{"Id":"48aeea9b-7812-4b25-9835-baaebe7dc551","Tags":["ADRMDRVSYS.sys"],"Verified":"TRUE","Author":"Northwave Cyber Security","Created":"2024-09-11","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create ADRMDRVSYS binPath=C:\\windows\\temp\\ADRMDRVSYS.sys type=kernel && sc.exe start ADRMDRVSYS","Description":"ADLINK Resource Manager exposes physical-memory mapping through IOCTL 0x2234D4, allowing low-privilege callers to read kernel memory. The interface has also been weaponized by Blackout Reloaded to terminate protected antimalware processes through a driver path that reaches ZwTerminateProcess.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://northwave-cybersecurity.com/vulnerability-notice-adlink-pxi-platform-services?hsLang=en","https://github.com/tijme/blackout-reloaded","https://github.com/fluffycats31/vulnerable-drivers"],"Detection":[],"Acknowledgement":{"Person":"Northwave Cyber Security, fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Filename":"ADRMDRVSYS.sys","SHA256":"edac730a75ed453bdcdfb7ca1dd19cf1e269e9ca59295efb15ca0071c96ed2f5","MD5":"4f4b41628f7685fec956017686c9ed35","SHA1":"a76cf0a0f292bbf61538b9743e80aee1878c06a6","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"8b1e382ad1de95ed27bddc8fbc4c5f6c","SHA1":"afa28da8f99ba78d43070a7b9e4291c1fbcc5d6d","SHA256":"b18d0039333d3bd44f8be9bf9b2fa1c7b3ce61a2de45a212b4fd5c5438888271"},"RichPEHeaderHash":{"MD5":"aae9cef2ced761fefc25afe27c3a273c","SHA1":"f2484b1d174a77d4d1ee9092b214a7608f61fe27","SHA256":"c5c093a7492e5d9548c503e0dcb64a4261e5e747022b46b3d0aeeb4b6a1b689b"},"Sections":{".text":{"Entropy":6.281556456463973,"Virtual Size":"0x22ce"},".rdata":{"Entropy":4.233874082202052,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.760885339208617,"Virtual Size":"0x138"},"INIT":{"Entropy":4.7646992285470855,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-17 08:14:33","Description":"ADLINK Resource Manager Kenerl Service.","Company":"ADLINK Technology, Inc.","InternalName":"ADRMDRVSYS","OriginalFilename":"ADRMDRVSYS.sys","FileVersion":"1.12.802.2022","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"ADRMDRVSYS.sys","SHA256":"9822ecd5b19022c6db17a0c2bf4a26c00216b456a834371e11ba20323efa7262","MD5":"ca6367efbebda8123aa7bdaa8f38dff7","SHA1":"8c922bc8e5070d76098db446f6ebdcbc7c861ce7","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"37d6279b25aca8b3826f2eadba4c0819","SHA1":"1ab607364cd4a20b425dda1fd814434854cad0d2","SHA256":"cf547c9bfe616df155cda71c45b7cd89a2256174eea70f673ee6b9e529d8b72a"},"RichPEHeaderHash":{"MD5":"aae9cef2ced761fefc25afe27c3a273c","SHA1":"f2484b1d174a77d4d1ee9092b214a7608f61fe27","SHA256":"c5c093a7492e5d9548c503e0dcb64a4261e5e747022b46b3d0aeeb4b6a1b689b"},"Sections":{".text":{"Entropy":6.281556456463973,"Virtual Size":"0x22ce"},".rdata":{"Entropy":4.239579705408071,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.760885339208617,"Virtual Size":"0x138"},"INIT":{"Entropy":4.7646992285470855,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-01-29 19:07:07","Description":"ADLINK Resource Manager Kenerl Service.","Company":"ADLINK Technology, Inc.","InternalName":"ADRMDRVSYS","OriginalFilename":"ADRMDRVSYS.sys","FileVersion":"1.12.802.2022","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"ADRMDRVSYS.sys","SHA256":"806b9f9967e26bee69843f71a7b76305386ceb231fd57549eabeb6b1652ee07e","MD5":"ceb08040c76342faa29d85c275349302","SHA1":"3d99a08dfb08f1bd6c30ea393881c1d883842927","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"43814bde1e7dbf0c899325135eb303cd","SHA1":"edd52d80b5e6ff4af724ac19872405521400bc3b","SHA256":"94f49026cb6445f9f20347b464d3d089d1ec3b4f44f7920ae809930a5fd17742"},"RichPEHeaderHash":{"MD5":"aae9cef2ced761fefc25afe27c3a273c","SHA1":"f2484b1d174a77d4d1ee9092b214a7608f61fe27","SHA256":"c5c093a7492e5d9548c503e0dcb64a4261e5e747022b46b3d0aeeb4b6a1b689b"},"Sections":{".text":{"Entropy":6.281556456463973,"Virtual Size":"0x22ce"},".rdata":{"Entropy":4.234351398701529,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.760885339208617,"Virtual Size":"0x138"},"INIT":{"Entropy":4.7646992285470855,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-12-12 02:18:33","Description":"ADLINK Resource Manager Kenerl Service.","Company":"ADLINK Technology, Inc.","InternalName":"ADRMDRVSYS","OriginalFilename":"ADRMDRVSYS.sys","FileVersion":"1.12.802.2022","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:30","ValidTo":"2024-04-03 19:16:30","Signature":"46265205ad9b6e72f93c97f9bf34c09a4a9f618fec8b7dd6ec24db2163c8b019835dab33b75917d152e60a82e374a0c824aabd01367487ae41dd80c6e98facf7ab35fb0e21b812444a0740d44e44c100b6edc2d3a5a243594b116a979fae9c2e5a0e8d8b9d3809064110d2427a911e520310562b1a3524d5b3767a94069e35c0a3df4f4e1d11f91c05e35bdcce15a12d0d0083f080b21de4d12c3cd428214ed47c21b2ecf546c3d258c90fc982530b04eb7b84fcad5c7898fb6ce95f8970d0d98ab02d730c33c75ced79ea3b9aa19938e719ad84889325a5de27e97c7715d7130926057292a83f09c89f0b5e3993f32de9f773016ba173520ae0d0559bfb4f78dc8564a66b619af0162abe1b02a812562d5517d681a5f096f73a8414bc414919c173240a48d5dd226caf91c1a7fc25b88d4d407af788d09452b324bdfecb7fbec11569e50dc596319701cdf5bd4e0d3714097054b84be6a9715cbf4d499a25a01114f02aa44973515379ebfa23bf8bbaf931f08fd998c4d63cbe8ca6b062145ba4379ad1fcd5749e226e14596ad99249c8c8009212f4a997cf6e4f4940c14a0d4733bc511189110958a9defce1668953a0ef3f17bd5d588af12fae2de418169c1ad1b3571584fcd7be4875ce8d4c10edfa60652327e39158c64eba0e1db8e85c8d07371603d60d2585a61f39f265d662240813567907809db37b3a38c50c1dab","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"93c79f426eb2f2a03b74a6275cac238f","SHA1":"e3ae60577ad97b4113d71845e11bd33a1ef2bea8","SHA256":"0f06228de7bacfbf65d426df80c4e40c5abfe5a2a402e6221dea03b18897de2b","SHA384":"4fcbd8696874577fdeed02d6f1245fb7f45d477850cbfdac0db27f478ed500665247ca122157f2678949f85e5386aa71"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"ADRMDRVSYS.sys","SHA256":"fa59c670b2282d870dd4c9920e56419ddfd8f5ab15b24e1b8708aa841439cc91","MD5":"eceb8140cc29d5348bcff3bb78f8d1d4","SHA1":"8bbe29e97cfe32a9da9d532ed8506e646e3f7321","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"9e328b923d86adec6ac0e8ad1db2dfcc","SHA1":"69a73fac571f7406db8a36f43fa522f720c7f562","SHA256":"0e1b9e8c711b06b5590ebf5f2499337041b0cc885961f18a77317e97e0690538"},"RichPEHeaderHash":{"MD5":"aae9cef2ced761fefc25afe27c3a273c","SHA1":"f2484b1d174a77d4d1ee9092b214a7608f61fe27","SHA256":"c5c093a7492e5d9548c503e0dcb64a4261e5e747022b46b3d0aeeb4b6a1b689b"},"Sections":{".text":{"Entropy":6.281556456463973,"Virtual Size":"0x22ce"},".rdata":{"Entropy":4.24317966765592,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.760885339208617,"Virtual Size":"0x138"},"INIT":{"Entropy":4.7646992285470855,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-06-21 01:29:32","Description":"ADLINK Resource Manager Kenerl Service.","Company":"ADLINK Technology, Inc.","InternalName":"ADRMDRVSYS","OriginalFilename":"ADRMDRVSYS.sys","FileVersion":"1.12.802.2022","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:30","ValidTo":"2024-04-03 19:16:30","Signature":"46265205ad9b6e72f93c97f9bf34c09a4a9f618fec8b7dd6ec24db2163c8b019835dab33b75917d152e60a82e374a0c824aabd01367487ae41dd80c6e98facf7ab35fb0e21b812444a0740d44e44c100b6edc2d3a5a243594b116a979fae9c2e5a0e8d8b9d3809064110d2427a911e520310562b1a3524d5b3767a94069e35c0a3df4f4e1d11f91c05e35bdcce15a12d0d0083f080b21de4d12c3cd428214ed47c21b2ecf546c3d258c90fc982530b04eb7b84fcad5c7898fb6ce95f8970d0d98ab02d730c33c75ced79ea3b9aa19938e719ad84889325a5de27e97c7715d7130926057292a83f09c89f0b5e3993f32de9f773016ba173520ae0d0559bfb4f78dc8564a66b619af0162abe1b02a812562d5517d681a5f096f73a8414bc414919c173240a48d5dd226caf91c1a7fc25b88d4d407af788d09452b324bdfecb7fbec11569e50dc596319701cdf5bd4e0d3714097054b84be6a9715cbf4d499a25a01114f02aa44973515379ebfa23bf8bbaf931f08fd998c4d63cbe8ca6b062145ba4379ad1fcd5749e226e14596ad99249c8c8009212f4a997cf6e4f4940c14a0d4733bc511189110958a9defce1668953a0ef3f17bd5d588af12fae2de418169c1ad1b3571584fcd7be4875ce8d4c10edfa60652327e39158c64eba0e1db8e85c8d07371603d60d2585a61f39f265d662240813567907809db37b3a38c50c1dab","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"93c79f426eb2f2a03b74a6275cac238f","SHA1":"e3ae60577ad97b4113d71845e11bd33a1ef2bea8","SHA256":"0f06228de7bacfbf65d426df80c4e40c5abfe5a2a402e6221dea03b18897de2b","SHA384":"4fcbd8696874577fdeed02d6f1245fb7f45d477850cbfdac0db27f478ed500665247ca122157f2678949f85e5386aa71"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"ADRMDRVSYS.sys","MD5":"b7b961e5052519435626a417cf612b97","SHA1":"8e879a968846f811ed8d99acee414ffa66d0589f","SHA256":"a1f79a2e1441970bb3e7c838f8c14a8f3d39a46b0ff9648614e922ac475c743d","Signature":"","Date":"","Publisher":"","Company":"ADLINK Technology, Inc.","Description":"ADLINK Resource Manager Kenerl Service.","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","FileVersion":"1.12.802.2022","MachineType":"AMD64","OriginalFilename":"ADRMDRVSYS.sys","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"dddde12c1e852679d330a053cadd56d6","SHA1":"284c263763d9bfe78d7d6aaf3543a925325469fe","SHA256":"3df5f17da8758288b633611afc1c0b6d42c1e56aed5539cfa313986f70ce90e7"},"RichPEHeaderHash":{"MD5":"aae9cef2ced761fefc25afe27c3a273c","SHA1":"f2484b1d174a77d4d1ee9092b214a7608f61fe27","SHA256":"c5c093a7492e5d9548c503e0dcb64a4261e5e747022b46b3d0aeeb4b6a1b689b"},"Sections":{".text":{"Entropy":6.281556456463973,"Virtual Size":"0x22ce"},".rdata":{"Entropy":4.224849902343282,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.760885339208617,"Virtual Size":"0x138"},"INIT":{"Entropy":4.764699228547086,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-22 04:05:36","InternalName":"ADRMDRVSYS","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:30","ValidTo":"2024-04-03 19:16:30","Signature":"46265205ad9b6e72f93c97f9bf34c09a4a9f618fec8b7dd6ec24db2163c8b019835dab33b75917d152e60a82e374a0c824aabd01367487ae41dd80c6e98facf7ab35fb0e21b812444a0740d44e44c100b6edc2d3a5a243594b116a979fae9c2e5a0e8d8b9d3809064110d2427a911e520310562b1a3524d5b3767a94069e35c0a3df4f4e1d11f91c05e35bdcce15a12d0d0083f080b21de4d12c3cd428214ed47c21b2ecf546c3d258c90fc982530b04eb7b84fcad5c7898fb6ce95f8970d0d98ab02d730c33c75ced79ea3b9aa19938e719ad84889325a5de27e97c7715d7130926057292a83f09c89f0b5e3993f32de9f773016ba173520ae0d0559bfb4f78dc8564a66b619af0162abe1b02a812562d5517d681a5f096f73a8414bc414919c173240a48d5dd226caf91c1a7fc25b88d4d407af788d09452b324bdfecb7fbec11569e50dc596319701cdf5bd4e0d3714097054b84be6a9715cbf4d499a25a01114f02aa44973515379ebfa23bf8bbaf931f08fd998c4d63cbe8ca6b062145ba4379ad1fcd5749e226e14596ad99249c8c8009212f4a997cf6e4f4940c14a0d4733bc511189110958a9defce1668953a0ef3f17bd5d588af12fae2de418169c1ad1b3571584fcd7be4875ce8d4c10edfa60652327e39158c64eba0e1db8e85c8d07371603d60d2585a61f39f265d662240813567907809db37b3a38c50c1dab","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"93c79f426eb2f2a03b74a6275cac238f","SHA1":"e3ae60577ad97b4113d71845e11bd33a1ef2bea8","SHA256":"0f06228de7bacfbf65d426df80c4e40c5abfe5a2a402e6221dea03b18897de2b","SHA384":"4fcbd8696874577fdeed02d6f1245fb7f45d477850cbfdac0db27f478ed500665247ca122157f2678949f85e5386aa71"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Filename":"ADRMDRVSYS.sys","MD5":"12e1825a3d65c0ba409dac61ac84469d","SHA1":"843ada80361bd77645af60286405600a86f0eb1f","SHA256":"57afe716c49b1a141351b4c24f70d71a688c5ac6d95da8fff348d7f184851a4d","LoadsDespiteHVCI":"FALSE","Imphash":"eef1bff6680f68ccc7bfea46aaab8210","Authentihash":{"MD5":"3d0249048295586658c451c30559685e","SHA1":"ef3adfe2d9aa035237182678aecc7216075e4ecb","SHA256":"2eaff8c35176b3725624d475df80c5b2bcc60be35aa6634ec3530af852396795"},"RichPEHeaderHash":{"MD5":"f1503c890593235dd5ace0bc0f69057a","SHA1":"5084ae099ec3f506f86b79bb3ef2c0d96a0c2a4c","SHA256":"14e6c2478576df2d4826afadd2013a94bda1729ac0cac19d8f775f5d662a23d6"},"Sections":{".text":{"Entropy":6.267018632810583,"Virtual Size":"0x244e"},".rdata":{"Entropy":4.267636827483558,"Virtual Size":"0x634"},".data":{"Entropy":0.5671439442631283,"Virtual Size":"0x2d8"},".pdata":{"Entropy":3.784282593516212,"Virtual Size":"0x138"},"INIT":{"Entropy":4.7646992285470855,"Virtual Size":"0x2f6"},".rsrc":{"Entropy":3.424259613414651,"Virtual Size":"0x3f0"},".reloc":{"Entropy":3.0890191852411095,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-01-08 19:56:37","Description":"ADLINK Resource Manager Kenerl Service.","Company":"ADLINK Technology, Inc.","InternalName":"ADRMDRVSYS","OriginalFilename":"ADRMDRVSYS.sys","FileVersion":"1.12.802.2022","Product":"ADLINK Resource Manager Kenerl Service.","ProductVersion":"1.12.802.0","Copyright":"Copyright (C) 2016-2021 ADLINK Technology, Inc.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmUnmapIoSpace","IofCompleteRequest","IoCreateDevice","MmMapIoSpace","IoDeleteDevice","IoDeleteSymbolicLink","ExFreePoolWithTag","ExAllocatePool","KeWaitForSingleObject","KeReleaseMutex","RtlCopyUnicodeString","KeInitializeMutex","RtlGetVersion","IoCreateSymbolicLink","RtlInitUnicodeString","HalGetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}