{"Id":"b51c441a-12c7-407d-9517-559cc0030cf6","Tags":["capcom.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create capcom.sys binPath=C:\\windows\\temp\\capcom.sys type=kernel && sc.exe start capcom.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/elastic/protections-artifacts/search?q=VulnDriver"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"capcom.sys","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"73c98438ac64a68e88b7b0afd11ba140","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"c1d5cf8c43e7679b782630e93f5e6420ca1749a7","SHA256":"da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":["CAPCOM Co.,Ltd.","Symantec Class 3 SHA256 Code Signing CA","VeriSign"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=JP, ST=Osaka, L=Chuo,ku, O=CAPCOM Co.,Ltd., OU=R&D Asset Management Section, CN=CAPCOM Co.,Ltd.","ValidFrom":"2016-05-02 00:00:00","ValidTo":"2017-05-02 23:59:59","Signature":"6b29c609e5a3bc4d2e3b59a22b42cfdcf409104be6cc7767624c4f96d585ef8243554de2513754867f64e7fdd39b00956903eee7ac6087641b82d8d49548202b8349085d9298c8e2498f2094190aa46cdda0510d937d4ab73ba469229672407822b47c4f1312475a14adcb291a101f0360acdcfa64a6aac9147b034fcea762c2a68a103885208922461990ef0bf3e602ba942257b36604ef4832c715d5320b99d5fd5ba7a76128ed6d0ba7cf90c4362ee2a96422fa4a69d5af070babf4ad786adfa43a21d1ae93fedfcef13b7e2f56b7c619f7d40bcaf8756e09797a9928daa90a582c8e7180cdb62f47c0873cc708f3e396820a7fdef929190fe86dea0b2566","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a9f59eaae33b89f4e1abd1f49343dcac","SHA1":"070bcfc8c776cb0c28f80c39c84633e233bea90a","SHA256":"30107b5e2bcaa8ae8a2c0682c78b4b79377ca56f6a84c5610ebfc0adcf7b21ad","SHA384":"b2dfce32fc217b83ce010a7f866e8dfc1dea72f11580521aa400c155b924432707abf72f279939ca1136d84800d445cf"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"002a58b90a589913a07012253662c98c","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"723fd9dd0957403ed131c72340e1996648f77a48","SHA256":"2b188ae51ec3be082e4d08f7483777ec5e66d30e393a4e9b5b9dc9af93d1f09b","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=JP, ST=Osaka, L=Chuo,ku, O=CAPCOM Co.,Ltd., OU=R&D Asset Management Section, CN=CAPCOM Co.,Ltd.","ValidFrom":"2016-05-02 00:00:00","ValidTo":"2017-05-02 23:59:59","Signature":"6b29c609e5a3bc4d2e3b59a22b42cfdcf409104be6cc7767624c4f96d585ef8243554de2513754867f64e7fdd39b00956903eee7ac6087641b82d8d49548202b8349085d9298c8e2498f2094190aa46cdda0510d937d4ab73ba469229672407822b47c4f1312475a14adcb291a101f0360acdcfa64a6aac9147b034fcea762c2a68a103885208922461990ef0bf3e602ba942257b36604ef4832c715d5320b99d5fd5ba7a76128ed6d0ba7cf90c4362ee2a96422fa4a69d5af070babf4ad786adfa43a21d1ae93fedfcef13b7e2f56b7c619f7d40bcaf8756e09797a9928daa90a582c8e7180cdb62f47c0873cc708f3e396820a7fdef929190fe86dea0b2566","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a9f59eaae33b89f4e1abd1f49343dcac","SHA1":"070bcfc8c776cb0c28f80c39c84633e233bea90a","SHA256":"30107b5e2bcaa8ae8a2c0682c78b4b79377ca56f6a84c5610ebfc0adcf7b21ad","SHA384":"b2dfce32fc217b83ce010a7f866e8dfc1dea72f11580521aa400c155b924432707abf72f279939ca1136d84800d445cf"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"524cd77f4c100cf20af4004f740b0268","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"b70321d078f2e9c9826303bdc87ba9b7be290807","SHA256":"ac26150bc98ee0419a8b23e4cda3566e0eba94718ba8059346a9696401e9793d","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=California, L=Santa Clara, O=NVIDIA Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Software, CN=NVIDIA Corporation","ValidFrom":"2011-09-02 00:00:00","ValidTo":"2014-09-01 23:59:59","Signature":"5238793a97b2868da546597dbe0a1fba197ae635b9f53b53e26758194d749767e05fb1ce407fd31469376b37c67d5d48bc834f970ac733cd63d557e8a3be20a1fbf9d09e7a5c6c4ebd6fc18a68d0842d2ffdf6f79142d914c6521d227014040fa12f2afb3878aa065cfbed7fa29091b4fe54ea6237a0e1f8f183d0573ebb5bfe712cee4c49bd0b2f40c33bfcf0c7de0bc51ce01a70d14072d4d01216f36e388159220a4d8e3250ddccd71c7ef8a93a26edda2e959b598703a85fa391630e052454e31390dd82d69afee5df2f287bdce8f45f6363c27e6e23ab92faefc7e8d78c10cc1f936f33c36a134cb8820b5749ff479f70834bd99d8e15ad79a1cb3d7ebf","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"43bb437d609866286dd839e1d00309f5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"cef292b5c6cdb07e480ccbba0c9d56d1","SHA1":"15c37dbebe6fcc77108e3d7ad982676d3d5e77f7","SHA256":"3cb152375fa9e694fd2f9167c382005166871c783774997df1a42e0b6013d82a","SHA384":"e64427dea71a71110ebc317f3552cd7193c5743f72d5cac9257abe80346d15ee42930d5a85e16c02ea06f56c7e8811fb"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"43bb437d609866286dd839e1d00309f5","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"1f15a513abc039533ca996552ba27e51","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"91530e1e1fb25a26f3e0d6587200ddbaecb45c74","SHA256":"54488a8c7da53222f25b6ed74b0dedc55d00f5fa80f4eaf6daac28f7c3528876","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=JP, ST=Osaka, L=Chuo,ku, O=CAPCOM Co.,Ltd., OU=R&D Asset Management Section, CN=CAPCOM Co.,Ltd.","ValidFrom":"2016-05-02 00:00:00","ValidTo":"2017-05-02 23:59:59","Signature":"6b29c609e5a3bc4d2e3b59a22b42cfdcf409104be6cc7767624c4f96d585ef8243554de2513754867f64e7fdd39b00956903eee7ac6087641b82d8d49548202b8349085d9298c8e2498f2094190aa46cdda0510d937d4ab73ba469229672407822b47c4f1312475a14adcb291a101f0360acdcfa64a6aac9147b034fcea762c2a68a103885208922461990ef0bf3e602ba942257b36604ef4832c715d5320b99d5fd5ba7a76128ed6d0ba7cf90c4362ee2a96422fa4a69d5af070babf4ad786adfa43a21d1ae93fedfcef13b7e2f56b7c619f7d40bcaf8756e09797a9928daa90a582c8e7180cdb62f47c0873cc708f3e396820a7fdef929190fe86dea0b2566","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a9f59eaae33b89f4e1abd1f49343dcac","SHA1":"070bcfc8c776cb0c28f80c39c84633e233bea90a","SHA256":"30107b5e2bcaa8ae8a2c0682c78b4b79377ca56f6a84c5610ebfc0adcf7b21ad","SHA384":"b2dfce32fc217b83ce010a7f866e8dfc1dea72f11580521aa400c155b924432707abf72f279939ca1136d84800d445cf"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"394e290aff9d4e78e504cedfb2d99350","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"59e6effdb23644ca03e60618095dc172a28f846e","SHA256":"c2562e0101cb39906c73b96fc15a6e6e3edd710b19858f6bbd0c90f1561b6038","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=JP, ST=Osaka, L=Chuo,ku, O=CAPCOM Co.,Ltd., OU=R&D Asset Management Section, CN=CAPCOM Co.,Ltd.","ValidFrom":"2016-05-02 00:00:00","ValidTo":"2017-05-02 23:59:59","Signature":"6b29c609e5a3bc4d2e3b59a22b42cfdcf409104be6cc7767624c4f96d585ef8243554de2513754867f64e7fdd39b00956903eee7ac6087641b82d8d49548202b8349085d9298c8e2498f2094190aa46cdda0510d937d4ab73ba469229672407822b47c4f1312475a14adcb291a101f0360acdcfa64a6aac9147b034fcea762c2a68a103885208922461990ef0bf3e602ba942257b36604ef4832c715d5320b99d5fd5ba7a76128ed6d0ba7cf90c4362ee2a96422fa4a69d5af070babf4ad786adfa43a21d1ae93fedfcef13b7e2f56b7c619f7d40bcaf8756e09797a9928daa90a582c8e7180cdb62f47c0873cc708f3e396820a7fdef929190fe86dea0b2566","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a9f59eaae33b89f4e1abd1f49343dcac","SHA1":"070bcfc8c776cb0c28f80c39c84633e233bea90a","SHA256":"30107b5e2bcaa8ae8a2c0682c78b4b79377ca56f6a84c5610ebfc0adcf7b21ad","SHA384":"b2dfce32fc217b83ce010a7f866e8dfc1dea72f11580521aa400c155b924432707abf72f279939ca1136d84800d445cf"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"d4119a5cb07ce945c6549eae74e39731","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"cfdb2085eaf729c7967f5d4efe16da3d50d07a23","SHA256":"d9e8be11a19699903016f39f95c9c5bf1a39774ecea73670f2c3ed5385ebfe4c","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=JP, ST=Osaka, L=Chuo,ku, O=CAPCOM Co.,Ltd., OU=R&D Asset Management Section, CN=CAPCOM Co.,Ltd.","ValidFrom":"2016-05-02 00:00:00","ValidTo":"2017-05-02 23:59:59","Signature":"6b29c609e5a3bc4d2e3b59a22b42cfdcf409104be6cc7767624c4f96d585ef8243554de2513754867f64e7fdd39b00956903eee7ac6087641b82d8d49548202b8349085d9298c8e2498f2094190aa46cdda0510d937d4ab73ba469229672407822b47c4f1312475a14adcb291a101f0360acdcfa64a6aac9147b034fcea762c2a68a103885208922461990ef0bf3e602ba942257b36604ef4832c715d5320b99d5fd5ba7a76128ed6d0ba7cf90c4362ee2a96422fa4a69d5af070babf4ad786adfa43a21d1ae93fedfcef13b7e2f56b7c619f7d40bcaf8756e09797a9928daa90a582c8e7180cdb62f47c0873cc708f3e396820a7fdef929190fe86dea0b2566","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a9f59eaae33b89f4e1abd1f49343dcac","SHA1":"070bcfc8c776cb0c28f80c39c84633e233bea90a","SHA256":"30107b5e2bcaa8ae8a2c0682c78b4b79377ca56f6a84c5610ebfc0adcf7b21ad","SHA384":"b2dfce32fc217b83ce010a7f866e8dfc1dea72f11580521aa400c155b924432707abf72f279939ca1136d84800d445cf"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"7e59408d3c99c511a853fb2f73c03dc4","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"a346417e9ae2c17a8fbf73302eeb611d","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"756fd2b82bf92538786b1bd283c6ef2f9794761e","SHA256":"2a11b4f125d8537e69af7b684494e49ef2a30a219634988e278177fa36c934eb","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":{},"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"}]}