{"DetectionScope":"context-only","ResearchEvidence":{"Id":"9454a752-233e-4ba2-b585-8da242bf8f31","Tags":["Netfilter.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"d28a2c907981a32d7855fbf5e8e61c48","SHA1":"05ac1c64ca16ab0517fe85d4499d08199e63df26","SHA256":"b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-09 07:38:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","ExAllocatePoolWithTag","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoAllocateIrp","RtlUnwind","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","KeGetCurrentThread","IoDeleteSymbolicLink","KeBugCheckEx","ExFreePoolWithTag","RtlInitUnicodeString","RtlCopyUnicodeString","strcpy","memset","memcpy","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"1e9f5515bff6f29d06694be4cd95a21c","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"f0b684c190bdbac4aa311a7355122963","SHA1":"b7866474ab0a322b84086fccf1948d5a8b7f03a0","SHA256":"33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae"},"SHA1":"919b22b086fb2718648e61274e7ae9535efa9a99","SHA256":"22da5a055b7b17c69def9f5af54e257c751507e7b6b9a835fcf6245ab90ae750","Sections":{".text":{"Entropy":6.340576773907242,"Virtual Size":"0x5de8"},".rdata":{"Entropy":4.626365451667356,"Virtual Size":"0x5fc"},".data":{"Entropy":0.6890836305716007,"Virtual Size":"0x9428"},"INIT":{"Entropy":5.674405086792681,"Virtual Size":"0xb48"},".reloc":{"Entropy":6.678125183974352,"Virtual Size":"0x694"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"b5403fb8687d7afd40fd8cf3b4dfe29b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"5064073c3f84f1569377081c4ad33867","SHA1":"aca8e53483b40a06dfdee81bb364b1622f9156fe","SHA256":"3d31118a2e92377ecb632bd722132c04af4e65e24ff87743796c75eb07cfcd71"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:44:55","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","ExAllocatePoolWithTag","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoAllocateIrp","RtlUnwind","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","KeGetCurrentThread","IoDeleteSymbolicLink","KeBugCheckEx","ExFreePoolWithTag","RtlInitUnicodeString","RtlCopyUnicodeString","strcpy","memset","memcpy","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"4fbf95520d372ed081a16e1ccfb3c154","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"f0b684c190bdbac4aa311a7355122963","SHA1":"b7866474ab0a322b84086fccf1948d5a8b7f03a0","SHA256":"33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae"},"SHA1":"45f68dd09d129264abed173fcdd5c56e1147a977","SHA256":"23115b5b1d5511d59cdad75f863d65893304dc098848dcb149b69492f51b31f6","Sections":{".text":{"Entropy":6.340579412340497,"Virtual Size":"0x5de8"},".rdata":{"Entropy":4.565535020821956,"Virtual Size":"0x5f4"},".data":{"Entropy":0.6890836305716007,"Virtual Size":"0x9428"},"INIT":{"Entropy":5.674405086792681,"Virtual Size":"0xb48"},".reloc":{"Entropy":6.678416291453968,"Virtual Size":"0x694"}},"Signature":"","Signatures":{},"Imphash":"b5403fb8687d7afd40fd8cf3b4dfe29b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"13e6bd0963191685d86aa909a5769b3f","SHA1":"3c20bb896fd16b5c698185fb176e820a448997b3","SHA256":"cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-14 22:22:09","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["RtlInitUnicodeString","IoDeleteSymbolicLink","RtlCopyUnicodeString","WdfVersionUnbindClass","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind"],"Imports":["ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"46e5dfe28aeccc39ea893975d54e3d3b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"6f68a8d35e578addef21fc78e0db33a2","SHA1":"a033bd7a041b2df1f345fca32d98a86c0e4a56b6","SHA256":"aaf6113599fa8837e1427737348e2c76b05a63fe85b5fbc5de8661d5e1f03cbe"},"SHA1":"0df5e8599b332a7927bd0a9d87ad9d6b5ad332fe","SHA256":"f3efcf47681d9f96afcbc843a241c21a643b173c48270446f6fe634991a57847","Sections":{".text":{"Entropy":5.817981688831222,"Virtual Size":"0x9ac"},".rdata":{"Entropy":3.8039387703024032,"Virtual Size":"0x544"},".data":{"Entropy":0.6106954451479871,"Virtual Size":"0xf58"},".pdata":{"Entropy":3.4419769857312277,"Virtual Size":"0xb4"},"INIT":{"Entropy":4.918280561548722,"Virtual Size":"0x19e"},".reloc":{"Entropy":3.0841837197791877,"Virtual Size":"0x28"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"650fb6bf48d8b35397597d970226ca12","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"8c667904b9db9e69a637c55ae50decbd","SHA1":"bc2f3850c7b858340d7ed27b90e63b036881fd6c","SHA256":"f08ebddc11aefcb46082c239f8d97ceea247d846e22c4bcdd72af75c1cbc6b0b"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:46:21","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","ExAllocatePoolWithTag","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoAllocateIrp","RtlUnwind","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","KeGetCurrentThread","IoDeleteSymbolicLink","KeBugCheckEx","ExFreePoolWithTag","RtlInitUnicodeString","RtlCopyUnicodeString","strcpy","memset","memcpy","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"a01abca106a37eb4e7f96b1c4be38712","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"f0b684c190bdbac4aa311a7355122963","SHA1":"b7866474ab0a322b84086fccf1948d5a8b7f03a0","SHA256":"33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae"},"SHA1":"0f45c274b86bdcffba8d09a3cdfce974b10e3bfe","SHA256":"cfe2dd2cf1eb8b79d3b4ae980cda6fd933979d47c837fda77256a24a41316468","Sections":{".text":{"Entropy":6.340579412340497,"Virtual Size":"0x5de8"},".rdata":{"Entropy":4.572425708982675,"Virtual Size":"0x5f4"},".data":{"Entropy":0.6890357570368669,"Virtual Size":"0x9428"},"INIT":{"Entropy":5.674405086792681,"Virtual Size":"0xb48"},".reloc":{"Entropy":6.678416291453968,"Virtual Size":"0x694"}},"Signature":"","Signatures":{},"Imphash":"b5403fb8687d7afd40fd8cf3b4dfe29b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"086a664c2a188f4a1db40a1684597517","SHA1":"8241c9a5755a740811c8e8d2739b33146acd3e6d","SHA256":"c56536f99207915e5a1f7d4f014ab942bd820e64ff7f371ad0462ef26ed27242"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:46:38","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","IoAllocateIrp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","IofCallDriver","ExAllocatePoolWithTag","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","IoDeleteSymbolicLink","KeBugCheckEx","RtlCopyUnicodeString","ExFreePoolWithTag","RtlInitUnicodeString","strcpy","strstr","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"530f12f8058199964d0b41f1856185ec","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"85bc198af7e82d3ad73505bc7086be84","SHA1":"e652b262f08c568106765e202ea0142129765004","SHA256":"4130707eedc8cb72f6c5703feee7b8bfbdbe7dc34630d6dc33a0f92da20bdb66"},"SHA1":"8b04023990d18dcd5cc4c5538b332b017f3962fc","SHA256":"bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a","Sections":{".text":{"Entropy":6.3151171440822305,"Virtual Size":"0x6722"},".rdata":{"Entropy":4.565306374693255,"Virtual Size":"0xefc"},".data":{"Entropy":0.6671192572015003,"Virtual Size":"0xbb18"},".pdata":{"Entropy":4.417141719623935,"Virtual Size":"0x630"},"INIT":{"Entropy":5.171869742524338,"Virtual Size":"0xcb8"},".reloc":{"Entropy":3.6204816846131127,"Virtual Size":"0x28"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"d252001e327cf09463aba69fb4de2125","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"086a664c2a188f4a1db40a1684597517","SHA1":"8241c9a5755a740811c8e8d2739b33146acd3e6d","SHA256":"c56536f99207915e5a1f7d4f014ab942bd820e64ff7f371ad0462ef26ed27242"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:46:38","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","IoAllocateIrp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","IofCallDriver","ExAllocatePoolWithTag","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","IoDeleteSymbolicLink","KeBugCheckEx","RtlCopyUnicodeString","ExFreePoolWithTag","RtlInitUnicodeString","strcpy","strstr","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"3ce1153adde6ca1fa17679d9f00b4de0","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"85bc198af7e82d3ad73505bc7086be84","SHA1":"e652b262f08c568106765e202ea0142129765004","SHA256":"4130707eedc8cb72f6c5703feee7b8bfbdbe7dc34630d6dc33a0f92da20bdb66"},"SHA1":"56086ede8efe41322b829aaec81df6ef317809e7","SHA256":"16e68d2fa75a4e04872be42e2b54c041e43ab3409096741690520417e3368aa6","Sections":{".text":{"Entropy":6.3151171440822305,"Virtual Size":"0x6722"},".rdata":{"Entropy":4.565306374693255,"Virtual Size":"0xefc"},".data":{"Entropy":0.6671192572015003,"Virtual Size":"0xbb18"},".pdata":{"Entropy":4.417141719623935,"Virtual Size":"0x630"},"INIT":{"Entropy":5.171869742524338,"Virtual Size":"0xcb8"},".reloc":{"Entropy":3.6204816846131127,"Virtual Size":"0x28"}},"Signature":"","Signatures":{},"Imphash":"d252001e327cf09463aba69fb4de2125","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"952d13ef24460cf6d9f7ce78005bc918","SHA1":"3debe170b5a113407f9e86ee6ed9ae00c3d82c9f","SHA256":"221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 03:06:29","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmTransactionCommit0","FwpmTransactionAbort0","FwpmSubLayerAdd0","FwpmSubLayerDeleteByKey0","FwpmCalloutAdd0","FwpmTransactionBegin0","FwpmFilterDeleteById0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpmFilterAdd0","FwpsCalloutRegister1","ExAllocatePoolWithTag","ExFreePoolWithTag","KeSetEvent","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwFlushKey","ZwSetValueKey","MmIsAddressValid","KeWaitForSingleObject","KeBugCheckEx","RtlCopyUnicodeString","KeInitializeEvent","IoDeleteSymbolicLink","RtlInitUnicodeString","ZwClose","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"2ff65eaca2ace4d13d0c7db521120e51","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"4515084119c0d55b8843fcbe64611276","SHA1":"78482066a1bb564c20bb2361adb896a05dbaaec9","SHA256":"e78ad40b7b64192da4009a3335caba162323bb5f86e38532eed33957951248b0"},"SHA1":"a9c16b188132cdf9e9d02ddda7727a241dc43ce2","SHA256":"04a269dd0a03e32e5b2a1c8ab0768791962e040d080d44dc44dab01dd7954f2b","Sections":{".text":{"Entropy":6.004652069757254,"Virtual Size":"0x16ea"},".rdata":{"Entropy":4.089109208356412,"Virtual Size":"0x754"},".data":{"Entropy":0.6753101114175523,"Virtual Size":"0x36d8"},".pdata":{"Entropy":3.8774173817774784,"Virtual Size":"0x1bc"},"INIT":{"Entropy":5.066163615261483,"Virtual Size":"0x530"},".reloc":{"Entropy":3.047012012247794,"Virtual Size":"0x28"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"40758fe0a03b654da35a5f035d0343c5","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"8ed8507c953e60b61f022350417236fa","SHA1":"2c27abbbbcf10dfb75ad79557e30ace5ed314df8","SHA256":"7f1772bdf7dd81cb00d30159d19d4eb9160b54d7609b36f781d08ca3afbd29a7"},"Company":"","Copyright":"","CreationTimestamp":"2021-03-27 04:41:44","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","KeInitializeEvent","KeWaitForSingleObject","IoAllocateIrp","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","strchr","strncat","strncpy_s","strstr","KeResetEvent","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","MmIsAddressValid","sprintf","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","strncmp","strncpy","wcsncmp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePoolWithTag","KeSetEvent","RtlFreeUnicodeString","KeBugCheckEx","RtlCopyUnicodeString","RtlAnsiStringToUnicodeString","RtlInitUnicodeString","RtlInitAnsiString","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"e3fb0f73f17f1fe04ae8fa9448d2f92b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b324bb3bfe051a8ce6eaa984b648d37e","SHA1":"5ca6f0de15e83eadef9ab16f19d18b89fbc171fb","SHA256":"c6eea0ec611fb1f51ab52e0625649f40428c2bcb8865f0b89ca9f1900f6c53f2"},"SHA1":"4656f21f4093a72864b12ad6783a640ec9d4adff","SHA256":"40c45c9b1c764777096b59f99ae524cbd25b88c805187e615c3ed6840f3d4c15","Sections":{".text":{"Entropy":6.346151239727315,"Virtual Size":"0x6958"},".rdata":{"Entropy":4.682011637139368,"Virtual Size":"0x11bc"},".data":{"Entropy":1.4664164031598028,"Virtual Size":"0x9468"},".pdata":{"Entropy":4.418309034702974,"Virtual Size":"0x60c"},"INIT":{"Entropy":5.255249066470295,"Virtual Size":"0xc3a"},".reloc":{"Entropy":3.7366309574076895,"Virtual Size":"0x3c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"e938b727f5a033818337f7ba0584500f","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"1f5f357f730b5852b34876b01fb1d44e","SHA1":"4b8c0445075f09aeef542ab1c86e5de6b06e91a3","SHA256":"0988d366572a57b3015d875b60704517d05115580678e8f2e126f771eda28f7b"},"Company":"","Copyright":"","CreationTimestamp":"2021-04-18 10:09:04","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","IoAllocateIrp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","IofCallDriver","ExAllocatePoolWithTag","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","IoDeleteSymbolicLink","KeBugCheckEx","RtlCopyUnicodeString","ExFreePoolWithTag","RtlInitUnicodeString","strcpy","strstr","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"a57e4e3a3fa46bbdbc9d803283af3479","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"85bc198af7e82d3ad73505bc7086be84","SHA1":"e652b262f08c568106765e202ea0142129765004","SHA256":"4130707eedc8cb72f6c5703feee7b8bfbdbe7dc34630d6dc33a0f92da20bdb66"},"SHA1":"4ede7f018c317ddc6a5f8f935f917621668cb1ec","SHA256":"f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca","Sections":{".text":{"Entropy":6.3151171440822305,"Virtual Size":"0x6722"},".rdata":{"Entropy":4.597541961463757,"Virtual Size":"0xf14"},".data":{"Entropy":0.6671192572015003,"Virtual Size":"0xbb18"},".pdata":{"Entropy":4.427523715328472,"Virtual Size":"0x630"},"INIT":{"Entropy":5.171869742524338,"Virtual Size":"0xcb8"},".reloc":{"Entropy":3.6204816846131127,"Virtual Size":"0x28"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"d252001e327cf09463aba69fb4de2125","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"ace17016bb2aba11a9f8f73b2fc98642","SHA1":"e014c6bebfda944ce3a58ab9fe055d4f9367d49c","SHA256":"651ffa0c7aff7b4a7695dddd209dc3e7f68156e29a14d3fcc17aef4f2a205dcc"},"Company":"","Copyright":"","CreationTimestamp":"2021-03-17 09:13:37","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","KeGetCurrentThread","KeInitializeEvent","KeWaitForSingleObject","IoAllocateIrp","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","strchr","strncat","strncpy_s","strstr","KeResetEvent","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoDeleteSymbolicLink","sprintf","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","strncmp","strncpy","wcsncmp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","memcpy","RtlUnwind","memset","MmIsAddressValid","ExFreePoolWithTag","ExAllocatePoolWithTag","KeSetEvent","KeBugCheckEx","RtlFreeUnicodeString","RtlCopyUnicodeString","RtlAnsiStringToUnicodeString","RtlInitUnicodeString","RtlInitAnsiString","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"9c46269615ae06f912463ddc28319157","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"3b4691d934a09c9e9405216d4916ad8a","SHA1":"beadde6d5d5b7e6a188598980e4ce7540b8e90ca","SHA256":"186f36b59d5535ba21343e53d01b70400138d19e0eebdb55a755ecd612ad08b7"},"SHA1":"6d6f71e858ce0fad35f4dc6e7ddb72dd0574a497","SHA256":"24ea733bae1b8722841fb4c6cead93c4c4f0b1248ca9a21601b1ce6b95b06864","Sections":{".text":{"Entropy":6.599025143052685,"Virtual Size":"0x55ae"},".rdata":{"Entropy":4.489014367618685,"Virtual Size":"0x8dc"},".data":{"Entropy":1.2232140216567502,"Virtual Size":"0x6d38"},"INIT":{"Entropy":5.5462767634898,"Virtual Size":"0xae6"},".reloc":{"Entropy":6.625671581169282,"Virtual Size":"0x5c0"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"9321f9c47129fbc728ead2710e22f1a5","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"8c667904b9db9e69a637c55ae50decbd","SHA1":"bc2f3850c7b858340d7ed27b90e63b036881fd6c","SHA256":"f08ebddc11aefcb46082c239f8d97ceea247d846e22c4bcdd72af75c1cbc6b0b"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:46:21","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","ExAllocatePoolWithTag","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoAllocateIrp","RtlUnwind","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","KeGetCurrentThread","IoDeleteSymbolicLink","KeBugCheckEx","ExFreePoolWithTag","RtlInitUnicodeString","RtlCopyUnicodeString","strcpy","memset","memcpy","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"0e2d4679f68796e9dd0d663137cb9e12","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"f0b684c190bdbac4aa311a7355122963","SHA1":"b7866474ab0a322b84086fccf1948d5a8b7f03a0","SHA256":"33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae"},"SHA1":"7cb3ea53660dbc1b4fe12e0c03c7bfea0a3c92a2","SHA256":"8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870","Sections":{".text":{"Entropy":6.340579412340497,"Virtual Size":"0x5de8"},".rdata":{"Entropy":4.572425708982675,"Virtual Size":"0x5f4"},".data":{"Entropy":0.6890357570368669,"Virtual Size":"0x9428"},"INIT":{"Entropy":5.674405086792681,"Virtual Size":"0xb48"},".reloc":{"Entropy":6.678416291453968,"Virtual Size":"0x694"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"b5403fb8687d7afd40fd8cf3b4dfe29b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"038cbc948ff5ba06ac0b54ca31401fe4","SHA1":"83660d245fe618ecafe4900ac1e2ad0292c2da2a","SHA256":"72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1"},"Company":"","Copyright":"","CreationTimestamp":"2019-11-04 01:10:09","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["MmUnmapLockedPages","KeClearEvent","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterPlugPlayNotification","KeReadStateEvent","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","KeInitializeEvent","KeReleaseSpinLock","IoDetachDevice","MmBuildMdlForNonPagedPool","IoFreeMdl","IoCancelIrp","KeDelayExecutionThread","ObQueryNameString","IoDriverObjectType","wcsstr","MmMapLockedPagesSpecifyCache","ExInterlockedInsertHeadList","ExAllocatePool","ExInterlockedInsertTailList","PoStartNextPowerIrp","IoUnregisterPlugPlayNotification","IofCompleteRequest","ObReferenceObjectByHandle","IoAttachDeviceToDeviceStack","PoCallDriver","ExInterlockedRemoveHeadList","IoCreateSymbolicLink","ObfDereferenceObject","ObReferenceObjectByName","IoCreateDevice","DbgPrint","IoAllocateMdl","IofCallDriver","KeAcquireSpinLockRaiseToDpc","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"f783cf9084f1cefa87e9e5a302d4d18a","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"a53e7b4810b8e8a6646827967165e841","SHA1":"6e089a0ffce20d92395e42c69b619bf59c140999","SHA256":"6d1066a1530eeb73686043235fe52052b0934d77e8e9ee471b0c67bfa61172c5"},"SHA1":"c1e63efa1447b68a870962334c61cedd04db379b","SHA256":"93d99a5fbfc888c0a40a18946933121ae110229dcf206b4d17116a57e7cf4dc9","Sections":{".text":{"Entropy":6.286294718424334,"Virtual Size":"0x1c97"},".rdata":{"Entropy":4.142075435632616,"Virtual Size":"0x33c"},".data":{"Entropy":0.4316511568077503,"Virtual Size":"0x150"},".pdata":{"Entropy":3.6825504342841513,"Virtual Size":"0xd8"},"INIT":{"Entropy":5.082788661818898,"Virtual Size":"0x594"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=CN, ??=Shanghai, ??=Private Organization, serialNumber=9131010707118381X9, C=CN, ST=Shanghai, L=Shanghai, O=, CN=","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-19 12:00:00","Signature":"3a72522da9ea787347ffe4ac96c364ffda35372ea83b3427ca0bb30d1478767ed738daaf84648998b3557ff959565e4000ffadb512d64361834b9ad550365a25a69f95ef9e7a4a38294ae14e9edd1724230f84b35deb1cedb5dc3f53d80ddfe9488df913ce93bf1a3989c325424bc35b601a0e85af646c3d764688e1922ba094b4c0e1de92186f4a0d0c1cad81673f9fca92b58e180101d9215fae80d2d42fe02c20fb1602a1cb72ec472d1d4725f1de0f76849cbd02cb7397920c623dbdebe4ea5d94b273ca1180cc5f29b45cc7c064a1bb7fa22f2d8e8e43d85c5e716481cb7beea87bb70eb5672220cec0ba61f08cbffb48114e48c11b1cdc3a13de5d221a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"62acdecc22447b159a7e2efb0350bd63","SHA1":"ddd0bd1dded2c9189fc5b8563f8210deb83c590b","SHA256":"ae3a19b6b64e739d5d2abb0e1471874b7d8b6b1e3f1e38ed483166a664355a4e","SHA384":"9af686e9341ce78dc60186100fa406916c8b90ea25a604401ffe99f3e2c4bfcf20e9106e1cfc05414972a2e069dae5e0"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"Imphash":"b679ac08daf4b4ce8a58d85a8e0904ac","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"9c6ee2cfa1e9a7cf7a847c6d4b20f10e","SHA1":"faa870b0cb15c9ac2b9bba5d0470bd501ccd4326","SHA256":"5c206b569b7059b7c32eb5fc36922cb435c2b16c8d96de1038c8bd298ed498fe"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:17:21","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","IoAllocateIrp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","IofCallDriver","ExAllocatePoolWithTag","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","IoDeleteSymbolicLink","KeBugCheckEx","RtlCopyUnicodeString","ExFreePoolWithTag","RtlInitUnicodeString","strcpy","strstr","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"1814c4b16c8c3e746a185daaa5099ebc","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"85bc198af7e82d3ad73505bc7086be84","SHA1":"e652b262f08c568106765e202ea0142129765004","SHA256":"4130707eedc8cb72f6c5703feee7b8bfbdbe7dc34630d6dc33a0f92da20bdb66"},"SHA1":"9065b63f7d1b7eac160c10d6f30a097613c29f12","SHA256":"0123c7f12dd7530d55aee49949ff1fee911c9689bd04591684aa641882589785","Sections":{".text":{"Entropy":6.3151171440822305,"Virtual Size":"0x6722"},".rdata":{"Entropy":4.567171752554631,"Virtual Size":"0xefc"},".data":{"Entropy":0.6671648510441038,"Virtual Size":"0xbb18"},".pdata":{"Entropy":4.417141719623935,"Virtual Size":"0x630"},"INIT":{"Entropy":5.171869742524338,"Virtual Size":"0xcb8"},".reloc":{"Entropy":3.6204816846131127,"Virtual Size":"0x28"}},"Signature":"","Signatures":{},"Imphash":"d252001e327cf09463aba69fb4de2125","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"9c6ee2cfa1e9a7cf7a847c6d4b20f10e","SHA1":"faa870b0cb15c9ac2b9bba5d0470bd501ccd4326","SHA256":"5c206b569b7059b7c32eb5fc36922cb435c2b16c8d96de1038c8bd298ed498fe"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:17:21","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpmFilterAdd0","FwpmFilterDeleteById0","FwpsAcquireClassifyHandle0","FwpmCalloutAdd0","FwpsCompleteClassify0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsReleaseClassifyHandle0","FwpsCalloutRegister1","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","IoAllocateIrp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","__C_specific_handler","IofCallDriver","ExAllocatePoolWithTag","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","IoDeleteSymbolicLink","KeBugCheckEx","RtlCopyUnicodeString","ExFreePoolWithTag","RtlInitUnicodeString","strcpy","strstr","WskCaptureProviderNPI","WskReleaseProviderNPI","WskDeregister","WskRegister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"0bd3b9f55a2d3a13f506d9d8b970e0de","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"85bc198af7e82d3ad73505bc7086be84","SHA1":"e652b262f08c568106765e202ea0142129765004","SHA256":"4130707eedc8cb72f6c5703feee7b8bfbdbe7dc34630d6dc33a0f92da20bdb66"},"SHA1":"f023177aca17f6dc90fdd9588240cb16c70a9fe2","SHA256":"63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0","Sections":{".text":{"Entropy":6.3151171440822305,"Virtual Size":"0x6722"},".rdata":{"Entropy":4.567171752554631,"Virtual Size":"0xefc"},".data":{"Entropy":0.6671648510441038,"Virtual Size":"0xbb18"},".pdata":{"Entropy":4.417141719623935,"Virtual Size":"0x630"},"INIT":{"Entropy":5.171869742524338,"Virtual Size":"0xcb8"},".reloc":{"Entropy":3.6204816846131127,"Virtual Size":"0x28"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"d252001e327cf09463aba69fb4de2125","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"e03a070a426b0c2de53ea23bfc76086b","SHA1":"202d5a05e546740037f9a4dc2b21f71680c39d3b","SHA256":"0391107305d76eb9ddf1a5b3b3c50da361e8ab35b573dbd19bf9383436b9303e"},"Company":"","Copyright":"","CreationTimestamp":"2021-04-09 02:29:46","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","memcpy","KeGetCurrentThread","KeInitializeEvent","KeWaitForSingleObject","IoAllocateIrp","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","strchr","strncat","strncpy_s","KeResetEvent","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","memset","sprintf","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","strncmp","strncpy","wcsncmp","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","IoDeleteSymbolicLink","RtlUnwind","MmIsAddressValid","ExFreePoolWithTag","ExAllocatePoolWithTag","KeSetEvent","RtlFreeUnicodeString","KeBugCheckEx","RtlAnsiStringToUnicodeString","RtlCopyUnicodeString","RtlInitUnicodeString","RtlInitAnsiString","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"a07f5f368deb3569ec3129fa55da4041","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"48c184eea90f0f9d8a01e83867866680","SHA1":"fadd2ab2dd0e54dd2328f37e313b3a7f50f58391","SHA256":"a918abac8859e89b8f2d620f60f54921e2f156a401cfe171a609326331f60635"},"SHA1":"a10ce0c717bfe0163eda2459964ad637d634de27","SHA256":"16b6be03495a4f4cf394194566bb02061fba2256cc04dcbde5aa6a17e41b7650","Sections":{".text":{"Entropy":6.564030296364231,"Virtual Size":"0x5b62"},".rdata":{"Entropy":4.44659940311796,"Virtual Size":"0x8c4"},".data":{"Entropy":1.2415415090465123,"Virtual Size":"0x6f40"},"INIT":{"Entropy":5.541103554795583,"Virtual Size":"0xae6"},".reloc":{"Entropy":6.652737807428317,"Virtual Size":"0x5e4"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"518e77c070ae21af7c558962cd1854a3","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"5064073c3f84f1569377081c4ad33867","SHA1":"aca8e53483b40a06dfdee81bb364b1622f9156fe","SHA256":"3d31118a2e92377ecb632bd722132c04af4e65e24ff87743796c75eb07cfcd71"},"Company":"","Copyright":"","CreationTimestamp":"2021-05-15 08:44:55","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["FwpsAcquireClassifyHandle0","FwpsReleaseClassifyHandle0","FwpmFilterDeleteById0","FwpsAcquireWritableLayerDataPointer0","FwpsApplyModifiedLayerData0","FwpmFilterAdd0","FwpmCalloutAdd0","FwpmSubLayerDeleteByKey0","FwpmSubLayerAdd0","FwpmTransactionAbort0","FwpmTransactionCommit0","FwpmTransactionBegin0","FwpmEngineClose0","FwpmEngineOpen0","FwpsCalloutUnregisterById0","FwpsCompleteClassify0","FwpsCalloutRegister1","IofCallDriver","IoCreateFile","IoFreeIrp","IoGetRelatedDeviceObject","ObReferenceObjectByHandle","ObfDereferenceObject","ZwQueryInformationFile","ZwSetInformationFile","ZwReadFile","ZwWriteFile","ZwClose","IoFileObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","PsTerminateSystemThread","KeSetBasePriorityThread","sprintf","CmUnRegisterCallback","CmRegisterCallbackEx","CmCallbackGetKeyObjectID","MmIsAddressValid","strlen","strncmp","strncpy","wcscat","wcslen","wcsncmp","RtlInitAnsiString","strcat","strcmp","strncat","ExAllocatePoolWithTag","ExAcquireSpinLockExclusive","ExReleaseSpinLockExclusive","wcscpy","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","KeResetEvent","KeInitializeTimerEx","KeSetTimerEx","PsCreateSystemThread","ZwCreateKey","ZwOpenKey","ZwFlushKey","ZwQueryValueKey","ZwSetValueKey","NtQueryInformationToken","RtlLengthSid","RtlConvertSidToUnicodeString","RtlCreateAcl","RtlAddAccessAllowedAce","RtlSetOwnerSecurityDescriptor","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenProcessTokenEx","ZwSetSecurityObject","PsGetProcessImageFileName","_allmul","PsProcessType","SeExports","strchr","strncpy_s","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","IoFreeMdl","IoReuseIrp","IoAllocateIrp","RtlUnwind","KeWaitForSingleObject","KeSetEvent","KeInitializeEvent","KeGetCurrentThread","IoDeleteSymbolicLink","KeBugCheckEx","ExFreePoolWithTag","RtlInitUnicodeString","RtlCopyUnicodeString","strcpy","memset","memcpy","strstr","WskDeregister","WskReleaseProviderNPI","WskCaptureProviderNPI","WskRegister","KeGetCurrentIrql","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionUnbind"],"Imports":["fwpkclnt.sys","ntoskrnl.exe","NETIO.SYS","HAL.dll","WDFLDR.SYS"],"InternalName":"","MD5":"cb34374f1b5fb771076872c6b14b7501","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"f0b684c190bdbac4aa311a7355122963","SHA1":"b7866474ab0a322b84086fccf1948d5a8b7f03a0","SHA256":"33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae"},"SHA1":"118f688c30a2f6c2d1feb955f53ce4acf3086b3b","SHA256":"e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37","Sections":{".text":{"Entropy":6.340579412340497,"Virtual Size":"0x5de8"},".rdata":{"Entropy":4.565535020821956,"Virtual Size":"0x5f4"},".data":{"Entropy":0.6890836305716007,"Virtual Size":"0x9428"},"INIT":{"Entropy":5.674405086792681,"Virtual Size":"0xb48"},".reloc":{"Entropy":6.678416291453968,"Virtual Size":"0x694"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"b5403fb8687d7afd40fd8cf3b4dfe29b","LoadsDespiteHVCI":"FALSE"}]}}