1a0fab94-f4a7-48c2-a2f4-72d19c382642

PGPwded.sys

Description

PGPwded.sys and eedDiskEncryptionDriver.sys are Symantec drive-encryption filters affected by CVE-2019-9702 and CVE-2019-9703. Symantec Endpoint Encryption releases before 11.3.0 and all Symantec Encryption Desktop releases are affected. The tracked filters expose raw-sector read and write controls. In the 11.1.1 eedDiskEncryptionDriver build, any-access IOCTLs 0x8002206C and 0x80022070 select a tracked volume and read or write sectors; its protected-range logic still permits writes beginning in sectors 0 through 2, leaving boot-sector modification possible.

UUID: 1a0fab94-f4a7-48c2-a2f4-72d19c382642
Created: 2026-08-31
Author: Michael Haag
Acknowledgement: Kyriakos Economou, fluffycats31 | [@kyREcon, @fluffycats31](https://twitter.com/@kyREcon, @fluffycats31)

Download

This download link contains the vulnerable driver!

Commands

sc.exe create PGPwded type= kernel binPath= C:\\windows\\temp\\PGPwded.sys &amp;&amp; sc.exe start PGPwded

Use Case	Privileges	Operating System
Elevate privileges	User	Windows

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://github.com/magicsword-io/LOLDrivers/issues/409

https://github.com/fluffycats31/vulnerable-drivers

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/0/0/symsa1485

https://nvd.nist.gov/vuln/detail/CVE-2019-9702

https://nvd.nist.gov/vuln/detail/CVE-2019-9703

https://github.com/DavidCarliez/CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC

CVE

CVE-2019-9702

CVE-2019-9703

Known Vulnerable Samples

Property	Value
Filename	PGPwded.sys
Creation Timestamp	2025-03-27 10:52:51
MD5	cf433fa0463e9fba56102bc1436ef7f3
SHA1	48f0e0856707e7cb82fd4e962dcac02a8625d8e0
SHA256	02579d833200abb641e476468bafd1f07d448f3d232f70cc34e2adad402b5c75
Authentihash MD5	000df31531ddeff7cf6371a275488c13
Authentihash SHA1	8d0ec5ca2af79cbb5883830fe1906dbf81d150f6
Authentihash SHA256	23354a3a8bcc7d51afca16590c18d158f5eddc41379284d4ac373a76029efcab
RichPEHeaderHash MD5	ef617c4b4467cdcb5439d95de9c05868
RichPEHeaderHash SHA1	868fbb2829b7e96d37df317eb08c75bc405e24e8
RichPEHeaderHash SHA256	bef207ec5001c4dfc87c6da4f458bd7974cadb9aa1638fe87bbc3b4f24b36626
Company	CA, Inc., a Broadcom subsidiary
Description	PGPwde NT/Win2k driver
Product	Symantec Encryption Desktop
OriginalFilename	PGPwded.sys

Download

Certificates

Expand

Certificate 08ad40b260d29c4c9f5ecda9bd93aed9

Field	Value
ToBeSigned (TBS) MD5	5d8003a64dfa5a4d88365da1566038cb
ToBeSigned (TBS) SHA1	79465b56bc7ad55a37bdf633943da8bfc84db228
ToBeSigned (TBS) SHA256	84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332
Subject	C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
ValidFrom	2021-04-29 00:00:00
ValidTo	2036-04-28 23:59:59
Signature	3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e
SignatureAlgorithmOID	1.2.840.113549.1.1.12
IsCertificateAuthority	True
SerialNumber	08ad40b260d29c4c9f5ecda9bd93aed9
Version	3

Certificate 090c3aaa41901d6ad321fddea91e1366

Field	Value
ToBeSigned (TBS) MD5	c5a9b13894baa951ef81c2b092800154
ToBeSigned (TBS) SHA1	fcd2e70f37161140c551364aeda08fd0460212f2
ToBeSigned (TBS) SHA256	2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e
Subject	C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc
ValidFrom	2023-03-20 00:00:00
ValidTo	2026-03-19 23:59:59
Signature	c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	090c3aaa41901d6ad321fddea91e1366
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

NtFsControlFile
DbgPrint
RtlInitializeBitMap
RtlClearBits
RtlSetBits
RtlAreBitsClear
RtlAreBitsSet
RtlInitUnicodeString
RtlEqualUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmBuildMdlForNonPagedPool
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
PsSetLoadImageNotifyRoutine
NtBuildNumber
KeInitializeEvent
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeSetTimer
ExAllocatePoolWithTag
ExFreePoolWithTag
ExQueueWorkItem
ExCreateCallback
ExRegisterCallback
ObfDereferenceObject
ZwPowerInformation
RtlInitAnsiString
RtlDeleteRegistryValue
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeSetEvent
ExAllocatePool
MmGetSystemRoutineAddress
ObReferenceObjectByHandle
ObfReferenceObject
ZwClose
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
PsGetCurrentProcessId
ObOpenObjectByPointer
ObQueryNameString
IoGetDeviceProperty
KeClearEvent
KeResetEvent
IoInitializeRemoveLockEx
InitSafeBootMode
_purecall
IoBuildSynchronousFsdRequest
KeReleaseSemaphore
MmMapIoSpace
MmUnmapIoSpace
PsGetVersion
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoGetCurrentProcess
IoRegisterShutdownNotification
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
NtCreateFile
ZwCreateEvent
ExEventObjectType
MmMapLockedPagesSpecifyCache
KeInitializeSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
wcsstr
_wcsicmp
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
NtQueryInformationFile
NtSetInformationFile
NtClose
ZwDeleteFile
MmUnlockPages
MmUnmapLockedPages
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
PsThreadType
ObOpenObjectByName
ExSemaphoreObjectType
IoAttachDeviceToDeviceStack
IoDetachDevice
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
VerSetConditionMask
RtlVerifyVersionInfo
tolower
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
_strnicmp
wcschr
RtlCheckRegistryKey
ZwOpenFile
_vsnwprintf
IoAllocateIrp
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
.rdata
.data
.pdata
LOCKDATA
bghkprms
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	PGPwded.sys
Creation Timestamp	2020-12-21 07:50:24
MD5	555705000dd726b10432d3bcf9e36c54
SHA1	72602fe173a375988b5c3d3a1bbb956fd8fe1f08
SHA256	2bb84d2b3af3d9ee0f2dbcdfe3574a5c576bc2c7dd2a5b3dbcb7784fbc9efec6
Authentihash MD5	cda325bb8b11396d637794e11c74f0d0
Authentihash SHA1	212d7c603c470f1a5c89bd66c774b01fa81f292c
Authentihash SHA256	7a0a29159ad02be390afc0759c8ab257d4fb32e156c0507503d32575e558c8fa
RichPEHeaderHash MD5	c6a47747861b9d17dd0f5ce99bf01315
RichPEHeaderHash SHA1	a4d2e0d68d73799265b59637e5d745c890cad213
RichPEHeaderHash SHA256	3b25275de17737bddf86cc532e0d40fd169a3c6f981ba24d3bf1078f07dcc3c1
Company	CA, Inc., a Broadcom subsidiary
Description	PGPwde NT/Win2k driver
Product	Symantec Encryption Desktop
OriginalFilename	PGPwded.sys

Download

Certificates

Expand

Certificate 7b46246b3b56ee913595ac77d43f7239

Field	Value
ToBeSigned (TBS) MD5	253489f34f86f42e16b9ce03c1b9a65f
ToBeSigned (TBS) SHA1	546abee7c949014efb7f8bb005d4219c62f6cc95
ToBeSigned (TBS) SHA256	b16f9608f6e5d9137363713a045b43c00912464a201fa01bf2ef1d0ddc4dcd32
Subject	C=US, ST=California, L=San Jose, O=Broadcom Inc, OU=SED, CN=Broadcom Inc
ValidFrom	2020-04-28 00:00:00
ValidTo	2023-04-29 23:59:59
Signature	60ca4759f2eedd44d05c8a6193ee5a6c9aca971799bb4dccca2b7ab3bb902840b2b736d7d7986d8399c38fbc2be807afc9909006d369a1655acd6d9bd382541efe603ae0e4e37bbff1ebb613ca51d70417e27ced8a00752287345b68be75bcea31dc46d061a4f51d3ae593de1084057358880b4ef7a4e3fc8a2ff8bfc2ebacbfc70dd61db1baae141e82e34353aaafeaf82588016455b0a4e74ce17df499063ce09acd628362b8d502ea75e004244f5219b6ab504782a779de5a82ef2c309d55c3da675bb2225eb4883a6eeedb77a65d6165d0ebb92cd16c1981d3cb978b56057e78e2cb21292268bbe48cde423f77b83c3d6d80d6bebacd947c4a7f50dee112
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	7b46246b3b56ee913595ac77d43f7239
Version	3

Certificate 3d78d7f9764960b2617df4f01eca862a

Field	Value
ToBeSigned (TBS) MD5	1f056ff7d5f874984dc605402b7cb042
ToBeSigned (TBS) SHA1	bdb348353a2203deb4b767914fa1bd7248dd728b
ToBeSigned (TBS) SHA256	a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1
Subject	C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA
ValidFrom	2013-12-10 00:00:00
ValidTo	2023-12-09 23:59:59
Signature	13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	3d78d7f9764960b2617df4f01eca862a
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlEqualUnicodeString
RtlInitUnicodeString
NtBuildNumber
DbgPrint
MmBuildMdlForNonPagedPool
MmFreeContiguousMemory
IoAllocateMdl
MmAllocateContiguousMemory
PsSetLoadImageNotifyRoutine
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExInterlockedRemoveHeadList
IoFreeWorkItem
IoGetDeviceObjectPointer
IoQueueWorkItem
IoAllocateWorkItem
ExInterlockedInsertTailList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ZwPowerInformation
ExUnregisterCallback
ExFreePoolWithTag
KeSetTimer
KeCancelTimer
ExQueueWorkItem
ExAllocatePoolWithTag
ObfDereferenceObject
ExRegisterCallback
ExCreateCallback
KeInitializeDpc
KeInitializeTimer
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
ZwOpenKey
ZwClose
ZwDeleteValueKey
ZwCreateKey
ZwSetValueKey
ZwQueryValueKey
ObReferenceObjectByHandle
KeSetEvent
ObOpenObjectByPointer
RtlGetVersion
RtlInitAnsiString
RtlDeleteRegistryValue
MmGetSystemRoutineAddress
PsGetCurrentProcessId
ObQueryNameString
ObfReferenceObject
KeDelayExecutionThread
IoGetDeviceProperty
IoInitializeRemoveLockEx
InitSafeBootMode
KeClearEvent
KeResetEvent
_purecall
IoBuildSynchronousFsdRequest
MmUnmapIoSpace
MmMapIoSpace
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
ExEventObjectType
ZwCreateEvent
ZwDeviceIoControlFile
NtCreateFile
KeReleaseSemaphore
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
PsGetVersion
IoGetCurrentProcess
PsCreateSystemThread
IofCompleteRequest
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeSemaphore
ExInitializeResourceLite
ExDeleteResourceLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ObReferenceObjectByPointer
PsThreadType
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
KeReadStateSemaphore
ExSemaphoreObjectType
ObInsertObject
ObCreateObject
ObOpenObjectByName
PoStartNextPowerIrp
PoCallDriver
IoAttachDeviceToDeviceStack
IoReleaseRemoveLockEx
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoAcquireRemoveLockEx
RtlVerifyVersionInfo
VerSetConditionMask
KeQueryActiveProcessors
NtFsControlFile
RtlInitializeBitMap
RtlSetBits
RtlAreBitsClear
RtlClearBits
RtlAreBitsSet
_wcsicmp
ZwQueryVolumeInformationFile
tolower
NtQueryInformationFile
ZwReadFile
ZwCreateFile
wcsstr
ZwWriteFile
NtSetInformationFile
ZwDeleteFile
NtClose
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
_strnicmp
_vsnwprintf
RtlCheckRegistryKey
ZwOpenFile
wcschr
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeleteKey
IoAllocateIrp
RtlFreeUnicodeString
RtlUpcaseUnicodeString

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
INIT
.rdata
.data
.pdata
LOCKDATA
bghkprms
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	PGPwded.sys
Creation Timestamp	2018-12-21 03:29:18
MD5	99e8631183314b2bd136de34c02c7b09
SHA1	1c13bc569c84a0616fad95bc65d63216e1169523
SHA256	5247d4ab237e8fc486ce95d018bd92074b2a8cf1af351cd699a5b4a9355c7071
Authentihash MD5	7b12d85f3f90d4c593ceccbf500ff1dd
Authentihash SHA1	f6eddbb0c70c3f703720e5af99ec163afd9cc209
Authentihash SHA256	ba28cd5ddcd1cc4e5a0683f042600bd11f7023ccb31f060fcfcf8de7564d8ca3
RichPEHeaderHash MD5	34193e2139c7ca2f344e7723a09688bd
RichPEHeaderHash SHA1	860a8ed1bb194edb967fafd94b1c6bffb91933b6
RichPEHeaderHash SHA256	1db723d1dccfaa989daa13301c446dbf0e4c74e87b5bc455e9cedd91b3270441
Company	Symantec Corporation
Description	PGPwde NT/Win2k driver
Product	Symantec Encryption Desktop
OriginalFilename	PGPwded.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 14baa0a5163f9626e487698c694a601c

Field	Value
ToBeSigned (TBS) MD5	b425014bae4d5988cedaae5d11f3e437
ToBeSigned (TBS) SHA1	5be6aed597874b88e9ba5c5b97a634d208c7ac9f
ToBeSigned (TBS) SHA256	65c7117461ee4aca3f4054db5654866449498f460a24e801268aac7f7128b567
Subject	C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation
ValidFrom	2017-11-06 00:00:00
ValidTo	2019-01-07 23:59:59
Signature	5acdc3eaa19eade70b40820009a656b92f556f97b05efc88cbf77e727fe5dfb9482cb1fe09b2ce81b5f35fca4a01bbd27436d2dd875968dfe764df0e5e8ba647d9788b2593ea5c61d0211c776568cc1a7bcbde4800fd9e05e16049edaa218c1d5db5e55ff4746ffdbe03c0f245c515e990cd65ec4b022f02f3075995c1afb584eba9ed74b28590819e8df515f3e7be4f87888d85e861d89be0e459259c00d3aaef420ecdcb2670a261d858ac639a07c47d4ba0891bfafd83f2fa2c112f77dcda1dc193f405b9ec1262e6b336998e18d28b8313f43ca0951d20ad422f3c594b79b9a9c27f8ea2594876b8c9d34843351cc6c6d7061ef663c45588d0f8ef96fe1d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	14baa0a5163f9626e487698c694a601c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlEqualUnicodeString
RtlInitUnicodeString
NtBuildNumber
DbgPrint
MmBuildMdlForNonPagedPool
MmFreeContiguousMemory
IoAllocateMdl
MmAllocateContiguousMemory
PsSetLoadImageNotifyRoutine
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExInterlockedRemoveHeadList
IoFreeWorkItem
IoGetDeviceObjectPointer
IoQueueWorkItem
IoAllocateWorkItem
ExInterlockedInsertTailList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ZwPowerInformation
ExUnregisterCallback
ExFreePoolWithTag
KeSetTimer
KeCancelTimer
ExQueueWorkItem
ExAllocatePoolWithTag
ObfDereferenceObject
ExRegisterCallback
ExCreateCallback
KeInitializeDpc
KeInitializeTimer
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
ZwOpenKey
ZwClose
ZwDeleteValueKey
ZwCreateKey
ZwSetValueKey
ZwQueryValueKey
ObReferenceObjectByHandle
KeSetEvent
ObOpenObjectByPointer
RtlGetVersion
RtlInitAnsiString
RtlDeleteRegistryValue
MmGetSystemRoutineAddress
PsGetCurrentProcessId
ObQueryNameString
ObfReferenceObject
KeDelayExecutionThread
IoGetDeviceProperty
IoInitializeRemoveLockEx
InitSafeBootMode
KeClearEvent
KeResetEvent
_purecall
IoBuildSynchronousFsdRequest
MmUnmapIoSpace
MmMapIoSpace
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
ExEventObjectType
ZwCreateEvent
ZwDeviceIoControlFile
NtCreateFile
KeReleaseSemaphore
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
PsGetVersion
IoGetCurrentProcess
PsCreateSystemThread
IofCompleteRequest
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeSemaphore
ExInitializeResourceLite
ExDeleteResourceLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ObReferenceObjectByPointer
PsThreadType
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
KeReadStateSemaphore
ExSemaphoreObjectType
ObInsertObject
ObCreateObject
ObOpenObjectByName
PoStartNextPowerIrp
PoCallDriver
IoAttachDeviceToDeviceStack
IoReleaseRemoveLockEx
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoAcquireRemoveLockEx
RtlVerifyVersionInfo
VerSetConditionMask
KeQueryActiveProcessors
NtFsControlFile
RtlInitializeBitMap
RtlSetBits
RtlAreBitsClear
RtlClearBits
RtlAreBitsSet
_wcsicmp
ZwQueryVolumeInformationFile
tolower
NtQueryInformationFile
ZwReadFile
ZwCreateFile
wcsstr
ZwWriteFile
NtSetInformationFile
ZwDeleteFile
NtClose
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
_strnicmp
_vsnwprintf
RtlCheckRegistryKey
ZwOpenFile
wcschr
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeleteKey
IoAllocateIrp
RtlFreeUnicodeString
RtlUpcaseUnicodeString

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
INIT
.rdata
.data
.pdata
LOCKDATA
bghkprms
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	PGPwded.sys
Creation Timestamp	2018-07-16 00:47:12
MD5	e7bc75d787e88ca7b6b3797ea8c4f376
SHA1	33caf07739768023bf156cde226bd4d0ec85e864
SHA256	6dd193dd6d60f08482a85e23d3c434f540fd38488281aea0f87ec5e9a1a8e4d9
Authentihash MD5	fe33dac8f6a616d62abf8f4103eacba9
Authentihash SHA1	4cec00b8168755893b8f08973aab477183706601
Authentihash SHA256	7a62b0aef4ffa0e0e20f02260d37bf507f5b5c04619ae880146ef4dbb3044a96
RichPEHeaderHash MD5	34193e2139c7ca2f344e7723a09688bd
RichPEHeaderHash SHA1	860a8ed1bb194edb967fafd94b1c6bffb91933b6
RichPEHeaderHash SHA256	1db723d1dccfaa989daa13301c446dbf0e4c74e87b5bc455e9cedd91b3270441
Company	Symantec Corporation
Description	PGPwde NT/Win2k driver
Product	Symantec Encryption Desktop
OriginalFilename	PGPwded.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 14baa0a5163f9626e487698c694a601c

Field	Value
ToBeSigned (TBS) MD5	b425014bae4d5988cedaae5d11f3e437
ToBeSigned (TBS) SHA1	5be6aed597874b88e9ba5c5b97a634d208c7ac9f
ToBeSigned (TBS) SHA256	65c7117461ee4aca3f4054db5654866449498f460a24e801268aac7f7128b567
Subject	C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation
ValidFrom	2017-11-06 00:00:00
ValidTo	2019-01-07 23:59:59
Signature	5acdc3eaa19eade70b40820009a656b92f556f97b05efc88cbf77e727fe5dfb9482cb1fe09b2ce81b5f35fca4a01bbd27436d2dd875968dfe764df0e5e8ba647d9788b2593ea5c61d0211c776568cc1a7bcbde4800fd9e05e16049edaa218c1d5db5e55ff4746ffdbe03c0f245c515e990cd65ec4b022f02f3075995c1afb584eba9ed74b28590819e8df515f3e7be4f87888d85e861d89be0e459259c00d3aaef420ecdcb2670a261d858ac639a07c47d4ba0891bfafd83f2fa2c112f77dcda1dc193f405b9ec1262e6b336998e18d28b8313f43ca0951d20ad422f3c594b79b9a9c27f8ea2594876b8c9d34843351cc6c6d7061ef663c45588d0f8ef96fe1d
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	14baa0a5163f9626e487698c694a601c
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlEqualUnicodeString
RtlInitUnicodeString
NtBuildNumber
DbgPrint
MmBuildMdlForNonPagedPool
MmFreeContiguousMemory
IoAllocateMdl
MmAllocateContiguousMemory
PsSetLoadImageNotifyRoutine
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExInterlockedRemoveHeadList
IoFreeWorkItem
IoGetDeviceObjectPointer
IoQueueWorkItem
IoAllocateWorkItem
ExInterlockedInsertTailList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ZwPowerInformation
ExUnregisterCallback
ExFreePoolWithTag
KeSetTimer
KeCancelTimer
ExQueueWorkItem
ExAllocatePoolWithTag
ObfDereferenceObject
ExRegisterCallback
ExCreateCallback
KeInitializeDpc
KeInitializeTimer
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
ZwOpenKey
ZwClose
ZwDeleteValueKey
ZwCreateKey
ZwSetValueKey
ZwQueryValueKey
ObReferenceObjectByHandle
KeSetEvent
ObOpenObjectByPointer
RtlGetVersion
RtlInitAnsiString
RtlDeleteRegistryValue
MmGetSystemRoutineAddress
PsGetCurrentProcessId
ObQueryNameString
ObfReferenceObject
KeDelayExecutionThread
IoGetDeviceProperty
IoInitializeRemoveLockEx
InitSafeBootMode
KeClearEvent
KeResetEvent
_purecall
IoBuildSynchronousFsdRequest
MmUnmapIoSpace
MmMapIoSpace
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
ExEventObjectType
ZwCreateEvent
ZwDeviceIoControlFile
NtCreateFile
KeReleaseSemaphore
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
PsGetVersion
IoGetCurrentProcess
PsCreateSystemThread
IofCompleteRequest
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeInitializeSemaphore
ExInitializeResourceLite
ExDeleteResourceLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ObReferenceObjectByPointer
PsThreadType
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
KeReadStateSemaphore
ExSemaphoreObjectType
ObInsertObject
ObCreateObject
ObOpenObjectByName
PoStartNextPowerIrp
PoCallDriver
IoAttachDeviceToDeviceStack
IoReleaseRemoveLockEx
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoAcquireRemoveLockEx
RtlVerifyVersionInfo
VerSetConditionMask
KeQueryActiveProcessors
NtFsControlFile
RtlInitializeBitMap
RtlSetBits
RtlAreBitsClear
RtlClearBits
RtlAreBitsSet
_wcsicmp
ZwQueryVolumeInformationFile
tolower
NtQueryInformationFile
ZwReadFile
ZwCreateFile
wcsstr
ZwWriteFile
NtSetInformationFile
ZwDeleteFile
NtClose
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
_strnicmp
_vsnwprintf
RtlCheckRegistryKey
ZwOpenFile
wcschr
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeleteKey
IoAllocateIrp
RtlFreeUnicodeString
RtlUpcaseUnicodeString

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
INIT
.rdata
.data
.pdata
LOCKDATA
bghkprms
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	PGPwded.sys
Creation Timestamp	2024-02-07 15:41:42
MD5	ef4d6fa6679fc8dfa9d223408124c884
SHA1	8148913cb9a748b8d9d1ad5863e8075ceee6f10f
SHA256	90c7fe509129a8095319c3d4ce7e867f503321a1d41d23b674dcf2adfd7424fa
Authentihash MD5	d92486c7ae23002234964b8b403a69e6
Authentihash SHA1	ac40ff2c75649245653fe1230d6056371b040de4
Authentihash SHA256	01447fccc18760cdbe70f3eb020d5944d56926bcd16da2cc3a07236e87e89a9f
RichPEHeaderHash MD5	ef617c4b4467cdcb5439d95de9c05868
RichPEHeaderHash SHA1	868fbb2829b7e96d37df317eb08c75bc405e24e8
RichPEHeaderHash SHA256	bef207ec5001c4dfc87c6da4f458bd7974cadb9aa1638fe87bbc3b4f24b36626
Company	CA, Inc., a Broadcom subsidiary
Description	PGPwde NT/Win2k driver
Product	Symantec Encryption Desktop
OriginalFilename	PGPwded.sys

Download

Certificates

Expand

Certificate 08ad40b260d29c4c9f5ecda9bd93aed9

Field	Value
ToBeSigned (TBS) MD5	5d8003a64dfa5a4d88365da1566038cb
ToBeSigned (TBS) SHA1	79465b56bc7ad55a37bdf633943da8bfc84db228
ToBeSigned (TBS) SHA256	84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332
Subject	C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
ValidFrom	2021-04-29 00:00:00
ValidTo	2036-04-28 23:59:59
Signature	3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e
SignatureAlgorithmOID	1.2.840.113549.1.1.12
IsCertificateAuthority	True
SerialNumber	08ad40b260d29c4c9f5ecda9bd93aed9
Version	3

Certificate 090c3aaa41901d6ad321fddea91e1366

Field	Value
ToBeSigned (TBS) MD5	c5a9b13894baa951ef81c2b092800154
ToBeSigned (TBS) SHA1	fcd2e70f37161140c551364aeda08fd0460212f2
ToBeSigned (TBS) SHA256	2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e
Subject	C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc
ValidFrom	2023-03-20 00:00:00
ValidTo	2026-03-19 23:59:59
Signature	c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	090c3aaa41901d6ad321fddea91e1366
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

NtFsControlFile
DbgPrint
RtlInitializeBitMap
RtlClearBits
RtlSetBits
RtlAreBitsClear
RtlAreBitsSet
RtlInitUnicodeString
RtlEqualUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmBuildMdlForNonPagedPool
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
PsSetLoadImageNotifyRoutine
NtBuildNumber
KeInitializeEvent
KeWaitForSingleObject
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeSetTimer
ExAllocatePoolWithTag
ExFreePoolWithTag
ExQueueWorkItem
ExCreateCallback
ExRegisterCallback
ObfDereferenceObject
ZwPowerInformation
RtlInitAnsiString
RtlDeleteRegistryValue
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeSetEvent
ExAllocatePool
MmGetSystemRoutineAddress
ObReferenceObjectByHandle
ObfReferenceObject
ZwClose
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
PsGetCurrentProcessId
ObOpenObjectByPointer
ObQueryNameString
IoGetDeviceProperty
KeClearEvent
KeResetEvent
IoInitializeRemoveLockEx
InitSafeBootMode
_purecall
IoBuildSynchronousFsdRequest
KeReleaseSemaphore
MmMapIoSpace
MmUnmapIoSpace
PsGetVersion
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoGetCurrentProcess
IoRegisterShutdownNotification
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
NtCreateFile
ZwCreateEvent
ExEventObjectType
MmMapLockedPagesSpecifyCache
KeInitializeSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
wcsstr
_wcsicmp
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
NtQueryInformationFile
NtSetInformationFile
NtClose
ZwDeleteFile
MmUnlockPages
MmUnmapLockedPages
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
ObReferenceObjectByPointer
PsThreadType
ObOpenObjectByName
ExSemaphoreObjectType
IoAttachDeviceToDeviceStack
IoDetachDevice
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
VerSetConditionMask
RtlVerifyVersionInfo
tolower
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
_strnicmp
wcschr
RtlCheckRegistryKey
ZwOpenFile
_vsnwprintf
IoAllocateIrp
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
.rdata
.data
.pdata
LOCKDATA
bghkprms
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	eedDiskEncryptionDriver.sys
Creation Timestamp	2016-04-27 21:08:54
MD5	d5f0f35134135206dd1986b4c8b19794
SHA1	5c757a3f97b15fc44550c5853eefcd2cc5f90997
SHA256	435f56a1f5bf3f89a29125b4e42396bb8d1499d20a5d4db865a35df23c41844f
Authentihash MD5	0093d69ee026ec06fbd518dfe0984e45
Authentihash SHA1	6a2d6498b6300061830208a7081dedfe3a7b19f8
Authentihash SHA256	792f87a87cef485e0d41c43096cf36233299ef6457688bb35b1f68c42dfb9831
RichPEHeaderHash MD5	922c838586773519d8094411dc598335
RichPEHeaderHash SHA1	7f82fd611fd5461571372b61b6b016ad82ed3d4b
RichPEHeaderHash SHA256	5f91815a137653469192eff988326ae24b75797d9a936bf3186d69a0b40ed561
Company	Symantec Corporation
Description	Disk Encryption Driver
Product	Client for Symantec Endpoint Encryption
OriginalFilename	eedDiskEncryptionDriver.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 20b44682a0de2a8026a1c3d781e63fc0

Field	Value
ToBeSigned (TBS) MD5	de8691740d00b889e29007e596f2ac08
ToBeSigned (TBS) SHA1	932d2606a168b39b42094c75453b30dcad60af83
ToBeSigned (TBS) SHA256	35b4c2f8a8402febb1e6864f1365ec623dd08fcfc9731d2c30889d962531ef67
Subject	C=US, ST=California, L=Mountain View, O=Symantec Corporation, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Symantec Corporation
ValidFrom	2013-08-08 00:00:00
ValidTo	2016-11-06 23:59:59
Signature	4f98f0c2944dc1718f98e860924987d1428e5d8d9e88733eee6ccef0014655e860f461c8430efbd33dd69448a0a1f0489a79c27bf11415e945fc0ed346dfd59ea1a63ab1044efc2c130d3f8fe80da8dde7d4ca30e66a0f5c9703db2043afc4924f14b508e686148782d01c84bf538a36f722381e73ab806015af06d747857bf8bb52c014b2ab84a03981bee6a213609c0bfeece2b9ac22b1fe008a43480eba170cb6dbcb2ca4644c0630ccb6fa147ff0ed5dccd1b04a5d09e07a3dde2348e766a71009469da06c09f0a0943183e755e3bf8a0d9b9e7c180c84d28299ac7e7ed5307bbfde7704276e0f62c82c96bd4599c9a1c47db0cfa6b4bf43b61759eb54aa
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	20b44682a0de2a8026a1c3d781e63fc0
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
PGPCE.SYS

Imported Functions

Expand

RtlInitUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
NtClose
ZwDeleteFile
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
RtlCompareUnicodeString
wcschr
RtlCheckRegistryKey
ZwOpenFile
KeResetEvent
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ObReferenceObjectByPointer
RtlEqualUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmBuildMdlForNonPagedPool
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
PsSetLoadImageNotifyRoutine
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeSetTimer
ExQueueWorkItem
ExCreateCallback
ExRegisterCallback
ZwPowerInformation
RtlInitAnsiString
RtlDeleteRegistryValue
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
CmUnRegisterCallback
CmRegisterCallbackEx
ObReferenceObjectByHandle
ObfReferenceObject
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
ObOpenObjectByPointer
ObQueryNameString
IoGetDeviceProperty
KeClearEvent
KeReadStateEvent
IoInitializeRemoveLockEx
ZwQueryInformationFile
InitSafeBootMode
_wcsicmp
ExAllocatePoolWithQuotaTag
KeReleaseSemaphore
MmGetSystemRoutineAddress
MmMapIoSpace
MmUnmapIoSpace
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoGetCurrentProcess
IoRegisterShutdownNotification
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ExEventObjectType
MmMapLockedPagesSpecifyCache
KeInitializeSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
PsTerminateSystemThread
MmUnlockPages
MmUnmapLockedPages
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
ObOpenObjectByName
ExSemaphoreObjectType
IoAttachDeviceToDeviceStack
IoDetachDevice
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
VerSetConditionMask
RtlVerifyVersionInfo
KeQueryActiveProcessors
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlFreeUnicodeString
wcsstr
__C_specific_handler
ZwCreateEvent
ZwClose
NtBuildNumber
RtlAreBitsSet
RtlAreBitsClear
RtlSetBits
RtlClearBits
RtlInitializeBitMap
DbgPrint
KeWaitForSingleObject
KeSetEvent
KeInitializeEvent
strcmp
NtFsControlFile
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
KeBugCheckEx
ZwDeleteKey
ZwEnumerateKey
IoAllocateIrp
RtlUpcaseUnicodeString
ExpInterlockedPopEntrySList
ExQueryDepthSList
_purecall
_vsnwprintf
_vsnprintf
wcslen
IoBuildSynchronousFsdRequest
strlen
PGPceUnpack
PGPceGetDerivedKey
PGPceNewKDF
PGPcePeekContextMemoryMgr
PGPceFreeData
PGPceNewData
PGPceNewMemoryMgrExternalP2
PGPceDiskBlockEncryptionDecrypt
PGPceDiskBlockEncryptionEncrypt
PGPceInitDiskBlockEncryption
PGPceNewDiskBlockEncryptionContext
PGPceGetSymmetricCipherSizes
PGPceSymmetricCipherDecrypt
PGPceSymmetricCipherEncrypt
PGPceInitSymmetricCipher
PGPceNewSymmetricCipherContext
PGPceGetSDKErrorState
PGPceFinalizeHash
PGPceContinueHash
PGPceNewHashContext
PGPceFreeObject
PGPceFreeContext
PGPceNewContext
PGPceFreeMemoryMgr
PGPceNewMemoryMgrExternal
PGPcePack

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
.rdata
.data
.pdata
LOCKDATA
bghkprms
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	eedDiskEncryptionDriver.sys
Creation Timestamp	2017-06-20 13:34:09
MD5	29b98854c8dbf6f7859ec913b09fc185
SHA1	fceae2e110919fcbb953d75d460bc55e3e4165b9
SHA256	fab797f9e498b078dbea8c05e7ddcf157db9aa902e2f7c0e89e21c1308867f16
Authentihash MD5	511fecad28c220398c026a5730c9571b
Authentihash SHA1	f5bc1f93fb491cf96608959bdfd48d9d4d8319ac
Authentihash SHA256	c60e5c41c65ea34c8cda7eac06018fd33feb2b43d5b283275e87f161fd259fea
RichPEHeaderHash MD5	922c838586773519d8094411dc598335
RichPEHeaderHash SHA1	7f82fd611fd5461571372b61b6b016ad82ed3d4b
RichPEHeaderHash SHA256	5f91815a137653469192eff988326ae24b75797d9a936bf3186d69a0b40ed561
Company	Symantec Corporation
Description	Disk Encryption Driver
Product	Client for Symantec Endpoint Encryption
OriginalFilename	eedDiskEncryptionDriver.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 0f2d17e62e571f288acb5666fd3c5230

Field	Value
ToBeSigned (TBS) MD5	bf3e672d7cdd9596fe28d02c40aaa83b
ToBeSigned (TBS) SHA1	5c1ccf094c7e4627d5a60c368a134416cea1d2fd
ToBeSigned (TBS) SHA256	63eadd5ecf45a5e861c4e62f0e4c7dad04dde0ff2a2a9ef05daa43d517d421ad
Subject	C=US, ST=California, L=San Francisco, O=Symantec Corporation, OU=DATA LOSS PREVENTION, CN=Symantec Corporation
ValidFrom	2016-10-18 00:00:00
ValidTo	2018-01-01 23:59:59
Signature	ad012225094fdb9c9350d249bc3ea97801503eaf00316a887a3d71aec777c7ba620dfc45cfe2362232f1f63c56c3de93b173fcbf4e66e446be32bf2cd95559516278e9cd63f033b721ece440ca556ac7506db206e4dd7b3b86f8f327566c21fc6e2b2f6401891711aaa97e23935adcced32dce9113051434a56e1e5f45d1cf65c7f3c95c6c0a5b0699af73dbb58d9f1d186a2c747fcc71c6031e8fe564cbab54ce2b312b9c6689a83c19ebad25b17e3c885b485721f5d822c00103635fe6b2984e04bc714796715e2bb572cd8c655a804b059fbfb83bb9cf025ac76061ec4d36ce34be1b8b41690b83c9796f7becdaf709090dfd6f6f47451c3c9f1109dd46ef
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0f2d17e62e571f288acb5666fd3c5230
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
PGPCE.SYS

Imported Functions

Expand

RtlInitUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
NtClose
ZwDeleteFile
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
RtlCompareUnicodeString
wcschr
RtlCheckRegistryKey
ZwOpenFile
KeResetEvent
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ObReferenceObjectByPointer
RtlEqualUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmBuildMdlForNonPagedPool
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
PsSetLoadImageNotifyRoutine
ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
KeInitializeDpc
KeInitializeTimer
KeCancelTimer
KeSetTimer
ExQueueWorkItem
ExCreateCallback
ExRegisterCallback
ZwPowerInformation
RtlInitAnsiString
RtlDeleteRegistryValue
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
CmUnRegisterCallback
CmRegisterCallbackEx
ObReferenceObjectByHandle
ObfReferenceObject
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
ObOpenObjectByPointer
ObQueryNameString
IoGetDeviceProperty
KeClearEvent
KeReadStateEvent
IoInitializeRemoveLockEx
ZwQueryInformationFile
InitSafeBootMode
_wcsicmp
ExAllocatePoolWithQuotaTag
KeReleaseSemaphore
MmGetSystemRoutineAddress
MmMapIoSpace
MmUnmapIoSpace
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoGetCurrentProcess
IoRegisterShutdownNotification
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ExEventObjectType
MmMapLockedPagesSpecifyCache
KeInitializeSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
PsTerminateSystemThread
MmUnlockPages
MmUnmapLockedPages
IoBuildAsynchronousFsdRequest
IoFreeIrp
IoFreeMdl
ObOpenObjectByName
ExSemaphoreObjectType
IoAttachDeviceToDeviceStack
IoDetachDevice
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
PoCallDriver
PoStartNextPowerIrp
VerSetConditionMask
RtlVerifyVersionInfo
KeQueryActiveProcessors
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlFreeUnicodeString
wcsstr
__C_specific_handler
ZwCreateEvent
ZwClose
NtBuildNumber
RtlAreBitsSet
RtlAreBitsClear
RtlSetBits
RtlClearBits
RtlInitializeBitMap
DbgPrint
KeWaitForSingleObject
KeSetEvent
KeInitializeEvent
strcmp
NtFsControlFile
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
KeBugCheckEx
ZwDeleteKey
ZwEnumerateKey
IoAllocateIrp
RtlUpcaseUnicodeString
ExpInterlockedPopEntrySList
ExQueryDepthSList
_purecall
_vsnwprintf
_vsnprintf
wcslen
IoBuildSynchronousFsdRequest
strlen
PGPceUnpack
PGPceGetDerivedKey
PGPceNewKDF
PGPcePeekContextMemoryMgr
PGPceFreeData
PGPceNewData
PGPceNewMemoryMgrExternalP2
PGPceDiskBlockEncryptionDecrypt
PGPceDiskBlockEncryptionEncrypt
PGPceInitDiskBlockEncryption
PGPceNewDiskBlockEncryptionContext
PGPceGetSymmetricCipherSizes
PGPceSymmetricCipherDecrypt
PGPceSymmetricCipherEncrypt
PGPceInitSymmetricCipher
PGPceNewSymmetricCipherContext
PGPceGetSDKErrorState
PGPceFinalizeHash
PGPceContinueHash
PGPceNewHashContext
PGPceFreeObject
PGPceFreeContext
PGPceNewContext
PGPceFreeMemoryMgr
PGPceNewMemoryMgrExternal
PGPcePack

Exported Functions

Expand

Sections

Expand

.text
LOCKCODE
.rdata
.data
.pdata
LOCKDATA
bghkprms
PAGE
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "08ad40b260d29c4c9f5ecda9bd93aed9",
      "Signature": "3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "TBS": {
        "MD5": "5d8003a64dfa5a4d88365da1566038cb",
        "SHA1": "79465b56bc7ad55a37bdf633943da8bfc84db228",
        "SHA256": "84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332",
        "SHA384": "65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"
      },
      "ValidFrom": "2021-04-29 00:00:00",
      "ValidTo": "2036-04-28 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Signature": "c148313259f374267daf171fa9658ee0c8ef1c0327fbe952fb5b412b4806bae75ff59a7419901e353f14ba25e3029d870500e4f1566ea03061e0fb26aa245cae584c7f9a4654bdf4ab1e88dbb66feb997042a038780b219b0398dc88200cfbbe5d1b3b347b8e6e930e2554961ae74e18f1ddf3b534da902d7002935de051fa78c4a89a143486c3c489ad97bbe0d2e28dec3f2b0d9b01f800b19165eec9248b731d3d457f8ecc0adb61017b7476f4d339e1cf24f52f22c24e80f7c0c466ccab54dde8928e5a7ca9da5986f9a1f6c8b3c3297c778b9504a2612209325b9682e7aad89578af015847813c0761f15400c68c5965116375cbe628f88cfcb5593ae75d899ffe47bce7e4302984863dfab7e607082c5603a39e8f89309b32613f1cc9598aa85e4ba8b219ae46da7b72caf3e21c2969a467b6b8a6e1199df6c0a5b0d9022c5686762580bf7712db09ebdb47fff0f86463d6ce836ddca7d8187d8e13a2af27f0ba6aa533d8ca9fd04f4c4118ee0e7c74f5aa35adc432abaa2d8d0ad59ed5c973ae1ca885a00f339a4f3d75ae788d103d29d3261948b88b400007d339d0cbd5bc48335a0ef664e47ceae4f453858854122d28bab50207b7d5bac8430e6b2425ff246c14b9c95eb868d6fe1ab1759890610fe71fdae9c454ef3cafe77751ef79fe5d28bc00e3c2b69c65954b6c89cd2be6bda8a7348073834af1c72aae9d0d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=California, L=San Jose, O=Broadcom Inc, CN=Broadcom Inc",
      "TBS": {
        "MD5": "c5a9b13894baa951ef81c2b092800154",
        "SHA1": "fcd2e70f37161140c551364aeda08fd0460212f2",
        "SHA256": "2bd8039f7bab429ce858701eae8e80f453b1f824923511c96af7e6a1f4a7df1e",
        "SHA384": "e21db8148aad738da556a69292561419f1278df1988e56d0f60921b92bd04bd1b3f748e4315c37bcde2f143f7e6f73a7"
      },
      "ValidFrom": "2023-03-20 00:00:00",
      "ValidTo": "2026-03-19 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "SerialNumber": "090c3aaa41901d6ad321fddea91e1366",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2026-09-08

1a0fab94-f4a7-48c2-a2f4-72d19c382642

PGPwded.sys

Description

Block PGPwded.sys across your endpoints

Commands

Detections

YARA 🏹

Sigma 🛡️

Sysmon 🔎

Resources

CVE

Known Vulnerable Samples

Certificates

Certificate 08ad40b260d29c4c9f5ecda9bd93aed9

Certificate 090c3aaa41901d6ad321fddea91e1366

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 7b46246b3b56ee913595ac77d43f7239

Certificate 3d78d7f9764960b2617df4f01eca862a

Certificate 611993e400000000001c

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Certificate 0ecff438c8febf356e04d86a981b1a50

Certificate 14baa0a5163f9626e487698c694a601c

Certificate 611993e400000000001c

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Certificate 0ecff438c8febf356e04d86a981b1a50

Certificate 14baa0a5163f9626e487698c694a601c

Certificate 611993e400000000001c

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 08ad40b260d29c4c9f5ecda9bd93aed9

Certificate 090c3aaa41901d6ad321fddea91e1366

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Certificate 0ecff438c8febf356e04d86a981b1a50

Certificate 20b44682a0de2a8026a1c3d781e63fc0

Certificate 611993e400000000001c

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Certificate 0ecff438c8febf356e04d86a981b1a50

Certificate 0f2d17e62e571f288acb5666fd3c5230

Certificate 611993e400000000001c

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Imports

Imported Functions

Exported Functions

Sections