0","SHA1":"be27b16ae4225403c97142e4f91b4b7e95694d60","Imphash":"e951e0b26d5c36b13f3da573ac4c7b54","Authentihash":{"MD5":"c2fb41555ed290bf5fdf40ca7659fc91","SHA1":"1e21ec423f6127799b1e505e75deb7e99395f94d","SHA256":"5234c53ef95231a1848eb4947f8f7390463d9e759af706f19cc3ce2b0f9eae61"},"RichPEHeaderHash":{"MD5":"f9c9289670f9904d05aa20b51b8bc30b","SHA1":"be188a41cbedd539e654a086d09df160572cd7fe","SHA256":"c7c857950b4eada29e7ad09916359e1b314d9d1ff7a76b67f100f7781be7902b"},"Sections":{".text":{"Entropy":6.387874005965718,"Virtual Size":"0x245b2"},".rdata":{"Entropy":5.751056739687033,"Virtual Size":"0x3d6c"},".data":{"Entropy":2.863268220635897,"Virtual Size":"0x25bb0"},".pdata":{"Entropy":5.417548225163718,"Virtual Size":"0x12cc"},"PAGE":{"Entropy":6.2474972367268515,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.2822915769432015,"Virtual Size":"0x1422"},".rsrc":{"Entropy":3.3736086776176823,"Virtual Size":"0x3d8"},".reloc":{"Entropy":5.445788529620991,"Virtual Size":"0x1a0"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-05-13 11:58:36","Description":"AVG Anti Rootkit","Company":"AVG Technologies CZ, s.r.o.","InternalName":"aswArPot","OriginalFilename":"aswArPot.sys","FileVersion":"21.4.237.0","Product":"AVG Internet Security System ","ProductVersion":"21.4.237.0","Copyright":"Copyright (C) 2021 AVG Technologies CZ, s.r.o.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["__C_specific_handler","KeDelayExecutionThread","IoAllocateWorkItem","MmIsAddressValid","MmUnlockPages","ExAllocatePool","RtlAnsiStringToUnicodeString","KeAcquireSpinLockRaiseToDpc","ZwQuerySystemInformation","PsRemoveLoadImageNotifyRoutine","ZwUnmapViewOfSection","ZwQuerySymbolicLinkObject","MmProbeAndLockPages","RtlVolumeDeviceToDosName","PsSetLoadImageNotifyRoutine","IoGetRequestorProcessId","ZwReadFile","ObQueryNameString","IoDetachDevice","ZwOpenThreadTokenEx","ZwOpenProcessTokenEx","towlower","NtBuildNumber","ExReleaseFastMutex","_wcsicmp","PsDereferencePrimaryToken","_snwprintf","RtlConvertSidToUnicodeString","ObfDereferenceObject","IoAllocateMdl","ZwCreateSection","ZwQueryInformationProcess","IoAttachDeviceToDeviceStackSafe","PsGetProcessId","PsCreateSystemThread","ZwQueryInformationThread","RtlInitUnicodeString","ZwOpenSymbolicLinkObject","tolower","PsRemoveCreateThreadNotifyRoutine","IoDeleteDevice","IoBuildDeviceIoControlRequest","wcsncpy","IoGetDeviceObjectPointer","IoGetCurrentProcess","ObOpenObjectByPointer","strncpy","KeReleaseSpinLock","_strnicmp","IoFileObjectType","KeStackAttachProcess","PsLookupProcessByProcessId","PsGetCurrentProcessId","KeSetEvent","PsThreadType","RtlUnicodeStringToAnsiString","ZwQueryInformationToken","ZwMapViewOfSection","strncmp","ObReferenceObjectByHandle","RtlGetVersion","PsGetThreadId","PsGetVersion","KeClearEvent","IoGetBaseFileSystemDeviceObject","wcschr","ZwSetInformationFile","ZwEnumerateKey","IoFreeMdl","wcsstr","PsReferencePrimaryToken","ExAcquireFastMutex","MmGetSystemRoutineAddress","IoFreeWorkItem","_stricmp","ExAllocatePoolWithTag","RtlInitString","IoCreateDevice","IofCallDriver","IoDeviceObjectType","_snprintf","ExFreePoolWithTag","ZwOpenFile","KeSetSystemAffinityThread","strstr","KeInitializeEvent","ObReferenceObjectByName","strchr","_wcsnicmp","KeQueryActiveProcessors","RtlEqualSid","IoQueueWorkItem","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","PsSetCreateThreadNotifyRoutine","PsGetCurrentThreadId","IofCompleteRequest","PsGetProcessWin32Process","ExEventObjectType","ZwQueryInformationFile","KeWaitForSingleObject","IoCreateSymbolicLink","PsSetCreateProcessNotifyRoutine","IoDriverObjectType","PsLookupThreadByThreadId","IoGetDeviceInterfaces","ZwClose","PsTerminateSystemThread","wcsrchr","strrchr","SeExports","KeUnstackDetachProcess","KeResetEvent","KeRevertToUserAffinityThread","ZwOpenProcess","wcsncmp","ZwOpenKey","PsGetThreadProcess","IoThreadToProcess","PsInitialSystemProcess","KeInsertQueueDpc","KeNumberProcessors","KeInitializeDpc","KeSetTargetProcessorDpc","PsProcessType","MmMapIoSpace","MmUnmapIoSpace","ZwDeleteFile","KeAttachProcess","KeDetachProcess","RtlCompareUnicodeString","ZwWriteFile","NtClose","ObfReferenceObject","IoBuildSynchronousFsdRequest","ZwOpenThread","ZwTerminateProcess","RtlEqualUnicodeString","IoFreeIrp","ZwQueryDirectoryObject","KeBugCheck","ZwOpenDirectoryObject","IoAllocateIrp","KdDebuggerNotPresent","ZwSetSecurityObject","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","RtlLengthSecurityDescriptor","RtlCreateSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","RtlQueryRegistryValues","RtlPrefixUnicodeString","ExRegisterCallback","ExCreateCallback","ExUnregisterCallback","strcmp"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2021","ValidFrom":"2021-01-01 00:00:00","ValidTo":"2031-01-06 00:00:00","Signature":"481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d424ae0be3a88ff604021ce1400f0dd","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c0189c338449a42fe8358c2c1fbecc60","SHA1":"b8ac0ee6875594b80ad86a6df6dd1fa3048c187c","SHA256":"a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5","SHA384":"76d3a316a5a106050298418cce3beea16100524723d9e3220b0de51bfb6f1c35a5d4c7cd10b358fef7bf94c3e3562150"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Timestamping CA","ValidFrom":"2016-01-07 12:00:00","ValidTo":"2031-01-07 12:00:00","Signature":"719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0aa125d6d6321b7e41e405da3697c215","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8d26184fc613f89aba1cefb30fce1b53","SHA1":"63a7e376bad5ec2e419d514a403bcf46c8d31d95","SHA256":"56b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c","SHA384":"d8c9691fe9dbe182f07b49b07fbb4f589fa7b38b5c4d21f265d3a2e818f4b1bfb39e03faab2ec05bb10333a99914fb8a"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, ST=North Carolina, L=Newton, O=AVG Technologies USA, LLC, OU=RE 999, CN=AVG Technologies USA, LLC","ValidFrom":"2020-01-27 00:00:00","ValidTo":"2022-10-20 12:00:00","Signature":"b02cbaf178caf97fa7c0182c25b4c97d4e68127e4d5634609757bcbc051eb94254bb50e112e72505e7f9c6dbd92622287bacbcd726fa911b3b3e36ccc88f8794e980c0b0409efc87fb04d88a15df20dedb23ced152779b799359e4d3b553eb4c6c6ea61216899a0d9cc97de7f7e21ce374d5430e2dcfbb3b6f653db2d236f59bb22bd65e0787a65610c4fde1463a5be08e4710fb4e1ae7c00080edb315995b06297431ce4a9821d1050aa7061ef26c182482d09ba42001ab103c882c01f312411130490aa7820ff72902e723a864b881066e2d7883afdb5ba9d3027550f6a3761669e42b425ad61f76e2add3dd012558bd769b76f8f37843243dfbd0a2efa363","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03ec0c9015079fab8a6f3fc9f839311c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"bf2831557abdf7e58917d0a2608080a5","SHA1":"24ece342e4c4f2f17f32e6924f48c240ad6300ff","SHA256":"1afa061865098b2da9d030bc9f5815ad98e59fa847903692e52d6ba0bbf260dd","SHA384":"0bed85528163e2befed14755c2dcaf02acea62bdf352d3f964cfeaa2883bebea3e186aa26ce12e4df1dfd6d235bf9bb6"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"03ec0c9015079fab8a6f3fc9f839311c","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}]},{"Authentihash":{"MD5":"66d55dcf5fe5e1b60f32880d48207105","SHA1":"b8b5e5951f1c4148537e9850f2b577a453e4c045","SHA256":"c0c131bc8d6c8b5a2be32474474b1221bce1289c174c87e743ed4a512f5571d4"},"Company":"AVAST Software","Copyright":"Copyright (c) 2021 AVAST Software","CreationTimestamp":"2021-02-01 04:08:43","Date":"","Description":"Avast Anti Rootkit","ExportedFunctions":"","FileVersion":"21.1.187.0","Filename":"aswArPot.sys","ImportedFunctions":["__C_specific_handler","KeDelayExecutionThread","IoAllocateWorkItem","MmIsAddressValid","MmUnlockPages","ExAllocatePool","RtlAnsiStringToUnicodeString","KeAcquireSpinLockRaiseToDpc","ZwQuerySystemInformation","PsRemoveLoadImageNotifyRoutine","ZwUnmapViewOfSection","ZwQuerySymbolicLinkObject","MmProbeAndLockPages","RtlVolumeDeviceToDosName","PsSetLoadImageNotifyRoutine","IoGetRequestorProcessId","ZwReadFile","ObQueryNameString","IoDetachDevice","ZwOpenThreadTokenEx","ZwOpenProcessTokenEx","towlower","NtBuildNumber","ExReleaseFastMutex","_wcsicmp","_snwprintf","RtlConvertSidToUnicodeString","ObfDereferenceObject","IoAllocateMdl","ZwCreateSection","ZwQueryInformationProcess","IoAttachDeviceToDeviceStackSafe","PsGetProcessId","PsCreateSystemThread","ZwQueryInformationThread","RtlInitUnicodeString","ZwOpenSymbolicLinkObject","tolower","PsRemoveCreateThreadNotifyRoutine","IoDeleteDevice","IoBuildDeviceIoControlRequest","wcsncpy","IoGetDeviceObjectPointer","IoGetCurrentProcess","ObOpenObjectByPointer","strncpy","KeReleaseSpinLock","_strnicmp","IoFileObjectType","KeStackAttachProcess","PsLookupProcessByProcessId","PsGetCurrentProcessId","KeSetEvent","PsThreadType","RtlUnicodeStringToAnsiString","ZwQueryInformationToken","ZwMapViewOfSection","strncmp","ObReferenceObjectByHandle","RtlGetVersion","PsGetThreadId","PsGetVersion","KeClearEvent","IoGetBaseFileSystemDeviceObject","wcschr","ZwSetInformationFile","ZwEnumerateKey","IoFreeMdl","wcsstr","ExAcquireFastMutex","MmGetSystemRoutineAddress","IoFreeWorkItem","_stricmp","ExAllocatePoolWithTag","RtlInitString","IoCreateDevice","IofCallDriver","IoDeviceObjectType","_snprintf","ExFreePoolWithTag","ZwOpenFile","KeSetSystemAffinityThread","strstr","KeInitializeEvent","ObReferenceObjectByName","strchr","_wcsnicmp","KeQueryActiveProcessors","RtlEqualSid","IoQueueWorkItem","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","PsSetCreateThreadNotifyRoutine","PsGetCurrentThreadId","IofCompleteRequest","PsGetProcessWin32Process","ExEventObjectType","ZwQueryInformationFile","KeWaitForSingleObject","IoCreateSymbolicLink","PsSetCreateProcessNotifyRoutine","IoDriverObjectType","PsLookupThreadByThreadId","IoGetDeviceInterfaces","ZwClose","PsTerminateSystemThread","wcsrchr","strrchr","SeExports","KeUnstackDetachProcess","KeResetEvent","KeRevertToUserAffinityThread","ZwOpenProcess","wcsncmp","ZwOpenKey","PsGetThreadProcess","IoThreadToProcess","PsInitialSystemProcess","KeInsertQueueDpc","KeNumberProcessors","KeInitializeDpc","KeSetTargetProcessorDpc","PsProcessType","MmMapIoSpace","MmUnmapIoSpace","ZwDeleteFile","KeAttachProcess","KeDetachProcess","RtlCompareUnicodeString","ZwWriteFile","NtClose","ObfReferenceObject","IoBuildSynchronousFsdRequest","ZwOpenThread","ZwTerminateProcess","RtlEqualUnicodeString","IoFreeIrp","ZwQueryDirectoryObject","KeBugCheck","ZwOpenDirectoryObject","IoAllocateIrp","KdDebuggerNotPresent","ZwSetSecurityObject","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","RtlLengthSecurityDescriptor","RtlCreateSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","RtlQueryRegistryValues","RtlPrefixUnicodeString","ExRegisterCallback","ExCreateCallback","ExUnregisterCallback","strcmp"],"Imports":["ntoskrnl.exe"],"InternalName":"aswArPot","MD5":"a179c4093d05a3e1ee73f6ff07f994aa","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"aswArPot.sys","Product":"Avast Antivirus ","ProductVersion":"21.1.187.0","Publisher":"","RichPEHeaderHash":{"MD5":"edc05997bbdab8acd04f275b386ffdab","SHA1":"b47a65e11021476840629d33996069e4638e241c","SHA256":"fe13709d1d6fd5734b2d61d1661e6ac2540c5ee2f4f96e56418d1db86c0bdb20"},"SHA1":"5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4","SHA256":"4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1","Sections":{".text":{"Entropy":6.386320097220837,"Virtual Size":"0x228c2"},".rdata":{"Entropy":5.733045078108813,"Virtual Size":"0x3ba4"},".data":{"Entropy":2.827822492450825,"Virtual Size":"0x25ad0"},".pdata":{"Entropy":5.411411947630738,"Virtual Size":"0x1218"},"PAGE":{"Entropy":6.270335052415906,"Virtual Size":"0x1c4b"},"INIT":{"Entropy":5.365142970284712,"Virtual Size":"0x13dc"},".rsrc":{"Entropy":3.285771259007418,"Virtual Size":"0x398"},".reloc":{"Entropy":5.435120402444784,"Virtual Size":"0x1a0"}},"Signature":["Avast Software s.r.o.","DigiCert High Assurance Code Signing CA-1","DigiCert"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2021","ValidFrom":"2021-01-01 00:00:00","ValidTo":"2031-01-06 00:00:00","Signature":"481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d424ae0be3a88ff604021ce1400f0dd","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c0189c338449a42fe8358c2c1fbecc60","SHA1":"b8ac0ee6875594b80ad86a6df6dd1fa3048c187c","SHA256":"a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5","SHA384":"76d3a316a5a106050298418cce3beea16100524723d9e3220b0de51bfb6f1c35a5d4c7cd10b358fef7bf94c3e3562150"}},{"Subject":"C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE 999, CN=Avast Software s.r.o.","ValidFrom":"2019-12-02 00:00:00","ValidTo":"2022-10-19 12:00:00","Signature":"874d04f17ffc50e66100207e56ecc8ae7e81c1957a7600295ead9db28842c7c05e06e8e28ccfc1e9d45d7a55d6d4a2fb74d72600a79ef5bfa53acaa4f3a4fcaf90a2554fc37742dd44c83a90880f948f5538637c0d999b03ebbf20cc001293a5639d44ad950cacfce2a337f7a24b817a5b85df89f6acf49974adee1d867373e6534a3f3558e59f87d06afe5744ec575b66c76110a595471007b209c591984f0ff20ea4c87ac405c85f42f0b105b04ec2ced11ca9cfb6aef21a3c6ae9ccd2a9cb4a9f78244751b15bfccb32ec3a52d44258bad6fc6d9f24c24700e9e1c4c0c29b9db4683c526a92934d72367620c6a89119e7a678597d7603c62b1c22f54edfad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03f02aca051d1c9330eeabd3706e836f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"f251d9cde0901fb67831855b4a592b51","SHA1":"cd0ac068faea4b875ded287512f20b6ba8dcb457","SHA256":"247e040822854e1a4cbc3488782a9e96db6bffa9bdfe36406a46e3f88695d423","SHA384":"c6a765c300f3ee36604e9c51a9fcd18071b0cd0bd15b3ad69350f04a0b1b5ef7b71556af698a1e8988bf91cd8b2a6104"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Timestamping CA","ValidFrom":"2016-01-07 12:00:00","ValidTo":"2031-01-07 12:00:00","Signature":"719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0aa125d6d6321b7e41e405da3697c215","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8d26184fc613f89aba1cefb30fce1b53","SHA1":"63a7e376bad5ec2e419d514a403bcf46c8d31d95","SHA256":"56b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c","SHA384":"d8c9691fe9dbe182f07b49b07fbb4f589fa7b38b5c4d21f265d3a2e818f4b1bfb39e03faab2ec05bb10333a99914fb8a"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}}],"Signer":[{"SerialNumber":"03f02aca051d1c9330eeabd3706e836f","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"Imphash":"3702511999371bac8982d01820dd70f2","LoadsDespiteHVCI":"FALSE"}]}