{"Id":"9905c737-83ad-4801-a573-8267f3aea924","Tags":["bsitf.sys","AsusBSItf.sys","ASUS BIOS Flash Driver"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","CVE":["CVE-2024-33221"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create bsitf binPath=C:\\windows\\temp\\bsitf.sys type=kernel && sc.exe start bsitf","Description":"bsitf.sys and AsusBSItf.sys are ASUS BIOS Flash Driver naming variants distributed with the ASUS WinFlash utility. The 3.2.12.0 AsusBSItf.sys build exposes physical-memory reads through MmMapIoSpace (IOCTL 0x222804), contiguous kernel-memory allocation mapped to user mode through an MDL (IOCTL 0x222808), arbitrary I/O-port writes and reads (IOCTLs 0x222810 and 0x222818), and PCI configuration-space reads with BAR mapping (IOCTL 0x222814). Public research identifies this low-privilege interface as CVE-2024-33221 and demonstrates its use for privilege escalation, kernel code execution, or information disclosure. Earlier bsitf.sys builds tracked in this record additionally expose BIOS flash writes through IOCTL 0x22281C.","Usecase":"Elevate privileges","Privileges":"User","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/magicsword-io/LOLDrivers/pull/332","https://github.com/KeServiceDescriptorTable/vulnerable-drivers","https://github.com/fluffycats31/vulnerable-drivers","https://nvd.nist.gov/vuln/detail/CVE-2024-33221","https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33221"],"Detection":[],"Acknowledgement":{"Person":"fluffycats31","Handle":"@rainbowdynamix, @DbgPrint, @AkaTorich, @fluffycats31"},"KnownVulnerableSamples":[{"Filename":"AsusBSItf.sys","SHA256":"c82377f2c1b75afd1503bb494e1b23fc45a4a6b81c7678e4e6cf391ce023ccbb","MD5":"7afc060df3d17bbaf4d1d97de5aeb7ab","SHA1":"10abdafa632f5460f1d6da16f250257b30e9f7f7","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"bcf222909522659e1471e0fd718add96","SHA1":"77a404930cb34a172caee87060d2e8a56d6ca902","SHA256":"9387ad984318ffc0f2055006aab9c6af251d6d6534c39c1c335be7f115c17177"},"RichPEHeaderHash":{"MD5":"cb0aef4a0ebe414a83cc5cf06c221763","SHA1":"c082cabc79bbee2afc97c711a2817a72f4455fda","SHA256":"994dc10423bacedfef915682d72766ddefa90513a69bcdeeefee1ed7307691cf"},"Sections":{".text":{"Entropy":6.251487960842492,"Virtual Size":"0x1834"},".rdata":{"Entropy":4.37756485212279,"Virtual Size":"0xce0"},".data":{"Entropy":1.6413515232083404,"Virtual Size":"0x300"},".pdata":{"Entropy":4.0641389358534505,"Virtual Size":"0x2ac"},"PAGE":{"Entropy":6.252943848647559,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.557086642432217,"Virtual Size":"0x428"},".reloc":{"Entropy":3.795121441439695,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-10-26 21:32:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTeK COMPUTER INC.","InternalName":"AsusBSItf.sys","OriginalFilename":"AsusBSItf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"© ASUSTeK COMPUTER INC. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_C=TW, serialNumber=23638777, C=TW, ST=Taipei City, L=Beitou District, O=ASUSTeK COMPUTER INC., OU=SYS BG,PC BU,SW RD Ctr, CN=ASUSTeK COMPUTER INC.","ValidFrom":"2021-05-04 00:00:00","ValidTo":"2024-05-08 23:59:59","Signature":"198104654ec4070826b40a1b0450eb45c409b6fbcba328cd9d7f797a692c3d5d2b166d5ecefc5519701cafda65263f13c3900384ec33b37eb67ef9efedea1e2c5cbc63e772c1d1d64a402b5aad0e7a3e5a947f798c8fa0a204f5b66054b6106412e8f5f1dadc3d578993b836bd6792a48cc058d3326fb3277232642e3383e418791c659fb6f0c6b9a7dfaedccc4461bae1ebd925080129daf77ad40ee0d3b9bab3fb2ca0da4518df398ca89a01a28efcf823e5d735c600c7e9fff6b4c2cb0239aeb71edd6c7b9df050ca1cef168f3b7ee3db4a0938ecc7706221c90494d958dc7e3c394be70e6e04c3718eb988fdb0a0971aaf294ccdb4edb5cd35024da6205b","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"07207b3a1acb44e4dc39ebd389a96d65","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b382ea0cfba11401487fca94b6ea6de6","SHA1":"10b2559e898bfb08af670ea5f51e6468bee5dcca","SHA256":"fb7f21d7287cb8247255d82e6eb097e38d4e8d33aa94ff7eeb5ff267b56167b5","SHA384":"6002b53470e6aa7f092c8566b646d4dab7481f3ba8c8eb43d1935a603c17c4d2017bd7689b199411242399dd60572005"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"03f1b4e15f3a82f1149678b3d7d8475c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"83f5de89f641d0fbf60248e10a7b9534","SHA1":"382a73a059a08698d6eb98c87e1b36fc750933a4","SHA256":"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf","SHA384":"4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"}}],"Signer":[{"SerialNumber":"07207b3a1acb44e4dc39ebd389a96d65","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"4d59cc4dd2c94cdb78e561f3a422e899","SHA1":"e77af2651fb4a4ff0fe80bf838ebe0b76aa8edd4","SHA256":"602bef923ddbf2ea7967cedf56866b9db10fb43f0e90a9681cd021f1cddc05c9","Signature":"","Date":"","Publisher":"","Company":"ASUSTek Computer Inc.","Description":"ASUS BIOS Flash Driver","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","FileVersion":"3.2.11.0","MachineType":"AMD64","OriginalFilename":"bsitf.sys","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","InternalName":"bsitf.sys","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"28d244dd772cc099f1ccc617f46863fc"},{"Filename":"bsitf.sys","MD5":"835dd954d9f306f09050fd1751e9e1d2","SHA1":"d80b8c9dfd317c57cbd9c3c6dfacc5b787bac06d","SHA256":"41f604cfc56b101cafba8d12ee7f30409457deb13684091262571f1a6c1ddd07","Signature":"","Date":"","Publisher":"","Company":"ASUSTek Computer Inc.","Description":"ASUS BIOS Flash Driver","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","FileVersion":"3.2.12.0","MachineType":"AMD64","OriginalFilename":"bsitf.sys","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","InternalName":"bsitf.sys","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"28d244dd772cc099f1ccc617f46863fc"},{"Filename":"bsitf.sys","MD5":"684b273804e93966ab33126a19b10081","SHA1":"63b722ff2bede1e9801648f258a628c8207b460b","SHA256":"fecfa23abf0d2a7dcf96eed620d8c5c614d61e483c44b3f5d7fccf5cd6498efd","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"66d62669f75297f1ef9c3fc7da023894","SHA1":"9384f44413621701be8e99558cc6b77f48808c33","SHA256":"663b248cae58cc25b7dbe32fd3162689244055da5f64f2cb56b00b31bcc04cbb","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.11.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"fac9a7be193a8c83dd2a2a6ef6a4a64f","SHA1":"92be49e79b4e2baca13904636a616ab0e3cbb1c3","SHA256":"f21bb1d8cf4ffc60d3ee1435f305a0997bd70fcc3dabf56e9bab2f9a396f2e2d","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.11.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"7ce755f7bb9b1e6e300baa84e70590f6","SHA1":"7eb76ad802dde690a32877884c45bdaf2bbd0abf","SHA256":"7d9bb305a98d49658a625f6f12f1c95e291c4fe3aa2ba150fef094b3be6337e3","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"f92971e1a7c995959af7d55fc66d2341","SHA1":"db79da0fd20cab108af2bf98f60fe5b988769417","SHA256":"74adbc40526354d688e199a29bc84f72416b7d65a88f4cec925a3e1bbb2fde45","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"5450cf5bcbf4d050563621fd44b5293b","SHA1":"90c51a1d6a6834437e268811cbf1cdc0cbb21b0e","SHA256":"16f25dcae1da288989bfcd43af7a7508550c9c3995f611a576f653e3dbb2b188","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"04edefd2322c55d396e737a52fde127f","SHA1":"15972f940c2e43274e778fce3d3a4f3b981f685c","SHA256":"91c9b881a5c1a5aadac1751c7957fcaa2b94691093875048729a551dab65e3df","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"346a00e5b4af2e5e54f29f9e83b63f49","SHA1":"d924fc336c8c337196dcdfce81f8fa9bc2ce0885","SHA256":"084645f99cdb6103ae779228b138e960ce57e21e1e9680d708883278f367350d","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.11.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"3449f8581980785d6b35d2c85ba8360f","SHA1":"e5b562aa028e978158ad1875c53c09a61832e919","SHA256":"f743bec7528848f6ae893eff849be21463dc78d2decfd7bcf50f165d2e03f1dd","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.11.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"9559ad8c4b674b6d26e888728933fc2b","SHA1":"6a9668321104c94bb6f0418e3152cec14d7ce956","SHA256":"506c8a63ad44737e893385c6ee70e05b30725ec52752c9134842906cf9d14fee","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"090861039dcbcfc0feecdbaf1aa577cc","SHA1":"65d2ac2cabd251c0eab84cf4c0ab57ed15504f4f","SHA256":"678d7d011499c5793ca87b29c7179d0d959f8d6d5b3b966ee619c3d0cfcb6bc1"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.232531482513575,"Virtual Size":"0x1db4"},".rdata":{"Entropy":4.406100493738688,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.106433873658979,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.247662669939153,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.197351419429812,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5575668402783402,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-15 03:26:29","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.11.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.11.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"bsitf.sys","MD5":"ae2454c4b0f2cb159a1d419636658514","SHA1":"7f1ab2880f8db472db5121bc95d0ddd01e0f52a0","SHA256":"87db5659f019a5d909f2310ae09c2cd089f3feee57d1eae3d302fe59eea53c70","LoadsDespiteHVCI":"FALSE","Imphash":"28d244dd772cc099f1ccc617f46863fc","Authentihash":{"MD5":"b9a4fb5c158dbc15ffbda5db91d0248a","SHA1":"fbb05ee844e53f280f97012f02ac3cc2778260b6","SHA256":"ae8d7bf855b35951bed2e5cd14daf569befe3284f0b90a8296cc89ace3845fbe"},"RichPEHeaderHash":{"MD5":"a17da6e24f9d7f5d4335a7c4f22cd502","SHA1":"5b43331ee12aad91ad19fcafe4106b122494c7cd","SHA256":"64b94de97b482bdd0ff9f96d307093e6c2f631bcd1b1089ca53f5ae789628711"},"Sections":{".text":{"Entropy":6.227603841043359,"Virtual Size":"0x1df4"},".rdata":{"Entropy":4.39396975570802,"Virtual Size":"0xcc8"},".data":{"Entropy":1.6274053617928048,"Virtual Size":"0x300"},".pdata":{"Entropy":4.058314104315186,"Virtual Size":"0x2c4"},"PAGE":{"Entropy":6.24798590167577,"Virtual Size":"0x21ec"},"INIT":{"Entropy":5.192733466798069,"Virtual Size":"0x644"},".rsrc":{"Entropy":3.5556185158699756,"Virtual Size":"0x418"},".reloc":{"Entropy":3.660708930055735,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-09 23:10:34","Description":"ASUS BIOS Flash Driver","Company":"ASUSTek Computer Inc.","InternalName":"bsitf.sys","OriginalFilename":"bsitf.sys","FileVersion":"3.2.12.0","Product":"ASUS BIOS Flash Driver","ProductVersion":"3.2.12.0","Copyright":"(C) ASUSTek Computer Inc. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPages","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoAllocateMdl","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoWMIRegistrationControl","IoWMIOpenBlock","IoWMIQueryAllData","ObfDereferenceObject","MmGetPhysicalAddress","ZwCreateKey","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}