{"Id":"5a03dc5a-115d-4d6f-b5b5-685f4c014a69","Tags":["sfdrvx64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"3997557bc6175c3a3fa6e7a3abcd9161","SHA1":"7151719fbc8bc69bcbd601fc7f06f0965cc50d82","SHA256":"8f8956abdeb2a52be2cc514790a737a0ad39a9e698a77c1f358e77f1bf9f180b"},"Company":"Almico Software","Copyright":"Copyright © Almico Software 2001-2011","CreationTimestamp":"2011-03-18 12:08:46","Date":"","Description":"SpeedFan x64 Driver","ExportedFunctions":"","FileVersion":"X2.01.07","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoGetLowerDeviceObject","IoBuildDeviceIoControlRequest","IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","MmGetSystemRoutineAddress","KeInitializeEvent","RtlQueryRegistryValues","IoIs32bitProcess","MmUnmapIoSpace","IoCancelIrp","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoGetDeviceAttachmentBaseRef","KeWaitForSingleObject","PsGetVersion","IoGetDiskDeviceObject","RtlCompareMemory","ObfReferenceObject","IoCreateSymbolicLink","ObfDereferenceObject","IoCreateDevice","IoEnumerateDeviceObjectList","IoGetDeviceProperty","DbgPrint","IofCallDriver","KeBugCheckEx","RtlUnwindEx"],"Imports":["ntoskrnl.exe"],"InternalName":"sfdrvx64.sys","MD5":"12583af6cbe0050651eaf2723b3ad7b3","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"sfdrvx64.sys","PDBPath":"","Product":"SpeedFan","ProductVersion":"X2.01.07","Publisher":"","RichPEHeaderHash":{"MD5":"14282f6727c5e35f75b61f5088377f11","SHA1":"17ceaca75276d666ab96d685f491c84a126973d6","SHA256":"e0a72a747093856158411f6645f02b721e1122c73d508e574ff1aea1fb2c79fd"},"SHA1":"74bb900754636b5f2d519a41a3b5505bc6201789","SHA256":"965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb","Sections":{".text":{"Entropy":6.310540039060815,"Virtual Size":"0x2c41"},".rdata":{"Entropy":4.459510602918384,"Virtual Size":"0x2f4"},".data":{"Entropy":0.5159719988134768,"Virtual Size":"0x110"},".pdata":{"Entropy":3.702267211779809,"Virtual Size":"0xb4"},"PAGE":{"Entropy":5.925039880811379,"Virtual Size":"0xa76"},"INIT":{"Entropy":5.665205221244955,"Virtual Size":"0x642"},".rsrc":{"Entropy":3.301449537608998,"Virtual Size":"0x3f8"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2006-11-08 00:00:00","ValidTo":"2021-11-07 23:59:59","Signature":"1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"250ce8e030612e9f2b89f7054d7cf8fd","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"918d9eb6a6cd36c531eceb926170a7e1","SHA1":"0ae95700d65e6f59715aa47048993ca7858e676a","SHA256":"47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166","SHA384":"e54017c93ba52f012cc15aeb3bcbce1e90a0006ff8dca231a24fc572926770f63213343f538003407bed3463fa9c4a85"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}},{"Subject":"C=IT, ST=Marche, L=Ancona, O=Sokno S.R.L., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Software Development, CN=Sokno S.R.L.","ValidFrom":"2011-01-17 00:00:00","ValidTo":"2012-01-17 23:59:59","Signature":"b396a37f2fb9e14df27dd96d28e595a5dc8393f79c1c5451fe80a40bf1b137f382f6cc19893e6bb8593ab5a791d0a8376b5c15f222ca18da6e98b795b91dc91905a5686cf774b2302bc2699b8e0948ab317b61661199a9434d3ac99de902ecc7917a876e6f2be824f6579f604e8a5ddfa346a48b80447601863ff2895272339a56fe6e1a4eadd5819322fc61d7b7f6bafa4c4100050db7dc28b8fee2b57569f7b84e0a75a7779246854ce23f119e6a7473ca567a4d00036fa0fda173c2416eecd7e75ceee28e6f4333b9cd10b176de0ded58198970cd627874e2d256daeb2e2c3f6f96c54b678eb3b5eee0cf35a81f7519e48f7515983c6b573bd52feecc5406","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"13aeb106771cc3a1bcef3513c2e03196","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3ba7a92d9261090182e93029fbb8cb5f","SHA1":"909fd9f95fcd160634f33a56914a1177ee818e0d","SHA256":"85bbc71865ceb6cd1a1b3c5564db193364e7ca285f97573b5daae275412b9b79","SHA384":"e5b1b724776ed2fbfa0d3cd1a183811da25ebeb8dc98451513321ba23efb1f6a3eb55d38d4b9f7ccaec17ca6ca4e5a68"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"13aeb106771cc3a1bcef3513c2e03196","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"9833f7dab4a59d51b04d2cf31656a0f6","LoadsDespiteHVCI":"TRUE"},{"Authentihash":{"MD5":"94749793f16989a1c2cc24a75f1559ac","SHA1":"e26a1a3cd82ce6e58fb4252a0da2cc86236618b1","SHA256":"d8ff25255202321bd00f7aa792800e1fb7aab506dca771a4a8e2cc1af265fa15"},"Company":"Almico Software","Copyright":"Copyright © Almico Software 2001-2010","CreationTimestamp":"2010-12-18 06:03:51","Date":"","Description":"Speed Fan x64 Driver","ExportedFunctions":"","FileVersion":"X4.43.04","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoGetLowerDeviceObject","IoBuildDeviceIoControlRequest","IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","MmGetSystemRoutineAddress","KeInitializeEvent","RtlQueryRegistryValues","IoIs32bitProcess","MmUnmapIoSpace","IoCancelIrp","IoGetDeviceObjectPointer","MmMapIoSpace","IofCompleteRequest","IoGetDeviceAttachmentBaseRef","KeWaitForSingleObject","PsGetVersion","IoGetDiskDeviceObject","ObfReferenceObject","IoCreateSymbolicLink","ObfDereferenceObject","IoCreateDevice","IoEnumerateDeviceObjectList","DbgPrint","IofCallDriver","KeBugCheckEx","RtlUnwindEx"],"Imports":["ntoskrnl.exe"],"InternalName":"sfdrvx64.sys","MD5":"7455ed832a33fef453407f5411c3342d","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"sfdrvx64.sys","PDBPath":"","Product":"Speed Fan","ProductVersion":"X4.43.04","Publisher":"","RichPEHeaderHash":{"MD5":"825b8dd63f5e4e6be93b0e5db7910807","SHA1":"5445242f2ce7ccfda8ead34f42e555d81b89899a","SHA256":"25171eca9358b1fb78f39664ab9a00ec59d8b8e9979649d8251ab9998bd35701"},"SHA1":"a5d7ea909df5ad14a0e6241c4036c1c97ec30aa9","SHA256":"88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af","Sections":{".text":{"Entropy":6.275909814730868,"Virtual Size":"0x2521"},".rdata":{"Entropy":4.437390207622937,"Virtual Size":"0x27c"},".data":{"Entropy":0.5159719988134768,"Virtual Size":"0x110"},".pdata":{"Entropy":3.5825069080329555,"Virtual Size":"0x84"},"PAGE":{"Entropy":5.90834923753593,"Virtual Size":"0xa66"},"INIT":{"Entropy":5.6823059965117295,"Virtual Size":"0x5ee"},".rsrc":{"Entropy":3.3165817359453325,"Virtual Size":"0x3f8"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=IT, ST=Marche, L=Ancona, O=Sokno S.R.L., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Software Development, CN=Sokno S.R.L.","ValidFrom":"2010-02-06 00:00:00","ValidTo":"2011-02-11 23:59:59","Signature":"4af5c78740fff4400227bf9855994728dc50952f5fbfca91e51daf991c11699fc4471de9aba215c56b166966a7a7faa933de560a7dc2f747b5050d8d21c2f49c7c44e40378b8b0cfe243eb0ca6a44afdda2d830de6e4a4402aafd96af9e0370dde4aa7076d2eec26e7f63a89ee80a6fa37b733dd9cfc107289ea7a37b0247922ca9f2da216ac3763e36358035284a87f9ca3207c0a1d56e972466efbefcca77179787c990266e4773c686ebe44c3e865280b1c9410d711bf4af210c4af8d606602a2616bc4ef864a4873d0b315a3e8a4b8d621295a37b6e51d79511656dbcadb92c59816dc1be44536352d1a6eec740ed3be6d988d8eed2419498fcb5ffe2a44","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"202ed4a0a58d3214998c9a2bed089580","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"55742be12a3eedd1220df04ce0bf919b","SHA1":"e385f5f8c52ddad2a1f19e6d43a289e012e5f478","SHA256":"34213e50739ea1768a9bf3c3eed6dabbb5d8ab444636ec35f9d6c71a4c73863d","SHA384":"eefa42b51c6c31c434858a27a4717af9c186e8850bc2aa49b92a4205f59f3fd329fa4b1911a08b17b137cf37c35aae6c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"202ed4a0a58d3214998c9a2bed089580","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"Imphash":"0b19304edb04d5b178dd763d7cd04167","LoadsDespiteHVCI":"TRUE"},{"Authentihash":{"MD5":"79680d213f9c7a85a512b3d90e3f2e36","SHA1":"8fe08faea7bb2a8ba69014dd49ee44a3f8a2985c","SHA256":"c09dfc18959fe51d3e5ca1500a94ab74faf0eb72040930e89cdbac653df9e816"},"Company":"Almico Software","Copyright":"Copyright © Almico Software 2001-2013","CreationTimestamp":"2012-12-29 15:59:35","Date":"","Description":"SpeedFan x64 Driver","ExportedFunctions":"","FileVersion":"X2.03.11","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","IoGetLowerDeviceObject","IoBuildDeviceIoControlRequest","IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","MmGetSystemRoutineAddress","KeInitializeEvent","RtlQueryRegistryValues","IoIs32bitProcess","MmUnmapIoSpace","IoCancelIrp","IoGetDeviceObjectPointer","ExAllocatePool","MmMapIoSpace","IofCompleteRequest","IoGetDeviceAttachmentBaseRef","KeWaitForSingleObject","PsGetVersion","IoGetDiskDeviceObject","RtlCompareMemory","ObfReferenceObject","IoCreateSymbolicLink","ObfDereferenceObject","IoCreateDevice","IoEnumerateDeviceObjectList","IoGetDeviceProperty","DbgPrint","IofCallDriver","KeBugCheckEx","RtlUnwindEx"],"Imports":["ntoskrnl.exe"],"InternalName":"sfdrvx64.sys","MD5":"0ffe35f0b0cd5a324bbe22f02569ae3b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"sfdrvx64.sys","PDBPath":"","Product":"SpeedFan","ProductVersion":"X2.03.11","Publisher":"","RichPEHeaderHash":{"MD5":"14282f6727c5e35f75b61f5088377f11","SHA1":"17ceaca75276d666ab96d685f491c84a126973d6","SHA256":"e0a72a747093856158411f6645f02b721e1122c73d508e574ff1aea1fb2c79fd"},"SHA1":"25789f290feba14f53d48f4d1a5003ec130f7d95","SHA256":"f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560","Sections":{".text":{"Entropy":6.311036525002312,"Virtual Size":"0x2d51"},".rdata":{"Entropy":4.53674003294266,"Virtual Size":"0x310"},".data":{"Entropy":0.5159719988134768,"Virtual Size":"0x110"},".pdata":{"Entropy":3.690383453286534,"Virtual Size":"0xc0"},"PAGE":{"Entropy":5.985531981826166,"Virtual Size":"0xc06"},"INIT":{"Entropy":5.661556138214024,"Virtual Size":"0x642"},".rsrc":{"Entropy":3.3121861943705873,"Virtual Size":"0x3f8"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"OU=Timestamping CA, O=GlobalSign, CN=GlobalSign Timestamping CA","ValidFrom":"2009-03-18 11:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"5df6cb2b0d0140849f857a43706ae0c5e7aa0600d76713c9089131654f14a8a905dc389e6aa0300abd8dc78028ee4245ca94f3de5845a9803204f5595c6a70003927944df5b44634e81c5331b2b35416e9cc42abd5d959301cfb462725b88723b1e8758824831ec876377b01494548a4ede25dd27c9ca2dc2dba105a126265abae00c710343bcb72bd14240cdcc37627b4a7fee15829f20e169f91391d89a6e60f1c878ce258ac927e243eaaec14e73a33348bc63bac83ab0f14627aba1a2d4d4b1bc530f00b92797d3c78e0f8e6d215965999392b3061e8b8f8c0a1e9221411787dc4dc89bec0bb94e172aeebb540404fef171e585ed0a88996ac9228e9babf","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012019c19066","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"42023b9487cafe46c1b6a49c369a362e","SHA1":"7c7b524d269334b9f073c32e888e09544c6acd98","SHA256":"b7126567833f3daa4085ff41e73112daad3d1e3808a942c1936520e2d6c46c78","SHA384":"0ee4f63d6f157ec4f6990c3ebb411ccd76cb1e2123c7f692459e43f96c0da2dbf60a2bce6afeacc60621d3055028baea"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2019-04-13 10:00:00","Signature":"225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee1355c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f6a9e8eb8784f3f694b4e353c08a0ff5","SHA1":"589a7d4df869395601ba7538a65afae8c4616385","SHA256":"cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4","SHA384":"dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"}},{"Subject":"C=BE, O=GlobalSign NV, CN=GlobalSign Time Stamping Authority","ValidFrom":"2009-12-21 09:32:56","ValidTo":"2020-12-22 09:32:56","Signature":"bc89ecfee63655935c79d4117a86808f17b693b26d9b91a1561811c655eaf608edad9b9ef52b81c8bbdd607b1b47991e6d403e1d80c213d58e04052fdbe7ae529e688472a1e54a603cf89bd52f46d8c3b2b79353ac9b6c432424d1f1fce9562e3411581843eaefff34746ca0c06c7fad031969881e9560cabbbd0cbb76efc724b081c63831cf36ad0c38b89020849b2e8f28b99ff6ca9427cdac396157e0e3955a9c769230f5dea6973d721c2a6032a8334d8635338a5cf3a4fdf7062ce16b4b30f5cbd34362f841b9de7d20cb058c8e2cf65f35fd338d42896508362ca389f45a858bb0b97bdb6ccba1f8d20e1bbb977cd12779be9d7c3be6a75634d8c991a9","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"01000000000125b0b4cc01","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e3369c8e5aec0504b3a50455f615d9f9","SHA1":"13c244a894b40ecd18aaf97c362f20385bd005a7","SHA256":"26da721a670c72836926032fee6920118bfb9bff89cc8d0ce30d9452c33f2532","SHA384":"1524902f0e25addc6d74039d439366d2b06199e215004fd8e145369f50ea94a021ce6312e8a62b35470da0309ccb975c"}},{"Subject":"C=IT, ST=AN, L=Ancona, O=SOKNO S.R.L., OU=Software development, CN=SOKNO S.R.L.","ValidFrom":"2012-01-23 11:31:42","ValidTo":"2013-01-23 11:31:42","Signature":"12db538df515e86a2fdf7a491c37cf868a49d272d18b2e31558ea2e2d4f0c4a24609a65dcc6af470994f183cb6cf31d5d486efbac82a49ff4c989abae0e12781ab507666c0a5eef221c92c944ff94912678a22800af588d70fec25bc5e562809f1a14f280429deedab4aedc7d722b74cb0caf26cc06a49fe9698917f43918f1d01c8f33e45605be1c2a1e3efa3ec6b51d0c8504651a2647bede351730a3d0b2df454b5bcd32ca3a3054ab0f32a4fa624c3857ed0bce29578d0141236ffe9d464679ad3ff4aa120bab73e7da7df39f1d41c1ab18704c7e23cdcfa3e687d7a0ce421800860b92ca47843bdccde80b821e21f6af5a64e1fb0c92d9f2d9138704529","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"112195d7aa105e2ffc7b0e33f36da1636e74","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"84bc78b97f6e7688634c980ee0a78102","SHA1":"53a67d0f8677e0c85cc75c779ffe199fcff5df42","SHA256":"1d016faa85d7797373fe502c17c35461aff2f8f8fbec5a30f1871691820d5753","SHA384":"d655b57f8805eb589506a3a1e7bc0cf4aa5d5c59b8d5f1f052991d9b6a6d37f8fc454ea3d6305bd46455e59ec3d2875f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}}],"Signer":[{"SerialNumber":"112195d7aa105e2ffc7b0e33f36da1636e74","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","Version":1}]}],"Imphash":"9833f7dab4a59d51b04d2cf31656a0f6","LoadsDespiteHVCI":"FALSE"}]}