{"Id":"7bb5ff05-25f8-410d-ae99-c8e8f082d24f","Tags":["WinRing0.sys","WinRing0x64","OpenHardwareMonitorLib.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create WinRing0.sys binPath=C:\\windows\\temp\\WinRing0.sys type=kernel && sc.exe start WinRing0.sys","Description":"OpenLibSys WinRing0 hardware-access drivers expose MSR, I/O-port, and physical-memory operations to user mode. Attackers can abuse these primitives for kernel-memory access and security-control tampering.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/namazso/physmem_drivers","https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md","https://github.com/fluffycats31/vulnerable-drivers","https://aka.ms/VulnerableDriverBlockList"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8.yara"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84.yara"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"650fa4b522e8d06d0cdfa4bf278e85f1","SHA1":"dfe2533a4398d67dfc722eb8d9f8ffa3a823a721","SHA256":"7188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3"},"Company":"OpenLibSys.org","Copyright":"Copyright (C) 2007 OpenLibSys.org. All rights reserved.","CreationTimestamp":"2007-12-15 03:04:52","Date":"","Description":"WinRing0","ExportedFunctions":"","FileVersion":"1.0.1.2","Filename":"WinRing0.sys","ImportedFunctions":["MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","IoDeleteDevice","IoCreateDevice","KeBugCheckEx","RtlInitUnicodeString","IoCreateSymbolicLink","IoDeleteSymbolicLink","__C_specific_handler","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"WinRing0.sys","MD5":"828bb9cb1dd449cd65a29b18ec46055f","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"WinRing0.sys","Product":"WinRing0","ProductVersion":"1.0.1.2","Publisher":"","RichPEHeaderHash":{"MD5":"6c9272bb390e89b75934eea3b15a1858","SHA1":"16dab615286d22f060143bb9316a28122f8e4d1b","SHA256":"4a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a"},"SHA1":"558aad879b6a47d94a968f39d0a4e3a3aaef1ef1","SHA256":"3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8","Sections":{".text":{"Entropy":6.02563890741647,"Virtual Size":"0x796"},".rdata":{"Entropy":4.1567602868650235,"Virtual Size":"0x190"},".data":{"Entropy":0.5096713223407059,"Virtual Size":"0x114"},".pdata":{"Entropy":3.2625699366690815,"Virtual Size":"0x6c"},"INIT":{"Entropy":4.864582637105269,"Virtual Size":"0x222"},".rsrc":{"Entropy":3.2650956402233735,"Virtual Size":"0x3b0"}},"Signature":["TOSHIBA AMERICA INFORMATION SYSTEMS, INC.","VeriSign Class 3 Code Signing 2004 CA","VeriSign Class 3 Public Primary CA"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","ValidFrom":"2004-07-16 00:00:00","ValidTo":"2014-07-15 23:59:59","Signature":"ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"4191a15a3978dfcf496566381d4c75c2","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"41011f8d0e7c7a6408334ca387914c61","SHA1":"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5","SHA256":"88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0","SHA384":"a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"}},{"Subject":"C=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.","ValidFrom":"2006-11-30 00:00:00","ValidTo":"2010-01-29 23:59:59","Signature":"35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"450d3382b4c87b8d7220cff8951f1aa2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"dfda998e348c0cd822de571eefd95842","SHA1":"873c99b0c3d5715130af541dcaed94e096c665b3","SHA256":"747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6","SHA384":"0a5669530912b1b0e566b775057dfe6f8b8611a780e59eaae90d95dfa3d36ae7cc509713e739453471cded2cf6807d86"}}],"Signer":[{"SerialNumber":"450d3382b4c87b8d7220cff8951f1aa2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA","Version":1}]}],"Imphash":"d6f977640d4810a784d152e4d3c63a6b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"650fa4b522e8d06d0cdfa4bf278e85f1","SHA1":"dfe2533a4398d67dfc722eb8d9f8ffa3a823a721","SHA256":"7188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3"},"Company":"OpenLibSys.org","Copyright":"Copyright (C) 2007 OpenLibSys.org. All rights reserved.","CreationTimestamp":"2007-12-15 03:04:52","Date":"","Description":"WinRing0","ExportedFunctions":"","FileVersion":"1.0.1.2","Filename":"WinRing0.sys","ImportedFunctions":["MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","IoDeleteDevice","IoCreateDevice","KeBugCheckEx","RtlInitUnicodeString","IoCreateSymbolicLink","IoDeleteSymbolicLink","__C_specific_handler","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"WinRing0.sys","MD5":"12cecc3c14160f32b21279c1a36b8338","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"WinRing0.sys","Product":"WinRing0","ProductVersion":"1.0.1.2","Publisher":"","RichPEHeaderHash":{"MD5":"6c9272bb390e89b75934eea3b15a1858","SHA1":"16dab615286d22f060143bb9316a28122f8e4d1b","SHA256":"4a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a"},"SHA1":"7fb52290883a6b69a96d480f2867643396727e83","SHA256":"47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84","Sections":{".text":{"Entropy":6.02563890741647,"Virtual Size":"0x796"},".rdata":{"Entropy":4.1567602868650235,"Virtual Size":"0x190"},".data":{"Entropy":0.5096713223407059,"Virtual Size":"0x114"},".pdata":{"Entropy":3.2625699366690815,"Virtual Size":"0x6c"},"INIT":{"Entropy":4.864582637105269,"Virtual Size":"0x222"},".rsrc":{"Entropy":3.2650956402233735,"Virtual Size":"0x3b0"}},"Signature":["Noriyuki MIYAZAKI","GlobalSign ObjectSign CA","GlobalSign Primary Object Publishing CA","GlobalSign Root CA - R1"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=JP, CN=Noriyuki MIYAZAKI, emailAddress=hiyohiyo@crystalmark.info","ValidFrom":"2007-09-24 10:50:55","ValidTo":"2008-09-24 10:50:55","Signature":"4b6c4ea808b550cbae0f97c27726a0445d0e3e021ee0e0087bfe5bbc290e3e45ca35333f2a97fb7667f64326629f7a99fe2fec4da9fe14f0d858419982b983457848fbd6a9115769db6c5626b4d2f87fc77019a755a9efdf81b1968dfbfa638bf87bd25a8adf1c6c3bba3735f06b54d127462ed40dc364ad4c4f29c9f9692b29ff9557300a7c0d395f250172e312ff253b7ce8885ef8c1fe60c448676180e4ca09b34b52ae116b01f22b446b827a748ca80aee5f8e9ff6725e1dce5a7984c26eb72a615a9ef272f6f7b2e03e6d34665caf506b93cb5a2de127177eb1923cf5bc499e312d6c43ff5a26124ea63a4dc9a3340daa6449c2322857adf98166423cfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"01000000000115372421a8","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c11203d7c1fcb38e1eaff246bb8e7595","SHA1":"99f00de6eefb2076662465e682a2429373ebcb26","SHA256":"08a073aa77d42d608a9457a6b1d63eadcf5113407d8a55025ea1bbef0716dca5","SHA384":"ef57f44999a39185b9ebf97894ce5a3cca2894e15bc0733a865501c3a41ea9054be5d7517aa59006b04a853cadbed567"}},{"Subject":"CN=GlobalSign RootSign Partners CA, OU=RootSign Partners CA, O=GlobalSign nv,sa, C=BE","ValidFrom":"2003-12-16 13:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"5c2f2e674a26b3e7b53f353cdda003ed569af9443752163065c7d14ea20f8db7b6b6678ee74cec8d95bee6cea7227874acd7f87499b3f7ce8b1338d596cc8d76c52f38b23aae61be0b8799e321626423398d84f6858df777ffb03806f07ec1485fb5ee582606660522749283a7dbb5f992e3e8c3192c2e63efbb1fdff9f70747660d0789977ef8332c9ecbae143df11cdfa3f179afc8928f9471c4d144c554db1eb50b0aa942a3afd643391dee8f9398585bbe6e9c0bf563ec5e99c2f954fa010746da0db06424cf8ed1061d4f3ca26377455ba4bc5fb080bb31e00b54015c161d724ed52a6947d11b667e5f016ef135916be02efeb045d81627b5c58bc2da53","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"040000000000f97faa2e1e","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"59466cb0c1788b2f251fce3495837102","SHA1":"c5cfc5f6a131a3a77c3905c9893c99bb1b2baa0b","SHA256":"eedda02668f7636eeec69429a7164cc47ca3de0539122d37f5b8078df7ee56db","SHA384":"982b72c3ee7066ce80ee642444c91adc60e7009fc6ef981a32edf666591d6aedb09d258e10e86f4ef265eae8149bbd92"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"O=GlobalSign, CN=GlobalSign Time Stamping Authority, emailAddress=timestampinfo@globalsign.com","ValidFrom":"2007-02-05 09:00:00","ValidTo":"2014-01-27 09:00:00","Signature":"649b07caaccc411e37ef6f349cb5e8ca48f9daeafaf7172e5cad193b7311ec5adbfd7b213161c092515bb166b07c64d8fe10b471a8bc9e75379c5f6ff2da0437b8ecc003e256b7785995581d7a7c3e18d74c32bdf91ee723457fdee08d65825b45fd64c66fc3d7ea12411d0c395ef696f8c3cd9e1fff51886976988b8eb42788821ad63c7aabb04eb73ee8d434d2c1a439533cb2747b15373054a6ebb924cc2f084b4364f14aaf8d9ce8546cb2dbdc3bb1c722849f558e72a8b2a8f6f0ff03c996ebab8273dabe45561936fdba6cbc71f0d3c7c376d7e4bce2a1a67200cfbdb200ed92aa39ab09d16e3953862ad43b517398b754e9972d9977ee123e3642257f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000011092eb8295","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"11d73a3638fc78e0bac6c459feadcc42","SHA1":"6636f7dcf81b370b919966f9063295ec84422f91","SHA256":"1eb5fc1d2e3254b1e3c4587a6efed87ee65306525e684b4cfa4b51893cfe86a3","SHA384":"a13c07e505c79c58654ad2cffe219c6c801fa092c52f18c489a6061420c6475706f11c200f4dadd51718c660e49b3f24"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"01000000000115372421a8","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"d6f977640d4810a784d152e4d3c63a6b","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"c4355451eccb590e5e6d817760d2d2ef","SHA1":"7aed8186977fcf7ee219da493baecdb95ec8040d","SHA256":"9305f0834e67aa16fb252bd30927e5f835639ef4b868f20d232260edffefd6f0"},"Company":"OpenLibSys.org","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","CreationTimestamp":"2013-05-01 22:19:47","Date":"","Description":"WinRing0","ExportedFunctions":"","FileVersion":"1.2.0.5","Filename":"WinRing0.sys","ImportedFunctions":["MmUnmapIoSpace","MmMapIoSpace","IofCompleteRequest","IoDeleteDevice","IoCreateDevice","KeBugCheckEx","RtlInitUnicodeString","IoCreateSymbolicLink","IoDeleteSymbolicLink","__C_specific_handler","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"WinRing0.sys","MD5":"27bcbeec8a466178a6057b64bef66512","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"WinRing0.sys","Product":"WinRing0","ProductVersion":"1.2.0.5","Publisher":"","RichPEHeaderHash":{"MD5":"bc02c8d775721faba8edc4cde3e2f975","SHA1":"0b5efeae6fcaa45d68933a6570412dea379750b9","SHA256":"0d456f914c7a3a9b70f1a5ba7320682340381f11e9373de2d2d1585fe23e8a8e"},"SHA1":"012db3a80faf1f7f727b538cbe5d94064e7159de","SHA256":"a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062","Sections":{".text":{"Entropy":5.995968257191882,"Virtual Size":"0x796"},".rdata":{"Entropy":4.182802481161083,"Virtual Size":"0x19c"},".data":{"Entropy":0.5096713223407059,"Virtual Size":"0x114"},".pdata":{"Entropy":3.276775635503942,"Virtual Size":"0x78"},"INIT":{"Entropy":5.031588684181026,"Virtual Size":"0x242"},".rsrc":{"Entropy":3.2858216134068057,"Virtual Size":"0x3c0"}},"Signature":["EVGA","VeriSign Class 3 Code Signing 2010 CA","VeriSign"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Brea, O=EVGA, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=EVGA","ValidFrom":"2012-02-29 00:00:00","ValidTo":"2014-04-15 23:59:59","Signature":"d77d9dbdeea6d42d15335f0b16117963e49d39b89af081160a467824968e611f0947648a83375d1380acca6cbe1117f488b428bcab943b20dad29e72dd48e7d01b080b12c444727bba415a098799abd5e5673dd7eda91787920c3cc53aac068e0a3d1faef713c14f7ec6f68f69a33340b70e81083db2ce1daf45592063235d05232a1d3d8052fc3f102b2b71e1c46275eff3d4a2dc5ee0d5d727d180da205055a3709a32ad6bd11317b1f109e7c5eca18c8293c937ba6f76278bc306c10f0f1bc865cedcf2c2331e7a7f5c0bcfab91786b8ff848d8ef9c59937ddb94f6369884162148f882e7d0c4343538ad23aeb6ab3db0f6d125a8e2fe3889e40ed66bc66a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"26d7f5563eb3e42a81f7c715fcd2799d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"e994671d8d440b7739cdd9775bbca72f","SHA1":"ea9446b39b968aa6953e1bf74a36435759b3d2e3","SHA256":"37a9886a67c19d644c74505801f947d3b2756a5540cbd89a0c8d500511cb838d","SHA384":"41d34e73f1b002f885c80004e3c366299392258ce5ba880150875ed8811ebc9913dc34cdf7c9800a8303dd512207787c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"26d7f5563eb3e42a81f7c715fcd2799d","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Imphash":"d6f977640d4810a784d152e4d3c63a6b","LoadsDespiteHVCI":"TRUE"},{"Authentihash":{"MD5":"2bab314d894a026ac6073efe43c14a3d","SHA1":"266821a39174d29f6f8791cf9f44f1a1f3439dda","SHA256":"1b845e5e43ce9e9b645ac198549e81f45c08197aad69708d96cdb9a719eb0e29"},"Company":"OpenLibSys.org","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","CreationTimestamp":"2008-07-26 09:29:37","Date":"","Description":"WinRing0","ExportedFunctions":"","FileVersion":"1.2.0.5","Filename":"WinRing0x64.sys","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IoDeleteDevice","IoCreateDevice","MmMapIoSpace","KeBugCheckEx","IoCreateSymbolicLink","MmUnmapIoSpace","IofCompleteRequest","__C_specific_handler","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"WinRing0.sys","MD5":"0c0195c48b6b8582fa6f6373032118da","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"WinRing0.sys","Product":"WinRing0","ProductVersion":"1.2.0.5","Publisher":"","RichPEHeaderHash":{"MD5":"6c9272bb390e89b75934eea3b15a1858","SHA1":"16dab615286d22f060143bb9316a28122f8e4d1b","SHA256":"4a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a"},"SHA1":"d25340ae8e92a6d29f599fef426a2bc1b5217299","SHA256":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","Sections":{".text":{"Entropy":5.985778783373138,"Virtual Size":"0x6c6"},".rdata":{"Entropy":4.1187644683409586,"Virtual Size":"0x17c"},".data":{"Entropy":0.5096713223407059,"Virtual Size":"0x114"},".pdata":{"Entropy":3.180043880366087,"Virtual Size":"0x60"},"INIT":{"Entropy":4.880913698813426,"Virtual Size":"0x222"},".rsrc":{"Entropy":3.2858216134068057,"Virtual Size":"0x3c0"}},"Signature":["Noriyuki MIYAZAKI","GlobalSign ObjectSign CA","GlobalSign Primary Object Publishing CA","GlobalSign Root CA - R1"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=JP, CN=Noriyuki MIYAZAKI, emailAddress=hiyohiyo@crystalmark.info","ValidFrom":"2007-09-24 10:50:55","ValidTo":"2008-09-24 10:50:55","Signature":"4b6c4ea808b550cbae0f97c27726a0445d0e3e021ee0e0087bfe5bbc290e3e45ca35333f2a97fb7667f64326629f7a99fe2fec4da9fe14f0d858419982b983457848fbd6a9115769db6c5626b4d2f87fc77019a755a9efdf81b1968dfbfa638bf87bd25a8adf1c6c3bba3735f06b54d127462ed40dc364ad4c4f29c9f9692b29ff9557300a7c0d395f250172e312ff253b7ce8885ef8c1fe60c448676180e4ca09b34b52ae116b01f22b446b827a748ca80aee5f8e9ff6725e1dce5a7984c26eb72a615a9ef272f6f7b2e03e6d34665caf506b93cb5a2de127177eb1923cf5bc499e312d6c43ff5a26124ea63a4dc9a3340daa6449c2322857adf98166423cfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"01000000000115372421a8","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c11203d7c1fcb38e1eaff246bb8e7595","SHA1":"99f00de6eefb2076662465e682a2429373ebcb26","SHA256":"08a073aa77d42d608a9457a6b1d63eadcf5113407d8a55025ea1bbef0716dca5","SHA384":"ef57f44999a39185b9ebf97894ce5a3cca2894e15bc0733a865501c3a41ea9054be5d7517aa59006b04a853cadbed567"}},{"Subject":"CN=GlobalSign RootSign Partners CA, OU=RootSign Partners CA, O=GlobalSign nv,sa, C=BE","ValidFrom":"2003-12-16 13:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"5c2f2e674a26b3e7b53f353cdda003ed569af9443752163065c7d14ea20f8db7b6b6678ee74cec8d95bee6cea7227874acd7f87499b3f7ce8b1338d596cc8d76c52f38b23aae61be0b8799e321626423398d84f6858df777ffb03806f07ec1485fb5ee582606660522749283a7dbb5f992e3e8c3192c2e63efbb1fdff9f70747660d0789977ef8332c9ecbae143df11cdfa3f179afc8928f9471c4d144c554db1eb50b0aa942a3afd643391dee8f9398585bbe6e9c0bf563ec5e99c2f954fa010746da0db06424cf8ed1061d4f3ca26377455ba4bc5fb080bb31e00b54015c161d724ed52a6947d11b667e5f016ef135916be02efeb045d81627b5c58bc2da53","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"040000000000f97faa2e1e","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"59466cb0c1788b2f251fce3495837102","SHA1":"c5cfc5f6a131a3a77c3905c9893c99bb1b2baa0b","SHA256":"eedda02668f7636eeec69429a7164cc47ca3de0539122d37f5b8078df7ee56db","SHA384":"982b72c3ee7066ce80ee642444c91adc60e7009fc6ef981a32edf666591d6aedb09d258e10e86f4ef265eae8149bbd92"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"O=GlobalSign, CN=GlobalSign Time Stamping Authority, emailAddress=timestampinfo@globalsign.com","ValidFrom":"2007-02-05 09:00:00","ValidTo":"2014-01-27 09:00:00","Signature":"649b07caaccc411e37ef6f349cb5e8ca48f9daeafaf7172e5cad193b7311ec5adbfd7b213161c092515bb166b07c64d8fe10b471a8bc9e75379c5f6ff2da0437b8ecc003e256b7785995581d7a7c3e18d74c32bdf91ee723457fdee08d65825b45fd64c66fc3d7ea12411d0c395ef696f8c3cd9e1fff51886976988b8eb42788821ad63c7aabb04eb73ee8d434d2c1a439533cb2747b15373054a6ebb924cc2f084b4364f14aaf8d9ce8546cb2dbdc3bb1c722849f558e72a8b2a8f6f0ff03c996ebab8273dabe45561936fdba6cbc71f0d3c7c376d7e4bce2a1a67200cfbdb200ed92aa39ab09d16e3953862ad43b517398b754e9972d9977ee123e3642257f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000011092eb8295","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"11d73a3638fc78e0bac6c459feadcc42","SHA1":"6636f7dcf81b370b919966f9063295ec84422f91","SHA256":"1eb5fc1d2e3254b1e3c4587a6efed87ee65306525e684b4cfa4b51893cfe86a3","SHA384":"a13c07e505c79c58654ad2cffe219c6c801fa092c52f18c489a6061420c6475706f11c200f4dadd51718c660e49b3f24"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"01000000000115372421a8","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"Imphash":"d41fa95d4642dc981f10de36f4dc8cd7","LoadsDespiteHVCI":"FALSE"},{"Filename":"WinRing0.sys","MD5":"845af1ba23c8d5e64def61bcc441604c","SHA1":"8ac34eb21b9b38f67cd29684c45696c20ab2e75a","SHA256":"206ee7a7c3f4d9496f742ccb84718f556ecb4ba2a95fe7e0cdf3a003ffbe4597","Authentihash":{"MD5":"4f656b084d9df85129cddc642ae8a5e7","SHA1":"a04d7019946d9dd3516150b4789de92fd31870af","SHA256":"b051e5898c7154161b57a6acc7595873c44a3772bd48da71f14a9204cd46babe"},"Description":"WinRing0","Company":"OpenLibSys.org","InternalName":"WinRing0.sys","OriginalFilename":"WinRing0.sys","FileVersion":"1.2.0.5","Product":"WinRing0","ProductVersion":"1.2.0.5","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","MachineType":"I386","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoCreateSymbolicLink","IofCompleteRequest","KeTickCount","MmMapIoSpace","READ_REGISTER_BUFFER_ULONG","READ_REGISTER_BUFFER_USHORT","READ_REGISTER_BUFFER_UCHAR","MmUnmapIoSpace","RtlInitUnicodeString","IoDeleteSymbolicLink","IoCreateDevice","IoDeleteDevice","RtlUnwind","KeBugCheckEx","HalGetBusDataByOffset","WRITE_PORT_ULONG","WRITE_PORT_USHORT","WRITE_PORT_UCHAR","READ_PORT_ULONG","READ_PORT_USHORT","READ_PORT_UCHAR","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=JP, CN=Noriyuki MIYAZAKI, emailAddress=hiyohiyo@crystalmark.info","ValidFrom":"2007-09-24 10:50:55","ValidTo":"2008-09-24 10:50:55","Signature":"4b6c4ea808b550cbae0f97c27726a0445d0e3e021ee0e0087bfe5bbc290e3e45ca35333f2a97fb7667f64326629f7a99fe2fec4da9fe14f0d858419982b983457848fbd6a9115769db6c5626b4d2f87fc77019a755a9efdf81b1968dfbfa638bf87bd25a8adf1c6c3bba3735f06b54d127462ed40dc364ad4c4f29c9f9692b29ff9557300a7c0d395f250172e312ff253b7ce8885ef8c1fe60c448676180e4ca09b34b52ae116b01f22b446b827a748ca80aee5f8e9ff6725e1dce5a7984c26eb72a615a9ef272f6f7b2e03e6d34665caf506b93cb5a2de127177eb1923cf5bc499e312d6c43ff5a26124ea63a4dc9a3340daa6449c2322857adf98166423cfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"01000000000115372421a8","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c11203d7c1fcb38e1eaff246bb8e7595","SHA1":"99f00de6eefb2076662465e682a2429373ebcb26","SHA256":"08a073aa77d42d608a9457a6b1d63eadcf5113407d8a55025ea1bbef0716dca5","SHA384":"ef57f44999a39185b9ebf97894ce5a3cca2894e15bc0733a865501c3a41ea9054be5d7517aa59006b04a853cadbed567"}},{"Subject":"CN=GlobalSign RootSign Partners CA, OU=RootSign Partners CA, O=GlobalSign nv,sa, C=BE","ValidFrom":"2003-12-16 13:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"5c2f2e674a26b3e7b53f353cdda003ed569af9443752163065c7d14ea20f8db7b6b6678ee74cec8d95bee6cea7227874acd7f87499b3f7ce8b1338d596cc8d76c52f38b23aae61be0b8799e321626423398d84f6858df777ffb03806f07ec1485fb5ee582606660522749283a7dbb5f992e3e8c3192c2e63efbb1fdff9f70747660d0789977ef8332c9ecbae143df11cdfa3f179afc8928f9471c4d144c554db1eb50b0aa942a3afd643391dee8f9398585bbe6e9c0bf563ec5e99c2f954fa010746da0db06424cf8ed1061d4f3ca26377455ba4bc5fb080bb31e00b54015c161d724ed52a6947d11b667e5f016ef135916be02efeb045d81627b5c58bc2da53","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"040000000000f97faa2e1e","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"59466cb0c1788b2f251fce3495837102","SHA1":"c5cfc5f6a131a3a77c3905c9893c99bb1b2baa0b","SHA256":"eedda02668f7636eeec69429a7164cc47ca3de0539122d37f5b8078df7ee56db","SHA384":"982b72c3ee7066ce80ee642444c91adc60e7009fc6ef981a32edf666591d6aedb09d258e10e86f4ef265eae8149bbd92"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"O=GlobalSign, CN=GlobalSign Time Stamping Authority, emailAddress=timestampinfo@globalsign.com","ValidFrom":"2007-02-05 09:00:00","ValidTo":"2014-01-27 09:00:00","Signature":"649b07caaccc411e37ef6f349cb5e8ca48f9daeafaf7172e5cad193b7311ec5adbfd7b213161c092515bb166b07c64d8fe10b471a8bc9e75379c5f6ff2da0437b8ecc003e256b7785995581d7a7c3e18d74c32bdf91ee723457fdee08d65825b45fd64c66fc3d7ea12411d0c395ef696f8c3cd9e1fff51886976988b8eb42788821ad63c7aabb04eb73ee8d434d2c1a439533cb2747b15373054a6ebb924cc2f084b4364f14aaf8d9ce8546cb2dbdc3bb1c722849f558e72a8b2a8f6f0ff03c996ebab8273dabe45561936fdba6cbc71f0d3c7c376d7e4bce2a1a67200cfbdb200ed92aa39ab09d16e3953862ad43b517398b754e9972d9977ee123e3642257f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000011092eb8295","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"11d73a3638fc78e0bac6c459feadcc42","SHA1":"6636f7dcf81b370b919966f9063295ec84422f91","SHA256":"1eb5fc1d2e3254b1e3c4587a6efed87ee65306525e684b4cfa4b51893cfe86a3","SHA384":"a13c07e505c79c58654ad2cffe219c6c801fa092c52f18c489a6061420c6475706f11c200f4dadd51718c660e49b3f24"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"01000000000115372421a8","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"a96ff2c8a6f10b7189ad5f134537031f","SHA1":"d941b4b7fc027b18ae91da9311dabcc292d2c183","SHA256":"c7425dda77b641dc99ccd1d3e107565d03454d28949dcbb2515928705d8b56e3"},"Sections":{".text":{"Entropy":6.17,"Virtual Size":"0xa72"},".rdata":{"Entropy":3.92,"Virtual Size":"0x184"},".data":{"Entropy":2.92,"Virtual Size":"0xc"},"INIT":{"Entropy":5.42,"Virtual Size":"0x2c6"},".rsrc":{"Entropy":3.29,"Virtual Size":"0x3c0"},".reloc":{"Entropy":4.82,"Virtual Size":"0xbc"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2008-07-26 07:25:10","Imphash":"7cf815757705e26b809574488ed56d0e","LoadsDespiteHVCI":"FALSE"},{"Filename":"WinRing0x64.sys","MD5":"1c57d067b9fc5e9ef9aeb14223481243","SHA1":"4ee59164d3259667d3cade58f4c93b4dddf5a92b","SHA256":"d5bca2ca464a6cc91344bd85e812a7bac6e7c67038c4929a29e0bc60c7eabe4d","Authentihash":{"MD5":"c8bddfc109c3949bd94893036cb8fe23","SHA1":"c678f2d2c64fd4b2141958ed4bbf552a29dd81f4","SHA256":"93ae26aa102215c0e9aa3b4f2f5a480c9c9b8a18f102c5fd87979d8697a69a69"},"Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteDevice","RtlInitUnicodeString","RtlCopyUnicodeString","IoCreateSymbolicLink","IoCreateDevice","IofCompleteRequest","__C_specific_handler","IoDeleteSymbolicLink","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Zhejiang, L=Hangzhou, O=NetEase(Hangzhou) Network Co. Ltd., OU=NetEase(Hangzhou), CN=NetEase(Hangzhou) Network Co. Ltd.","ValidFrom":"2018-10-08 00:00:00","ValidTo":"2019-03-07 23:59:59","Signature":"53cdafd8ca9393f413dbe3ebb3e02c166ab29e2671eeab558f77593bcb5fab0a2642985e3cc150cbadaa133eadb0f790f217cab0bd075dbe1fba1b233a06d9a5a8f072c413298c3c4c1649315e232104b21dbc3993ec694f278fd63da4802b6808b1ae0416cfcdf4df0eb80083891cf3723c542cf63266ae6c3b4a93695799019b318e80b64539388e8554e012341d486137dc0072e2d8a12fffeedc19fe51010e94b366e1d2f981d35257b1bbe7a622f1023a0ae9ecbae9634f298caa7a3cb3a4973fd6da532494db7acf3afd1fe2777f0a6ba9d7e7b9f7654ed7e617d95947927276be9e6603e634b1af65193d714c2895e78118334b99beac1ccdfa146b6c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"74af57b25c70c644502a0f9de39cc00e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"48396cefb1dcd75373dd293fb7454f35","SHA1":"adde2691306c88138a9f2e646b8f6869898b0e8a","SHA256":"31abdbde5f2e816592e19cad6c0f782d5d262a4eb330f88fdf0d44cacf860440","SHA384":"663e8a63c96fcc2a9771bb7094e922a9edb0bba506dd6d3736b0f74bb828b137ad07d47217ba39d82cccdb96621b2d07"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"74af57b25c70c644502a0f9de39cc00e","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"RichPEHeaderHash":{"MD5":"82bd50f0a4b80d63feaea2d9e0cd75ec","SHA1":"7ed3aa24d9dff49b37d3656ace94a0e602a45e42","SHA256":"ed2553694707a61786aa74a821e70bde63d812cbe4b8675d0c74af73c2270cb1"},"Sections":{".text":{"Entropy":5.82,"Virtual Size":"0x756"},".rdata":{"Entropy":3.66,"Virtual Size":"0x4fc"},".data":{"Entropy":0.61,"Virtual Size":"0xf38"},".pdata":{"Entropy":3.28,"Virtual Size":"0x9c"},"INIT":{"Entropy":5.01,"Virtual Size":"0x230"},".reloc":{"Entropy":2.98,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-11-29 23:39:29","Imphash":"345a00bc31828117dd5247b4d3d32ee3","LoadsDespiteHVCI":"FALSE"},{"Filename":"WinRing0x64.sys","MD5":"6174b6fcd8815c6c6945ac972be924a4","SHA1":"6a22a46f613ed4518d2b971da01b5099e2ea6ec9","SHA256":"14d00976162a5d3238d183704fd84b50c3c5dcc762cab3c8adb5faf0a3caab99","LoadsDespiteHVCI":"FALSE","Imphash":"b62e9f4f8363c29992802646a5b4fa4b","Authentihash":{"MD5":"63266815c692055530654c1e7ed02d94","SHA1":"34702488beaa60358d989fb3f97c39469fe4ebdb","SHA256":"ecf58fd2ad36e4d1462f7f9c697ea73e94f5160953ca0b5c34076786c8efc745"},"RichPEHeaderHash":{"MD5":"7320932c4d9f8790f529d33ed0d10905","SHA1":"434509f85cd94c1cb9dd92299d3753b8c8bec727","SHA256":"973701bbbb66d3bd207e0ae6591a951afea32b6ef54f2480d19736a3616b7b43"},"Sections":{".text":{"Entropy":6.1940631744129835,"Virtual Size":"0x1466"},".rdata":{"Entropy":4.733837487119643,"Virtual Size":"0x102c"},".data":{"Entropy":1.3859797370893234,"Virtual Size":"0x4f8"},".pdata":{"Entropy":4.101048724255784,"Virtual Size":"0x2d0"},"PAGE":{"Entropy":6.216222704613836,"Virtual Size":"0x1d0b"},"INIT":{"Entropy":5.005903790307284,"Virtual Size":"0x61e"},".reloc":{"Entropy":3.8898432644391243,"Virtual Size":"0x44"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-06-05 03:02:06","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmGetSystemRoutineAddress","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","ExFreePoolWithTag","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","__C_specific_handler","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","IoDeleteSymbolicLink","IoDeleteDevice","IoCreateSymbolicLink","RtlCopyUnicodeString","DbgPrintEx","IofCompleteRequest","MmUnmapIoSpace","MmMapIoSpace","SeExports","RtlInitUnicodeString","HalSetBusDataByOffset","HalGetBusDataByOffset","WdfVersionBindClass","WdfVersionBind","WdfLdrQueryInterface","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"JURISDICTION_OF_INCORPORATION_C=IL, BUSINESS_CATEGORY=Private Organization, serialNumber=513409631, C=IL, L=Tel Aviv,Yafo, O=Atera Networks Ltd, CN=Atera Networks Ltd","ValidFrom":"2023-05-29 00:00:00","ValidTo":"2024-05-28 23:59:59","Signature":"39a354f8810c9ee13c5a429940fcb22ad0d4eed6f457dacaf8b7b6afbae46db0089c5251265c3e676a47dc737f33514045587e7a1599aa07c803163ab8a8b46a7f658fb2acfac8416d4fc0699822479f4d6ba0e53487264ba5bbd606cb7ceeb660a3affd88351e7232695bc7d9ef5cbad47feed50c92e8111bbbdf82cad7aa607f9cae3d876c04a2a9890cb32babce3f3d32b813f78bf7c487913568eb572ea8eae42b72b50a27d9bdab865f4e49678f5f2ba70fc42dabd2e1d7bc614e397c4828c2bb194a13ce8c85843aa6699f750dd65933076b54e0eb21f1b1ee5701338ac2864d28683b41cce4e923841e92cdff39df83514696385e41f59dae334905b3c77e9c4c29e0f54bd34d839d006ea6c1805af9a8642f6f98549fc1db2b324c316ddd69cebefea85f8c1ff3c1af19a62ee9d45bf418b14e6a780faf9ec814b760d4129c5a0e532e6e0cd1e02e1cc7c3fc4422ba59e575b81ac9b551e0216cdac9f4253e047a14b52d18a27b0828c21ed81974de06743a3a8bf37ce83a0247c922d0eb0c55e6288c0627425746148f608102c9036bb0ee1420c66119780c4a69e78b9335d716d0eac42ffaa7cd58b9c08ae011c52b4d4ac5100304113db3085fa570b988e70ff287ca68812e95a5dd398d6bdb7e7d9999fa0f1ac9f1a34d05b32251e0dbdab0524a4e7df8c5ad30b9f8bd17c5f3408d357d9bf85519c6b04013b3","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0dc9f3e30e81d816872a6ec907cf1b4e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5a9add0b8bd2eb6e3ac28516f7f92602","SHA1":"49431c95e24665a1c41451bcde0c66ff9cea9e8b","SHA256":"3513291354b7f8b7c3b8957d85c0ef5987a07f023b9799c7622876fef9aba939","SHA384":"5592a01bbb687a2647c70cfeb39ddbe4d50b995ba4dd94c56e9a4dbece97b5e749b9f2549fdd2548a3596c06e0c41dc3"}}],"Signer":[{"SerialNumber":"0dc9f3e30e81d816872a6ec907cf1b4e","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"WinRing0.sys","MD5":"bc273c0f3c14e19822114cd2bc5b6a97","SHA1":"64b2a9ec6f8bf2ad27bc4aa75aefd0cb17b7119f","SHA256":"a3e3cdbd8c781960a77efb5655a6b7c3bac8d5926aaf687108a57d99b78538fc","LoadsDespiteHVCI":"FALSE","Imphash":"b62e9f4f8363c29992802646a5b4fa4b","Authentihash":{"MD5":"b3bcb9e9b3c87b982b4d63a08d5c5e18","SHA1":"c974c8ca7a715070ae261fab586035545f56a3fe","SHA256":"0fffcee9a0270a8160b48885799d2ac099f2e4ee915d3fc3302786e7b83a9429"},"RichPEHeaderHash":{"MD5":"09e756e71f73065006d8d33bc70c22b4","SHA1":"45b2c7bafea62bb7c3e89e1878ab8788c0d56f99","SHA256":"edc517ed4806f491720e52f973c92961333c6f5ede0d78db67c65b69bd3eddb1"},"Sections":{".text":{"Entropy":6.183357089045415,"Virtual Size":"0x13a6"},".rdata":{"Entropy":4.766657905902649,"Virtual Size":"0x1074"},".data":{"Entropy":1.3859797370893234,"Virtual Size":"0x4f8"},".pdata":{"Entropy":4.127752913950469,"Virtual Size":"0x2d0"},"PAGE":{"Entropy":6.216800226216387,"Virtual Size":"0x1d0b"},"INIT":{"Entropy":5.005903790307284,"Virtual Size":"0x61e"},".rsrc":{"Entropy":3.287904946740139,"Virtual Size":"0x3c0"},".reloc":{"Entropy":3.8898432644391243,"Virtual Size":"0x44"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-05-16 07:20:37","Description":"WinRing0","Company":"OpenLibSys.org","InternalName":"WinRing0.sys","OriginalFilename":"WinRing0.sys","FileVersion":"1.2.0.5","Product":"WinRing0","ProductVersion":"1.2.0.5","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmGetSystemRoutineAddress","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","ExFreePoolWithTag","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","__C_specific_handler","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","IoDeleteSymbolicLink","IoDeleteDevice","IoCreateSymbolicLink","RtlCopyUnicodeString","DbgPrintEx","IofCompleteRequest","MmUnmapIoSpace","MmMapIoSpace","SeExports","RtlInitUnicodeString","HalSetBusDataByOffset","HalGetBusDataByOffset","WdfVersionBindClass","WdfVersionBind","WdfLdrQueryInterface","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Code Signing Root R45","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2029-03-18 00:00:00","Signature":"acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7803184245708a41cf6f01b8eeb4a954","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a33260428269bc902bc1cd280e4b1837","SHA1":"254209ca172cffcc67bd2a88996556d2f09538f0","SHA256":"a67411358594f2cf016741a63fd49f36de917f86531b3e3a43eb6a421c654868","SHA384":"fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2030-07-28 00:00:00","Signature":"2575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"77bd0e05b7590bb61d4761531e3f75ed","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"65fd1dac1f115d9507f4e1840c8cb36a","SHA1":"c7cf5607e19b22fe60c055e71d9b555d70f71f66","SHA256":"d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe","SHA384":"defe810317bd1215b4d1ee0ec8a5fb38b21d094ef1173cae670956cd899232638e4f9473fd947bd550a4a77300bbb2ab"}},{"Subject":"BUSINESS_CATEGORY=Private Organization, serialNumber=HRB 14379, JURISDICTION_OF_INCORPORATION_C=DE, JURISDICTION_OF_INCORPORATION_SP=Saarland, JURISDICTION_OF_INCORPORATION_L=Saarbruecken, C=DE, ST=Saarland, L=Eppelborn, STREET_ADDRESS=Koßmannstr. 7, O=Krämer IT Solutions GmbH, CN=Krämer IT Solutions GmbH","ValidFrom":"2023-05-17 14:09:08","ValidTo":"2024-05-17 14:09:08","Signature":"2d39ee9c13621012cfd6614927e22e7016696a31d3efc59f6d6ba9c45fb1da1ac7a21b6ab91bdc7b6678e1037efd79aabdc84d419af9be0d407e4837adb06828f833cfccb84886646b4f5558e9cd21f6d8a08c53df8f9a75e01cb294b89ba4b94c8ebf129434e43572a5dee50237dcfb3b5ad86607850741cc7a6d6c8eb4d3f33ff5fbe0e859ce04b0aa8888cb850659a64c8a250a2aa623abdfaa71412efcde495eca151e248a5997b63e3ebc95ba6cf2bfa72d05546e5d63808be61bee553e28a37f8b192b25dc76d77e04d883d13134eb88e7cfa9634a813b24c3d6aaba9e8f962b7b2fcc13bdd45e651603146974e8d8ed87e3561c35814a3e9069a86e7f33f0926ea22d99336b08477929bd59713413b71d3296da6ce159b8504977ff7a343fcd1c05b193e0a29a67b5254714ea9c310c6e77856b4edf45830d49c56fab6c46c3404ddff85936c8ff9266cf0aa18a07201e37e29a8d7fb818471ede2de2b561e6142de56fe383afe1080ced44b0cd3d7c014223d75147e99bf27ffe4e4ed1e9d541424dffc309c7c9148398999c5e329d41fa2675a47502f801c6f0be8e8573a6cf82a48cf5abda7a2c29304ac8b25109ffdd29052262be7f4c72ba5018ee5194c863b33683480f5e435fdfd218df53aa04d9758b9edef038bc9c7910aa75fd0fc841bbbf99074eb9f0c371ea175b6d6fb42a6ca3672b6b4a19e964c25c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"2a73cbc39d0d597b7cc22aba","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"4221f2d0f71f5dfd63b9308eb9e49cf8","SHA1":"5b547229673cd4c3d09e5e910f548513574d6540","SHA256":"371379bf110af336037e59b3fae88159a63cf6c46083493fd388566b1ee2ad75","SHA384":"14f444175bfc1631212cb42d51dd1039d438146c94b1d95feb4906d189e78bb0a5d51a60a0cfc3e492181972fdad61cb"}}],"Signer":[{"SerialNumber":"2a73cbc39d0d597b7cc22aba","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","Version":1}]}]},{"Filename":"WinRing0.sys","MD5":"b94c5984c8328ef8c8a5533ee10b59e2","SHA1":"9c249d366ab4bca598cb4213a474a56b960cef6d","SHA256":"489c0e3a8d70037eba46810c0d1c93a10e2796d809eb35023e5977d6902cb744","LoadsDespiteHVCI":"FALSE","Imphash":"d909815ce3d795b1d2854e16592b5f5c","Authentihash":{"MD5":"0ad2e067ce9a16248f279c193f0f4534","SHA1":"57828b17ad80cfeb14defd996fe6523dba165651","SHA256":"46a02c4a9e9fd3700544ff7053ef6b599f7145cbbed25380269af35a1dc35a05"},"RichPEHeaderHash":{"MD5":"2bce9e8f4d5f8f9c4c62720af255ea7d","SHA1":"daec6006717aed8c27d3b99258b0235ca622b99d","SHA256":"e34416082f9c9c457b54febbc5310e122213e0d084d93c6036c98e0ecaab25bb"},"Sections":{".text":{"Entropy":6.164640031991077,"Virtual Size":"0xc56"},".rdata":{"Entropy":4.150099297855072,"Virtual Size":"0xb64"},".data":{"Entropy":2.050299359932983,"Virtual Size":"0x230"},".pdata":{"Entropy":4.027169353589677,"Virtual Size":"0x240"},"PAGE":{"Entropy":6.2149286604361,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.014250090373807,"Virtual Size":"0x558"},".rsrc":{"Entropy":3.2850352722587184,"Virtual Size":"0x3c0"},".reloc":{"Entropy":3.4449988607096844,"Virtual Size":"0x2c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-01-25 23:57:33","Description":"WinRing0","Company":"OpenLibSys.org","InternalName":"WinRing0.sys","OriginalFilename":"WinRing0.sys","FileVersion":"1.2.0.6","Product":"WinRing0","ProductVersion":"1.2.0.6","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoCreateSymbolicLink","MmUnmapIoSpace","IoDeleteSymbolicLink","__C_specific_handler","ZwCreateKey","MmMapIoSpace","IoDeleteDevice","IofCompleteRequest","RtlInitUnicodeString","MmGetSystemRoutineAddress","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","ExFreePoolWithTag","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2021","ValidFrom":"2021-01-01 00:00:00","ValidTo":"2031-01-06 00:00:00","Signature":"481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d424ae0be3a88ff604021ce1400f0dd","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c0189c338449a42fe8358c2c1fbecc60","SHA1":"b8ac0ee6875594b80ad86a6df6dd1fa3048c187c","SHA256":"a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5","SHA384":"76d3a316a5a106050298418cce3beea16100524723d9e3220b0de51bfb6f1c35a5d4c7cd10b358fef7bf94c3e3562150"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Timestamping CA","ValidFrom":"2016-01-07 12:00:00","ValidTo":"2031-01-07 12:00:00","Signature":"719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0aa125d6d6321b7e41e405da3697c215","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8d26184fc613f89aba1cefb30fce1b53","SHA1":"63a7e376bad5ec2e419d514a403bcf46c8d31d95","SHA256":"56b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c","SHA384":"d8c9691fe9dbe182f07b49b07fbb4f589fa7b38b5c4d21f265d3a2e818f4b1bfb39e03faab2ec05bb10333a99914fb8a"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_C=US, JURISDICTION_OF_INCORPORATION_SP=Delaware, serialNumber=3887964, C=US, ST=California, L=Irvine, O=Razer USA Ltd., CN=Razer USA Ltd.","ValidFrom":"2021-09-22 00:00:00","ValidTo":"2024-11-21 23:59:59","Signature":"b145ca597e59a9f22a9b9928e52e45a280244e5c0cf3aa12d47d065079622846ab77afff1aee72dc5cddd890deb4cd08f6d2c9fee3b163d7591c062e9447b7a991c5a1e917a33438ec1c2dbe24e5363448ce8dbb7d82f72a016f50565bfc794395bcb24c88f50b8f020194f04476a317978cdabc328f9f0593858c177cea00f04feb64ea53a59119309e2f66869b5d24f111aaaaacdfd3e27a36bf69c8b1cd1e2dc7bd3a92bb249f8d9e3994d20d1d09260c82cf1e04ab64f4fae5e58c417e6d1653ea071d1d85fff5586a1c4eee1568f45aa1b15ff80b52ead930313c1bd7997b4a9767bfa37be5137e8046145e1967c38cf6ceba3ee46e7a238c4690d345034c276c8e9c2b74d9092660bdc28fe53f0c0aaeb5f3eea57ba1efdc0ab2881479cb62fe0e888a2b72ec586195054608de6d2636280ea6c1182e6eba20fc2ccf504403c28d3267b22e89be51ccbac67c1d96f9e078d48c94d97fa082959c55bebb611d2d1a0e18bc1580efac9d28b0ddc013d4934b41b7317ca3f051d7678216feeac1238782f2c3aba37ab040dac416f084ffa2daa05c3107fd16ff08218dac7231d5fefecf723fb29bb2c98dc1e6341418203095079b83afd580af4bad34a59d70a51edd57f42427bd77877792afca87e01b9b91368050af7fa6e65740bd8d02318a0f9a85a25418b330484d19820a8db4af4e9f57c8b593d86271da61d3d073","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0dcdadd13e8649f619040327f45a575f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"160a4477e91c84142e126b6909e9b420","SHA1":"97ba781f2de0a85ce9f2a14ab9668818714e9867","SHA256":"aef08776e336585742dafd96e88e2754f5532beec27ca7b9ecf4708cdda79489","SHA384":"2f473af34603dfefcca41357f15e1f754d562a6d9ef14335b001129528246c1941161af27d08c9b6b50aa7cce8541216"}}],"Signer":[{"SerialNumber":"0dcdadd13e8649f619040327f45a575f","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"WinRing0.sys","MD5":"3eb13af71e265728e7cb06c4e958c3f8","SHA1":"d08d07a760eaebfda0fb1a44ece35af13172a02f","SHA256":"3eb166c2117da2dd9a43bd2fbb083d2d4535e9f57c5060053986c06bf3dd275f","LoadsDespiteHVCI":"FALSE","Imphash":"a095f31019d7a32d0a0507879a1822b1","Authentihash":{"MD5":"95fd5c10a29ef9e123ed2be259da0c76","SHA1":"555d877accd5071da2e0af4b353c9a6f33514fa6","SHA256":"50a6984729650cd8019484e6f19bc63cd4615199031e873c2093cdd6fb86ee14"},"RichPEHeaderHash":{"MD5":"ebff05b5ea0456167879672c55e5ca70","SHA1":"e6a75f2f9f67ba7052de0a2a95e37712e51df34a","SHA256":"fcb33f68ccae8211065e4db91c40feb52fc5d12e0d67e0de123d387d26b1c1f5"},"Sections":{".text":{"Entropy":6.1371790179089025,"Virtual Size":"0x7a6"},".rdata":{"Entropy":3.4005778238243627,"Virtual Size":"0x28c"},".data":{"Entropy":3.4464393446710155,"Virtual Size":"0x14"},".pdata":{"Entropy":3.2990495304709495,"Virtual Size":"0x90"},"INIT":{"Entropy":4.664240945954362,"Virtual Size":"0x1da"},".rsrc":{"Entropy":3.2858216134068057,"Virtual Size":"0x3c0"},".reloc":{"Entropy":1.9669171866886992,"Virtual Size":"0x10"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-06-23 20:04:37","Description":"WinRing0","Company":"OpenLibSys.org","InternalName":"WinRing0.sys","OriginalFilename":"WinRing0.sys","FileVersion":"1.2.0.5","Product":"WinRing0","ProductVersion":"1.2.0.5","Copyright":"Copyright (C) 2007-2008 OpenLibSys.org. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","MmUnmapIoSpace","IoDeleteSymbolicLink","__C_specific_handler","MmMapIoSpace","IoDeleteDevice","RtlInitUnicodeString","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"JURISDICTION_OF_INCORPORATION_C=TW, BUSINESS_CATEGORY=Private Organization, serialNumber=23638777, C=TW, L=Taipei, O=ASUSTek Computer Inc., OU=SYS PC SW center, CN=ASUSTek Computer Inc.","ValidFrom":"2018-06-07 00:00:00","ValidTo":"2021-06-04 12:00:00","Signature":"9987b72c4f75e6d7212baa6aedb1fd539263b310f52bfa12ae0ab9b7efdb7da22b43ca0376a2968ff983c618db416d648493980f67f243609a47e29a863f106c3d6f95acfe2f680b58d75c9c67a964993eacaa878dfbebf46998acda6b73a0f8ae0dbe34d27b1e06f7f9f7ac200da723bbd3d80ffa24dd90a2db6bc7a4dfd426c21aa0e9278894329eee6404911fb4ef96fbd3292e0b388a865353e08ced7ec8467610bf9e78e434f7af0522934d635fc57a8e6449deac1e51a24fa34ea7dd4030d84b2ececabbc8b8ec887dde7f65f71bb1308a66b69f5fb67f2c22c7150732e9f40d94b004c7a8d1648796c1966325176542e50df96794034faa17f102b829","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"024fd22ed89c8823d79c2a09a4e6423f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"17b90cbd98af42c34e637c5b8df4eb64","SHA1":"7914797171811270bc01561479d5bd5c7388cec2","SHA256":"1759c954acc8ec1fb2a768612afbbdaee5df42277068e55408a067350e24ce91","SHA384":"c1edf17c215952f496ac4345813ae91737c7f4efdbc6eb3966cad4572810bc574e621a27212cbcceef489a17df53b457"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"03f1b4e15f3a82f1149678b3d7d8475c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"83f5de89f641d0fbf60248e10a7b9534","SHA1":"382a73a059a08698d6eb98c87e1b36fc750933a4","SHA256":"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf","SHA384":"4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"}}],"Signer":[{"SerialNumber":"024fd22ed89c8823d79c2a09a4e6423f","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","Version":1}]}]}]}