{"Id":"a0fbd397-64d5-4af2-844b-b096e08a1866","Tags":["libnicm.sys"],"Verified":"TRUE","Author":"Nasreddine Bencherchali","Created":"2023-05-06","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create libnicm.sys binPath=C:\\windows\\temp\\libnicm.sys type=kernel && sc.exe start libnicm.sys","Description":"","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["Internal Research"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"libnicm.sys","MD5":"7a6a6d6921cd1a4e1d61f9672a4560d6","SHA1":"cb5229acdf87493e45d54886e6371fc59fc09ee5","SHA256":"ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a","Authentihash":{"MD5":"8804d6be09e294ab07e2691ca91e67a5","SHA1":"ffe0a81f1e2aee5cb4c5720da8d3ab2cdec52dc1","SHA256":"6aa427e7230a2b077bfecade35ffff67b2f15c051cf92fd207a3412c747f83c3"},"Description":"Novell XTCOM Services Driver","Company":"Novell, Inc.","InternalName":"","OriginalFilename":"libnicm.sys","FileVersion":"3.1.11.0","Product":"Novell XTier","ProductVersion":"3.1.11","Copyright":"(C) Copyright 2000-2013, Novell, Inc. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["NicmCreateInstance","NicmDeregisterClassFactory","NicmGetVersion","NicmRegisterClassFactory","XTComCreateInstance","XTComDeregisterClassFactory","XTComFreeUnusedLibrariesEx","XTComGetClassObject","XTComGetVersion","XTComInitialize","XTComRegisterClassFactory"],"ImportedFunctions":["ExAcquireResourceExclusiveLite","ExAllocatePoolWithTag","ExFreePoolWithTag","strstr","RtlInitAnsiString","ExAcquireResourceSharedLite","ExReleaseResourceLite","RtlEqualString","MmUnmapLockedPages","ProbeForRead","IoDeleteSymbolicLink","IoRegisterShutdownNotification","KeInitializeMutex","KeLeaveCriticalRegion","IoDeleteDevice","ProbeForWrite","IoFreeMdl","KeEnterCriticalRegion","KeReleaseMutex","ZwCreateFile","MmMapLockedPagesSpecifyCache","IoUnregisterShutdownNotification","ZwClose","IofCompleteRequest","IoSetTopLevelIrp","KeWaitForSingleObject","MmProbeAndLockPages","MmUnlockPages","ExDeleteResourceLite","IoGetTopLevelIrp","IoCreateSymbolicLink","IoCreateDevice","ExInitializeResourceLite","NtSetSecurityObject","DbgPrintEx","IoAllocateMdl","RtlCreateSecurityDescriptor","IoGetCurrentProcess","ZwCreateKey","RtlAnsiStringToUnicodeString","ZwReadFile","RtlInitUnicodeString","RtlAppendUnicodeToString","RtlUnicodeStringToAnsiString","ZwSetValueKey","ZwQuerySystemInformation","RtlInitString","KeDelayExecutionThread","RtlFreeUnicodeString","ZwWaitForSingleObject","ZwQueryValueKey","ZwQueryDirectoryFile","RtlAppendUnicodeStringToString","RtlCopyString","MmIsAddressValid","ZwOpenFile","ZwQueryInformationFile","ZwLoadDriver","ZwOpenKey","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation","ValidFrom":"2021-09-02 18:32:59","ValidTo":"2022-09-01 18:32:59","Signature":"164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000002528b33aaf895f339db000000000252","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"92b6022918bc02eb361b8a02fb1da57d","SHA1":"8ceb945fac0f6d623d464e21740ae6eb60351652","SHA256":"c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb","SHA384":"322ed1a62a9f2ed7c7f601e99a8db15371e3ba1039a73c81801165ea987679023bc36f8c357f74354dce65532b71be3c"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011","ValidFrom":"2011-07-08 20:59:09","ValidTo":"2026-07-08 21:09:09","Signature":"67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610e90d2000000000003","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"b4ec95434f1d45b8055077cf90540a5f","SHA1":"71f74db41d045d6eaf81a849bbb3e21544edcff4","SHA256":"f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e","SHA384":"25cbac323e740588a1ea3ca39ea907647440884ad75fc4bd99be6c82202aba42e95049fa7b66884977e60b819b21a2a5"}}],"Signer":[{"SerialNumber":"33000002528b33aaf895f339db000000000252","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011","Version":1}]}],"RichPEHeaderHash":{"MD5":"4a53ed67faf49ecb288c974cd66ea496","SHA1":"f83f49f155f801d8ce781070309c4ce878f8f87f","SHA256":"93963bed2c58da923a8df184e6443740eba6ecb6949996b6568f42fe525bf906"},"Sections":{".text":{"Entropy":6.307312732264105,"Virtual Size":"0x3980"},".rdata":{"Entropy":4.780683221400144,"Virtual Size":"0x56c"},".data":{"Entropy":2.7659755587497967,"Virtual Size":"0x968"},".pdata":{"Entropy":4.129962233416926,"Virtual Size":"0x228"},".edata":{"Entropy":4.8209283897016855,"Virtual Size":"0x18e"},"INIT":{"Entropy":5.7784312613823845,"Virtual Size":"0xb38"},".rsrc":{"Entropy":3.2963910982792863,"Virtual Size":"0x360"},".reloc":{"Entropy":1.3741854163060885,"Virtual Size":"0x18"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2013-01-16 01:19:18","Imphash":"262d8fbbf1f514399bb3f230cddc12af","LoadsDespiteHVCI":"TRUE"},{"Filename":"libnicm.sys","MD5":"cfad9185ffcf5850b5810c28b24d5fc8","SHA1":"87f313fc30ec8759b391e9d6c08f79b02f3ecebd","SHA256":"b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b","Authentihash":{"MD5":"e30ca4b88f80e5441aee1a7102dccf9a","SHA1":"5e68ae28b2e80d0045c01affba7c76f649241fb6","SHA256":"c5647d315fb5ca1dcf4b063ea3f54003e2545739871519b8f2c98dc5baf66bac"},"Description":"Novell XTCOM Services Driver","Company":"Novell, Inc.","InternalName":"","OriginalFilename":"libnicm.sys","FileVersion":"3.1.6.0","Product":"Novell XTier","ProductVersion":"3.1.6","Copyright":"(C) Copyright 2000-2008, Novell, Inc. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["NicmCreateInstance","NicmDeregisterClassFactory","NicmGetVersion","NicmRegisterClassFactory","XTComCreateInstance","XTComDeregisterClassFactory","XTComFreeUnusedLibrariesEx","XTComGetClassObject","XTComGetVersion","XTComInitialize","XTComRegisterClassFactory"],"ImportedFunctions":["ExFreePoolWithTag","RtlInitAnsiString","ExAcquireResourceSharedLite","ExReleaseResourceLite","RtlEqualString","ExAcquireResourceExclusiveLite","ExAllocatePoolWithTag","strstr","IoFreeMdl","RtlCreateSecurityDescriptor","KeEnterCriticalRegion","KeReleaseMutex","ZwCreateFile","MmMapLockedPagesSpecifyCache","IoUnregisterShutdownNotification","ZwClose","IofCompleteRequest","IoSetTopLevelIrp","MmUnmapLockedPages","KeWaitForSingleObject","ProbeForRead","MmProbeAndLockPages","IoDeleteSymbolicLink","IoRegisterShutdownNotification","MmUnlockPages","KeInitializeMutex","ExDeleteResourceLite","KeLeaveCriticalRegion","IoGetTopLevelIrp","IoCreateSymbolicLink","IoDeleteDevice","IoCreateDevice","ProbeForWrite","ExInitializeResourceLite","NtSetSecurityObject","DbgPrintEx","IoAllocateMdl","IoGetCurrentProcess","ZwLoadDriver","ZwReadFile","RtlInitUnicodeString","ZwOpenKey","RtlAppendUnicodeToString","RtlUnicodeStringToAnsiString","ZwSetValueKey","ZwQuerySystemInformation","RtlInitString","KeDelayExecutionThread","RtlFreeUnicodeString","ZwWaitForSingleObject","ZwQueryValueKey","ZwQueryDirectoryFile","RtlAppendUnicodeStringToString","RtlCopyString","MmIsAddressValid","ZwCreateKey","ZwOpenFile","RtlAnsiStringToUnicodeString","ZwQueryInformationFile","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=Utah, L=Provo, O=Novell, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Novell Products Group, CN=Novell, Inc.","ValidFrom":"2007-04-04 00:00:00","ValidTo":"2010-04-27 23:59:59","Signature":"267f71f6ee43755fd6395f85c34bb15a72a6f2a959c2074627d294395fb1aaa4c7bbeff369d735628b233bde7e5c95a0f1837e5ad03704270834ce9c1b07649a256027930f44e064568666b06e7f9dc3cd299b38b0a6766301200ab58434a05a34a369ab99bbbf2aaa6b3603481e0393a80ea09e78a7cf55317a9590c49887f02e1fd948c3b1f6d203e91782ce423d0569f45e7f074205df5f92be6ccd9836641439af4390022242e0ca84aedb0d71c5a50f2dbd1ed30e5ac9c1bda67c694f94f2fe4aa83945ed32e426afe26f44dcb6dcc8186728f86f1a1bddc1ea7dd82b76578a42d1e63bf5f8f348fbcd509094858978e375d277394529df1dd5d78abab2","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4808d93b14b8600dbfa18dab5d15310f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"adddb65a3a360b3c1a55cb33e426f32a","SHA1":"93d9b282265288a94ee4f1a01c5fb3a08badb7ac","SHA256":"d98d63f26125a94eb767fdd2526f6c74bfb40cb4d117a1d87ca3ed0d99bd6f0b","SHA384":"cf20d9d6343b52b05ebaeace8a75ad950089e2d55508571cf5b153583fdf2d7b11bc61b8f38bfa70f09b2e7ac63d9ef5"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"4808d93b14b8600dbfa18dab5d15310f","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"c93ac24ebf03669439ddaedcdec40816","SHA1":"5fa20de9a3815959d4a524edfd3e84d75d9057a9","SHA256":"143c2b92a334ff7919b92c2360f8a38b2ba578796bef13a77df8bbc2cefeee47"},"Sections":{".text":{"Entropy":6.3095364913748115,"Virtual Size":"0x396c"},".rdata":{"Entropy":4.801718169229357,"Virtual Size":"0x548"},".data":{"Entropy":2.7659755587497967,"Virtual Size":"0x968"},".pdata":{"Entropy":4.135209047489949,"Virtual Size":"0x1f8"},".edata":{"Entropy":4.823155614292039,"Virtual Size":"0x18e"},"INIT":{"Entropy":5.7600622039931295,"Virtual Size":"0xb18"},".rsrc":{"Entropy":3.2975194770283838,"Virtual Size":"0x358"},".reloc":{"Entropy":1.3741854163060885,"Virtual Size":"0x18"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-03-27 13:53:33","Imphash":"96f270be3f73ec3fc2f2237fe84efca0","LoadsDespiteHVCI":"FALSE"},{"Filename":"libnicm.sys","MD5":"0809f48fd30845d983d569b847fa83cf","SHA1":"c02cb8256dfb37f690f2698473fe5428d17bc178","SHA256":"b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e","Authentihash":{"MD5":"1fd61feb0c5b905441426742e69ec997","SHA1":"faab67dd8387e4ccb17e28f3637ccce4096bd10b","SHA256":"fcdf0eaf9c8effa2786c82e774974f1ef4098dcd376461bad37fd4168dcab52b"},"Description":"Novell XTCOM Services Driver","Company":"Novell, Inc.","InternalName":"","OriginalFilename":"libnicm.sys","FileVersion":"3.1.6.0","Product":"Novell XTier","ProductVersion":"3.1.6","Copyright":"(C) Copyright 2000-2008, Novell, Inc. All Rights Reserved.","MachineType":"I386","Imports":["ntoskrnl.exe"],"ExportedFunctions":["NicmCreateInstance","NicmDeregisterClassFactory","NicmGetVersion","NicmRegisterClassFactory","XTComCreateInstance","XTComDeregisterClassFactory","XTComFreeUnusedLibrariesEx","XTComGetClassObject","XTComGetVersion","XTComInitialize","XTComRegisterClassFactory"],"ImportedFunctions":["ExFreePoolWithTag","ExAllocatePoolWithTag","RtlEqualString","RtlInitAnsiString","strstr","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ExAcquireResourceSharedLite","ExInitializeResourceLite","ExDeleteResourceLite","ZwClose","NtSetSecurityObject","ZwCreateFile","RtlCreateSecurityDescriptor","IoSetTopLevelIrp","IoGetTopLevelIrp","IofCompleteRequest","IoDeleteDevice","IoDeleteSymbolicLink","KeReleaseMutex","KeWaitForSingleObject","KeLeaveCriticalRegion","IoFreeMdl","MmUnlockPages","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","MmProbeAndLockPages","IoAllocateMdl","ProbeForWrite","ProbeForRead","KeEnterCriticalRegion","IoUnregisterShutdownNotification","IoCreateSymbolicLink","IoRegisterShutdownNotification","IoCreateDevice","KeInitializeMutex","DbgPrintEx","IoGetCurrentProcess","KeDelayExecutionThread","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","ZwSetValueKey","RtlInitUnicodeString","ZwCreateKey","RtlAppendUnicodeStringToString","memset","ZwQuerySystemInformation","RtlUnicodeStringToAnsiString","ZwQueryValueKey","ZwOpenKey","ZwOpenFile","RtlCopyString","MmIsAddressValid","ZwWaitForSingleObject","ZwReadFile","ZwQueryInformationFile","RtlInitString","ZwQueryDirectoryFile","ZwLoadDriver","RtlAppendUnicodeToString","KeTickCount","KeBugCheckEx","RtlUnwind"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=Utah, L=Provo, O=Novell, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Novell Products Group, CN=Novell, Inc.","ValidFrom":"2007-04-04 00:00:00","ValidTo":"2010-04-27 23:59:59","Signature":"267f71f6ee43755fd6395f85c34bb15a72a6f2a959c2074627d294395fb1aaa4c7bbeff369d735628b233bde7e5c95a0f1837e5ad03704270834ce9c1b07649a256027930f44e064568666b06e7f9dc3cd299b38b0a6766301200ab58434a05a34a369ab99bbbf2aaa6b3603481e0393a80ea09e78a7cf55317a9590c49887f02e1fd948c3b1f6d203e91782ce423d0569f45e7f074205df5f92be6ccd9836641439af4390022242e0ca84aedb0d71c5a50f2dbd1ed30e5ac9c1bda67c694f94f2fe4aa83945ed32e426afe26f44dcb6dcc8186728f86f1a1bddc1ea7dd82b76578a42d1e63bf5f8f348fbcd509094858978e375d277394529df1dd5d78abab2","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4808d93b14b8600dbfa18dab5d15310f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"adddb65a3a360b3c1a55cb33e426f32a","SHA1":"93d9b282265288a94ee4f1a01c5fb3a08badb7ac","SHA256":"d98d63f26125a94eb767fdd2526f6c74bfb40cb4d117a1d87ca3ed0d99bd6f0b","SHA384":"cf20d9d6343b52b05ebaeace8a75ad950089e2d55508571cf5b153583fdf2d7b11bc61b8f38bfa70f09b2e7ac63d9ef5"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"4808d93b14b8600dbfa18dab5d15310f","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"1057b10c078b885e3f08290c07a28c50","SHA1":"0ffa7dfa0ba19fb7b801bc37ee18c31964d8f68c","SHA256":"159cb8b8bd40916edc60562397b13c91c0f1dadc1c5d63eebadbe165c0cc327b"},"Sections":{".text":{"Entropy":6.40205063988472,"Virtual Size":"0x2eb2"},".rdata":{"Entropy":5.327211687609018,"Virtual Size":"0x328"},".data":{"Entropy":2.732784594862837,"Virtual Size":"0x574"},".edata":{"Entropy":4.79344220843885,"Virtual Size":"0x18e"},"INIT":{"Entropy":5.758686784808341,"Virtual Size":"0x8b8"},".rsrc":{"Entropy":3.294301150507165,"Virtual Size":"0x358"},".reloc":{"Entropy":5.760669973768758,"Virtual Size":"0x3d2"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-03-27 13:49:09","Imphash":"28d780857f0f6616f938aca3a38b5072","LoadsDespiteHVCI":"FALSE"},{"Filename":"libnicm.sys","MD5":"6ae9d25e02b54367a4e93c2492b8b02e","SHA1":"cfdf9c9125755f4e81fa7cc5410d7740fdfea4ed","SHA256":"da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d","Authentihash":{"MD5":"e960feebe973feb9fa4ceae648439f05","SHA1":"85dd2e3e9e97e981542336ab7051035d5e611380","SHA256":"14ec631a3cff171b86e2b0279c8db436cb88ec705c517bd82a964e2c59def92f"},"Description":"Novell XTCOM Services Driver","Company":"Novell, Inc.","InternalName":"","OriginalFilename":"libnicm.sys","FileVersion":"3.1.11.0","Product":"Novell XTier","ProductVersion":"3.1.11","Copyright":"(C) Copyright 2000-2013, Novell, Inc. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["NicmCreateInstance","NicmDeregisterClassFactory","NicmGetVersion","NicmRegisterClassFactory","XTComCreateInstance","XTComDeregisterClassFactory","XTComFreeUnusedLibrariesEx","XTComGetClassObject","XTComGetVersion","XTComInitialize","XTComRegisterClassFactory"],"ImportedFunctions":["ExAcquireResourceExclusiveLite","ExAllocatePoolWithTag","ExFreePoolWithTag","strstr","RtlInitAnsiString","ExAcquireResourceSharedLite","ExReleaseResourceLite","RtlEqualString","MmUnmapLockedPages","ProbeForRead","IoDeleteSymbolicLink","IoRegisterShutdownNotification","KeInitializeMutex","KeLeaveCriticalRegion","IoDeleteDevice","ProbeForWrite","IoFreeMdl","KeEnterCriticalRegion","KeReleaseMutex","ZwCreateFile","MmMapLockedPagesSpecifyCache","IoUnregisterShutdownNotification","ZwClose","IofCompleteRequest","IoSetTopLevelIrp","KeWaitForSingleObject","MmProbeAndLockPages","MmUnlockPages","ExDeleteResourceLite","IoGetTopLevelIrp","IoCreateSymbolicLink","IoCreateDevice","ExInitializeResourceLite","NtSetSecurityObject","DbgPrintEx","IoAllocateMdl","RtlCreateSecurityDescriptor","IoGetCurrentProcess","ZwCreateKey","RtlAnsiStringToUnicodeString","ZwReadFile","RtlInitUnicodeString","RtlAppendUnicodeToString","RtlUnicodeStringToAnsiString","ZwSetValueKey","ZwQuerySystemInformation","RtlInitString","KeDelayExecutionThread","RtlFreeUnicodeString","ZwWaitForSingleObject","ZwQueryValueKey","ZwQueryDirectoryFile","RtlAppendUnicodeStringToString","RtlCopyString","MmIsAddressValid","ZwOpenFile","ZwQueryInformationFile","ZwLoadDriver","ZwOpenKey","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation","ValidFrom":"2021-09-02 18:32:59","ValidTo":"2022-09-01 18:32:59","Signature":"164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000002528b33aaf895f339db000000000252","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"92b6022918bc02eb361b8a02fb1da57d","SHA1":"8ceb945fac0f6d623d464e21740ae6eb60351652","SHA256":"c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb","SHA384":"322ed1a62a9f2ed7c7f601e99a8db15371e3ba1039a73c81801165ea987679023bc36f8c357f74354dce65532b71be3c"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011","ValidFrom":"2011-07-08 20:59:09","ValidTo":"2026-07-08 21:09:09","Signature":"67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610e90d2000000000003","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"b4ec95434f1d45b8055077cf90540a5f","SHA1":"71f74db41d045d6eaf81a849bbb3e21544edcff4","SHA256":"f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e","SHA384":"25cbac323e740588a1ea3ca39ea907647440884ad75fc4bd99be6c82202aba42e95049fa7b66884977e60b819b21a2a5"}}],"Signer":[{"SerialNumber":"33000002528b33aaf895f339db000000000252","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011","Version":1}]}],"RichPEHeaderHash":{"MD5":"4a53ed67faf49ecb288c974cd66ea496","SHA1":"f83f49f155f801d8ce781070309c4ce878f8f87f","SHA256":"93963bed2c58da923a8df184e6443740eba6ecb6949996b6568f42fe525bf906"},"Sections":{".text":{"Entropy":6.307312732264105,"Virtual Size":"0x3980"},".rdata":{"Entropy":4.780683221400144,"Virtual Size":"0x56c"},".data":{"Entropy":2.7659755587497967,"Virtual Size":"0x968"},".pdata":{"Entropy":4.129962233416926,"Virtual Size":"0x228"},".edata":{"Entropy":4.8209283897016855,"Virtual Size":"0x18e"},"INIT":{"Entropy":5.8834626044862475,"Virtual Size":"0xb38"},".rsrc":{"Entropy":6.471949403238668,"Virtual Size":"0x14a2c"},".reloc":{"Entropy":3.5739348962840563,"Virtual Size":"0x18"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2013-01-16 01:19:18","Imphash":"262d8fbbf1f514399bb3f230cddc12af","LoadsDespiteHVCI":"TRUE"},{"Filename":"libnicm.sys","MD5":"34a7fab63a4ed5a0b61eb204828e08e5","SHA1":"469c04cb7841eedd43227facaf60a6d55cf21fd7","SHA256":"e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48","Authentihash":{"MD5":"e960feebe973feb9fa4ceae648439f05","SHA1":"85dd2e3e9e97e981542336ab7051035d5e611380","SHA256":"14ec631a3cff171b86e2b0279c8db436cb88ec705c517bd82a964e2c59def92f"},"Description":"Novell XTCOM Services Driver","Company":"Novell, Inc.","InternalName":"","OriginalFilename":"libnicm.sys","FileVersion":"3.1.11.0","Product":"Novell XTier","ProductVersion":"3.1.11","Copyright":"(C) Copyright 2000-2013, Novell, Inc. All Rights Reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":["NicmCreateInstance","NicmDeregisterClassFactory","NicmGetVersion","NicmRegisterClassFactory","XTComCreateInstance","XTComDeregisterClassFactory","XTComFreeUnusedLibrariesEx","XTComGetClassObject","XTComGetVersion","XTComInitialize","XTComRegisterClassFactory"],"ImportedFunctions":["ExAcquireResourceExclusiveLite","ExAllocatePoolWithTag","ExFreePoolWithTag","strstr","RtlInitAnsiString","ExAcquireResourceSharedLite","ExReleaseResourceLite","RtlEqualString","MmUnmapLockedPages","ProbeForRead","IoDeleteSymbolicLink","IoRegisterShutdownNotification","KeInitializeMutex","KeLeaveCriticalRegion","IoDeleteDevice","ProbeForWrite","IoFreeMdl","KeEnterCriticalRegion","KeReleaseMutex","ZwCreateFile","MmMapLockedPagesSpecifyCache","IoUnregisterShutdownNotification","ZwClose","IofCompleteRequest","IoSetTopLevelIrp","KeWaitForSingleObject","MmProbeAndLockPages","MmUnlockPages","ExDeleteResourceLite","IoGetTopLevelIrp","IoCreateSymbolicLink","IoCreateDevice","ExInitializeResourceLite","NtSetSecurityObject","DbgPrintEx","IoAllocateMdl","RtlCreateSecurityDescriptor","IoGetCurrentProcess","ZwCreateKey","RtlAnsiStringToUnicodeString","ZwReadFile","RtlInitUnicodeString","RtlAppendUnicodeToString","RtlUnicodeStringToAnsiString","ZwSetValueKey","ZwQuerySystemInformation","RtlInitString","KeDelayExecutionThread","RtlFreeUnicodeString","ZwWaitForSingleObject","ZwQueryValueKey","ZwQueryDirectoryFile","RtlAppendUnicodeStringToString","RtlCopyString","MmIsAddressValid","ZwOpenFile","ZwQueryInformationFile","ZwLoadDriver","ZwOpenKey","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Publisher","ValidFrom":"2022-01-27 19:31:19","ValidTo":"2023-01-26 19:31:19","Signature":"941777115fcaf24c60c4a8c891758c491887aa5e9f0902a704191e75dd6f99be3d14a24aa35b1f2a1c1c42dde08da3fa75a73edbf7b5ae0fe94b3716e43b838ff30149e19c51b8b87cc53377ae08bfc0f54c7fafa398db43e839de108493510bc34d0fe998a44fcd0a11b0dc0c7315421dac79ab09ca47f847f9fa88e15d57a564f7b074664409c0ce01c697b2dcfd31676fc908fbc6bb928f82170f0b5a54f52f4327797278b78188b87e37b192b493d00eaf661e30f12b9e67fbd1df9cc5843e6a1c68b45d4f62423450cdc990fab2367d7f57719cb8272f59d4f300284a36d88adfc976cb08c6b0da33d5e988be0e1a3cef2a9669b5227a5b8d027f804908","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000036ce57eeb5d1cc2be1700000000036c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7ece739fdaa27d96b67f587db04186a7","SHA1":"b8701efa0ab12b8fea2293c9cff8772ecca084d0","SHA256":"c1392bdcbb0b50215fca8c78f25c2d857e515dce06c87ce86527c88c91d5d7e4","SHA384":"8d292e8db16824f3ac9d668816c4cf521a9eb251069694c92932683afcaa4e53d5fa3a1f58356749e655299ed83fe191"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","ValidFrom":"2011-10-19 18:41:42","ValidTo":"2026-10-19 18:51:42","Signature":"14fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"61077656000000000008","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"30a3f0b64324ed7f465e7fc618cb69e7","SHA1":"002de3561519b662c5e3f5faba1b92c403fb7c41","SHA256":"4e80be107c860de896384b3eff50504dc2d76ac7151df3102a4450637a032146","SHA384":"4f9a02c3eac5e83c38074d54c0bf270e03a1d668e0001c9812c509eb08a19075ee778a7630e65598e4608fc66e2d1c66"}}],"Signer":[{"SerialNumber":"330000036ce57eeb5d1cc2be1700000000036c","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","Version":1}]}],"RichPEHeaderHash":{"MD5":"4a53ed67faf49ecb288c974cd66ea496","SHA1":"f83f49f155f801d8ce781070309c4ce878f8f87f","SHA256":"93963bed2c58da923a8df184e6443740eba6ecb6949996b6568f42fe525bf906"},"Sections":{".text":{"Entropy":6.307312732264105,"Virtual Size":"0x3980"},".rdata":{"Entropy":4.780683221400144,"Virtual Size":"0x56c"},".data":{"Entropy":2.7659755587497967,"Virtual Size":"0x968"},".pdata":{"Entropy":4.129962233416926,"Virtual Size":"0x228"},".edata":{"Entropy":4.8209283897016855,"Virtual Size":"0x18e"},"INIT":{"Entropy":5.8834626044862475,"Virtual Size":"0xb38"},".rsrc":{"Entropy":6.471949403238668,"Virtual Size":"0x14a2c"},".reloc":{"Entropy":3.5739348962840563,"Virtual Size":"0x18"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2013-01-16 01:19:18","Imphash":"262d8fbbf1f514399bb3f230cddc12af","LoadsDespiteHVCI":"TRUE"}]}