{"Id":"1aeb1205-8b02-42b6-a563-b953ea337c19","Tags":["Tmel.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"9452955f95c4dde4370d5ea363a86400","SHA1":"47d918b63158a297c44e3e8bbe1d2f99900e7fef","SHA256":"3de38ef40dbda07a537a7e48cb5d59dbd17bf27d5d399b32df737cd67c0cdb25"},"Company":"Trend Micro Inc.","Copyright":"Copyright (C) 2015 Trend Micro Incorporated. All rights reserved.","CreationTimestamp":"2015-05-08 02:06:46","Date":"","Description":"TrendMicro ELAM Driver","ExportedFunctions":"","FileVersion":"1.6.0.1002","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","ExFreePoolWithTag","_purecall","strncpy","wcsncpy","RtlInitUnicodeString","RtlEqualUnicodeString","DbgPrint","KeQuerySystemTime","ZwClose","ZwOpenKey","ZwQueryValueKey","ZwSetValueKey","memcpy","memset","KeInitializeEvent","KeWaitForSingleObject","IoBuildDeviceIoControlRequest","IofCallDriver","IofCompleteRequest","IoGetDeviceObjectPointer","ObfDereferenceObject","IoRegisterBootDriverCallback","IoUnregisterBootDriverCallback","_stricmp","MmIsAddressValid","RtlImageNtHeader","ZwQuerySystemInformation","wcsncmp","memcmp","RtlUnwind","Tbsi_Revoke_Attestation"],"Imports":["ntoskrnl.exe","tbs.sys"],"InternalName":"Tmel.sys","MD5":"d052dc4ac3c5bfe34f04abc62a153847","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"Tmel.sys","PDBPath":"","Product":"Trend Micro Early Launch Anti-Malware Driver","ProductVersion":"1.6","Publisher":"","RichPEHeaderHash":{"MD5":"5e73d8474cb1757ee6566d0416cc7aea","SHA1":"631a45aea3207ad70ac96c80e6c1e28d87b7a982","SHA256":"5e23e66bee07280a49103359030aa43aa4171df8887676fb7c75fa741496736d"},"SHA1":"6eece018896c250f15f778f0ccae667f315b8bd1","SHA256":"dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96","Sections":{".text":{"Entropy":6.361406803326352,"Virtual Size":"0x3f32"},".rdata":{"Entropy":4.152220214860239,"Virtual Size":"0x300"},".data":{"Entropy":0.6946247138069125,"Virtual Size":"0x328"},"INIT":{"Entropy":5.302438952697484,"Virtual Size":"0x364"},".rsrc":{"Entropy":3.489216555517427,"Virtual Size":"0x800"},".reloc":{"Entropy":6.073476767052889,"Virtual Size":"0x4b6"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows Early Launch Anti,malware Publisher","ValidFrom":"2015-01-14 21:31:10","ValidTo":"2016-04-14 21:31:10","Signature":"18c72a193d7efedccdf640d0a9c0ff2e9fa9b7b1dc3ac28ea90d33df3ab44670eab692d7c90e5dfa97ea674905adf1578f2d14a6085d2904c8812991ccec229b9dd2f11516f894517e97c201eff48c998ccf6b5d7a0efd07190ab33927be386d62acaaf5b73f4f891af0ef8002648737e57e62e9798e097aacced862778b51cc92357e090203fe6cd2322b82c6bde16dfaf6e598d05b1a352263da413a766038e665108701d6ac7efbe7ec04785a4b4f99a46583d724a09440d4752fb3d40c3565b3d03d37234f1bed4e3ae0c59160650f38aef29d3cf6a920ab86040f09e9f8087e9a89d8c443b3916d87479c352fdb44982f4799753df5e754434759545b1624ebef4794fffc2e2c8957fa370cee7790da87b3dfec3750a9a4a3780454299766c8a77670511082c4765b75be6a94a43113f58e22dac6440a102faf25f10dcd021f2e25b311b641c635b3ae5d9f7f63b342feaa02159be5bb63f09327162a523029df7f44fa36f0665708523b63678748d09ddbe1298817549b9f600a42e2249b654b94276ac16a843f18d1531c0a8512ebdf0a8f8238529bfbf5587542d6cc038e7a5abc9d39d09f455f8f078ab1d26d57bf16eebfd1eb8ed9bf49da61ff138b362abb0a22718c322aada6bd26c1059ba8ebae619c15ddad5496d2a424c975bcc26cfded04ddb3d0f23342882b3bc97602329639df471c2541222b768127f8","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000000a35c02110041db90300000000000a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3d599ae8f2823b242ef0b42a48eb116c","SHA1":"87d1616058dae44dd602ab9acd4ac4e736bbd451","SHA256":"eda5653cc4fffbaeded2567b92aa03abb6c60ade2da823b8a07d826e0856c0af","SHA384":"f3d5d7e6a53e96d5c44b92c6bd81d71c6ffaf0ed77c13229adb301bc10ba7c2d5afde3d6a5eb553244666b0ce9ec68af"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000000a35c02110041db90300000000000a","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"e53133e314605f61696ede9f23dbc14e","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"93de89630be80425a0f5571498b89048","SHA1":"6f39048e31f8e835f7537998bbd3b6ac5cff2c04","SHA256":"4bef5f5160c6a981562597dda319f9a235c28d5beba5268a454f734500ec1f4f"},"Company":"Trend Micro Inc.","Copyright":"Copyright (C) 2015 Trend Micro Incorporated. All rights reserved.","CreationTimestamp":"2015-11-18 05:14:15","Date":"","Description":"TrendMicro ELAM Driver (64-Bit)","ExportedFunctions":"","FileVersion":"1.6.0.1004","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","ExFreePoolWithTag","_purecall","strncpy","wcsncpy","RtlInitUnicodeString","RtlEqualUnicodeString","DbgPrint","ZwClose","ZwOpenKey","ZwQueryValueKey","ZwSetValueKey","KeInitializeEvent","KeWaitForSingleObject","PsGetVersion","IoBuildDeviceIoControlRequest","IofCallDriver","IofCompleteRequest","IoGetDeviceObjectPointer","ObfDereferenceObject","IoRegisterBootDriverCallback","IoUnregisterBootDriverCallback","_stricmp","MmIsAddressValid","RtlImageNtHeader","ZwQuerySystemInformation","wcsncmp","Tbsi_Revoke_Attestation"],"Imports":["ntoskrnl.exe","tbs.sys"],"InternalName":"Tmel.sys","MD5":"4064a81b6339992cbb4171b43b9a69dc","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"Tmel.sys","PDBPath":"","Product":"Trend Micro Early Launch Anti-Malware Driver","ProductVersion":"1.6","Publisher":"","RichPEHeaderHash":{"MD5":"2b90445ddec8a8d927ff6eed42b21531","SHA1":"f49c75459256c711d9fc43aa63094e9059a9f60a","SHA256":"76890383bfcdb892dff16275a90fe117eef2e9733d56439f6580288b2148a10d"},"SHA1":"6cf7db611a351dbbf4e8cfde5b9912ddc329e43d","SHA256":"e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9","Sections":{".text":{"Entropy":6.195549645690676,"Virtual Size":"0x5004"},".rdata":{"Entropy":4.271691496190218,"Virtual Size":"0x86c"},".data":{"Entropy":0.7723664588396264,"Virtual Size":"0x500"},".pdata":{"Entropy":4.188948162641279,"Virtual Size":"0x3b4"},"INIT":{"Entropy":4.901313477158036,"Virtual Size":"0x3aa"},".rsrc":{"Entropy":3.4925070120773976,"Virtual Size":"0x810"},".reloc":{"Entropy":3.624399326618123,"Virtual Size":"0x126"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows Early Launch Anti,malware Publisher","ValidFrom":"2015-01-14 21:31:10","ValidTo":"2016-04-14 21:31:10","Signature":"18c72a193d7efedccdf640d0a9c0ff2e9fa9b7b1dc3ac28ea90d33df3ab44670eab692d7c90e5dfa97ea674905adf1578f2d14a6085d2904c8812991ccec229b9dd2f11516f894517e97c201eff48c998ccf6b5d7a0efd07190ab33927be386d62acaaf5b73f4f891af0ef8002648737e57e62e9798e097aacced862778b51cc92357e090203fe6cd2322b82c6bde16dfaf6e598d05b1a352263da413a766038e665108701d6ac7efbe7ec04785a4b4f99a46583d724a09440d4752fb3d40c3565b3d03d37234f1bed4e3ae0c59160650f38aef29d3cf6a920ab86040f09e9f8087e9a89d8c443b3916d87479c352fdb44982f4799753df5e754434759545b1624ebef4794fffc2e2c8957fa370cee7790da87b3dfec3750a9a4a3780454299766c8a77670511082c4765b75be6a94a43113f58e22dac6440a102faf25f10dcd021f2e25b311b641c635b3ae5d9f7f63b342feaa02159be5bb63f09327162a523029df7f44fa36f0665708523b63678748d09ddbe1298817549b9f600a42e2249b654b94276ac16a843f18d1531c0a8512ebdf0a8f8238529bfbf5587542d6cc038e7a5abc9d39d09f455f8f078ab1d26d57bf16eebfd1eb8ed9bf49da61ff138b362abb0a22718c322aada6bd26c1059ba8ebae619c15ddad5496d2a424c975bcc26cfded04ddb3d0f23342882b3bc97602329639df471c2541222b768127f8","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000000a35c02110041db90300000000000a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3d599ae8f2823b242ef0b42a48eb116c","SHA1":"87d1616058dae44dd602ab9acd4ac4e736bbd451","SHA256":"eda5653cc4fffbaeded2567b92aa03abb6c60ade2da823b8a07d826e0856c0af","SHA384":"f3d5d7e6a53e96d5c44b92c6bd81d71c6ffaf0ed77c13229adb301bc10ba7c2d5afde3d6a5eb553244666b0ce9ec68af"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000000a35c02110041db90300000000000a","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"f6aeb7d666f83d90492fb76d8af4e15b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"517db4899b3d996cb6f902b0611d233f","SHA1":"a9c9cb2548322748208199a7702d8056ad9a24fd","SHA256":"0e121d80264c51df9a6fca2f2201d75ccd4dc29d9566bbf0975bb05759e9c6c7"},"Company":"Trend Micro Inc.","Copyright":"Copyright (C) 2015 Trend Micro Incorporated. All rights reserved.","CreationTimestamp":"2015-05-08 03:13:56","Date":"","Description":"TrendMicro ELAM Driver (64-Bit)","ExportedFunctions":"","FileVersion":"1.6.0.1002","Filename":"","ImportedFunctions":["ExAllocatePoolWithTag","ExFreePoolWithTag","_purecall","strncpy","wcsncpy","RtlInitUnicodeString","RtlEqualUnicodeString","DbgPrint","ZwClose","ZwOpenKey","ZwQueryValueKey","ZwSetValueKey","KeInitializeEvent","KeWaitForSingleObject","IoBuildDeviceIoControlRequest","IofCallDriver","IofCompleteRequest","IoGetDeviceObjectPointer","ObfDereferenceObject","IoRegisterBootDriverCallback","IoUnregisterBootDriverCallback","_stricmp","MmIsAddressValid","RtlImageNtHeader","ZwQuerySystemInformation","wcsncmp","Tbsi_Revoke_Attestation"],"Imports":["ntoskrnl.exe","tbs.sys"],"InternalName":"Tmel.sys","MD5":"e58491b5aec097f17e310f83e82ae0c8","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"Tmel.sys","PDBPath":"","Product":"Trend Micro Early Launch Anti-Malware Driver","ProductVersion":"1.6","Publisher":"","RichPEHeaderHash":{"MD5":"fed8b3a0eacb12baa3271fc6856838a1","SHA1":"173b7cc38568ee8dabd25b695d2ab5a03febc21a","SHA256":"91598130b4705df160c726ff59dee5a2e460cc731ad6ef0b0b062ed06c7cec38"},"SHA1":"b667f48f5518632f3159f51e5e1f6332627c4fd8","SHA256":"d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11","Sections":{".text":{"Entropy":6.211209396417356,"Virtual Size":"0x4f84"},".rdata":{"Entropy":4.271822261614328,"Virtual Size":"0x85c"},".data":{"Entropy":0.7723664588396264,"Virtual Size":"0x4f8"},".pdata":{"Entropy":4.17152707941952,"Virtual Size":"0x3a8"},"INIT":{"Entropy":4.919554726416368,"Virtual Size":"0x392"},".rsrc":{"Entropy":3.4851512565207843,"Virtual Size":"0x810"},".reloc":{"Entropy":3.695966332799845,"Virtual Size":"0x11c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows Early Launch Anti,malware Publisher","ValidFrom":"2015-01-14 21:31:10","ValidTo":"2016-04-14 21:31:10","Signature":"18c72a193d7efedccdf640d0a9c0ff2e9fa9b7b1dc3ac28ea90d33df3ab44670eab692d7c90e5dfa97ea674905adf1578f2d14a6085d2904c8812991ccec229b9dd2f11516f894517e97c201eff48c998ccf6b5d7a0efd07190ab33927be386d62acaaf5b73f4f891af0ef8002648737e57e62e9798e097aacced862778b51cc92357e090203fe6cd2322b82c6bde16dfaf6e598d05b1a352263da413a766038e665108701d6ac7efbe7ec04785a4b4f99a46583d724a09440d4752fb3d40c3565b3d03d37234f1bed4e3ae0c59160650f38aef29d3cf6a920ab86040f09e9f8087e9a89d8c443b3916d87479c352fdb44982f4799753df5e754434759545b1624ebef4794fffc2e2c8957fa370cee7790da87b3dfec3750a9a4a3780454299766c8a77670511082c4765b75be6a94a43113f58e22dac6440a102faf25f10dcd021f2e25b311b641c635b3ae5d9f7f63b342feaa02159be5bb63f09327162a523029df7f44fa36f0665708523b63678748d09ddbe1298817549b9f600a42e2249b654b94276ac16a843f18d1531c0a8512ebdf0a8f8238529bfbf5587542d6cc038e7a5abc9d39d09f455f8f078ab1d26d57bf16eebfd1eb8ed9bf49da61ff138b362abb0a22718c322aada6bd26c1059ba8ebae619c15ddad5496d2a424c975bcc26cfded04ddb3d0f23342882b3bc97602329639df471c2541222b768127f8","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000000a35c02110041db90300000000000a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3d599ae8f2823b242ef0b42a48eb116c","SHA1":"87d1616058dae44dd602ab9acd4ac4e736bbd451","SHA256":"eda5653cc4fffbaeded2567b92aa03abb6c60ade2da823b8a07d826e0856c0af","SHA384":"f3d5d7e6a53e96d5c44b92c6bd81d71c6ffaf0ed77c13229adb301bc10ba7c2d5afde3d6a5eb553244666b0ce9ec68af"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000000a35c02110041db90300000000000a","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"e54f28e331d8e2b722551f3b280cc686","LoadsDespiteHVCI":"FALSE"}]}