Merge pull request #143 from TakahiroHaruyama/drivers_with_firmware_a…

…ccess

vulnerable drivers with firmware access (part1)

yaml/257d425f-f660-466c-8bee-c24cccf06daa.yml

@@ -0,0 +1,181 @@
+Id: 257d425f-f660-466c-8bee-c24cccf06daa
+Author: Takahiro Haruyama
+Created: '2023-10-12'
+MitreID: T1542, T1068
+Category: vulnerable driver
+Verified: 'TRUE'
+Commands:
+  Command: sc.exe create AsmIo64.sys binPath=C:\windows\temp\AsmIo64.sys type=kernel
+    && sc.exe start AsmIo64.sys
+  Description: ''
+  Usecase: Elevate privileges, firmware erasing/modification
+  Privileges: kernel
+  OperatingSystem: Windows 11
+Resources:
+- https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation
+Acknowledgement:
+  Person: ''
+  Handle: ''
+Detection: []
+KnownVulnerableSamples:
+- Filename: ''
+  MD5: 8f73c1c48ffddfca7d1a98faf83d18ff
+  SHA1: 8b53284fb23d34ca144544b19f8fba63700830d8
+  SHA256: e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb
+  Signature: ''
+  Date: ''
+  Publisher: ''
+  Company: Asmedia Technology  Inc.
+  Description: Asmedia PCI Driver
+  Product: Asmedia PCI Driver
+  ProductVersion: 1.0.1.0000
+  FileVersion: '1.0.1.0000 built by: WinDDK'
+  MachineType: AMD64
+  OriginalFilename: AsmIo.sys
+  Imphash: 0c2219c9c5eab786fa876f74356eea20
+  Authentihash:
+    MD5: 99f5e3f2ce4c4d50dfcf6ca02ca73ae9
+    SHA1: 4a127ea0beb39a525db4c95a4a690222945f5f22
+    SHA256: 1ca20c63d8f56c09c48d0faa1894f2e3fccd4b029fd711d9864355e5f29c19f8
+  RichPEHeaderHash:
+    MD5: f63ea2dd58c1c827e0782eaa925b3f89
+    SHA1: 12b2b973f610145de7a1e7a14b540bd1576bf458
+    SHA256: 3a75c6ee26ce098f085b2b62af2c019cf444815ac322108b1b3308c05f6b111d
+  Sections:
+    .text:
+      Entropy: 6.512585906736668
+      Virtual Size: '0x1c03'
+    .rdata:
+      Entropy: 4.170633367783203
+      Virtual Size: '0x1fc'
+    .data:
+      Entropy: 0.4702181866759453
+      Virtual Size: '0x148'
+    .pdata:
+      Entropy: 3.5076370502897625
+      Virtual Size: '0xcc'
+    INIT:
+      Entropy: 5.102526566590903
+      Virtual Size: '0x3d0'
+    .rsrc:
+      Entropy: 3.252725856961488
+      Virtual Size: '0x380'
+  MagicHeader: 50 45 0 0
+  CreationTimestamp: '2015-02-02 01:25:13'
+  InternalName: AsmIo.sys
+  Copyright: "\xA9 Asmedia Technology."
+  Imports:
+  - ntoskrnl.exe
+  ExportedFunctions: ''
+  ImportedFunctions:
+  - IoBuildSynchronousFsdRequest
+  - KeInitializeEvent
+  - KeWaitForSingleObject
+  - RtlAssert
+  - IofCallDriver
+  - _vsnprintf
+  - DbgPrint
+  - MmUnmapLockedPages
+  - IoDeleteSymbolicLink
+  - ExFreePoolWithTag
+  - RtlInitUnicodeString
+  - IoDeleteDevice
+  - KeReleaseSpinLock
+  - MmUnmapIoSpace
+  - MmBuildMdlForNonPagedPool
+  - IoFreeMdl
+  - MmMapLockedPagesSpecifyCache
+  - IoGetDeviceObjectPointer
+  - ExAllocatePool
+  - MmMapIoSpace
+  - IofCompleteRequest
+  - DbgSetDebugFilterState
+  - IoCreateSymbolicLink
+  - IoCreateDevice
+  - IoAllocateMdl
+  - KeAcquireSpinLockRaiseToDpc
+  - KeBugCheckEx
+  Signatures:
+  - CertificatesInfo: ''
+    SignerInfo: ''
+    Certificates:
+    - Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA
+        , G2
+      ValidFrom: '2012-12-21 00:00:00'
+      ValidTo: '2020-12-30 23:59:59'
+      Signature: 03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 7e93ebfb7cc64e59ea4b9a77d406fc3b
+      Version: 3
+      TBS:
+        MD5: d0785ad36e427c92b19f6826ab1e8020
+        SHA1: 365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
+        SHA256: c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
+        SHA384: eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b
+    - Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer
+        , G4
+      ValidFrom: '2012-10-18 00:00:00'
+      ValidTo: '2020-12-29 23:59:59'
+      Signature: 783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: false
+      SerialNumber: 0ecff438c8febf356e04d86a981b1a50
+      Version: 3
+      TBS:
+        MD5: e9d38360b914c8863f6cba3ee58764d3
+        SHA1: 4cba8eae47b6bf76f20b3504b98b8f062694a89b
+        SHA256: 88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
+        SHA384: e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652
+    - Subject: C=TW, ST=Taipei, L=New Taipei City, O=ASMedia Technology Inc., OU=Digital
+        ID Class 3 , Microsoft Software Validation v2, CN=ASMedia Technology Inc.
+      ValidFrom: '2013-04-27 00:00:00'
+      ValidTo: '2016-06-25 23:59:59'
+      Signature: 187e13899d21e0d28deac079465ffc9b2febc20639b43a16029aa44fe7ebf1f3549bc3b6cf2fb230f52f8c96f5e71b9acee80596f381be4e3c200cb6a64ebda32c5b32a565eafaa26fd11a02ce5536ae925b245cb1dc78ea427bf97da5e58f9a10139e25bd7ecb438167a4648282ccf600825725242263a265a4853426c14f098ac2249b81e7e205e05a3c2def3608a89c1f2d419502956ca774211cc37fa1d0a0a27acb9250837e32c902ef18064873108b04ff607a8ba37ff0b0d05b45a38b8fa6086dbb8ffd2b4eb753e1c436a73280389b9017115762ce214dad2a77a3c6f6c001950795897b726194ea173cd3c3e6c5d7a5629c897f97970de10558b365
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: false
+      SerialNumber: 7818ead53083ae1106a2d5a565786166
+      Version: 3
+      TBS:
+        MD5: 2ba4563cc7b153c752456fe1bb66230d
+        SHA1: 3c069ca2e4bdc4cf12982be3b200cdc1c89e1878
+        SHA256: 18edc5059f637786f76c3b6d9df9667092a11ba2e7574025b528d0014ee6a355
+        SHA384: 3abc81865df19eb337ce797d5ccb73dbf338e27ae77410110b81127b8d3a3cb354d113c5f4d73584261935a65f208b66
+    - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign,
+        Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification
+        Authority , G5
+      ValidFrom: '2011-02-22 19:25:17'
+      ValidTo: '2021-02-22 19:35:17'
+      Signature: 812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 611993e400000000001c
+      Version: 3
+      TBS:
+        MD5: 78a717e082dcc1cda3458d917e677d14
+        SHA1: 4a872e0e51f9b304469cd1dedb496ee9b8b983a4
+        SHA256: 317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
+        SHA384: b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c
+    - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use
+        at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010
+        CA
+      ValidFrom: '2010-02-08 00:00:00'
+      ValidTo: '2020-02-07 23:59:59'
+      Signature: 5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 5200e5aa2556fc1a86ed96c9d44b33c7
+      Version: 3
+      TBS:
+        MD5: b30c31a572b0409383ed3fbe17e56e81
+        SHA1: 4843a82ed3b1f2bfbee9671960e1940c942f688d
+        SHA256: 03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
+        SHA384: bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da
+    Signer:
+    - SerialNumber: 7818ead53083ae1106a2d5a565786166
+      Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at
+        https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010
+        CA
+      Version: 1
+Tags:
+- AsmIo64.sys

yaml/6736cbe7-33ea-4488-b464-231c0b8d1049.yml

@@ -0,0 +1,166 @@
+Id: 6736cbe7-33ea-4488-b464-231c0b8d1049
+Author: Takahiro Haruyama
+Created: '2023-10-12'
+MitreID: T1542
+Category: vulnerable driver
+Verified: 'TRUE'
+Commands:
+  Command: sc.exe create gpcidrv64.sys binPath=C:\windows\temp\gpcidrv64.sys type=kernel
+    && sc.exe start gpcidrv64.sys
+  Description: ''
+  Usecase: firmware erasing/modification
+  Privileges: kernel
+  OperatingSystem: Windows 11
+Resources:
+- https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation
+Acknowledgement:
+  Person: ''
+  Handle: ''
+Detection: []
+KnownVulnerableSamples:
+- Filename: ''
+  MD5: 5d4df0bac74e9ac62af6bc99440b050b
+  SHA1: 1743b073cccf44368dc83ed3659057eb5f644b06
+  SHA256: 655110646bff890c448c0951e11132dc3592bda6e080696341b930d090224723
+  Signature: ''
+  Date: ''
+  Publisher: ''
+  Company: ''
+  Description: ''
+  Product: ''
+  ProductVersion: ''
+  FileVersion: ''
+  MachineType: AMD64
+  OriginalFilename: ''
+  Imphash: 4aaef0105216f062a5f3ee071a72770c
+  Authentihash:
+    MD5: f2c76d31ca3d7f31c1b631a083f82cb9
+    SHA1: d79a25a5f52da4ce25a76422710764aca046bbe8
+    SHA256: c53b5f071de2bbc03387451052ab81bae9b8ec0a6e075c970600f791157b0b25
+  RichPEHeaderHash:
+    MD5: e945273f211e972149c8dc34cf62ded7
+    SHA1: ba832d4d71984adb8bf1868b64919f18a8167e0f
+    SHA256: f7e39435f8beaea2ce4f99fd10e3cad124f21b3e901c9c311972eaffee3c0014
+  Sections:
+    .text:
+      Entropy: 6.139164323839344
+      Virtual Size: '0xf94'
+    .rdata:
+      Entropy: 4.4411034485988194
+      Virtual Size: '0x16c'
+    .data:
+      Entropy: 0.4804878386624626
+      Virtual Size: '0x128'
+    .pdata:
+      Entropy: 3.1368421881310096
+      Virtual Size: '0x48'
+    INIT:
+      Entropy: 4.884811337685559
+      Virtual Size: '0x284'
+  MagicHeader: 50 45 0 0
+  CreationTimestamp: '2008-07-10 06:58:31'
+  InternalName: ''
+  Copyright: ''
+  Imports:
+  - ntoskrnl.exe
+  - HAL.dll
+  ExportedFunctions: ''
+  ImportedFunctions:
+  - IoCreateDevice
+  - ZwOpenSection
+  - DbgPrint
+  - IoDeleteSymbolicLink
+  - ZwMapViewOfSection
+  - RtlInitUnicodeString
+  - IoCreateSymbolicLink
+  - MmUnmapIoSpace
+  - ZwUnmapViewOfSection
+  - MmMapIoSpace
+  - ZwClose
+  - IofCompleteRequest
+  - KeBugCheckEx
+  - IoDeleteDevice
+  - ObReferenceObjectByHandle
+  - HalTranslateBusAddress
+  Signatures:
+  - CertificatesInfo: ''
+    SignerInfo: ''
+    Certificates:
+    - Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer ,
+        G2
+      ValidFrom: '2007-06-15 00:00:00'
+      ValidTo: '2012-06-14 23:59:59'
+      Signature: 50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: false
+      SerialNumber: 3825d7faf861af9ef490e726b5d65ad5
+      Version: 3
+      TBS:
+        MD5: d6c7684e9aaa508cf268335f83afe040
+        SHA1: 18066d20ad92409c567cdfde745279ff71c75226
+        SHA256: a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
+        SHA384: 35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7
+    - Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
+      ValidFrom: '2003-12-04 00:00:00'
+      ValidTo: '2013-12-03 23:59:59'
+      Signature: 4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 47bf1995df8d524643f7db6d480d31a4
+      Version: 3
+      TBS:
+        MD5: 518d2ea8a21e879c942d504824ac211c
+        SHA1: 21ce87d827077e61abddf2beba69fde5432ea031
+        SHA256: 1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
+        SHA384: 53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f
+    - Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use
+        at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004
+        CA
+      ValidFrom: '2004-07-16 00:00:00'
+      ValidTo: '2014-07-15 23:59:59'
+      Signature: ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 4191a15a3978dfcf496566381d4c75c2
+      Version: 3
+      TBS:
+        MD5: 41011f8d0e7c7a6408334ca387914c61
+        SHA1: c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
+        SHA256: 88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
+        SHA384: a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459
+    - Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
+      ValidFrom: '2006-05-23 17:01:29'
+      ValidTo: '2016-05-23 17:11:29'
+      Signature: 01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: true
+      SerialNumber: 610c120600000000001b
+      Version: 3
+      TBS:
+        MD5: 53c41bc1164e09e0cd1617a5bf913efd
+        SHA1: 93c03aac8951d494ecd5696b1c08658541b18727
+        SHA256: 40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
+        SHA384: f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8
+    - Subject: C=TW, ST=Taiwan, L=Taipei Hsien, O=Giga,Byte Technology, OU=Digital
+        ID Class 3 , Microsoft Software Validation v2, OU=Testing Department, CN=Giga,Byte
+        Technology
+      ValidFrom: '2007-10-02 00:00:00'
+      ValidTo: '2010-10-18 23:59:59'
+      Signature: 5c404cbb1176300b3b0f2b98924c5be7571d28c8e8086cea2fe21a4d3687b441facd3aec26e2722d2d4dabac900ab1158ad7b53edc2a3678743ae411eeb48e00560ce2e49a4954a5d3223cbb3fbcb6f19185ea33ac10f5c96fc80593236a3512ad98599c931486810fd0ca98df4c75fcdd6d69aceb0d6f755c74d4779ed39cc17946fc61e7a17bee5e5bc46220509aea779cc200315bfb778edc11429dc9763a4a3c7a04346ed759ef357c4744088ac9f4f949e783b42eec05b777c3629b718e0766c5ac956b0f67834009d3e0d171da24ee6b151d7bb40cf9f8e6f1e1a08fe2ec1fb101b766ec261c0ce6f98de3fb452a81a57bb0b72a44c06a01f199a8143d
+      SignatureAlgorithmOID: 1.2.840.113549.1.1.5
+      IsCertificateAuthority: false
+      SerialNumber: 720ef3aaa1a44f7d0717a805c290c378
+      Version: 3
+      TBS:
+        MD5: 0695cf8f3778103101610eccc2a78d04
+        SHA1: ab5b9a4474b73d3317a7853116f62e83c9301b0d
+        SHA256: 6b88dbf87d212b8a91c4fd09d6725e3ae498d898c8292e77657be9d44e2503ca
+        SHA384: 3dab111c5395ec6bda188690b936c86ed2e9d46d5f718488bd3f7608338556cf774df25f2ad4a64564d067c21dc05cdc
+    Signer:
+    - SerialNumber: 720ef3aaa1a44f7d0717a805c290c378
+      Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at
+        https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004
+        CA
+      Version: 1
+Tags:
+- gpcidrv64.sys