{"Id":"fa612342-5ae0-4e69-ad9c-14d574d9fb1e","Tags":["dellbios.sys"],"Verified":"TRUE","Author":"Takahiro Haruyama","Created":"2023-11-02","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create dellbiossys binPath= C:\\windows\\temp\\dellbiossys.sys type=kernel && sc.exe start dellbiossys","Description":"The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"fe937e1ed4c8f1d4eac12b065093ae63","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"4f02fb7387ca0bc598c3bcb66c5065d08dbb3f73","SHA256":"0584520b4b3bdad1d177329bd9952c0589b2a99eb9676cb324d1fce46dad0b9a","Signature":"","Imphash":"a9e22f5e8f4965960716d94ba7639c9f","Authentihash":{"MD5":"c7c7df2ad7431960cac0875dd12c85cf","SHA1":"7b8c480f527d76880037739b1b25e94efbb2f9ae","SHA256":"51859571d807d984e4f1cf145d5d74491feabd19327309c2c598c496a1976c70"},"RichPEHeaderHash":{"MD5":"1bbdf7cd8766fe6015dfc47be47c216d","SHA1":"8ceda53f04fa7380d72b394d0fa5307a8efc8c6b","SHA256":"f8900dbcaf9222d11685156134b12cbd17d420d2c0f7dbb2f4a10865d79b83c4"},"Sections":{".text":{"Entropy":4.309583289169937,"Virtual Size":"0x94"},".rdata":{"Entropy":4.71301608054388,"Virtual Size":"0x310"},".data":{"Entropy":2.437393253979351,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.675962095520548,"Virtual Size":"0x138"},"PAGE":{"Entropy":6.023148213418988,"Virtual Size":"0x991"},"INIT":{"Entropy":5.424160104157257,"Virtual Size":"0x4c2"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2005-04-05 11:16:56","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeBugCheckEx"],"Signatures":{},"LoadsDespiteHVCI":"TRUE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"0215d0681979987fe908fb19dab83399","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"724dde837df2ff92b3ea7026fe8a0c4e5773898f","SHA256":"163912dfa4ad141e689e1625e994ab7c1f335410ebff0ade86bda3b7cdf6e065","Signature":"","Imphash":"10917aa77669c6ae714f074d89be9ab8","Authentihash":{"MD5":"1c1b634a312794371abfac3d67e1eca6","SHA1":"a5f8e8044e4add00fef7f43725c8e6e121ba0e6a","SHA256":"e2b6350e17e9b24b7140eed743b4ae0b01453bbb8cb73b091b51e2306017d80f"},"RichPEHeaderHash":{"MD5":"2a677cfe0eaf9861e292c33b6bf4d08f","SHA1":"5404274bdd3c5b826d764c20a9126ba421e2729a","SHA256":"272046a9ecd8a55ae2e46744bb9a6fc0b83a22ad456a501a8a62a4445b3d2ffc"},"Sections":{".text":{"Entropy":5.466835057166973,"Virtual Size":"0x1ae"},".rdata":{"Entropy":4.66286486361732,"Virtual Size":"0x3c4"},".data":{"Entropy":2.430770928252996,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.797556729656597,"Virtual Size":"0x180"},"PAGE":{"Entropy":6.018974428780573,"Virtual Size":"0xc55"},"INIT":{"Entropy":5.507474579363753,"Virtual Size":"0x58a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2006-10-05 15:30:45","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2008-12-03 23:59:59","Signature":"877870da4e5201205be079c98230c4fdb91996bd9100c3bdcdcdc6f40ed8fff94dc033623011c5f5741bd492de5f9c2013b17c45be50cd83e7801783a72793671346fbcab8984103cc9b515b058b7fa86ff31b501b242ef2698d6c22f7bbca1695ed0c74c06877d9eb996287c17390f889747a23aba3987b97b1f78f29714d2e751b4841daf0b50d2054d677a097826369fd09cf8af075bb099bd9f91155269a6132be7a02b07b86bea2c38b222c78d13576bc92735cf9b9e64c150a23cce4d2d4342e4940153c0f607a24c6a566ef96cf70eb3ee7f40d7edcd17ca3767169c19c4f47303521b1a2af1a623c2bd98eaa2a077bd818b35c7be29da56ffe3c89ad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0de92bf0d4d82988183205095e9a7688","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"45c204b8a20f6abb0188d2d38a3fb0c9","SHA1":"cdf3a3c5c2eda4c29621f30fd3154f9f8c765739","SHA256":"e32839dddc0f4ed2474efaf37f59d46db400c700fd19533cb0895a111124bc77","SHA384":"ee9c75832cb252218b3201619852209df490d2ef7a5f7a28afdb37f1c1dd56f4604898838e558f615b1c798d4a488223"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2009-07-15 23:59:59","Signature":"9a65f5d8d7e1a4d05dded87d7bc3eec408c256d08cdcedac228de750060d072ca0a46995cc99dfcc6331cfb0c1e496cb38ce21fb7ce7580a2321072c9097abd89604935453ba3a1048720d85ec1b0a4125cc7d6cac7b03f1f7783cf2a840d05572dbbe0b28b5c8c705fed3e0b521dcbc40b7bebc60f5b8e3d85e3b65dd66565f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"57646e2b550023d490534a553eab0d0a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e0554e925960f8ebfe053732b72cf185","SHA1":"f305b91e55019f4353be8ef3f83c1cee7a986b4d","SHA256":"ea81c5bd80a1c1fc0e3b82cfb15837f221ea835f6b9d6c54c767f754355e3880","SHA384":"e77db35cbba6960fd54597a4dfb37740658cb8affa1472c75c0c1c6343cadd227334fe54b9acfa0493367c54661db9e4"}},{"Subject":"C=US, ST=Texas, L=Round Rock, O=Dell Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Dell Inc.","ValidFrom":"2005-12-06 00:00:00","ValidTo":"2007-01-10 23:59:59","Signature":"3cb891a21ee1115b0b7c51fc20a95edde7d6937b63428592fe1e4ce1c924995a5abcc250c18b986b9c34dd59094a5fb6e85ca434d4c7926724dc31acf425e36b4c147324b0c1c8b7ec07ae6f06aa3ea08896a14cca3daecadf310151d6a5b5e991dfca8d17312f6daa6ac64bc340f472a285538f8b7169125fd240ed0eb32706923be279b2379dac174a6d51d0c760531cc5913d61216d41a3198a58b4342791471f50f3e667a0e95e46e1c1eec5531ebda1f605a564ee14e104dec15daf37201a349d5cd55d92e58667772d00eea7c85b54692be14699a6822676b1619ec2ad8fd16573beed295588f522c024e54e2a1c83eb8f194f684c0e2a563b76dfdcad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4957a5495776e13165eb89eeda14831a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0477ed8e1755ed9b4ed2c38236da79df","SHA1":"741cf63102fbccf6873168697c21019c23f78d01","SHA256":"9fad3c4e14b1d1e5f8b15d75ef42a18dc6cd20d5f746b99cc72cff82eb274510","SHA384":"3783e3faef9f301e720c588be5bf3dcc2a960facb2341f876c7f7e60c86e977ce3cca796712fb92346a225582aed45e2"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"4957a5495776e13165eb89eeda14831a","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"16a8e8437b94d6207af2f25fd4801b6d","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"9e8a87401dc7cc56b3a628b554ba395b1868520f","SHA256":"2288c418ddadd5a1db4e58c118d8455b01fd33728664408ce23b9346ae0ca057","Signature":"","Imphash":"10917aa77669c6ae714f074d89be9ab8","Authentihash":{"MD5":"bebca66f8c5c2f34e2dc07b90c3b27fe","SHA1":"70c3aa0e20ceb094f72b53ef4228c62d884a7232","SHA256":"f9db97bd12d2d734ccd86045bae1fd5fbeed106ba5cfa519e6fcd9093c1c04a6"},"RichPEHeaderHash":{"MD5":"2a677cfe0eaf9861e292c33b6bf4d08f","SHA1":"5404274bdd3c5b826d764c20a9126ba421e2729a","SHA256":"272046a9ecd8a55ae2e46744bb9a6fc0b83a22ad456a501a8a62a4445b3d2ffc"},"Sections":{".text":{"Entropy":5.420137545377288,"Virtual Size":"0x1a4"},".rdata":{"Entropy":4.6745798650878365,"Virtual Size":"0x3a0"},".data":{"Entropy":2.437393253979351,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.7783998677644606,"Virtual Size":"0x174"},"PAGE":{"Entropy":6.020214568565758,"Virtual Size":"0xc25"},"INIT":{"Entropy":5.495248997126044,"Virtual Size":"0x58a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2005-04-26 14:28:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeBugCheckEx"],"Signatures":{},"LoadsDespiteHVCI":"TRUE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"c04a5cdcb446dc708d9302be4e91e46d","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"7c46ecc5ce8e5f6e236a3b169fb46bb357ac3546","SHA256":"3678ba63d62efd3b706d1b661d631ded801485c08b5eb9a3ef38380c6cff319a","Signature":"","Imphash":"e7cbb1ce75bfc69f53855066a936042d","Authentihash":{"MD5":"e03a33bd4f099f5d493030b040eeabfd","SHA1":"280fcedfe4013a14bf122a917ae2fa469142714c","SHA256":"ee067313bd75acae24e1661cb6807ed6148f9af34542ed77578144b21f5c8da1"},"RichPEHeaderHash":{"MD5":"0df29e332220beca9a43c8a546411803","SHA1":"fbc770f7abc1c150d19058bc52b402f0530f28bf","SHA256":"890246379c5e6ebdb38b657798a7615b23836e48297e4a1d72324cd9388c6ab5"},"Sections":{".text":{"Entropy":6.042555605693659,"Virtual Size":"0x814"},".rdata":{"Entropy":4.616453656954646,"Virtual Size":"0x23c"},".data":{"Entropy":2.442200946287043,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.575672337094565,"Virtual Size":"0xb4"},"PAGE":{"Entropy":6.172515545014358,"Virtual Size":"0xa71"},"INIT":{"Entropy":5.379234357204095,"Virtual Size":"0x432"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2008-05-12 15:35:43","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetImportanceDpc","KeSetTargetProcessorDpc","KeSetPriorityThread","RtlInitUnicodeString","IoDeleteDevice","KeInitializeDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmGetPhysicalAddress","MmMapIoSpace","KeInsertQueueDpc","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","MmAllocateContiguousMemorySpecifyCache","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=Texas, L=Round Rock, O=Dell Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Dell Inc.","ValidFrom":"2006-12-15 00:00:00","ValidTo":"2010-01-10 23:59:59","Signature":"964a90189bd6c008960e4aae75cdf7c5f763b0e04e8921995bb7bb7898297c7d4c84082cc6c324d5a0cc60c77f72cc04c7782416f13b04254e961796dab40b7b5726a18f4f1a1d6a02f18794758bbbc4f8664cef6cc505a5367a8ea999b3c296006dc8336d03d71bfbb5f828d14646a39714657909190d5927bbfa55aec76aad25fe4ec1c5d73b37caec576dbe1a40d13e91509e316dc512d6b07b01c08b7f59f8dbd0d65fcac246b545a91527a2e89c0d3a6603ef49ae2d5373f640ba930fcac4848ae1d1820d3b80866f4335eb9072ece3ab41e80d9d9b1338d8c0e026a11d90e96396b92bf4e4fdf5a161a526f7896a0b77357976010916e455d6bb888d67","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"18a686a1229059017a672136ac2e7265","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3f3990fd4fcf9d9ca9e6a3d53abb0083","SHA1":"e642b59ed916131746a973ddecfc5549cc81ecb3","SHA256":"cdfd38299aeafaa4853c8c21e8c33e2f6816a01d2b7daa4b8a7a0a59092d268e","SHA384":"33007140387111f8970a2e9f798a874c8ba6c8fc14b41e6cde3308d150e362c97185b5691f2f3647bd928159688d5441"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"18a686a1229059017a672136ac2e7265","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"2d64d681d79e0d26650928259530c075","MachineType":"I386","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"fc154983af4a5be15ae1e4b54e2050530b8bc057","SHA256":"5449e4dd1b75a7d52922c30baeca0ca8e32fe2210d1e72af2a2f314a5c2268fb","Signature":"","Imphash":"1957e33acbc826c69f452ae1d1b89ac9","Authentihash":{"MD5":"8f2101c5eeaa09c79656ec7e6edc4d5b","SHA1":"0da8d2776086079a96bef45383c53c9091e0432e","SHA256":"be589c5c853c86703e23e3b77455bd0d4330bd5e612d0af538f98cc3c4cec1b4"},"RichPEHeaderHash":{"MD5":"5d5242fdee7917d60c0902d4dcdf1fb0","SHA1":"1dbde4fae3f6a3b254d9bc7aa0167917c9aea38e","SHA256":"78b46fed6412f8c058305a69f359f5711e0309b9b3406a3ac60d4e6c6a74836e"},"Sections":{".text":{"Entropy":6.003834861765604,"Virtual Size":"0x294"},".rdata":{"Entropy":4.549663477419902,"Virtual Size":"0xd8"},".data":{"Entropy":4.677565267016201,"Virtual Size":"0x8c"},"PAGE":{"Entropy":6.159898187773842,"Virtual Size":"0x900"},"INIT":{"Entropy":5.737212126373759,"Virtual Size":"0x3c6"},".reloc":{"Entropy":4.164503927260694,"Virtual Size":"0xce"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2006-12-22 10:54:43","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","KeGetCurrentThread","KeInsertQueueDpc","WRITE_REGISTER_BUFFER_UCHAR","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","READ_REGISTER_BUFFER_UCHAR","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeTickCount","KeBugCheckEx"],"Signatures":{},"LoadsDespiteHVCI":"TRUE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"8a70921638ff82bb924456deadcd20e6","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"a88546fb61a2fa7dab978a9cb678469e8f0ed475","SHA256":"5bf3985644308662ebfa2fbcc11fb4d3e2a0c817ad3da1a791020f8c8589ebc8","Signature":"","Imphash":"10917aa77669c6ae714f074d89be9ab8","Authentihash":{"MD5":"fbb107d4b7088fa529edcf9a27b4499b","SHA1":"808b0de6f644d48c4ed0c9b607a17362ec3df083","SHA256":"b8e047a7c96a94eb7cf0416253eca48fa7ba66914b684ee75e81651c83c7ac30"},"RichPEHeaderHash":{"MD5":"2a677cfe0eaf9861e292c33b6bf4d08f","SHA1":"5404274bdd3c5b826d764c20a9126ba421e2729a","SHA256":"272046a9ecd8a55ae2e46744bb9a6fc0b83a22ad456a501a8a62a4445b3d2ffc"},"Sections":{".text":{"Entropy":5.466835057166973,"Virtual Size":"0x1ae"},".rdata":{"Entropy":4.682617552506909,"Virtual Size":"0x3c4"},".data":{"Entropy":2.437393253979351,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.797556729656597,"Virtual Size":"0x180"},"PAGE":{"Entropy":6.017523364135105,"Virtual Size":"0xc55"},"INIT":{"Entropy":5.501098548183702,"Virtual Size":"0x58a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2007-03-21 16:11:53","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2008-12-03 23:59:59","Signature":"877870da4e5201205be079c98230c4fdb91996bd9100c3bdcdcdc6f40ed8fff94dc033623011c5f5741bd492de5f9c2013b17c45be50cd83e7801783a72793671346fbcab8984103cc9b515b058b7fa86ff31b501b242ef2698d6c22f7bbca1695ed0c74c06877d9eb996287c17390f889747a23aba3987b97b1f78f29714d2e751b4841daf0b50d2054d677a097826369fd09cf8af075bb099bd9f91155269a6132be7a02b07b86bea2c38b222c78d13576bc92735cf9b9e64c150a23cce4d2d4342e4940153c0f607a24c6a566ef96cf70eb3ee7f40d7edcd17ca3767169c19c4f47303521b1a2af1a623c2bd98eaa2a077bd818b35c7be29da56ffe3c89ad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0de92bf0d4d82988183205095e9a7688","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"45c204b8a20f6abb0188d2d38a3fb0c9","SHA1":"cdf3a3c5c2eda4c29621f30fd3154f9f8c765739","SHA256":"e32839dddc0f4ed2474efaf37f59d46db400c700fd19533cb0895a111124bc77","SHA384":"ee9c75832cb252218b3201619852209df490d2ef7a5f7a28afdb37f1c1dd56f4604898838e558f615b1c798d4a488223"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=Texas, L=Round Rock, O=Dell Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Dell Inc.","ValidFrom":"2006-12-15 00:00:00","ValidTo":"2010-01-10 23:59:59","Signature":"964a90189bd6c008960e4aae75cdf7c5f763b0e04e8921995bb7bb7898297c7d4c84082cc6c324d5a0cc60c77f72cc04c7782416f13b04254e961796dab40b7b5726a18f4f1a1d6a02f18794758bbbc4f8664cef6cc505a5367a8ea999b3c296006dc8336d03d71bfbb5f828d14646a39714657909190d5927bbfa55aec76aad25fe4ec1c5d73b37caec576dbe1a40d13e91509e316dc512d6b07b01c08b7f59f8dbd0d65fcac246b545a91527a2e89c0d3a6603ef49ae2d5373f640ba930fcac4848ae1d1820d3b80866f4335eb9072ece3ab41e80d9d9b1338d8c0e026a11d90e96396b92bf4e4fdf5a161a526f7896a0b77357976010916e455d6bb888d67","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"18a686a1229059017a672136ac2e7265","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3f3990fd4fcf9d9ca9e6a3d53abb0083","SHA1":"e642b59ed916131746a973ddecfc5549cc81ecb3","SHA256":"cdfd38299aeafaa4853c8c21e8c33e2f6816a01d2b7daa4b8a7a0a59092d268e","SHA384":"33007140387111f8970a2e9f798a874c8ba6c8fc14b41e6cde3308d150e362c97185b5691f2f3647bd928159688d5441"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"18a686a1229059017a672136ac2e7265","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"c37b575c3a96b9788c26cefcf43f3542","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"f7413250e7e8ad83c350092d78f0f75fcca9f474","SHA256":"6575ea9b319beb3845d43ce2c70ea55f0414da2055fa82eec324c4cebdefe893","Signature":"","Imphash":"be69e763a6a858c3e7e1ea6e3af12691","Authentihash":{"MD5":"a1c36e75bb10e6010531223ab5141ae7","SHA1":"ac1d5f3691326940bb3cb471097296ff7d21dc9b","SHA256":"419b5bca6d43650893d5e044e785c0ad87cbe1185de0d3feaa9f681c6e7f50b4"},"RichPEHeaderHash":{"MD5":"86b20d196871ff3f737af9f0c91d3228","SHA1":"9e15e0df43370ffcc4aceed701abba1258c4e611","SHA256":"137a0549327550f5b20068fa9d4cbea9c8ec8bec6b80008c9a3e60a00e6b0b3d"},"Sections":{".text":{"Entropy":5.281823709049508,"Virtual Size":"0x138"},".rdata":{"Entropy":4.771663253268149,"Virtual Size":"0x1d8"},".data":{"Entropy":4.5877080636470255,"Virtual Size":"0x83"},".pdata":{"Entropy":3.2367173466653854,"Virtual Size":"0x84"},"PAGE":{"Entropy":6.218000851496456,"Virtual Size":"0xa45"},"INIT":{"Entropy":5.550166547865309,"Virtual Size":"0x3e8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2005-08-02 16:38:51","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","KeGetCurrentThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2008-12-03 23:59:59","Signature":"877870da4e5201205be079c98230c4fdb91996bd9100c3bdcdcdc6f40ed8fff94dc033623011c5f5741bd492de5f9c2013b17c45be50cd83e7801783a72793671346fbcab8984103cc9b515b058b7fa86ff31b501b242ef2698d6c22f7bbca1695ed0c74c06877d9eb996287c17390f889747a23aba3987b97b1f78f29714d2e751b4841daf0b50d2054d677a097826369fd09cf8af075bb099bd9f91155269a6132be7a02b07b86bea2c38b222c78d13576bc92735cf9b9e64c150a23cce4d2d4342e4940153c0f607a24c6a566ef96cf70eb3ee7f40d7edcd17ca3767169c19c4f47303521b1a2af1a623c2bd98eaa2a077bd818b35c7be29da56ffe3c89ad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0de92bf0d4d82988183205095e9a7688","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"45c204b8a20f6abb0188d2d38a3fb0c9","SHA1":"cdf3a3c5c2eda4c29621f30fd3154f9f8c765739","SHA256":"e32839dddc0f4ed2474efaf37f59d46db400c700fd19533cb0895a111124bc77","SHA384":"ee9c75832cb252218b3201619852209df490d2ef7a5f7a28afdb37f1c1dd56f4604898838e558f615b1c798d4a488223"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2009-07-15 23:59:59","Signature":"9a65f5d8d7e1a4d05dded87d7bc3eec408c256d08cdcedac228de750060d072ca0a46995cc99dfcc6331cfb0c1e496cb38ce21fb7ce7580a2321072c9097abd89604935453ba3a1048720d85ec1b0a4125cc7d6cac7b03f1f7783cf2a840d05572dbbe0b28b5c8c705fed3e0b521dcbc40b7bebc60f5b8e3d85e3b65dd66565f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"57646e2b550023d490534a553eab0d0a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e0554e925960f8ebfe053732b72cf185","SHA1":"f305b91e55019f4353be8ef3f83c1cee7a986b4d","SHA256":"ea81c5bd80a1c1fc0e3b82cfb15837f221ea835f6b9d6c54c767f754355e3880","SHA384":"e77db35cbba6960fd54597a4dfb37740658cb8affa1472c75c0c1c6343cadd227334fe54b9acfa0493367c54661db9e4"}},{"Subject":"C=US, ST=Texas, L=Round Rock, O=Dell Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Dell Inc.","ValidFrom":"2005-12-06 00:00:00","ValidTo":"2007-01-10 23:59:59","Signature":"3cb891a21ee1115b0b7c51fc20a95edde7d6937b63428592fe1e4ce1c924995a5abcc250c18b986b9c34dd59094a5fb6e85ca434d4c7926724dc31acf425e36b4c147324b0c1c8b7ec07ae6f06aa3ea08896a14cca3daecadf310151d6a5b5e991dfca8d17312f6daa6ac64bc340f472a285538f8b7169125fd240ed0eb32706923be279b2379dac174a6d51d0c760531cc5913d61216d41a3198a58b4342791471f50f3e667a0e95e46e1c1eec5531ebda1f605a564ee14e104dec15daf37201a349d5cd55d92e58667772d00eea7c85b54692be14699a6822676b1619ec2ad8fd16573beed295588f522c024e54e2a1c83eb8f194f684c0e2a563b76dfdcad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4957a5495776e13165eb89eeda14831a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0477ed8e1755ed9b4ed2c38236da79df","SHA1":"741cf63102fbccf6873168697c21019c23f78d01","SHA256":"9fad3c4e14b1d1e5f8b15d75ef42a18dc6cd20d5f746b99cc72cff82eb274510","SHA384":"3783e3faef9f301e720c588be5bf3dcc2a960facb2341f876c7f7e60c86e977ce3cca796712fb92346a225582aed45e2"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"4957a5495776e13165eb89eeda14831a","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"f4a31e08f89e5f002ef3cf7b1224af5f","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"c2d18ce26ce2435845f534146d7f353b662ad2b9","SHA256":"700b9839fde53e91f0847053b4d2eb8d9bd3aca098844510f1fa3bab6a37eb24","Signature":"","Imphash":"10917aa77669c6ae714f074d89be9ab8","Authentihash":{"MD5":"685227232e3e50d40eedef9afdb000aa","SHA1":"03952b6ddcdfc4a2ab375dce0475cea07113ad36","SHA256":"7c62a659a4f8fdecfd5a64f4f4391852996db564d123fc5d20e3f3dfb11ed62c"},"RichPEHeaderHash":{"MD5":"b02c2ef12ee24a4e0caf681e8cccb03e","SHA1":"a982890a37bf51a61a4624f3efb2e059f22c28be","SHA256":"e461fb5e07f45e90c6b58963b5562836a30aafbb6f932eef710471aabc83ae14"},"Sections":{".text":{"Entropy":6.024293789731569,"Virtual Size":"0x51e"},".rdata":{"Entropy":4.71171050052965,"Virtual Size":"0x430"},".data":{"Entropy":2.437393253979351,"Virtual Size":"0x1a0"},".pdata":{"Entropy":3.9099178695802297,"Virtual Size":"0x1b0"},"PAGE":{"Entropy":6.0074072317452885,"Virtual Size":"0xda5"},"INIT":{"Entropy":5.388922651806295,"Virtual Size":"0x49a"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2006-12-22 10:54:37","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeBugCheckEx"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2008-12-03 23:59:59","Signature":"877870da4e5201205be079c98230c4fdb91996bd9100c3bdcdcdc6f40ed8fff94dc033623011c5f5741bd492de5f9c2013b17c45be50cd83e7801783a72793671346fbcab8984103cc9b515b058b7fa86ff31b501b242ef2698d6c22f7bbca1695ed0c74c06877d9eb996287c17390f889747a23aba3987b97b1f78f29714d2e751b4841daf0b50d2054d677a097826369fd09cf8af075bb099bd9f91155269a6132be7a02b07b86bea2c38b222c78d13576bc92735cf9b9e64c150a23cce4d2d4342e4940153c0f607a24c6a566ef96cf70eb3ee7f40d7edcd17ca3767169c19c4f47303521b1a2af1a623c2bd98eaa2a077bd818b35c7be29da56ffe3c89ad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0de92bf0d4d82988183205095e9a7688","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"45c204b8a20f6abb0188d2d38a3fb0c9","SHA1":"cdf3a3c5c2eda4c29621f30fd3154f9f8c765739","SHA256":"e32839dddc0f4ed2474efaf37f59d46db400c700fd19533cb0895a111124bc77","SHA384":"ee9c75832cb252218b3201619852209df490d2ef7a5f7a28afdb37f1c1dd56f4604898838e558f615b1c798d4a488223"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2009-07-15 23:59:59","Signature":"9a65f5d8d7e1a4d05dded87d7bc3eec408c256d08cdcedac228de750060d072ca0a46995cc99dfcc6331cfb0c1e496cb38ce21fb7ce7580a2321072c9097abd89604935453ba3a1048720d85ec1b0a4125cc7d6cac7b03f1f7783cf2a840d05572dbbe0b28b5c8c705fed3e0b521dcbc40b7bebc60f5b8e3d85e3b65dd66565f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"57646e2b550023d490534a553eab0d0a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e0554e925960f8ebfe053732b72cf185","SHA1":"f305b91e55019f4353be8ef3f83c1cee7a986b4d","SHA256":"ea81c5bd80a1c1fc0e3b82cfb15837f221ea835f6b9d6c54c767f754355e3880","SHA384":"e77db35cbba6960fd54597a4dfb37740658cb8affa1472c75c0c1c6343cadd227334fe54b9acfa0493367c54661db9e4"}},{"Subject":"C=US, ST=Texas, L=Round Rock, O=Dell Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Dell Inc.","ValidFrom":"2005-12-06 00:00:00","ValidTo":"2007-01-10 23:59:59","Signature":"3cb891a21ee1115b0b7c51fc20a95edde7d6937b63428592fe1e4ce1c924995a5abcc250c18b986b9c34dd59094a5fb6e85ca434d4c7926724dc31acf425e36b4c147324b0c1c8b7ec07ae6f06aa3ea08896a14cca3daecadf310151d6a5b5e991dfca8d17312f6daa6ac64bc340f472a285538f8b7169125fd240ed0eb32706923be279b2379dac174a6d51d0c760531cc5913d61216d41a3198a58b4342791471f50f3e667a0e95e46e1c1eec5531ebda1f605a564ee14e104dec15daf37201a349d5cd55d92e58667772d00eea7c85b54692be14699a6822676b1619ec2ad8fd16573beed295588f522c024e54e2a1c83eb8f194f684c0e2a563b76dfdcad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4957a5495776e13165eb89eeda14831a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"0477ed8e1755ed9b4ed2c38236da79df","SHA1":"741cf63102fbccf6873168697c21019c23f78d01","SHA256":"9fad3c4e14b1d1e5f8b15d75ef42a18dc6cd20d5f746b99cc72cff82eb274510","SHA384":"3783e3faef9f301e720c588be5bf3dcc2a960facb2341f876c7f7e60c86e977ce3cca796712fb92346a225582aed45e2"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"4957a5495776e13165eb89eeda14831a","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"51c233297c3aa16c4222e35ded1139b6","MachineType":"I386","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"0ff2ad8941fbb80cbccb6db7db1990c01c2869b1","SHA256":"a6c11d3bec2a94c40933ec1d3604cfe87617ba828b14f4cded6cfe85656debc0","Signature":"","Imphash":"edc2197e927392567cf09f7de410b5bb","Authentihash":{"MD5":"afd1f043a2f346f1349131e0db185805","SHA1":"586987aba0aed6f989588f7e852260aab2679332","SHA256":"03df432d7ff56ed53fd050b1875f5a05dffbe1c999adf2dd6c8d790b7ffd2c2d"},"RichPEHeaderHash":{"MD5":"632ce656b30c7ea200ce437baddf369a","SHA1":"cd7045c7d331f3707df34afd5dea72a3572c0360","SHA256":"2a7bc3f088c84d3a52f54c2c2d94b21d0a3e9d5c55cf6151f5ac16f3b0fe3949"},"Sections":{".text":{"Entropy":6.021213675788733,"Virtual Size":"0x2a0"},".rdata":{"Entropy":4.42031665937162,"Virtual Size":"0xca"},".data":{"Entropy":4.773136066100384,"Virtual Size":"0x8c"},"PAGE":{"Entropy":6.185648330264994,"Virtual Size":"0x910"},"INIT":{"Entropy":5.786044343517343,"Virtual Size":"0x3cc"},".reloc":{"Entropy":4.312323739183205,"Virtual Size":"0xdc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2008-05-12 15:32:50","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","KeGetCurrentThread","KeInsertQueueDpc","WRITE_REGISTER_BUFFER_UCHAR","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","READ_REGISTER_BUFFER_UCHAR","MmFreeContiguousMemory","memset","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString","KeTickCount","KeBugCheckEx"],"Signatures":{},"LoadsDespiteHVCI":"TRUE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"1a5a95d6bedbe29e5acf5eb6a727c634","MachineType":"AMD64","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"c1777fcb7005b707f8c86b2370f3278a8ccd729f","SHA256":"b3a191ccd1df19cdf17fe6637d48266ac84c4310b013ad6973d8cb336b06ff69","Signature":"","Imphash":"be69e763a6a858c3e7e1ea6e3af12691","Authentihash":{"MD5":"a1c36e75bb10e6010531223ab5141ae7","SHA1":"ac1d5f3691326940bb3cb471097296ff7d21dc9b","SHA256":"419b5bca6d43650893d5e044e785c0ad87cbe1185de0d3feaa9f681c6e7f50b4"},"RichPEHeaderHash":{"MD5":"86b20d196871ff3f737af9f0c91d3228","SHA1":"9e15e0df43370ffcc4aceed701abba1258c4e611","SHA256":"137a0549327550f5b20068fa9d4cbea9c8ec8bec6b80008c9a3e60a00e6b0b3d"},"Sections":{".text":{"Entropy":5.281823709049508,"Virtual Size":"0x138"},".rdata":{"Entropy":4.771663253268149,"Virtual Size":"0x1d8"},".data":{"Entropy":4.5877080636470255,"Virtual Size":"0x83"},".pdata":{"Entropy":3.2367173466653854,"Virtual Size":"0x84"},"PAGE":{"Entropy":6.218000851496456,"Virtual Size":"0xa45"},"INIT":{"Entropy":5.550166547865309,"Virtual Size":"0x3e8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2005-08-02 16:38:51","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","KeGetCurrentThread","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","KeInsertQueueDpc","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString"],"Signatures":{},"LoadsDespiteHVCI":"FALSE"},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"","MD5":"637cf50b06bc53deae846b252d56bbdc","MachineType":"I386","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"be270d94744b62b0d36bef905ef6296165ffcee9","SHA256":"b84dc9b885193ced6a1b6842a365a4f18d1683951bb11a5c780ab737ffa06684","Signature":"","Imphash":"6b867dee14a77d0ada8ccad99b16291e","Authentihash":{"MD5":"275dc7c2ad082fb91ce22e5c327fe6d4","SHA1":"53b69917a6aed8b1a309fc2de63f37f5f1062af7","SHA256":"8fe475d3082a0226ae9fa945542ac3e0cb5214c0f44193dcff12514cadf52101"},"RichPEHeaderHash":{"MD5":"cd0af2102bca4e2aa767a00f8cb91093","SHA1":"888d0caadbd9248a8fd687d141da2fe4a11bf7c3","SHA256":"25902bf5a0ecec83c62506620b9e269e456964e63f4bc1bafdc02e0c988eaf86"},"Sections":{".text":{"Entropy":5.564781789405919,"Virtual Size":"0xe2"},".rdata":{"Entropy":4.506571896579582,"Virtual Size":"0xba"},".data":{"Entropy":4.5877080636470255,"Virtual Size":"0x83"},"PAGE":{"Entropy":6.253128102349306,"Virtual Size":"0x7b4"},"INIT":{"Entropy":5.737910509343613,"Virtual Size":"0x380"},".reloc":{"Entropy":4.2249116580967305,"Virtual Size":"0x88"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2005-08-02 16:39:08","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeSetPriorityThread","KeGetCurrentThread","KeInsertQueueDpc","WRITE_REGISTER_BUFFER_UCHAR","MmGetPhysicalAddress","MmAllocateContiguousMemorySpecifyCache","READ_REGISTER_BUFFER_UCHAR","MmFreeContiguousMemory","MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","KeSetImportanceDpc","KeSetTargetProcessorDpc","KeInitializeDpc","IoDeleteDevice","IoCreateSymbolicLink","IoCreateDevice","RtlInitUnicodeString"],"Signatures":{},"LoadsDespiteHVCI":"TRUE"}]}