{"Id":"23f11e19-0776-4dd4-9c9c-7f6b60f8553f","Tags":["ATSZIO.sys","ATSZIO64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","CVE":["CVE-2024-33222"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create ATSZIO.sys binPath=C:\\windows\\temp\\ATSZIO.sys type=kernel && sc.exe start ATSZIO.sys","Description":"ASUS ATSZIO64.sys version 0.2.1.7 is affected by CVE-2024-33222, which permits local privilege escalation and arbitrary code execution through crafted IOCTL requests. The tracked x64 build exposes MSR read and write through IOCTLs 0x88070F88 and 0x88070F8C, maps selected ranges of \\Device\\PhysicalMemory, and returns physical addresses for contiguous allocations. These unrestricted hardware primitives can be used to modify kernel state.","OperatingSystem":"Windows 10","Privileges":"User","Usecase":"Elevate privileges"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://nvd.nist.gov/vuln/detail/CVE-2024-33222","https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33222","https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"69a92cb6ac87c99f10b24eefa13f0b10","SHA1":"b66bf2b1b07f8f2bab1418131ae66b0a55265f73","SHA256":"0ff8bcc7f938ec71ee33fbe089d38e40a8190603558d4765c47b1b09e1dd764a"},"Company":"ASUSTek Computer Inc.","Copyright":"Copyright (C) 2012","CreationTimestamp":"2014-09-18 08:04:29","Date":"","Description":"ATSZIO Driver","ExportedFunctions":"","FileVersion":"0.2.1.7","Filename":"ATSZIO.sys","ImportedFunctions":["KeWaitForSingleObject","ExAllocatePool","ExFreePoolWithTag","MmAllocateContiguousMemory","MmFreeContiguousMemory","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoCreateSynchronizationEvent","KeSetEvent","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ZwClose","ZwOpenSection","ZwMapViewOfSection","ZwUnmapViewOfSection","MmGetPhysicalAddress","__C_specific_handler","DbgPrint","IoDeleteDevice","RtlInitUnicodeString","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"ATSZIO.sys","MD5":"b12d1630fd50b2a21fd91e45d522ba3a","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"ATSZIO.sys","Product":"ATSZIO Driver","ProductVersion":"0.2.1.7","Publisher":"","RichPEHeaderHash":{"MD5":"5633aed816ac7f25c13e7f4286ee4097","SHA1":"65f5dfbb3adcd40e7bdac184b5f599df9317377a","SHA256":"63b956b0064047af48cfdc479899aa30c5f0c2944c96e6ad03e3c26171d83147"},"SHA1":"490109fa6739f114651f4199196c5121d1c6bdf2","SHA256":"01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece","Sections":{".text":{"Entropy":5.55616133376499,"Virtual Size":"0x5d4"},".rdata":{"Entropy":3.9257359466643256,"Virtual Size":"0x2ec"},".data":{"Entropy":0.5035334969292564,"Virtual Size":"0x118"},".pdata":{"Entropy":3.305451172213043,"Virtual Size":"0x60"},"PAGE":{"Entropy":6.205978336553792,"Virtual Size":"0xcfe"},"INIT":{"Entropy":5.6051981124019505,"Virtual Size":"0x5dc"},".rsrc":{"Entropy":3.2691875406923323,"Virtual Size":"0x330"},".reloc":{"Entropy":1.584962500721156,"Virtual Size":"0xc"}},"Signature":["ASUSTeK Computer Inc.","VeriSign Class 3 Code Signing 2010 CA","VeriSign"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2006-11-08 00:00:00","ValidTo":"2021-11-07 23:59:59","Signature":"1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"250ce8e030612e9f2b89f7054d7cf8fd","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"918d9eb6a6cd36c531eceb926170a7e1","SHA1":"0ae95700d65e6f59715aa47048993ca7858e676a","SHA256":"47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166","SHA384":"e54017c93ba52f012cc15aeb3bcbce1e90a0006ff8dca231a24fc572926770f63213343f538003407bed3463fa9c4a85"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}},{"Subject":"C=TW, ST=Taiwan, L=Taipei / Peitou, O=ASUSTeK Computer Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Quality Testing Department, CN=ASUSTeK Computer Inc.","ValidFrom":"2012-07-31 00:00:00","ValidTo":"2015-08-03 23:59:59","Signature":"03cd161c1960e13d0b06441f08fdfc9df8319f8d87a83ecc865bc20767841d4087e40dc9d770bdc5c0fe6ccb9cf3e08bee7364451b03fb3130356761cae54417e8a282ed7cd33b0becd72e8799b616a2766976a7172a1cc299e8321ebeb479f592e03f425da4b2ea6a0cd0b5cc32b9bdeec80aa3ef0a62d6e16b72765301d53ef883ab9210a4b868ff2e2724e37804feb5277d3e26da8ba9d0b6ef61769d1c0f62a78757779d7134a63320b1a692584f12162d3fa20ec6e1b038b1a8d7afc2fad7b692759c6a000159714271f40d608fed3c08213b757fa75baf4674380f5aea46b7125f17532c636876c1f3e0d4b0350822f2a640001fda794b969e2cc681c2","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"7d08d9bc130726de26ee4ef28e133084","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"72cafb0a175f0481177fa2c9803283c7","SHA1":"b603167b958c5fcd7094552891ddc4e2ea4c149f","SHA256":"a36a0024075771a4b30eab8f1288817059fe1a01003d0c1d92f647df17f3b688","SHA384":"33c28dc6857ce5d20a2e9ba8a47f6bc80a9a98fba518fd732963bedbbb408848b89b3d8438d413f8b933ee761ffa1653"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"7d08d9bc130726de26ee4ef28e133084","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"b19743993dc7f1d48b2a86fe9b9c91e3","LoadsDespiteHVCI":"FALSE"},{"Filename":"ATSZIO64.sys","SHA256":"ecb4b15a847e888d36ca4e317a5d1d8963a305cc9705896a7a6d3769697d9f2d","MD5":"7a17e05b826b145a57ecd0d57b9a7238","SHA1":"ac193543255977e1d06c505bd6521aab51e68ed2","Imphash":"fa2125bfdaa1ea28db816c32ec3b8f8a","Authentihash":{"MD5":"34f537a649772cc643ddab927d019b95","SHA1":"0c0df9703b85b36094566b22b17082d9de65725e","SHA256":"a7c4268ab333669a1514dd1251a1a39420c2def0c8fe59926f1184aaa356e362"},"RichPEHeaderHash":{"MD5":"82fe750b6b17d3566199a23b76774931","SHA1":"e89465d471f37cba71e30b121355f1011f69dd1b","SHA256":"26ea493d00d5c9f9bb9e7248a5fdfbe04daa980b7688d607fc72e95a74b2d6bd"},"Sections":{".text":{"Entropy":5.67085269361349,"Virtual Size":"0x5e9"},".rdata":{"Entropy":4.278188510088278,"Virtual Size":"0xc5c"},".data":{"Entropy":2.0362923168025606,"Virtual Size":"0x230"},".pdata":{"Entropy":4.065070415372988,"Virtual Size":"0x27c"},"PAGE":{"Entropy":6.32767478223931,"Virtual Size":"0x2bae"},"INIT":{"Entropy":5.551367131939401,"Virtual Size":"0x9f8"},".reloc":{"Entropy":3.490748962019487,"Virtual Size":"0x30"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-08-08 01:38:30","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeSetEvent","KeWaitForSingleObject","ExAllocatePool","ExFreePoolWithTag","MmAllocateContiguousMemory","MmFreeContiguousMemory","IofCompleteRequest","IoCreateSymbolicLink","IoCreateSynchronizationEvent","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ZwClose","ZwOpenSection","ZwMapViewOfSection","ZwUnmapViewOfSection","MmGetPhysicalAddress","__C_specific_handler","MmGetSystemRoutineAddress","DbgPrint","ZwSetSecurityObject","IoDeviceObjectType","RtlGUIDFromString","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","IoCreateDevice","RtlInitUnicodeString","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"JURISDICTION_OF_INCORPORATION_C=TW, BUSINESS_CATEGORY=Private Organization, serialNumber=23638777, C=TW, ST=Taipei City, L=Beitou District, O=ASUSTeK COMPUTER INC., CN=ASUSTeK COMPUTER INC.","ValidFrom":"2024-04-02 00:00:00","ValidTo":"2027-04-04 23:59:59","Signature":"b99bddf774c21cd45aac116454707bdd906c6445db39887585a52884a006677038f6ed256deddf37c1ace339c4c202d8ab049cb0d3403c29ff9c6faca738054c6d094c2ec4b6f3ba78066c7174b78884cf43191bae9ce168697b118f221f5be3251df22d852256ae3013d3e138a580113607d6d3d82e21cb996f9cb575e12cd9a78bdd7bab113993965f314e8c8b61fbbd7e186b23aaa5af122347986b6edbe402de593c35274f6396074f5d94620d60eedc1d57c18a34a3720cb62bf7b90f4f72189cc31d03bbfd96efc116bfe080269d0d7067abb2efb9b74281908a500d55a4e5b65ce7ffe880ce950bb25ed8c4d5efa14910367987eee9d243221e609c61496cf6ee27d7f7c3bd457e1aaf39943a7197841bcc0f3052d92af8d0d221f311dd3b95507ea90a569217c42faccff8da9471921e0f25690d15fd68a2bdf0b0dd1d159bb45592a03c6368aefc31aa3c98c2642bb515e44da1f891a772e2db7443fbb7ef4f963a074981f639fdab2757f949adc637f3865ee70193067695c6b213dab45e62b629c652349808c65a54c660f3c14aeb234acde8f8a54bffc5342f1c9cad19979e5b1438face2a02dada8a85d87ae751b3336bfa10c34067536f8b5143f76f5819ac960b748fa52345617828cfdd66adba6b475710d2eeb518d8ead9b1c6f906c451c4f8c84b5aeb99ac3158383d33fe95d72f1f9373ce6dab276d77","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0e840bc7c81cc687147f6130ab892b73","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d1c82c80f9bda45d79a3ee38d7d165eb","SHA1":"798556081852ce51828b553113ffaa742b75e2ae","SHA256":"ea944a15d738fcd2fc8adbe0bb874cf37d458af11bb931950ee402fa2381dc12","SHA384":"dc010a208fbb98d1b6aba446a939bc2b3b24279c4875e9af9f1507351a01e3cef77cb1550bb6c058be6e6f7069dedb33"}}],"Signer":[{"SerialNumber":"0e840bc7c81cc687147f6130ab892b73","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]}]}