{"DetectionScope":"context-only","ResearchEvidence":{"Id":"a02ee964-a21e-4b08-9c98-a730c90bfd53","Tags":["LMIinfo.sys"],"Verified":"TRUE","Author":"Nasreddine Bencherchali","Created":"2023-05-11","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create LMIinfo binPath=C:\\windows\\temp\\LMIinfo.sys type=kernel && sc.exe start LMIinfo.sys","Description":"","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["Internal Research"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"Michael Alfaro","Handle":"@_mmpte_software"},"KnownVulnerableSamples":[{"Filename":"LMIinfo.sys","MD5":"d4f7c14e92b36c341c41ae93159407dd","SHA1":"eac1b9e1848dc455ed780292f20cd6a0c38a3406","SHA256":"453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233","Signature":"","Date":"","Publisher":"","Company":"LogMeIn, Inc.","Description":"LogMeIn Kernel Information Provider","Product":"LogMeIn","ProductVersion":"11.1.0.3220","FileVersion":"11.1.0.3220","MachineType":"AMD64","OriginalFilename":"LMIinfo.sys","Imphash":"8f52e36711c80bb9d7e30995e0092e83","Authentihash":{"MD5":"99b6f355ca0fb587ccb303e88bd73785","SHA1":"0ae6274d4f95b64415c6a5aefe3b5d6be8d1e4a4","SHA256":"e466e2bf4e190edd8717f6e8466b77a66b3304f5ae1458ca4400025a869fdfd1"},"RichPEHeaderHash":{"MD5":"bdff99685e44a2a995ac2c3f89cbfbc4","SHA1":"9e01c42c79a136e87196a62b38b3341bdda1fc0d","SHA256":"92cbcf061051bb7af8e3d62500d56bf58677d8c1f1775ca303d9692a793db897"},"Sections":{".text":{"Entropy":6.3716328247359995,"Virtual Size":"0x13fe"},".rdata":{"Entropy":3.700134110487962,"Virtual Size":"0x3c4"},".data":{"Entropy":1.9101517233007972,"Virtual Size":"0xfe0"},".pdata":{"Entropy":3.6288991018347074,"Virtual Size":"0xfc"},"INIT":{"Entropy":5.1019801701731975,"Virtual Size":"0x404"},".rsrc":{"Entropy":3.552566938777486,"Virtual Size":"0x438"},".reloc":{"Entropy":2.3438548967005404,"Virtual Size":"0x20"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-10 11:30:08","InternalName":"LMIinfo.sys","Copyright":"Copyright © 2003-2017 LogMeIn, Inc. Patented and patents pending.","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ObfDereferenceObject","ZwClose","ZwOpenKey","ExFreePoolWithTag","ZwOpenProcess","KeStackAttachProcess","KeUnstackDetachProcess","PsLookupProcessByProcessId","ObQueryNameString","ZwDuplicateObject","__C_specific_handler","KeBugCheckEx","RtlCopyUnicodeString","ExAllocatePoolWithTag","RtlFreeAnsiString","RtlUnicodeStringToAnsiString","ZwQueryValueKey","RtlInitUnicodeString","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=Private Organization, ??=US, ??=Delaware, serialNumber=3830661, ??=320 Summer Street, postalCode=02210, C=US, ST=Massachusetts, L=Boston, O=LogMeIn, Inc., CN=LogMeIn, Inc.","ValidFrom":"2015-06-18 00:00:00","ValidTo":"2018-06-22 12:00:00","Signature":"6a0e23b60625614e2b9d63745730ab1055883fd2e09d3ed78bb7723882c8f7d67be6deb473463ebbdf4996afae195462426a3f57f9d37b9d8182499f3416a24f2fd9f6da7e3cef9215dfe3c889f47cce584eaf5dd2116da627b91d4de5705951c8c9807fc21f899c05f9ed97a655ccc0ae9b311f85715ae8510c213cb05139929690950e9155386da88d1b1158ae20699db1116a988a6b0bdc98b246767e71b1ec40df7a5f2d7e3b17bb4cb4de8da18d77c58b938f4db8f197bd9d1313cf5711f222a16add8a5cb7c576bd26ec4abcff8701766a32f9bd8d89b9a9f875908cfc34a0d3d216729ebb5fee7e73b1b036caae620a80e6bd921425cc59dc3e692fc4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"080d35880102e23d2340f69eb3c0e561","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0ab811681729b60e5a52e1d629735427","SHA1":"915bae9a4eb8f9401e25e88aa88df0291d284e87","SHA256":"0959baf33a5efce5a36076b4fde7d39f1c04e3c4e2b0f6859be66cc9d472538f","SHA384":"42654d164eef35c9ef5c4138dd485009b65b8db4affc1f1359572b00465b92bf5ce3dd64e4504f74263b81f81eb73044"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"03f1b4e15f3a82f1149678b3d7d8475c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"83f5de89f641d0fbf60248e10a7b9534","SHA1":"382a73a059a08698d6eb98c87e1b36fc750933a4","SHA256":"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf","SHA384":"4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"080d35880102e23d2340f69eb3c0e561","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","Version":1}]}],"LoadsDespiteHVCI":"TRUE"},{"Filename":"LMIinfo.sys","MD5":"d4f7c14e92b36c341c41ae93159407dd","SHA1":"eac1b9e1848dc455ed780292f20cd6a0c38a3406","SHA256":"453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233","Authentihash":{"MD5":"99b6f355ca0fb587ccb303e88bd73785","SHA1":"0ae6274d4f95b64415c6a5aefe3b5d6be8d1e4a4","SHA256":"e466e2bf4e190edd8717f6e8466b77a66b3304f5ae1458ca4400025a869fdfd1"},"Description":"LogMeIn Kernel Information Provider","Company":"LogMeIn, Inc.","InternalName":"LMIinfo.sys","OriginalFilename":"LMIinfo.sys","FileVersion":"11.1.0.3220","Product":"LogMeIn","ProductVersion":"11.1.0.3220","Copyright":"Copyright © 2003-2017 LogMeIn, Inc. Patented and patents pending.","MachineType":"AMD64","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ObfDereferenceObject","ZwClose","ZwOpenKey","ExFreePoolWithTag","ZwOpenProcess","KeStackAttachProcess","KeUnstackDetachProcess","PsLookupProcessByProcessId","ObQueryNameString","ZwDuplicateObject","__C_specific_handler","KeBugCheckEx","RtlCopyUnicodeString","ExAllocatePoolWithTag","RtlFreeAnsiString","RtlUnicodeStringToAnsiString","ZwQueryValueKey","RtlInitUnicodeString","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=Private Organization, ??=US, ??=Delaware, serialNumber=3830661, ??=320 Summer Street, postalCode=02210, C=US, ST=Massachusetts, L=Boston, O=LogMeIn, Inc., CN=LogMeIn, Inc.","ValidFrom":"2015-06-18 00:00:00","ValidTo":"2018-06-22 12:00:00","Signature":"6a0e23b60625614e2b9d63745730ab1055883fd2e09d3ed78bb7723882c8f7d67be6deb473463ebbdf4996afae195462426a3f57f9d37b9d8182499f3416a24f2fd9f6da7e3cef9215dfe3c889f47cce584eaf5dd2116da627b91d4de5705951c8c9807fc21f899c05f9ed97a655ccc0ae9b311f85715ae8510c213cb05139929690950e9155386da88d1b1158ae20699db1116a988a6b0bdc98b246767e71b1ec40df7a5f2d7e3b17bb4cb4de8da18d77c58b938f4db8f197bd9d1313cf5711f222a16add8a5cb7c576bd26ec4abcff8701766a32f9bd8d89b9a9f875908cfc34a0d3d216729ebb5fee7e73b1b036caae620a80e6bd921425cc59dc3e692fc4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"080d35880102e23d2340f69eb3c0e561","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0ab811681729b60e5a52e1d629735427","SHA1":"915bae9a4eb8f9401e25e88aa88df0291d284e87","SHA256":"0959baf33a5efce5a36076b4fde7d39f1c04e3c4e2b0f6859be66cc9d472538f","SHA384":"42654d164eef35c9ef5c4138dd485009b65b8db4affc1f1359572b00465b92bf5ce3dd64e4504f74263b81f81eb73044"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"03f1b4e15f3a82f1149678b3d7d8475c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"83f5de89f641d0fbf60248e10a7b9534","SHA1":"382a73a059a08698d6eb98c87e1b36fc750933a4","SHA256":"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf","SHA384":"4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"080d35880102e23d2340f69eb3c0e561","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","Version":1}]}],"RichPEHeaderHash":{"MD5":"bdff99685e44a2a995ac2c3f89cbfbc4","SHA1":"9e01c42c79a136e87196a62b38b3341bdda1fc0d","SHA256":"92cbcf061051bb7af8e3d62500d56bf58677d8c1f1775ca303d9692a793db897"},"Sections":{".text":{"Entropy":6.3716328247359995,"Virtual Size":"0x13fe"},".rdata":{"Entropy":3.700134110487962,"Virtual Size":"0x3c4"},".data":{"Entropy":1.9101517233007972,"Virtual Size":"0xfe0"},".pdata":{"Entropy":3.6288991018347074,"Virtual Size":"0xfc"},"INIT":{"Entropy":5.1019801701731975,"Virtual Size":"0x404"},".rsrc":{"Entropy":3.552566938777486,"Virtual Size":"0x438"},".reloc":{"Entropy":2.3438548967005404,"Virtual Size":"0x20"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-10 11:30:08","Imphash":"8f52e36711c80bb9d7e30995e0092e83","LoadsDespiteHVCI":"TRUE"}]}}