{"Id":"c67ad48b-223e-40f8-bfc7-0cb904d0a3d7","Tags":["pskmad_64.sys","PSKMAD.sys","Panda Kernel Memory Access Driver"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-08-31","MitreID":"T1068","CVE":["CVE-2023-6330","CVE-2023-6331","CVE-2023-6332"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create PSKMAD type= kernel binPath= C:\\\\windows\\\\temp\\\\pskmad_64.sys && sc.exe start PSKMAD","Description":"Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. The tracked 1.0.0.16 and 1.0.0.17 builds expose IOCTL 0xB3702C08 through \\Device\\PSMEMDriver. After a fixed magic value, the request accepts a process, address, and caller-controlled length without relating that length to the fixed buffered-I/O header, allowing kernel-memory disclosure and buffered-output corruption.","Usecase":"Read kernel memory and corrupt non-paged kernel memory","Privileges":"Administrator","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://www.sophos.com/en-us/blog/multiple-vulnerabilities-discovered-in-widely-used-security-driver","https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00001","https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00002","https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00003"],"Detection":[],"Acknowledgement":{"Person":"fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Filename":"pskmad_64.sys","MD5":"9746d407113028f9cdac7031d717203e","SHA1":"c582269f43c2d4e1894ff53116bccb9f4abc5acc","SHA256":"7f9a397038732678c52a73e5e2238ab3619e3c1fcb2ce41efc8e5bd38d77f83e","Imphash":"4cc218740b780c7d3e40804b184c2b5d","Authentihash":{"MD5":"7ff742e9f4770bf2edec876f4bd3042a","SHA1":"f3872dc5b28aaad25b16712ed0adb79eafcaf4bc","SHA256":"cf92fa9fb3067b134f3ae49b981c19bb785e90c8d6348e76f346aa12afc211dc"},"RichPEHeaderHash":{"MD5":"ef3d067a6fc8aaf14d02b0d9f1cc15e3","SHA1":"12994df17aa0c486650d12b437c6a69445ee5580","SHA256":"b682b41b221846f76894542c1ed0d433443707c3b99ad2afaa2ba95b87abefee"},"Sections":{".text":{"Entropy":6.305694434309464,"Virtual Size":"0x80ba"},".rdata":{"Entropy":4.7854544590455985,"Virtual Size":"0xde4"},".data":{"Entropy":1.1575528347317705,"Virtual Size":"0x4c0"},".pdata":{"Entropy":4.4207808981725565,"Virtual Size":"0x57c"},"PAGE":{"Entropy":6.263712835860189,"Virtual Size":"0x1e4c"},"INIT":{"Entropy":5.222391733472644,"Virtual Size":"0xcb6"},".rsrc":{"Entropy":3.3178975571108458,"Virtual Size":"0x368"},".reloc":{"Entropy":1.2089679887091815,"Virtual Size":"0x6c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2016-08-08 02:59:58","Description":"Panda Kernel Memory Access Driver (x64)","Company":"Panda Security, S.L.","InternalName":"PSKMAD_64","OriginalFilename":"PSKMAD_64","FileVersion":"1.0.0.17","Product":"Panda Technologies","ProductVersion":"1.0.0.3800","Copyright":"© Panda 2016","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoWMIRegistrationControl","ExFreePoolWithTag","IoWMIWriteEvent","RtlInitUnicodeString","MmGetSystemRoutineAddress","IoGetCurrentProcess","IofCompleteRequest","RtlCompareMemory","sprintf","ZwCreateKey","ExInitializeNPagedLookasideList","IoDeleteDevice","RtlGetVersion","ZwQueryValueKey","ZwClose","RtlCharToInteger","IoCreateSymbolicLink","wcscspn","ExDeleteNPagedLookasideList","MmSystemRangeStart","MmUnmapLockedPages","PsProcessType","KeSetTargetProcessorDpc","KeQueryActiveProcessors","ZwFsControlFile","PsLookupProcessByProcessId","InitializeSListHead","ZwQuerySymbolicLinkObject","ZwSetEaFile","ZwReadFile","ZwMapViewOfSection","ExpInterlockedPushEntrySList","IoCreateFile","MmHighestUserAddress","KeInitializeDpc","KeAcquireQueuedSpinLock","ExpInterlockedPopEntrySList","KeReleaseQueuedSpinLock","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","ZwOpenSymbolicLinkObject","IoFreeMdl","ZwSetInformationFile","KeDetachProcess","KeDelayExecutionThread","MmGetPhysicalAddress","ZwWaitForSingleObject","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ZwUnmapViewOfSection","ZwQueryDirectoryFile","PsTerminateSystemThread","MmIsDriverVerifying","MmMapIoSpace","KeInsertQueueDpc","ZwQueryEaFile","ZwQueryVolumeInformationFile","ObReferenceObjectByHandle","MmProbeAndLockPages","KeRevertToUserAffinityThread","RtlEnumerateGenericTableAvl","MmUnlockPages","PsGetCurrentProcessId","KeSetSystemAffinityThread","MmIsAddressValid","ObfDereferenceObject","ZwCreateSection","KeNumberProcessors","ZwQueryInformationFile","ZwWriteFile","ObReferenceObjectByPointer","ObOpenObjectByPointer","KeStackAttachProcess","IoAllocateMdl","ZwQuerySystemInformation","KeBugCheckEx","IoCreateDevice","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","wcschr","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","ZwOpenKey","ZwSetValueKey","RtlFreeUnicodeString","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign","ValidFrom":"2009-11-18 10:00:00","ValidTo":"2019-03-18 10:00:00","Signature":"4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"04000000000125071df9af","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"f47739306d14722e670d9436eadb8e4f","SHA1":"457d9df00a652cb4c3356d00145d9528fc309172","SHA256":"bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7","SHA384":"b8b268a1bdf388be66a1c969b7b353cb2bbc9fad446049b7efa05a9ab3b714494e97f4d1ee1c0bae35bfd9bf6ef275b3"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2","ValidFrom":"2011-08-02 10:00:00","ValidTo":"2019-08-02 10:00:00","Signature":"aaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0400000000013189c64de1","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b3d3ff804abcd2e7686c126c98cc2c10","SHA1":"358391557c2b6213777e282ad8efe9c8112d1b0e","SHA256":"9467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca","SHA384":"936a127c2d468f5e4edb642c82bed11fb5df99b87cf34b8d7ddc136e979183d133dae715146d98c63af32186eb8d1bbd"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}},{"Subject":"BUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.","ValidFrom":"2015-11-27 15:16:51","ValidTo":"2016-11-27 15:16:51","Signature":"24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"11219873654df7d712c9fe7c2d374eefa7ab","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9d408b0c2e5a1520b0508a7b242c0a5d","SHA1":"a4c64020ee78bca379a16e301b527ff47862ee81","SHA256":"6db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e","SHA384":"96a2b733af62a8c25756513e6f0234767176a610a44536fb728b9879aeb4dadd79fd9d54b55becc727e7b8d0036e7bac"}}],"Signer":[{"SerialNumber":"11219873654df7d712c9fe7c2d374eefa7ab","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2","Version":1}]}]},{"Filename":"PSKMAD_64.sys","SHA256":"db6ffb4100bd35d491ff1c61fb3073049c2c18038d004a6d1e279a95ab8ba2ec","MD5":"f803473cd0e5d36d02eb58109f1294cd","SHA1":"afa8295865d8a9b1d35522bf2e49ced6f2294f4f","Imphash":"4cc218740b780c7d3e40804b184c2b5d","Authentihash":{"MD5":"96e50bd954df7b979be7da555fcb1941","SHA1":"bc2a5e5347cc2e9bc09bf269da5bf7ca1cd8bc15","SHA256":"897b1107e11dab0029bd31582a84a08e70e0f98aff3179b86cc5a0fabcec95b6"},"RichPEHeaderHash":{"MD5":"ef3d067a6fc8aaf14d02b0d9f1cc15e3","SHA1":"12994df17aa0c486650d12b437c6a69445ee5580","SHA256":"b682b41b221846f76894542c1ed0d433443707c3b99ad2afaa2ba95b87abefee"},"Sections":{".text":{"Entropy":6.296888562135902,"Virtual Size":"0x7dca"},".rdata":{"Entropy":4.79243012636001,"Virtual Size":"0xdb8"},".data":{"Entropy":1.1555997097317705,"Virtual Size":"0x4c0"},".pdata":{"Entropy":4.468379926624868,"Virtual Size":"0x564"},"PAGE":{"Entropy":6.261745860040305,"Virtual Size":"0x1e4c"},"INIT":{"Entropy":5.217336962118641,"Virtual Size":"0xcb6"},".rsrc":{"Entropy":3.322085599231794,"Virtual Size":"0x368"},".reloc":{"Entropy":1.2089679887091815,"Virtual Size":"0x6c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2015-05-22 02:31:12","Description":"Panda Kernel Memory Access Driver (x64)","Company":"Panda Security, S.L.","InternalName":"PSKMAD_64","OriginalFilename":"PSKMAD_64","FileVersion":"1.0.0.16","Product":"Panda Technologies","ProductVersion":"1.0.0.3700","Copyright":"© Panda 2015","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoWMIRegistrationControl","ExFreePoolWithTag","IoWMIWriteEvent","RtlInitUnicodeString","MmGetSystemRoutineAddress","IoGetCurrentProcess","IofCompleteRequest","RtlCompareMemory","sprintf","ZwCreateKey","ExInitializeNPagedLookasideList","IoDeleteDevice","RtlGetVersion","ZwQueryValueKey","ZwClose","RtlCharToInteger","IoCreateSymbolicLink","wcscspn","ExDeleteNPagedLookasideList","MmSystemRangeStart","MmUnmapLockedPages","PsProcessType","KeSetTargetProcessorDpc","KeQueryActiveProcessors","ZwFsControlFile","PsLookupProcessByProcessId","InitializeSListHead","ZwQuerySymbolicLinkObject","ZwSetEaFile","ZwReadFile","ZwMapViewOfSection","ExpInterlockedPushEntrySList","IoCreateFile","MmHighestUserAddress","KeInitializeDpc","KeAcquireQueuedSpinLock","ExpInterlockedPopEntrySList","KeReleaseQueuedSpinLock","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","ZwOpenSymbolicLinkObject","IoFreeMdl","ZwSetInformationFile","KeDetachProcess","KeDelayExecutionThread","MmGetPhysicalAddress","ZwWaitForSingleObject","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ZwUnmapViewOfSection","ZwQueryDirectoryFile","PsTerminateSystemThread","MmIsDriverVerifying","MmMapIoSpace","KeInsertQueueDpc","ZwQueryEaFile","ZwQueryVolumeInformationFile","ObReferenceObjectByHandle","MmProbeAndLockPages","KeRevertToUserAffinityThread","RtlEnumerateGenericTableAvl","MmUnlockPages","PsGetCurrentProcessId","KeSetSystemAffinityThread","MmIsAddressValid","ObfDereferenceObject","ZwCreateSection","KeNumberProcessors","ZwQueryInformationFile","ZwWriteFile","ObReferenceObjectByPointer","ObOpenObjectByPointer","KeStackAttachProcess","IoAllocateMdl","ZwQuerySystemInformation","KeBugCheckEx","IoCreateDevice","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","wcschr","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","ZwOpenKey","ZwSetValueKey","RtlFreeUnicodeString","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2015-01-14 21:31:25","ValidTo":"2016-04-14 21:31:25","Signature":"6285e319cd93cdbfa9ec995bc47fdeed4e31621fb94f9f16f5a59fb8bf40b0505236402f00491c6e04e1bd038d782b5b4f293cef521d23515d0b7a887566f976fe2d030d642c183c685b271b1048d1221270cc0fabce8a7404a8cffad985638f6795f93a1dd6c3f0e41fc127dbb9a423db4123559188c9e2b22f7eaf050520f62495c98a1eaa89b653ec29d6dcab6edbbd6e059698150611aaecc716071a9929c737c2be38639df5866d6a75495664f36c76431bab6c9a691b745516640ba37de6ec0c0f73c861dd63415fb387d6f638db87c6fa9a367d773cf51d67dcb50b1fb762360a27ef110ce853e604fb1c18606841c8025fe50ece666a0e7cbae169f2cb6e8552e875ae9534e48eab7d45f1737ef360c2ea87417460289a7ffd47f0f02926fcde5a9651ee492ce071c31c0637d18a5601ee903610d875c8ec0b793f08cde325da3a7b69dba7b157138cae71ed7f79ae3f1083b29a3a6392e260aa1452d6c607ba0392d9b972a7914c902c95cfbeaf95433d581f889cc7c3db6da5c4b646001d116b0d370793f8ed5210026b55d6594c07e28d555ccb3cb3a12331f8caec7ab669ffed9411385cdc43a80d85dd7ea08f5e1e4f02326a4d98c3bf6995f2b3fb044382ac7d9f6ea4d42b379630ae4846a2919a4215eaac5a331753e9f2d053c90cb41ef5ed3b1aca322b1012cb30621855734405c82c46565060d1134c6c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000000cd4840c29fd1712a000000000000c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"518cec47456b7d55c36f58bea9c68476","SHA1":"923bc6e21aaa6802adeb82ca7be7558e86eaa13f","SHA256":"6a24dbb4e4809ba56db48ae26fd75677d721c6b93f36e6310c2df699ca2f55f6","SHA384":"9d55360fd6374d0e4cbc351e9170e3303f5bc6b702a958cc7edf12a9870bf0039ee4cff9cd785b79158b0badf18c6240"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000000cd4840c29fd1712a000000000000c","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}