f4126206-564f-49f5-a942-2138a3131e0e

NICM.SYS

Description

NICM.SYS is a vulnerable driver and more information will be added as found.

UUID: f4126206-564f-49f5-a942-2138a3131e0e
Created: 2023-05-06
Author: Nasreddine Bencherchali
Acknowledgement: |

This download link contains the vulnerable driver!

Commands

sc.exe create NICM.sys binPath=C:\windows\temp\NICM.SYS type=kernel &amp;&amp; sc.exe start NICM.SYS

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

Internal Research

Known Vulnerable Samples

Property	Value
Filename	NICM.SYS
Creation Timestamp	2013-01-15 23:20:00
MD5	52b7cd123f6d1b9ed76b08f2ee7d9433
SHA1	4d6e532830058fadd861ff9eac16de8cfc6974ce
SHA256	3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0
Authentihash MD5	cd820a2aee5e475a92f3860b20a3fc1a
Authentihash SHA1	db97af81d295f3f7f7777d3805635ab8cc40ab44
Authentihash SHA256	98636f857235fb66122296db147cd29440de681a29bbd631fc94373da31f99fa
RichPEHeaderHash MD5	69be7d6bc33a7ee9619315180123bd46
RichPEHeaderHash SHA1	7ee6731a37901780d7908fc3fad4474835f832bf
RichPEHeaderHash SHA256	14ccd7b6557e31d8e57079e70c05cb15da8336c7380554b9b40f44840989f524
Company	Novell, Inc.
Description	Novell Client Portability Layer
Product	Novell XTier
OriginalFilename	NICM.SYS

Download

Certificates

Expand

Certificate 33000002528b33aaf895f339db000000000252

Field	Value
ToBeSigned (TBS) MD5	92b6022918bc02eb361b8a02fb1da57d
ToBeSigned (TBS) SHA1	8ceb945fac0f6d623d464e21740ae6eb60351652
ToBeSigned (TBS) SHA256	c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation
ValidFrom	2021-09-02 18:32:59
ValidTo	2022-09-01 18:32:59
Signature	164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	33000002528b33aaf895f339db000000000252
Version	3

Certificate 610e90d2000000000003

Field	Value
ToBeSigned (TBS) MD5	b4ec95434f1d45b8055077cf90540a5f
ToBeSigned (TBS) SHA1	71f74db41d045d6eaf81a849bbb3e21544edcff4
ToBeSigned (TBS) SHA256	f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
ValidFrom	2011-07-08 20:59:09
ValidTo	2026-07-08 21:09:09
Signature	67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	610e90d2000000000003
Version	3

Imports

Expand

ntoskrnl.exe
nicm.sys

Imported Functions

Expand

KeWaitForSingleObject
ExAllocatePoolWithTag
ZwCreateKey
ExFreePoolWithTag
ExReleaseFastMutex
ExAcquireFastMutex
RtlInitUnicodeString
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
ZwClose
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwDeleteKey
ZwEnumerateKey
ZwOpenKey
DbgPrintEx
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
RtlFreeUnicodeString
RtlOemStringToUnicodeString
RtlFreeAnsiString
DbgPrint
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
RtlIntegerToUnicodeString
RtlAppendUnicodeToString
RtlInitString
RtlEqualUnicodeString
RtlCompareString
RtlCopyString
KeReleaseMutex
RtlEqualString
RtlUnicodeStringToInteger
ExAcquireResourceExclusiveLite
KeResetEvent
KeInitializeMutex
KeLeaveCriticalRegion
KeSetEvent
ExIsResourceAcquiredSharedLite
ExIsResourceAcquiredExclusiveLite
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
KeSetPriorityThread
IoDeleteDevice
IoCreateDevice
PsCreateSystemThread
PsTerminateSystemThread
RtlCompareMemory
IoUninitializeWorkItem
IoFreeWorkItem
KeInitializeDpc
KeInitializeTimer
KeDelayExecutionThread
IoAllocateWorkItem
KeSetTimer
IoInitializeWorkItem
IoQueueWorkItem
KeCancelTimer
KeBugCheckEx
RtlCompareUnicodeString
KeInitializeEvent
NicmCreateInstance

Exported Functions

Expand

DllGetClassObject
XTCOM_Table

Sections

Expand

.text
.rdata
.data
.pdata
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Signature": "164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation",
      "TBS": {
        "MD5": "92b6022918bc02eb361b8a02fb1da57d",
        "SHA1": "8ceb945fac0f6d623d464e21740ae6eb60351652",
        "SHA256": "c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb",
        "SHA384": "322ed1a62a9f2ed7c7f601e99a8db15371e3ba1039a73c81801165ea987679023bc36f8c357f74354dce65532b71be3c"
      },
      "ValidFrom": "2021-09-02 18:32:59",
      "ValidTo": "2022-09-01 18:32:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "610e90d2000000000003",
      "Signature": "67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "TBS": {
        "MD5": "b4ec95434f1d45b8055077cf90540a5f",
        "SHA1": "71f74db41d045d6eaf81a849bbb3e21544edcff4",
        "SHA256": "f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e",
        "SHA384": "25cbac323e740588a1ea3ca39ea907647440884ad75fc4bd99be6c82202aba42e95049fa7b66884977e60b819b21a2a5"
      },
      "ValidFrom": "2011-07-08 20:59:09",
      "ValidTo": "2026-07-08 21:09:09",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	NICM.SYS
Creation Timestamp	2009-03-27 11:49:27
MD5	f690bfc0799e51a626ba3931960c3173
SHA1	d3a6f86245212e1ef9e0e906818027ec14a239cb
SHA256	904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a
Authentihash MD5	2e72873429bed4886fe76aeba274283e
Authentihash SHA1	ab636e8ba41f37d2bcd5291ddf30024be7f3ce2f
Authentihash SHA256	7419b05e74733d2b7ce4c860ab74043b816a7f66a1ff7eec81fe3b35730e3bbb
RichPEHeaderHash MD5	9a271840015f5068d0bd867da9c79669
RichPEHeaderHash SHA1	e758d2f4525ea5880a0cd08f8f0032d89b4bd4e7
RichPEHeaderHash SHA256	d5afe68d99aac43ff5850dd37b3184bed8f8f14e681b622515121d8000b4fbbb
Company	Novell, Inc.
Description	Novell Client Portability Layer
Product	Novell XTier
OriginalFilename	NICM.SYS

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 4808d93b14b8600dbfa18dab5d15310f

Field	Value
ToBeSigned (TBS) MD5	adddb65a3a360b3c1a55cb33e426f32a
ToBeSigned (TBS) SHA1	93d9b282265288a94ee4f1a01c5fb3a08badb7ac
ToBeSigned (TBS) SHA256	d98d63f26125a94eb767fdd2526f6c74bfb40cb4d117a1d87ca3ed0d99bd6f0b
Subject	C=US, ST=Utah, L=Provo, O=Novell, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Novell Products Group, CN=Novell, Inc.
ValidFrom	2007-04-04 00:00:00
ValidTo	2010-04-27 23:59:59
Signature	267f71f6ee43755fd6395f85c34bb15a72a6f2a959c2074627d294395fb1aaa4c7bbeff369d735628b233bde7e5c95a0f1837e5ad03704270834ce9c1b07649a256027930f44e064568666b06e7f9dc3cd299b38b0a6766301200ab58434a05a34a369ab99bbbf2aaa6b3603481e0393a80ea09e78a7cf55317a9590c49887f02e1fd948c3b1f6d203e91782ce423d0569f45e7f074205df5f92be6ccd9836641439af4390022242e0ca84aedb0d71c5a50f2dbd1ed30e5ac9c1bda67c694f94f2fe4aa83945ed32e426afe26f44dcb6dcc8186728f86f1a1bddc1ea7dd82b76578a42d1e63bf5f8f348fbcd509094858978e375d277394529df1dd5d78abab2
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	4808d93b14b8600dbfa18dab5d15310f
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
nicm.sys

Imported Functions

Expand

RtlCopyUnicodeString
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
DbgBreakPoint
memset
_aulldvrm
DbgPrintEx
RtlUpcaseUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlOemStringToUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
DbgPrint
RtlAppendUnicodeToString
RtlCompareString
RtlCompareUnicodeString
RtlCopyString
RtlEqualString
RtlEqualUnicodeString
RtlInitString
RtlIntegerToUnicodeString
RtlUnicodeStringToInteger
KeLeaveCriticalRegion
KeGetCurrentThread
ExAcquireResourceSharedLite
RtlAppendUnicodeStringToString
ExAcquireResourceExclusiveLite
KeInitializeMutex
ExInitializeResourceLite
KeSetEvent
ExDeleteResourceLite
ExIsResourceAcquiredSharedLite
ExIsResourceAcquiredExclusiveLite
ExReleaseResourceLite
KeResetEvent
KeWaitForMultipleObjects
_allmul
KeSetPriorityThread
KeQuerySystemTime
IoDeleteDevice
IoCreateDevice
PsCreateSystemThread
PsTerminateSystemThread
RtlCompareMemory
memcpy
memmove
IoInitializeWorkItem
IoAllocateWorkItem
KeCancelTimer
IoFreeWorkItem
IoUninitializeWorkItem
KeSetTimer
KeDelayExecutionThread
KeInitializeDpc
KeInitializeTimer
IoQueueWorkItem
KeTickCount
KeBugCheckEx
ZwCreateKey
ZwClose
ExFreePoolWithTag
KeWaitForSingleObject
KeReleaseMutex
KeEnterCriticalRegion
KeInitializeEvent
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
NicmCreateInstance

Exported Functions

Expand

DllGetClassObject
XTCOM_Table

Sections

Expand

.text
.rdata
.data
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Signature": "164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation",
      "TBS": {
        "MD5": "92b6022918bc02eb361b8a02fb1da57d",
        "SHA1": "8ceb945fac0f6d623d464e21740ae6eb60351652",
        "SHA256": "c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb",
        "SHA384": "322ed1a62a9f2ed7c7f601e99a8db15371e3ba1039a73c81801165ea987679023bc36f8c357f74354dce65532b71be3c"
      },
      "ValidFrom": "2021-09-02 18:32:59",
      "ValidTo": "2022-09-01 18:32:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "610e90d2000000000003",
      "Signature": "67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "TBS": {
        "MD5": "b4ec95434f1d45b8055077cf90540a5f",
        "SHA1": "71f74db41d045d6eaf81a849bbb3e21544edcff4",
        "SHA256": "f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e",
        "SHA384": "25cbac323e740588a1ea3ca39ea907647440884ad75fc4bd99be6c82202aba42e95049fa7b66884977e60b819b21a2a5"
      },
      "ValidFrom": "2011-07-08 20:59:09",
      "ValidTo": "2026-07-08 21:09:09",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	NICM.SYS
Creation Timestamp	2009-03-27 11:53:53
MD5	3bf217f8ef018ca5ea20947bfdfc0a4d
SHA1	26a8ab6ea80ab64d5736b9b72a39d90121156e76
SHA256	cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190
Authentihash MD5	1b164cdc9dadc9944f2d3c0063cfcaa9
Authentihash SHA1	a13e2a1ea1c6427bc2006b1512047cc9779e480e
Authentihash SHA256	ea80b4a2314e44061f33a7403e0740437aa34326082e97816bb6e7693866478b
RichPEHeaderHash MD5	7ccba2f5532d28974864bb49f2f7ecde
RichPEHeaderHash SHA1	d70b833fc592a8822e52af45961fb0eb6675311c
RichPEHeaderHash SHA256	2c7265667f82af5943f1c9d0a07c904f2bc44c93380430659daaabd4527fa943
Company	Novell, Inc.
Description	Novell Client Portability Layer
Product	Novell XTier
OriginalFilename	NICM.SYS

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 4808d93b14b8600dbfa18dab5d15310f

Field	Value
ToBeSigned (TBS) MD5	adddb65a3a360b3c1a55cb33e426f32a
ToBeSigned (TBS) SHA1	93d9b282265288a94ee4f1a01c5fb3a08badb7ac
ToBeSigned (TBS) SHA256	d98d63f26125a94eb767fdd2526f6c74bfb40cb4d117a1d87ca3ed0d99bd6f0b
Subject	C=US, ST=Utah, L=Provo, O=Novell, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Novell Products Group, CN=Novell, Inc.
ValidFrom	2007-04-04 00:00:00
ValidTo	2010-04-27 23:59:59
Signature	267f71f6ee43755fd6395f85c34bb15a72a6f2a959c2074627d294395fb1aaa4c7bbeff369d735628b233bde7e5c95a0f1837e5ad03704270834ce9c1b07649a256027930f44e064568666b06e7f9dc3cd299b38b0a6766301200ab58434a05a34a369ab99bbbf2aaa6b3603481e0393a80ea09e78a7cf55317a9590c49887f02e1fd948c3b1f6d203e91782ce423d0569f45e7f074205df5f92be6ccd9836641439af4390022242e0ca84aedb0d71c5a50f2dbd1ed30e5ac9c1bda67c694f94f2fe4aa83945ed32e426afe26f44dcb6dcc8186728f86f1a1bddc1ea7dd82b76578a42d1e63bf5f8f348fbcd509094858978e375d277394529df1dd5d78abab2
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	4808d93b14b8600dbfa18dab5d15310f
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
nicm.sys

Imported Functions

Expand

KeWaitForSingleObject
ZwEnumerateKey
ZwOpenKey
ExAllocatePoolWithTag
ZwCreateKey
ExFreePoolWithTag
ExReleaseFastMutex
ExAcquireFastMutex
RtlInitUnicodeString
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
ZwClose
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwDeleteKey
DbgBreakPoint
DbgPrintEx
DbgPrint
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
RtlFreeUnicodeString
RtlOemStringToUnicodeString
RtlFreeAnsiString
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
RtlIntegerToUnicodeString
RtlAppendUnicodeToString
RtlInitString
RtlEqualUnicodeString
RtlCompareString
KeReleaseMutex
RtlCompareUnicodeString
RtlEqualString
RtlUnicodeStringToInteger
ExDeleteResourceLite
ExInitializeResourceLite
KeWaitForMultipleObjects
ExAcquireResourceExclusiveLite
KeResetEvent
KeInitializeMutex
KeLeaveCriticalRegion
KeSetEvent
ExIsResourceAcquiredSharedLite
ExIsResourceAcquiredExclusiveLite
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExReleaseResourceLite
KeSetPriorityThread
IoDeleteDevice
IoCreateDevice
PsCreateSystemThread
PsTerminateSystemThread
RtlCompareMemory
IoUninitializeWorkItem
IoFreeWorkItem
KeInitializeDpc
KeInitializeTimer
KeDelayExecutionThread
IoAllocateWorkItem
KeSetTimer
IoInitializeWorkItem
IoQueueWorkItem
KeCancelTimer
KeBugCheckEx
RtlCopyString
KeInitializeEvent
NicmCreateInstance

Exported Functions

Expand

DllGetClassObject
XTCOM_Table

Sections

Expand

.text
.rdata
.data
.pdata
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Signature": "164937b92c644c4061d4db4097b062bc812c0167605f5a99f847593186d029ab18e888522d744cc45d41dce29d47d2bf91c72992f35c1a5f03ed8c984b89a109430147e54bae0ddff0f523dfc03d5796a2636fc9a24ed66453809a33d134d1a7c9e83b974953893845a84fb668eb3afa179e82a01d7a51a03492911cb591ba118ab8b230e65920c7d2b2f90bd9ae7fc3762f2e4c88162a9f8c186f3163a3c1bef8e0b7d8d04a19673eb677518f01bf0cbaaf29e15c1695d15d134cbd20131ede87f2b5a3c3226abbbab3fec5caa38b7944b8bd31e1f538012f90edc4262ead76d2055b4bd458f8e3e39dffa7260bd9a6bebb62c86ef4f58dd177761d263d9fdc626aed8eca756ab441885ab4a8417a0e1fc63860d32badda0e9a3359b18cd3eb138f33e87582346bbd80c2b966e765751c386b8e59d3a02892da1fd02a8ec9312bbead188e81385e96b4fbced3fcf5545cda9fed8faa494efef4bb4b42e318478c377123e3b8dbacbcb7fd8019dc87946a33b91a0ed6160e02f2078d847ecc5e32ac0a5b003e4d58b41eb591a9f4b1da895b139ea125c1243233922b3dec46eba91425f752ba3261fe762feda2553add6bc5d67ac3c6eb63279f74fc02e2dfcde245b806df392111c7b20564ef7650fa17135b848cbe6c925d724d907732e6e0380e05f0aa11361be21401124fe9c6f1cf2e22c6d979bd3c49e61032a8d51269",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation",
      "TBS": {
        "MD5": "92b6022918bc02eb361b8a02fb1da57d",
        "SHA1": "8ceb945fac0f6d623d464e21740ae6eb60351652",
        "SHA256": "c1446860a1cd9db490d3ea85e9df05df44af8d44e2bb803a2a2018f3b6c41bcb",
        "SHA384": "322ed1a62a9f2ed7c7f601e99a8db15371e3ba1039a73c81801165ea987679023bc36f8c357f74354dce65532b71be3c"
      },
      "ValidFrom": "2021-09-02 18:32:59",
      "ValidTo": "2022-09-01 18:32:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "610e90d2000000000003",
      "Signature": "67f286a598e054791a2ed3d87467229b0b9611e163929942967dd2790c90c1655f2e2c3ef8c372d16d83febe3fe80aca3bbf47a9a3f369db63bf2235a5975d6584907d8b465055d80c927cd21a4b1cf33c428b52d0b0fd6be33e072e299be63d1ba5d4b51d779439e2e964c9443d787a23f3137da69074838df4cb2602462ac28a10bba4a9050c9bed68fa682e95a02a3f2a6b5849631f09696e5a9896e483f4c08ff3462bdefc3bd0bd35ef6e25aee5af27edd0ddf30eaf992897984d0e3d0bf20889d61fc33218e2f0c52dce5b9eb449390ac60ac2c6adaee5b2d9db1588514558383271271a7fb1f427f8de2c3a206998b25989686e6fa7b774c3400506a6012a283e823f134d660bc0b34df5e18f7f1c6f157d45a776e5402a65a3c35d526286c31d63369786dfdaf3f8f216a19a27e1cda597d0ee5d6341e35b079c873e067706d106b1751f14be6161b5f0dcc61b04bedf41c70e28eede652fec97f6a15c96d800d6a146bd59f397a5094b481099801fd00029c5b19ba53f45771e35c6d2a2a29f7a7a22fa48951fabfb472380f59ef8bf6bb74b97e2eb75781aecea379979184bffd6b3236875e6affafc8beb0b80ea693baffc30ed044c8edfdf756d63913dd19d564e4fbf805722a1781132217aef410ab13ffba8cca45dc1a1889b5771564e4845c042c99b765b0a80486bfd799fc1bd6d6d6ac95273130d7a50cd",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "TBS": {
        "MD5": "b4ec95434f1d45b8055077cf90540a5f",
        "SHA1": "71f74db41d045d6eaf81a849bbb3e21544edcff4",
        "SHA256": "f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e",
        "SHA384": "25cbac323e740588a1ea3ca39ea907647440884ad75fc4bd99be6c82202aba42e95049fa7b66884977e60b819b21a2a5"
      },
      "ValidFrom": "2011-07-08 20:59:09",
      "ValidTo": "2026-07-08 21:09:09",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011",
      "SerialNumber": "33000002528b33aaf895f339db000000000252",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-09-01