{"Id":"f0a02666-44f6-4174-a7c6-d006481a340f","Tags":["TRIXX.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-07","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create TRIXX binPath=C:\\windows\\temp\\TRIXX.sys type=kernel && sc.exe start TRIXX","Description":"TRIXX.sys is a shared utility kernel driver distributed by TechPowerUp LLC with Sapphire TRIXX and GPU-Z. The driver provides completely unrestricted hardware access from usermode through 16+ IOCTLs with zero validation on hardware parameters, including arbitrary port I/O read/write, arbitrary PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset, MMIO BAR mapping via MmMapIoSpace, and MMIO read/write through mapped BARs. Physical memory read/write is achievable by remapping a PCI device BAR to a target physical address then mapping it via MmMapIoSpace. The driver creates its device dynamically based on the Windows service name and has no hardware dependency, loading on any x64 Windows system. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771) which expose the same MmMapIoSpace primitive. Fresh EV code signing certificate valid until April 2028 with zero AV detections.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/291","https://github.com/magicsword-io/LOLDrivers/issues/320"],"Detection":[],"Acknowledgement":{"Person":"Patrick Saif","Handle":"@weezerOSINT"},"KnownVulnerableSamples":[{"Filename":"TRIXX.sys","MD5":"132006f1712896a68dc5d4ef9f8891b2","SHA1":"56664f538773a01166f69790ecf72bd9021f5c1c","SHA256":"69fb21e4c8dbfcab838d53d98ec7357d35e30cbbe5fde9e26457d79242ddd78e","Signature":"","Date":"","Publisher":"","Company":"","Description":"Low-Level Driver","Product":"Low-Level Driver","ProductVersion":"7.2.0.0","FileVersion":"7.2.0.0","MachineType":"AMD64","OriginalFilename":"","Authentihash":{"MD5":"44f4ac2673ab75c9f394502e769edf36","SHA1":"b9f05fb25367edacde96f5f2feb8cbc3dde23ef3","SHA256":"10f4336d2e8f667e8da6dc127f444c1c304ab747e2dcf1f565ac15d1a2f73339"},"RichPEHeaderHash":{"MD5":"910cf550563e90cf64ed6efb76965bcb","SHA1":"0a080b81c28a7b7a45e5b43463705c93254ee874","SHA256":"b587f20fd7e972ce5377614b345a2bb96c8011aa5538cc8e0937866188c45025"},"Sections":{".text":{"Entropy":6.249533351843214,"Virtual Size":"0x3de6"},".rdata":{"Entropy":4.260814585107555,"Virtual Size":"0x149c"},".data":{"Entropy":1.2469985439298796,"Virtual Size":"0x5b08"},".pdata":{"Entropy":4.405248181030497,"Virtual Size":"0x534"},"PAGE":{"Entropy":6.216730531527119,"Virtual Size":"0x1c53"},"INIT":{"Entropy":5.074802317459462,"Virtual Size":"0x8be"},".rsrc":{"Entropy":3.197957095924652,"Virtual Size":"0x2b0"},".reloc":{"Entropy":4.0790989808517395,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-12-21 02:12:08","InternalName":"","Copyright":"Copyright (c) 2004-2025. All rights reserved.","Imports":["HAL.dll","ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["HalGetBusDataByOffset","KeStallExecutionProcessor","HalSetBusDataByOffset","MmMapIoSpace","MmUnmapIoSpace","ExAllocatePoolWithTag","ExFreePoolWithTag","RtlCompareMemory","_vsnwprintf","RtlInitUnicodeString","IoDeleteDevice","RtlCopyUnicodeString","IoDeleteSymbolicLink","PsSetCreateProcessNotifyRoutineEx","IoRegisterShutdownNotification","IoUnregisterShutdownNotification","IofCompleteRequest","IoCreateSymbolicLink","wcsrchr","IoWriteErrorLogEntry","IoAllocateErrorLogEntry","__C_specific_handler","ExReleaseFastMutex","MmBuildMdlForNonPagedPool","ObfDereferenceObject","IoAllocateMdl","IoGetCurrentProcess","PsGetCurrentProcessId","IoFreeMdl","ObfReferenceObject","ExAcquireFastMutex","KeInitializeEvent","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","IoEnumerateDeviceObjectList","IoGetDeviceAttachmentBaseRef","IoGetDeviceObjectPointer","IoGetDeviceProperty","IofCallDriver","IoBuildSynchronousFsdRequest","KeWaitForSingleObject","MmGetSystemRoutineAddress","RtlFreeUnicodeString","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Spokane, O=TechPowerUp LLC, serialNumber=604 057 982, CN=TechPowerUp LLC, BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_SP=Washington, JURISDICTION_OF_INCORPORATION_C=US","ValidFrom":"2025-04-07 20:27:51","ValidTo":"2028-04-01 17:23:05","Signature":"6baa8d982ca0a84aff4ce716f40ba3b025c0da38dd3dbe585e36dcf5f7a00f5d8c01be945bc6639f84431c5f12e408612e80fd96d645e180e5a859d3ecee8e89f861aefc3d3155f8ce645740f07d04d7ab4f8bdb2c1c6df03d4d912ae72e16c0fc157b25ad646bc488320fee16949ff029f264f71d513fb3701ca96061fc3f86fa7b7d104e8c8d09706d40dab966bc2a7a837e41b8ff77680df9d4bb7abdc751d34a010ab909ca9500dc15d47958d222da869fdf5d503e32e973925e2ea34608aa83337062aceab2bc3f16e0e4762c10036940003dd47d159cb54820b1f21c70ebf271aa75d4f6971cb39cb78adca582c668eb1a5b43c40216d4936b0db11736e1caeda618257047f255d35a1959845b4ef26118ed5f581173b2f3f5c25fa8b0c30c3a5d707e092b701b27998550163871f00a4b9795ee34acb99e2fc2053faeee6eb0e8b7cc4e1aeb352153d5cc02b9522b20829939614277a277c4ec771a2acb158c494154ad4e4491f070e9d031fe4cfe19721ab7984f9f25faa5f487dc3b2387d9c8e2195aa999187a33be29a1be00170b22cb6e12c63392cfd84dfc61cb18bd915b2c6282bd781f4c021debbc57198deb83cd0187b67c1f11a8b61ff6a893f62167a7b15b4ba40f5fbeeb3f2963792d412f9bdabd6411ff4c6fd1dda7c0bffdd68b78f3c630e9a9a57515fba39d813060b3162b098d0a3184034567116f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"58243aa26dea4bc0a378e983f7c06dc8","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"323fdf85dae25368bd3077481ec99a5b","SHA1":"361fdf2151e2ec520dda28387fde0f69e6798556","SHA256":"4dc7597601d16853b79f679aade0309e8cfc67835fac7575e7637ca536064524","SHA384":"d9f48ac5486f2351145280c2a77b552be46e9f494d43190ef68e9d9510bc95858de2bc1d558a11544aacfe37383fd893"}},{"Subject":"C=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping CA R36","ValidFrom":"2021-03-22 00:00:00","ValidTo":"2036-03-21 23:59:59","Signature":"12d77b20ad0e35580c9e811d2558fd4c2d6774afc7622621f6555469c6a14686765b685f8843b2404c671e4d6392fa4827300cc6611ce99bc8c872395243c26d72aca62a1831d6ce9c1590527ef7dea328a017c8821a51fe4954a8dc71ebf7c35ea6348525353929244a2bede75525989125508099601a1dcc3dccfd21637823f9f5a9f0c6cea1c23d667efcc6f9bd5ca181a7aac4b3db048aafe9c33be0dbf2a35c4db2594408926b3afb2b25091a8d5cf8c49c19f1b940757e6e9b3c057e4ecaff42b77e98e0897a6a34ea57689f8a4915b41dd1341520c2efe64a249489c7bf269feaf01324fe037cfb4acd204f90a94eb726854c08c3d8dbbe762e6112b11555a32a4956df3f377a90d5ce8589b6dc45a6e8ddacd991c21d58655201da0b80023110a05e361f4040ed6042b9e1d5303c95d5ee2733d2b802cecf55236f43c2c8d5645a4ee19215477dcbc17c8f0db60590ba989a01e3477b4a564861f6a295d960a606e0b6ee920ec7a4d8bf2aa261b9ed8a79a93aa87f40f02784381ec4a1bd197fe7d4f8209068bd1c26a9669f1f47083c45fb704b6d4b9fad5eb811b4c8e34cea7a03d9740fac5c299b719cbaa24c7f4a3c2cbac59122d140dc313c30e4597856fa066cc1b6a289ee5f77f5b6ca072da3bf170923df156bde50e499e52a8af79b413bc6931e611ae25a49543ec7ad3127f636f5106bf139bd5c9e7d02","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7a23aeda5369960f91c83e5cf4c7e33f","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"755ba7f8d47fb9d82d06aca64d85a6b0","SHA1":"aa31b174f9264f55abfe9c750555ba11e3558222","SHA256":"a8ed8f8a0ffe4dfc35837080540e5d3f8924884ce714c71c8aa883b863efe9ac","SHA384":"a9a2bf0749c796981278c7e8c4a80312048da6ce75adb20b9a114ee4b208683d0b41c141023ff5a7a18afc81f03e65ee"}},{"Subject":"C=GB, ST=West Yorkshire, O=Sectigo Limited, CN=Sectigo Public Time Stamping Signer R36","ValidFrom":"2025-03-27 00:00:00","ValidTo":"2036-03-21 23:59:59","Signature":"02813ea486725121f965a92e3d528ae1e59bcc4b134493848db22eeabeef9b35d72e9271e05c8699caa7159a1ad5dcf1dc9ad40ab746e5bfff2df031386cbd3e1f49b6b6028496951ebbac0e1f4d818c221833a1cb2276cd1cb7fa476a870b5494b09d3631636a44d213e8640bd179b72d6ec4ea10d9991f23958ce165c0dd91dc347078578db38bb264de4b449e449d56257133aaddb975b48e69a2bbbd59a411590e1eca75e9ecf8f4173e032abf3a1d81024493168838de57442a01c40c16c22326dad84f0ee653cd6a7f8141738bb8b30a612de2913729fd0c3adddc720c27e0a976148710695e799e48efd60383707703f7e6558d8668c8a4d559be15a8c432fe3f10dda69877f8ce43ae85864dcd59b836b589798e1402b88b04e79560e0dd0351b116bd7271b71410695479c7384423e06324ace1dd3434dba2711e1af67ee274995ebc025b85afdaac860c12e52a4de4516d692127030a99bf7212fa6946e74acaed6dea5db5b08b8866a729547f282d60b11d2d0ba43445f58e238a","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":false,"SerialNumber":"00a4293b6e1eddd7a7340887ad7a4eb724","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"335413e187285d138a26eda3118b9e99","SHA1":"930faed9c5e55e113afabd29f61e7d832d4c6025","SHA256":"f37011735ca11e3c05b6c0abf86e9e0fc4454a2ff77569a24d713cd8a65e1cd2","SHA384":"e782b12019ba93c896be34fb8efc44ac6d1325addf058700ab57052d63a144c076004074adb528407000c7c10d6ab8fc"}},{"Subject":"C=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping Root R46","ValidFrom":"2021-03-22 00:00:00","ValidTo":"2038-01-18 23:59:59","Signature":"0ebe6541ed6844b8e5a1c5d41187e4b73b258ceb7edac81791edd8f143c4a28539cb7f6b00045a01d03151e897d64b4b277fa5831b682d0867e5c15bdc61764926515fca6d43a22fb83df0cff2cd1caa50e675fc863b032d186cc9e22226c9acf720169ef75839d10cab55bad4a13d265064076d1705e7ba25a5f1e14044adcf98ba849bd52c557fb9e436d5233df731b85b6b41d44c462fdf22757f0286c4f06c3ff3204c40a29a1ede5e89af326d3f18fc57dae87009cb3f60bc439c1755565c6f0e31e33b572ec1b3a99222461e62d75d535bb1d5d40b6c41aeaf5f2eb7def0806c038868a70b028fc853bb0297265493ad970f45549c70fe62f54dbc819ece333a091a5c59e77f3838a9b4af9ebc328f5362bab329e299805a347e3dbfd221db8f9e61736d237f1bcade6422f87ef1a5bcf164e1469bfc95424a68f9f7efe60761a7e86fd460ecbc93ad2629c99a019b0456484e16ea23e307bc098c9a47dbddf4f1992928a7699224bd58db1ffde794b6f46bb481224891cdf3df4bd4fe25eb3295b1dad4bb5157d53fee6d2aecc6b6090feddfdda2a0eb2c5d6ee828b74e98c065d78b2e5450666f3aede55e5c40f9f0b5ddd4393a52f68086f996617a222f3e0903980f05ccfb277d75b9a8710b078dc44fb1c71477913d162b3012a391bf3f20decfa34774850a05e1378c33ecd8009ce82909d528e2e0f296553d3f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"36c2b0bd7c1b3ae7a3b3dd36cbc97568","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"c06edb294c1f02cb85226fe5ef0bb876","SHA1":"349f753dffc4e1ef7a6aa00c64c5e1c1aaeb1586","SHA256":"2527985bdd90b23ebf85bdfec39de37b9d6a10a44a4116fca078e609adcdd95a","SHA384":"24919e38eafa7d09214d6cba68eb2c772ea0c02b7918c2657f6dbffb19356515c563eaee1136512c36cfe781b268afef"}},{"Subject":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA RSA R3","ValidFrom":"2019-03-26 17:44:23","ValidTo":"2034-03-22 17:44:23","Signature":"728ffa81488291e26083255b7b8f2f940f8358ce8824fa99424e2d4e3789f89fb11eae744079f9decbf7ff2c25105298408f5438ff5dd12aa95ae6b702bbc87fee2ad3ff7fcc363c5529435d364996265d70e7f22b0567474c99581908f6b1c64f60d2fc38be02ac25d1880da52ce1ddd37d57cf6ac31960d26daa5d7b44e85a5b83dbc81b360a7e0af50a523678e29afb1354cc9cc947bf624e35af3ee1ba0fc993eed520b796b7507652357a9da13b2664371fcebc037bc461815289cc7bfe5a051a47aee412ca8e54e35a9fb0c18af2f95f4668b9afc7d93e84d12b2512383dbb9a01eadfcc66a8b6c51f6a9347b0ce069284ad43836a86395c4ce2024b7873ae4b28e6a4f8616980ccff34e8b02f6402490d8d2e1f7deba186050fed5e7034e5180200eb63be75266da71c905707ae99a58e37d2a7c3586ca5f4e7522235a75bbb6eeb48db9a72deaa5a6249099e902b120fc83adbaf68739dd9e379ca98f9681deae6582ea9186ccd993a9acd267044e666989c251e196ac7d8f3e7ffa63577fbf57dbb8c82c76f7d5432bbea990b39e82051152f89e32ae1c520f37a784e3daf176292548d278c9037dce329e84293b6f83b2b0b9950b8e434069823eeeadfb554bbaedbf1eadd72f945edb1da433b80fc6f6cdfdc916db8a5d4ef75cd654c642c59df132e021b4bfa0493c0bb371d1fb220d34f33af16a11cc0aaa888","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"424b6a53cec766141c2a63b1a51c4104","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"db3494d2a0da480f9a2dc03978395f8a","SHA1":"9cb274c1f98981dbdbe1a7630a9071458784c80d","SHA256":"49b229a10f850de5b85110a0e0f59c48dd12b116c9ad236a3f16c5bdfbc968d5","SHA384":"2012fa0acaa171e7e953cfad3301af5dc2947a64428d9fdc7bcd47afe88ab85fa580e0ed6d0f61e9629d46accc3b48ec"}}],"Signer":[{"SerialNumber":"58243aa26dea4bc0a378e983f7c06dc8","Issuer":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA RSA R3","Version":1}]}],"LoadsDespiteHVCI":"FALSE","Imphash":"0f0debec985c6fda5df59da70c63bf43"},{"Filename":"TRIXX.sys","MD5":"d2070f9c767ddb80bc8b61c15933de32","SHA1":"ca6cc11d06497b84b3f80bd7adefbaf9ba93581a","SHA256":"7d39223e7eb902712aeac77c90b9fa00a6e5e56a68d4c542bcc88556a57ba735","Signature":"","Date":"","Publisher":"","Company":"","Description":"Low-Level Driver","Product":"Low-Level Driver","ProductVersion":"3.0.0.0","FileVersion":"3.0.0.0","MachineType":"I386","OriginalFilename":"","Authentihash":{"MD5":"ca2ffb1d3fe02c47bc2a6f7f141b7a6e","SHA1":"69371c7f7c182fb8a454be1ec4ecb10e2c6c97b8","SHA256":"f661571ddc863f0f157e3a14fd090148b840a8b5260d3e079b0fc15e519371df"},"RichPEHeaderHash":{"MD5":"b2ffb2b6d147a89c3618ece2b90eb7f8","SHA1":"1034a6211d3a0c1858f2a43c76285442e14e2141","SHA256":"fc4d9b00258184d98f22f0fa4fee2b4a318e1a0ef421b5033ff852b14bd1f05a"},"Sections":{".text":{"Entropy":6.21911318478517,"Virtual Size":"0x1373"},".rdata":{"Entropy":4.437892240752775,"Virtual Size":"0xab4"},".data":{"Entropy":1.9291473196809052,"Virtual Size":"0x21e0"},"PAGE":{"Entropy":6.267584311797547,"Virtual Size":"0x132e"},"INIT":{"Entropy":5.373281087835215,"Virtual Size":"0x5f6"},".rsrc":{"Entropy":3.1601144852595806,"Virtual Size":"0x2b0"},".reloc":{"Entropy":6.378259918084838,"Virtual Size":"0x284"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-10-06 14:34:27","InternalName":"","Copyright":"Copyright 2004-2020 (c). All rights reserved.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteDevice","RtlCopyUnicodeString","IoDeleteSymbolicLink","IoRegisterShutdownNotification","ExAllocatePoolWithTag","IoUnregisterShutdownNotification","ExFreePoolWithTag","IofCompleteRequest","IoCreateSymbolicLink","RtlInitUnicodeString","MmBuildMdlForNonPagedPool","IoAllocateMdl","MmMapIoSpace","MmUnmapIoSpace","PsGetCurrentProcessId","IoFreeMdl","MmUnmapLockedPages","MmMapLockedPagesSpecifyCache","KeBugCheckEx","_vsnwprintf","DbgPrint","wcsrchr","_vsnprintf","RtlUnwind","MmGetSystemRoutineAddress","ZwClose","ZwSetSecurityObject","ObOpenObjectByPointer","IoDeviceObjectType","IoCreateDevice","RtlGetDaclSecurityDescriptor","RtlGetSaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","SeExports","IoIsWdmVersionAvailable","_wcsnicmp","RtlAddAccessAllowedAce","RtlLengthSid","memcpy","memset","wcschr","RtlAbsoluteToSelfRelativeSD","RtlSetDaclSecurityDescriptor","RtlCreateSecurityDescriptor","ZwOpenKey","ZwCreateKey","ZwQueryValueKey","ZwSetValueKey","RtlFreeUnicodeString","_except_handler3","HalSetBusDataByOffset","KeGetCurrentIrql","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"JURISDICTION_OF_INCORPORATION_C=US, JURISDICTION_OF_INCORPORATION_SP=Washington, BUSINESS_CATEGORY=Private Organization, serialNumber=604 057 982, C=US, ST=Washington, L=Spokane, O=TechPowerUp LLC, CN=TechPowerUp LLC","ValidFrom":"2019-08-10 00:00:00","ValidTo":"2022-06-15 12:00:00","Signature":"4384432152977ded7405b677aeaccf0f77976f3fc5ef542e99175672e48ffbc43950444c565620bd8824b94637ecb900001c02525a1cc27bac59574988698e3594bff43723f956c56a484dd5ba6512f77082ac9ffd76f6e39e29c20a70e5d89933c1e06ad48616cff5fb283b180ac45fb2f2fc922cf07aced1b9f89f4e0ba33b9bc9d2384780fe0364b6abf0f756919ef0188da554d9c5e33c6064e16d14ea64de273f1278e802c769c630f5beee2fcd7708cad6a3b7505ba5f0de85828339362364ff0b2c50f223a883c18f02f3569698229bef4adb91ce6287a957dd0405d558c64a5af821a66652909537d01a48acf40221265e1d3bfbe87acc96c95ce87f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0afc69772ae1ea9a285731b6aa4523c6","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"8092ae05898c55302543adff23e8d5bf","SHA1":"307e52adab5b03498fc63b5dbd4923a062a71166","SHA256":"c4929a2019eaa5ee564ede2fe402dc3fb4cc80436829a6c72651541b71e4f903","SHA384":"a7623d27b4444a5f3b68c76448202abd485be8db319ffcdd8343634e83df7a226312033645f94846fc8c9111b80d0040"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"0afc69772ae1ea9a285731b6aa4523c6","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE","Imphash":"77ae59c87ead2b82a6d0b32d5624f9c5"},{"Filename":"TRIXX.sys","MD5":"e0bbbff8573de4305a653aa83066068b","SHA1":"11e3227d35b3c2a06bdf1e3bdc3ba158e494ffa4","SHA256":"6e7b28216c1d7f1dab6e147823c70414df804836701fa43ec686fd7f4a6e573f","Signature":"","Date":"","Publisher":"","Company":"","Description":"Low-Level Driver","Product":"Low-Level Driver","ProductVersion":"1.60.0.0","FileVersion":"1.60.0.0","MachineType":"I386","OriginalFilename":"","Authentihash":{"MD5":"7c95d64cedd14c97337e4bc4d9415b27","SHA1":"77f4324c9b7f96dc96c3c357926480dbce05acd9","SHA256":"abb444b043b6cfe5350dadb38b26507fd5ed83d581781900c7dba1eebdd59df2"},"RichPEHeaderHash":{"MD5":"e8a3c00ff9e325713460f8d70f5dfd9f","SHA1":"5c0cad9c9899d274e216d660d8a39c7442a92349","SHA256":"35f3bfa3831184f68d52152bc9171d0e80c739de9d1c10ac2b09512aa73bdbfd"},"Sections":{".text":{"Entropy":6.317104462406003,"Virtual Size":"0x259e"},".rdata":{"Entropy":5.070069485023059,"Virtual Size":"0x414"},".data":{"Entropy":0.48228805229131577,"Virtual Size":"0x2080"},"INIT":{"Entropy":5.169523560906122,"Virtual Size":"0x32e"},".rsrc":{"Entropy":3.209948477892573,"Virtual Size":"0x2b8"},".reloc":{"Entropy":4.929789711397544,"Virtual Size":"0x20c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2010-10-06 10:14:38","InternalName":"","Copyright":"Copyright 2004-2010 (c). All rights reserved.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterShutdownNotification","RtlInitUnicodeString","IoDeleteDevice","wcsncpy","wcsrchr","IoUnregisterShutdownNotification","IofCompleteRequest","IoCreateSymbolicLink","RtlCopyUnicodeString","IoCreateDevice","MmUnmapLockedPages","ExAllocatePoolWithTag","MmBuildMdlForNonPagedPool","IoFreeMdl","MmMapLockedPagesSpecifyCache","MmMapIoSpace","PsGetCurrentProcessId","MmIsAddressValid","IoAllocateMdl","MmUnmapIoSpace","DbgPrint","RtlUnicodeToMultiByteN","RtlAnsiCharToUnicodeChar","KeBugCheckEx","memcpy","_except_handler3","KeGetCurrentIrql"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=HK, ST=Hong Kong, L=Hong Kong, O=Sapphire Technology Limited, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Sapphire Technology Limited","ValidFrom":"2010-10-04 00:00:00","ValidTo":"2012-09-24 23:59:59","Signature":"06dea52a42f03b9000034bc30fa83a6d5ce92c485b47f0bad6643020496ac017eb159b944a18090749687c7e0ea01d274eaaa5f9497f15210e26a355d9b363519ff914d168ad63fc11ebd5094fd0bf9941284b73ec3b7d70292a9623ee972ebb36e04aa1b68fca46c31bbb626431d4100614712c30afd171f19e332967742c6845248c203f8c7e8435f5a257208b9f28bb09b30e230d04a2bf2fafd031883ce81528c883f0e2bff61181081c776d32b8d76b5867d14f7639384f71a7eda5871752979d528f321b878a68176db2399b9e71d7d8e3acd697bee0a48473437ee7c38da9d046fb366ea6bf81ef935a924ffccf7765478594133a149b5dab14da22c3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0637af4e75d87818c42a85ada8eae231","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"87a44c00c7e9b4f5bdebabb5c2542126","SHA1":"0c5b27d5735a599cbb3f58a4d2884e2584061177","SHA256":"dd0db9879ed441ed2a599362058c56bbafd4385d3a3e12d591b0a5301d2efc90","SHA384":"d52f302aa0748d4bd3fd700f9adc2628a16adfebc3f60f68edebe7ac954abb7ad1453c81047616298ed3c09c883ed043"}}],"Signer":[{"SerialNumber":"0637af4e75d87818c42a85ada8eae231","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE","Imphash":"f5d9d876f905bcbf64aa8827443a2b10"}]}