17a1ad58-ecf3-4dea-b1ca-336880d15256

f.sys :inline :inline

Description

Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.

  • UUID: 17a1ad58-ecf3-4dea-b1ca-336880d15256
  • Created: 2024-09-10
  • Author: Michael Haag
  • Acknowledgement: |

DownloadBlock

This download link contains the malicious driver!

Commands

sc.exe create f.sys binPath=C:\windows\temp\f.sys type=kernel && sc.exe start f.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/

    • Known Vulnerable Samples

    PropertyValue
    Filename
    Creation Timestamp2024-08-02 09:42:29
    MD57190f99ecf8bc3f4c496443ff1f9ee83
    SHA16ec298a9aff2708c3e28a8510e3735e841b14e06
    SHA25654942b92790dc0b84c56d4a00f3ac419b0a506344ca7e9f1fb666a86dbc4117f
    Authentihash MD51f679ab07e74f82c9f2f606109d55052
    Authentihash SHA12801aa69e63680b9691e6c5064eab8c957069144
    Authentihash SHA25625819a8c8f2ebceef661d751a56a024a5584f8283d9600273e52d18923c9f455
    RichPEHeaderHash MD5ffdf660eb1ebf020a1d0a55a90712dfb
    RichPEHeaderHash SHA13e905e3d061d0d59de61fcf39c994fcb0ec1bab3
    RichPEHeaderHash SHA2562b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6

    Download

    Certificates

    Expand
    Certificate 0cea5c41b4b35660b883ba06def5a053
    FieldValue
    ToBeSigned (TBS) MD58234dd5e8208c4d458a23e9adaf32110
    ToBeSigned (TBS) SHA1fe7bb159aea2f724db4f960db7843af9e9525b9c
    ToBeSigned (TBS) SHA256a540e6d68222208f67266bfbe6f316d6dc457345079f9f746a33c05fcdbc39be
    SubjectC=CN, ST=Jiangxi, L=Ji'an, O=AnFu NetShield Technology Co., Ltd., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=AnFu NetShield Technology Co., Ltd.
    ValidFrom2014-03-25 00:00:00
    ValidTo2015-03-25 23:59:59
    Signature5a01f1b2c2b239ba6d7284a0bf17a26b32e8299d93793405c26475bb92e58e7b29b3edbda43d228db29539949769642ff14234a33590853db88f15181f76da5022b1519e7e332021a704cc1f97f78dfc89b15343c1dc3daa15f6d3f28bc11d068dab6f783cba2a42bbc9904b3087074859110484afc185cb1d61c4046581ad25b20cb31a0ae22de8f3f5bb37404eece6864d88a73342a43d68de57c28f35b4d8123150ff36570471c3d46642727cc943aebecb77752c871e8ef34174de9a912fd65fbfdbfe898ad21d3b6b397516cc0279622d28380e6abd5c6a1fbf1d0213cb90f7f5c4d0153e86eed28d6047f56b888384f57d71057e56f1eba78054cdeee9
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0cea5c41b4b35660b883ba06def5a053
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3
    Certificate 7a23aeda5369960f91c83e5cf4c7e33f
    FieldValue
    ToBeSigned (TBS) MD5755ba7f8d47fb9d82d06aca64d85a6b0
    ToBeSigned (TBS) SHA1aa31b174f9264f55abfe9c750555ba11e3558222
    ToBeSigned (TBS) SHA256a8ed8f8a0ffe4dfc35837080540e5d3f8924884ce714c71c8aa883b863efe9ac
    SubjectC=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping CA R36
    ValidFrom2021-03-22 00:00:00
    ValidTo2036-03-21 23:59:59
    Signature12d77b20ad0e35580c9e811d2558fd4c2d6774afc7622621f6555469c6a14686765b685f8843b2404c671e4d6392fa4827300cc6611ce99bc8c872395243c26d72aca62a1831d6ce9c1590527ef7dea328a017c8821a51fe4954a8dc71ebf7c35ea6348525353929244a2bede75525989125508099601a1dcc3dccfd21637823f9f5a9f0c6cea1c23d667efcc6f9bd5ca181a7aac4b3db048aafe9c33be0dbf2a35c4db2594408926b3afb2b25091a8d5cf8c49c19f1b940757e6e9b3c057e4ecaff42b77e98e0897a6a34ea57689f8a4915b41dd1341520c2efe64a249489c7bf269feaf01324fe037cfb4acd204f90a94eb726854c08c3d8dbbe762e6112b11555a32a4956df3f377a90d5ce8589b6dc45a6e8ddacd991c21d58655201da0b80023110a05e361f4040ed6042b9e1d5303c95d5ee2733d2b802cecf55236f43c2c8d5645a4ee19215477dcbc17c8f0db60590ba989a01e3477b4a564861f6a295d960a606e0b6ee920ec7a4d8bf2aa261b9ed8a79a93aa87f40f02784381ec4a1bd197fe7d4f8209068bd1c26a9669f1f47083c45fb704b6d4b9fad5eb811b4c8e34cea7a03d9740fac5c299b719cbaa24c7f4a3c2cbac59122d140dc313c30e4597856fa066cc1b6a289ee5f77f5b6ca072da3bf170923df156bde50e499e52a8af79b413bc6931e611ae25a49543ec7ad3127f636f5106bf139bd5c9e7d02
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber7a23aeda5369960f91c83e5cf4c7e33f
    Version3
    Certificate 3a526a2c84ce55e61d65fccc12d8e989
    FieldValue
    ToBeSigned (TBS) MD5c4fb7295227e67e7bf819f64ec5d112f
    ToBeSigned (TBS) SHA1c35ad183fbdf95a482ee304c71e2a0c4ded6ae0a
    ToBeSigned (TBS) SHA256b23e839b27d445a46c916ea9331b1131e24550b023697f6041b2e446176a6059
    SubjectC=GB, ST=Manchester, O=Sectigo Limited, CN=Sectigo Public Time Stamping Signer R35
    ValidFrom2024-01-15 00:00:00
    ValidTo2035-04-14 23:59:59
    Signatureb0dc2ec9fa4f364c8a2ff6c94fd5ef184f1f9f0ec6bffe127ad98e9232bd84f3daeff36cbf9fcc1ee56eb3e697c1116a33956ee75a9fac74f09d513170fd841caafb211fa6fd46fb3da99a7967e57b9c7c0f4c7f32ccac202b34d31b52355c45cb00af5f1e7997a5a0de55e23c2ba2f0de2ce759974b41edf397e45e8ddab99768d4ee251f324b617e11668be55560f911fc15e957b51bd50cb259e6ea923487247466bf794161b432934f3f4bb4e521e3abf6243e50de7b7c9838408d32a9d9fa3f289e852d674a02f0291b38e93f00ea15e24a7fe90976804a776cd0bb0ce4e5682987db80e3a5582bca7f0532496a1282b867722852057c47da902e0d5dafafc18e08469e3d97340f2e8ed6b6272a31a6aa6fc844d90982148c8b3af588838f37edb77eeb415c0866c7c262ff83539b21fd2b452f5c78ae0363dadf0671c51f6bf577885156f657c82565acbed942e5738e390b30af552655d35641e9b82f0ae52e071d3bf6009c7a98e764309c12e202e527b817ac85699f11be6889e218
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityFalse
    SerialNumber3a526a2c84ce55e61d65fccc12d8e989
    Version3
    Certificate 36c2b0bd7c1b3ae7a3b3dd36cbc97568
    FieldValue
    ToBeSigned (TBS) MD5c06edb294c1f02cb85226fe5ef0bb876
    ToBeSigned (TBS) SHA1349f753dffc4e1ef7a6aa00c64c5e1c1aaeb1586
    ToBeSigned (TBS) SHA2562527985bdd90b23ebf85bdfec39de37b9d6a10a44a4116fca078e609adcdd95a
    SubjectC=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping Root R46
    ValidFrom2021-03-22 00:00:00
    ValidTo2038-01-18 23:59:59
    Signature0ebe6541ed6844b8e5a1c5d41187e4b73b258ceb7edac81791edd8f143c4a28539cb7f6b00045a01d03151e897d64b4b277fa5831b682d0867e5c15bdc61764926515fca6d43a22fb83df0cff2cd1caa50e675fc863b032d186cc9e22226c9acf720169ef75839d10cab55bad4a13d265064076d1705e7ba25a5f1e14044adcf98ba849bd52c557fb9e436d5233df731b85b6b41d44c462fdf22757f0286c4f06c3ff3204c40a29a1ede5e89af326d3f18fc57dae87009cb3f60bc439c1755565c6f0e31e33b572ec1b3a99222461e62d75d535bb1d5d40b6c41aeaf5f2eb7def0806c038868a70b028fc853bb0297265493ad970f45549c70fe62f54dbc819ece333a091a5c59e77f3838a9b4af9ebc328f5362bab329e299805a347e3dbfd221db8f9e61736d237f1bcade6422f87ef1a5bcf164e1469bfc95424a68f9f7efe60761a7e86fd460ecbc93ad2629c99a019b0456484e16ea23e307bc098c9a47dbddf4f1992928a7699224bd58db1ffde794b6f46bb481224891cdf3df4bd4fe25eb3295b1dad4bb5157d53fee6d2aecc6b6090feddfdda2a0eb2c5d6ee828b74e98c065d78b2e5450666f3aede55e5c40f9f0b5ddd4393a52f68086f996617a222f3e0903980f05ccfb277d75b9a8710b078dc44fb1c71477913d162b3012a391bf3f20decfa34774850a05e1378c33ecd8009ce82909d528e2e0f296553d3f
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber36c2b0bd7c1b3ae7a3b3dd36cbc97568
    Version3

    Imports

    Expand
    • NETIO.SYS
    • ntoskrnl.exe

    Imported Functions

    Expand
    • WskCaptureProviderNPI
    • WskDeregister
    • WskRegister
    • strstr
    • RtlInitAnsiString
    • RtlInitUnicodeString
    • RtlDeleteRegistryValue
    • RtlAnsiStringToUnicodeString
    • RtlFreeUnicodeString
    • DbgPrintEx
    • ExAllocatePool
    • ExAllocatePoolWithTag
    • ExFreePoolWithTag
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • IoAllocateMdl
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoFreeMdl
    • ObfDereferenceObject
    • ZwClose
    • ZwOpenKey
    • ZwDeleteKey
    • MmIsAddressValid
    • RtlFindExportedRoutineByName
    • ObReferenceObjectByName
    • __C_specific_handler
    • IoDriverObjectType
    • PsLoadedModuleList
    • MmGetSystemRoutineAddress
    • RtlGetVersion
    • PsGetProcessExitStatus
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • SeLocateProcessImageName
    • PsReferencePrimaryToken
    • PsLookupProcessByProcessId
    • ZwAllocateVirtualMemory
    • MmCopyVirtualMemory
    • PsGetProcessWow64Process
    • PsGetProcessImageFileName
    • PsGetProcessPeb
    • PsReferenceProcessFilePointer
    • wcsstr
    • KeInitializeEvent
    • KeSetEvent
    • KeWaitForSingleObject
    • IoAllocateIrp
    • IofCallDriver
    • IoFreeIrp
    • IoGetCurrentProcess
    • IoGetRelatedDeviceObject
    • IoSetCompletionRoutineEx
    • ObReferenceObjectByHandle
    • ZwOpenFile
    • ZwQueryValueKey
    • IoFileObjectType
    • RtlCompareUnicodeString
    • RtlEqualUnicodeString
    • DbgPrint
    • MmUnmapLockedPages
    • MmAllocateContiguousMemorySpecifyCache
    • MmGetVirtualForPhysical
    • PsGetProcessId
    • PsInitialSystemProcess
    • sprintf
    • KeLowerIrql
    • KfRaiseIrql
    • KeEnterGuardedRegion
    • KeLeaveGuardedRegion

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .'M
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0cea5c41b4b35660b883ba06def5a053",
      "Signature": "5a01f1b2c2b239ba6d7284a0bf17a26b32e8299d93793405c26475bb92e58e7b29b3edbda43d228db29539949769642ff14234a33590853db88f15181f76da5022b1519e7e332021a704cc1f97f78dfc89b15343c1dc3daa15f6d3f28bc11d068dab6f783cba2a42bbc9904b3087074859110484afc185cb1d61c4046581ad25b20cb31a0ae22de8f3f5bb37404eece6864d88a73342a43d68de57c28f35b4d8123150ff36570471c3d46642727cc943aebecb77752c871e8ef34174de9a912fd65fbfdbfe898ad21d3b6b397516cc0279622d28380e6abd5c6a1fbf1d0213cb90f7f5c4d0153e86eed28d6047f56b888384f57d71057e56f1eba78054cdeee9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Jiangxi, L=Ji\u0027an, O=AnFu NetShield Technology Co., Ltd., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=AnFu NetShield Technology Co., Ltd.",
      "TBS": {
        "MD5": "8234dd5e8208c4d458a23e9adaf32110",
        "SHA1": "fe7bb159aea2f724db4f960db7843af9e9525b9c",
        "SHA256": "a540e6d68222208f67266bfbe6f316d6dc457345079f9f746a33c05fcdbc39be",
        "SHA384": "69e7b5f20ea37e73cfb9a208fd1e384969339e81e1a55acca650c81f84b7ae24c2e244b1e751e71cfe3ca4855d862c97"
      },
      "ValidFrom": "2014-03-25 00:00:00",
      "ValidTo": "2015-03-25 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7a23aeda5369960f91c83e5cf4c7e33f",
      "Signature": "12d77b20ad0e35580c9e811d2558fd4c2d6774afc7622621f6555469c6a14686765b685f8843b2404c671e4d6392fa4827300cc6611ce99bc8c872395243c26d72aca62a1831d6ce9c1590527ef7dea328a017c8821a51fe4954a8dc71ebf7c35ea6348525353929244a2bede75525989125508099601a1dcc3dccfd21637823f9f5a9f0c6cea1c23d667efcc6f9bd5ca181a7aac4b3db048aafe9c33be0dbf2a35c4db2594408926b3afb2b25091a8d5cf8c49c19f1b940757e6e9b3c057e4ecaff42b77e98e0897a6a34ea57689f8a4915b41dd1341520c2efe64a249489c7bf269feaf01324fe037cfb4acd204f90a94eb726854c08c3d8dbbe762e6112b11555a32a4956df3f377a90d5ce8589b6dc45a6e8ddacd991c21d58655201da0b80023110a05e361f4040ed6042b9e1d5303c95d5ee2733d2b802cecf55236f43c2c8d5645a4ee19215477dcbc17c8f0db60590ba989a01e3477b4a564861f6a295d960a606e0b6ee920ec7a4d8bf2aa261b9ed8a79a93aa87f40f02784381ec4a1bd197fe7d4f8209068bd1c26a9669f1f47083c45fb704b6d4b9fad5eb811b4c8e34cea7a03d9740fac5c299b719cbaa24c7f4a3c2cbac59122d140dc313c30e4597856fa066cc1b6a289ee5f77f5b6ca072da3bf170923df156bde50e499e52a8af79b413bc6931e611ae25a49543ec7ad3127f636f5106bf139bd5c9e7d02",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping CA R36",
      "TBS": {
        "MD5": "755ba7f8d47fb9d82d06aca64d85a6b0",
        "SHA1": "aa31b174f9264f55abfe9c750555ba11e3558222",
        "SHA256": "a8ed8f8a0ffe4dfc35837080540e5d3f8924884ce714c71c8aa883b863efe9ac",
        "SHA384": "a9a2bf0749c796981278c7e8c4a80312048da6ce75adb20b9a114ee4b208683d0b41c141023ff5a7a18afc81f03e65ee"
      },
      "ValidFrom": "2021-03-22 00:00:00",
      "ValidTo": "2036-03-21 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "3a526a2c84ce55e61d65fccc12d8e989",
      "Signature": "b0dc2ec9fa4f364c8a2ff6c94fd5ef184f1f9f0ec6bffe127ad98e9232bd84f3daeff36cbf9fcc1ee56eb3e697c1116a33956ee75a9fac74f09d513170fd841caafb211fa6fd46fb3da99a7967e57b9c7c0f4c7f32ccac202b34d31b52355c45cb00af5f1e7997a5a0de55e23c2ba2f0de2ce759974b41edf397e45e8ddab99768d4ee251f324b617e11668be55560f911fc15e957b51bd50cb259e6ea923487247466bf794161b432934f3f4bb4e521e3abf6243e50de7b7c9838408d32a9d9fa3f289e852d674a02f0291b38e93f00ea15e24a7fe90976804a776cd0bb0ce4e5682987db80e3a5582bca7f0532496a1282b867722852057c47da902e0d5dafafc18e08469e3d97340f2e8ed6b6272a31a6aa6fc844d90982148c8b3af588838f37edb77eeb415c0866c7c262ff83539b21fd2b452f5c78ae0363dadf0671c51f6bf577885156f657c82565acbed942e5738e390b30af552655d35641e9b82f0ae52e071d3bf6009c7a98e764309c12e202e527b817ac85699f11be6889e218",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=GB, ST=Manchester, O=Sectigo Limited, CN=Sectigo Public Time Stamping Signer R35",
      "TBS": {
        "MD5": "c4fb7295227e67e7bf819f64ec5d112f",
        "SHA1": "c35ad183fbdf95a482ee304c71e2a0c4ded6ae0a",
        "SHA256": "b23e839b27d445a46c916ea9331b1131e24550b023697f6041b2e446176a6059",
        "SHA384": "8bae85d4d479e247f759fdcd83aa11d76b33e9c71b225571cf49ddf738c07b01cea34e886927b68110bcc2f4e2711b19"
      },
      "ValidFrom": "2024-01-15 00:00:00",
      "ValidTo": "2035-04-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "36c2b0bd7c1b3ae7a3b3dd36cbc97568",
      "Signature": "0ebe6541ed6844b8e5a1c5d41187e4b73b258ceb7edac81791edd8f143c4a28539cb7f6b00045a01d03151e897d64b4b277fa5831b682d0867e5c15bdc61764926515fca6d43a22fb83df0cff2cd1caa50e675fc863b032d186cc9e22226c9acf720169ef75839d10cab55bad4a13d265064076d1705e7ba25a5f1e14044adcf98ba849bd52c557fb9e436d5233df731b85b6b41d44c462fdf22757f0286c4f06c3ff3204c40a29a1ede5e89af326d3f18fc57dae87009cb3f60bc439c1755565c6f0e31e33b572ec1b3a99222461e62d75d535bb1d5d40b6c41aeaf5f2eb7def0806c038868a70b028fc853bb0297265493ad970f45549c70fe62f54dbc819ece333a091a5c59e77f3838a9b4af9ebc328f5362bab329e299805a347e3dbfd221db8f9e61736d237f1bcade6422f87ef1a5bcf164e1469bfc95424a68f9f7efe60761a7e86fd460ecbc93ad2629c99a019b0456484e16ea23e307bc098c9a47dbddf4f1992928a7699224bd58db1ffde794b6f46bb481224891cdf3df4bd4fe25eb3295b1dad4bb5157d53fee6d2aecc6b6090feddfdda2a0eb2c5d6ee828b74e98c065d78b2e5450666f3aede55e5c40f9f0b5ddd4393a52f68086f996617a222f3e0903980f05ccfb277d75b9a8710b078dc44fb1c71477913d162b3012a391bf3f20decfa34774850a05e1378c33ecd8009ce82909d528e2e0f296553d3f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping Root R46",
      "TBS": {
        "MD5": "c06edb294c1f02cb85226fe5ef0bb876",
        "SHA1": "349f753dffc4e1ef7a6aa00c64c5e1c1aaeb1586",
        "SHA256": "2527985bdd90b23ebf85bdfec39de37b9d6a10a44a4116fca078e609adcdd95a",
        "SHA384": "24919e38eafa7d09214d6cba68eb2c772ea0c02b7918c2657f6dbffb19356515c563eaee1136512c36cfe781b268afef"
      },
      "ValidFrom": "2021-03-22 00:00:00",
      "ValidTo": "2038-01-18 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "0cea5c41b4b35660b883ba06def5a053",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2025-01-13