7bb5ff05-25f8-410d-ae99-c8e8f082d24f

WinRing0.sys :inline

Description

WinRing0.sys is a vulnerable driver and more information will be added as found.

  • UUID: 7bb5ff05-25f8-410d-ae99-c8e8f082d24f
  • Created: 2023-01-09
  • Author: Michael Haag
  • Acknowledgement: |

Download

This download link contains the vulnerable driver!

Commands

sc.exe create WinRing0.sys binPath=C:\windows\temp\WinRing0.sys type=kernel && sc.exe start WinRing0.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/namazso/physmem_drivers
  • https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md

    • Known Vulnerable Samples

    PropertyValue
    FilenameWinRing0.sys
    Creation Timestamp2007-12-15 01:04:52
    MD5828bb9cb1dd449cd65a29b18ec46055f
    SHA1558aad879b6a47d94a968f39d0a4e3a3aaef1ef1
    SHA2563ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8
    Authentihash MD5650fa4b522e8d06d0cdfa4bf278e85f1
    Authentihash SHA1dfe2533a4398d67dfc722eb8d9f8ffa3a823a721
    Authentihash SHA2567188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3
    RichPEHeaderHash MD56c9272bb390e89b75934eea3b15a1858
    RichPEHeaderHash SHA116dab615286d22f060143bb9316a28122f8e4d1b
    RichPEHeaderHash SHA2564a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a
    CompanyOpenLibSys.org
    DescriptionWinRing0
    ProductWinRing0
    OriginalFilenameWinRing0.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4191a15a3978dfcf496566381d4c75c2
    FieldValue
    ToBeSigned (TBS) MD541011f8d0e7c7a6408334ca387914c61
    ToBeSigned (TBS) SHA1c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
    ToBeSigned (TBS) SHA25688dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
    ValidFrom2004-07-16 00:00:00
    ValidTo2014-07-15 23:59:59
    Signatureae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4191a15a3978dfcf496566381d4c75c2
    Version3
    Certificate 450d3382b4c87b8d7220cff8951f1aa2
    FieldValue
    ToBeSigned (TBS) MD5dfda998e348c0cd822de571eefd95842
    ToBeSigned (TBS) SHA1873c99b0c3d5715130af541dcaed94e096c665b3
    ToBeSigned (TBS) SHA256747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6
    SubjectC=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.
    ValidFrom2006-11-30 00:00:00
    ValidTo2010-01-29 23:59:59
    Signature35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber450d3382b4c87b8d7220cff8951f1aa2
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • MmUnmapIoSpace
    • MmMapIoSpace
    • IofCompleteRequest
    • IoDeleteDevice
    • IoCreateDevice
    • KeBugCheckEx
    • RtlInitUnicodeString
    • IoCreateSymbolicLink
    • IoDeleteSymbolicLink
    • __C_specific_handler
    • HalSetBusDataByOffset
    • HalGetBusDataByOffset

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "3825d7faf861af9ef490e726b5d65ad5",
      "Signature": "50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2",
      "TBS": {
        "MD5": "d6c7684e9aaa508cf268335f83afe040",
        "SHA1": "18066d20ad92409c567cdfde745279ff71c75226",
        "SHA256": "a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff",
        "SHA384": "35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"
      },
      "ValidFrom": "2007-06-15 00:00:00",
      "ValidTo": "2012-06-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "47bf1995df8d524643f7db6d480d31a4",
      "Signature": "4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA",
      "TBS": {
        "MD5": "518d2ea8a21e879c942d504824ac211c",
        "SHA1": "21ce87d827077e61abddf2beba69fde5432ea031",
        "SHA256": "1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7",
        "SHA384": "53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"
      },
      "ValidFrom": "2003-12-04 00:00:00",
      "ValidTo": "2013-12-03 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "4191a15a3978dfcf496566381d4c75c2",
      "Signature": "ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "TBS": {
        "MD5": "41011f8d0e7c7a6408334ca387914c61",
        "SHA1": "c7fc1727f5b75a6421a1f95c73bbdb23580c48e5",
        "SHA256": "88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0",
        "SHA384": "a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"
      },
      "ValidFrom": "2004-07-16 00:00:00",
      "ValidTo": "2014-07-15 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Signature": "35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.",
      "TBS": {
        "MD5": "dfda998e348c0cd822de571eefd95842",
        "SHA1": "873c99b0c3d5715130af541dcaed94e096c665b3",
        "SHA256": "747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6",
        "SHA384": "0a5669530912b1b0e566b775057dfe6f8b8611a780e59eaae90d95dfa3d36ae7cc509713e739453471cded2cf6807d86"
      },
      "ValidFrom": "2006-11-30 00:00:00",
      "ValidTo": "2010-01-29 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameWinRing0.sys
    Creation Timestamp2007-12-15 01:04:52
    MD512cecc3c14160f32b21279c1a36b8338
    SHA17fb52290883a6b69a96d480f2867643396727e83
    SHA25647eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84
    Authentihash MD5650fa4b522e8d06d0cdfa4bf278e85f1
    Authentihash SHA1dfe2533a4398d67dfc722eb8d9f8ffa3a823a721
    Authentihash SHA2567188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3
    RichPEHeaderHash MD56c9272bb390e89b75934eea3b15a1858
    RichPEHeaderHash SHA116dab615286d22f060143bb9316a28122f8e4d1b
    RichPEHeaderHash SHA2564a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a
    CompanyOpenLibSys.org
    DescriptionWinRing0
    ProductWinRing0
    OriginalFilenameWinRing0.sys

    Download

    Certificates

    Expand
    Certificate 01000000000115372421a8
    FieldValue
    ToBeSigned (TBS) MD5c11203d7c1fcb38e1eaff246bb8e7595
    ToBeSigned (TBS) SHA199f00de6eefb2076662465e682a2429373ebcb26
    ToBeSigned (TBS) SHA25608a073aa77d42d608a9457a6b1d63eadcf5113407d8a55025ea1bbef0716dca5
    SubjectC=JP, CN=Noriyuki MIYAZAKI, emailAddress=hiyohiyo@crystalmark.info
    ValidFrom2007-09-24 10:50:55
    ValidTo2008-09-24 10:50:55
    Signature4b6c4ea808b550cbae0f97c27726a0445d0e3e021ee0e0087bfe5bbc290e3e45ca35333f2a97fb7667f64326629f7a99fe2fec4da9fe14f0d858419982b983457848fbd6a9115769db6c5626b4d2f87fc77019a755a9efdf81b1968dfbfa638bf87bd25a8adf1c6c3bba3735f06b54d127462ed40dc364ad4c4f29c9f9692b29ff9557300a7c0d395f250172e312ff253b7ce8885ef8c1fe60c448676180e4ca09b34b52ae116b01f22b446b827a748ca80aee5f8e9ff6725e1dce5a7984c26eb72a615a9ef272f6f7b2e03e6d34665caf506b93cb5a2de127177eb1923cf5bc499e312d6c43ff5a26124ea63a4dc9a3340daa6449c2322857adf98166423cfb
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber01000000000115372421a8
    Version3
    Certificate 040000000000f97faa2e1e
    FieldValue
    ToBeSigned (TBS) MD559466cb0c1788b2f251fce3495837102
    ToBeSigned (TBS) SHA1c5cfc5f6a131a3a77c3905c9893c99bb1b2baa0b
    ToBeSigned (TBS) SHA256eedda02668f7636eeec69429a7164cc47ca3de0539122d37f5b8078df7ee56db
    SubjectCN=GlobalSign RootSign Partners CA, OU=RootSign Partners CA, O=GlobalSign nv,sa, C=BE
    ValidFrom2003-12-16 13:00:00
    ValidTo2014-01-27 11:00:00
    Signature5c2f2e674a26b3e7b53f353cdda003ed569af9443752163065c7d14ea20f8db7b6b6678ee74cec8d95bee6cea7227874acd7f87499b3f7ce8b1338d596cc8d76c52f38b23aae61be0b8799e321626423398d84f6858df777ffb03806f07ec1485fb5ee582606660522749283a7dbb5f992e3e8c3192c2e63efbb1fdff9f70747660d0789977ef8332c9ecbae143df11cdfa3f179afc8928f9471c4d144c554db1eb50b0aa942a3afd643391dee8f9398585bbe6e9c0bf563ec5e99c2f954fa010746da0db06424cf8ed1061d4f3ca26377455ba4bc5fb080bb31e00b54015c161d724ed52a6947d11b667e5f016ef135916be02efeb045d81627b5c58bc2da53
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber040000000000f97faa2e1e
    Version3
    Certificate 04000000000108d9611cd6
    FieldValue
    ToBeSigned (TBS) MD5698f075151097d84c0b1f3e7bc3d6fca
    ToBeSigned (TBS) SHA1041750993d7c9e063f02dfe74699598640911aab
    ToBeSigned (TBS) SHA256a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8
    SubjectC=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA
    ValidFrom1999-01-28 12:00:00
    ValidTo2014-01-27 11:00:00
    Signaturea0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber04000000000108d9611cd6
    Version3
    Certificate 0400000000011092eb8295
    FieldValue
    ToBeSigned (TBS) MD511d73a3638fc78e0bac6c459feadcc42
    ToBeSigned (TBS) SHA16636f7dcf81b370b919966f9063295ec84422f91
    ToBeSigned (TBS) SHA2561eb5fc1d2e3254b1e3c4587a6efed87ee65306525e684b4cfa4b51893cfe86a3
    SubjectO=GlobalSign, CN=GlobalSign Time Stamping Authority, emailAddress=timestampinfo@globalsign.com
    ValidFrom2007-02-05 09:00:00
    ValidTo2014-01-27 09:00:00
    Signature649b07caaccc411e37ef6f349cb5e8ca48f9daeafaf7172e5cad193b7311ec5adbfd7b213161c092515bb166b07c64d8fe10b471a8bc9e75379c5f6ff2da0437b8ecc003e256b7785995581d7a7c3e18d74c32bdf91ee723457fdee08d65825b45fd64c66fc3d7ea12411d0c395ef696f8c3cd9e1fff51886976988b8eb42788821ad63c7aabb04eb73ee8d434d2c1a439533cb2747b15373054a6ebb924cc2f084b4364f14aaf8d9ce8546cb2dbdc3bb1c722849f558e72a8b2a8f6f0ff03c996ebab8273dabe45561936fdba6cbc71f0d3c7c376d7e4bce2a1a67200cfbdb200ed92aa39ab09d16e3953862ad43b517398b754e9972d9977ee123e3642257f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0400000000011092eb8295
    Version3
    Certificate 04000000000108d9612448
    FieldValue
    ToBeSigned (TBS) MD52fc76031fc24eec1ef3db2d246d21d6a
    ToBeSigned (TBS) SHA175c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d
    ToBeSigned (TBS) SHA2569238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9
    SubjectC=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA
    ValidFrom2004-01-22 09:00:00
    ValidTo2014-01-27 10:00:00
    Signature11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber04000000000108d9612448
    Version3
    Certificate 610b7f6b000000000019
    FieldValue
    ToBeSigned (TBS) MD54798d55be7663a75649cda4dedc686ef
    ToBeSigned (TBS) SHA10f1ab2937b245d9466ea6f9bf056a5942e3989cf
    ToBeSigned (TBS) SHA256ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1
    SubjectC=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
    ValidFrom2006-05-23 17:00:51
    ValidTo2016-05-23 17:10:51
    Signature13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610b7f6b000000000019
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • MmUnmapIoSpace
    • MmMapIoSpace
    • IofCompleteRequest
    • IoDeleteDevice
    • IoCreateDevice
    • KeBugCheckEx
    • RtlInitUnicodeString
    • IoCreateSymbolicLink
    • IoDeleteSymbolicLink
    • __C_specific_handler
    • HalSetBusDataByOffset
    • HalGetBusDataByOffset

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "3825d7faf861af9ef490e726b5d65ad5",
      "Signature": "50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2",
      "TBS": {
        "MD5": "d6c7684e9aaa508cf268335f83afe040",
        "SHA1": "18066d20ad92409c567cdfde745279ff71c75226",
        "SHA256": "a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff",
        "SHA384": "35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"
      },
      "ValidFrom": "2007-06-15 00:00:00",
      "ValidTo": "2012-06-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "47bf1995df8d524643f7db6d480d31a4",
      "Signature": "4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA",
      "TBS": {
        "MD5": "518d2ea8a21e879c942d504824ac211c",
        "SHA1": "21ce87d827077e61abddf2beba69fde5432ea031",
        "SHA256": "1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7",
        "SHA384": "53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"
      },
      "ValidFrom": "2003-12-04 00:00:00",
      "ValidTo": "2013-12-03 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "4191a15a3978dfcf496566381d4c75c2",
      "Signature": "ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "TBS": {
        "MD5": "41011f8d0e7c7a6408334ca387914c61",
        "SHA1": "c7fc1727f5b75a6421a1f95c73bbdb23580c48e5",
        "SHA256": "88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0",
        "SHA384": "a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"
      },
      "ValidFrom": "2004-07-16 00:00:00",
      "ValidTo": "2014-07-15 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Signature": "35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.",
      "TBS": {
        "MD5": "dfda998e348c0cd822de571eefd95842",
        "SHA1": "873c99b0c3d5715130af541dcaed94e096c665b3",
        "SHA256": "747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6",
        "SHA384": "0a5669530912b1b0e566b775057dfe6f8b8611a780e59eaae90d95dfa3d36ae7cc509713e739453471cded2cf6807d86"
      },
      "ValidFrom": "2006-11-30 00:00:00",
      "ValidTo": "2010-01-29 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameWinRing0.sys
    Creation Timestamp2013-05-01 20:19:47
    MD527bcbeec8a466178a6057b64bef66512
    SHA1012db3a80faf1f7f727b538cbe5d94064e7159de
    SHA256a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062
    Authentihash MD5c4355451eccb590e5e6d817760d2d2ef
    Authentihash SHA17aed8186977fcf7ee219da493baecdb95ec8040d
    Authentihash SHA2569305f0834e67aa16fb252bd30927e5f835639ef4b868f20d232260edffefd6f0
    RichPEHeaderHash MD5bc02c8d775721faba8edc4cde3e2f975
    RichPEHeaderHash SHA10b5efeae6fcaa45d68933a6570412dea379750b9
    RichPEHeaderHash SHA2560d456f914c7a3a9b70f1a5ba7320682340381f11e9373de2d2d1585fe23e8a8e
    CompanyOpenLibSys.org
    DescriptionWinRing0
    ProductWinRing0
    OriginalFilenameWinRing0.sys

    Download

    Certificates

    Expand
    Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
    FieldValue
    ToBeSigned (TBS) MD5d0785ad36e427c92b19f6826ab1e8020
    ToBeSigned (TBS) SHA1365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
    ToBeSigned (TBS) SHA256c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
    ValidFrom2012-12-21 00:00:00
    ValidTo2020-12-30 23:59:59
    Signature03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber7e93ebfb7cc64e59ea4b9a77d406fc3b
    Version3
    Certificate 0ecff438c8febf356e04d86a981b1a50
    FieldValue
    ToBeSigned (TBS) MD5e9d38360b914c8863f6cba3ee58764d3
    ToBeSigned (TBS) SHA14cba8eae47b6bf76f20b3504b98b8f062694a89b
    ToBeSigned (TBS) SHA25688901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
    ValidFrom2012-10-18 00:00:00
    ValidTo2020-12-29 23:59:59
    Signature783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ecff438c8febf356e04d86a981b1a50
    Version3
    Certificate 26d7f5563eb3e42a81f7c715fcd2799d
    FieldValue
    ToBeSigned (TBS) MD5e994671d8d440b7739cdd9775bbca72f
    ToBeSigned (TBS) SHA1ea9446b39b968aa6953e1bf74a36435759b3d2e3
    ToBeSigned (TBS) SHA25637a9886a67c19d644c74505801f947d3b2756a5540cbd89a0c8d500511cb838d
    SubjectC=US, ST=California, L=Brea, O=EVGA, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=EVGA
    ValidFrom2012-02-29 00:00:00
    ValidTo2014-04-15 23:59:59
    Signatured77d9dbdeea6d42d15335f0b16117963e49d39b89af081160a467824968e611f0947648a83375d1380acca6cbe1117f488b428bcab943b20dad29e72dd48e7d01b080b12c444727bba415a098799abd5e5673dd7eda91787920c3cc53aac068e0a3d1faef713c14f7ec6f68f69a33340b70e81083db2ce1daf45592063235d05232a1d3d8052fc3f102b2b71e1c46275eff3d4a2dc5ee0d5d727d180da205055a3709a32ad6bd11317b1f109e7c5eca18c8293c937ba6f76278bc306c10f0f1bc865cedcf2c2331e7a7f5c0bcfab91786b8ff848d8ef9c59937ddb94f6369884162148f882e7d0c4343538ad23aeb6ab3db0f6d125a8e2fe3889e40ed66bc66a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber26d7f5563eb3e42a81f7c715fcd2799d
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • MmUnmapIoSpace
    • MmMapIoSpace
    • IofCompleteRequest
    • IoDeleteDevice
    • IoCreateDevice
    • KeBugCheckEx
    • RtlInitUnicodeString
    • IoCreateSymbolicLink
    • IoDeleteSymbolicLink
    • __C_specific_handler
    • HalSetBusDataByOffset
    • HalGetBusDataByOffset

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "3825d7faf861af9ef490e726b5d65ad5",
      "Signature": "50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2",
      "TBS": {
        "MD5": "d6c7684e9aaa508cf268335f83afe040",
        "SHA1": "18066d20ad92409c567cdfde745279ff71c75226",
        "SHA256": "a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff",
        "SHA384": "35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"
      },
      "ValidFrom": "2007-06-15 00:00:00",
      "ValidTo": "2012-06-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "47bf1995df8d524643f7db6d480d31a4",
      "Signature": "4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA",
      "TBS": {
        "MD5": "518d2ea8a21e879c942d504824ac211c",
        "SHA1": "21ce87d827077e61abddf2beba69fde5432ea031",
        "SHA256": "1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7",
        "SHA384": "53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"
      },
      "ValidFrom": "2003-12-04 00:00:00",
      "ValidTo": "2013-12-03 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "4191a15a3978dfcf496566381d4c75c2",
      "Signature": "ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "TBS": {
        "MD5": "41011f8d0e7c7a6408334ca387914c61",
        "SHA1": "c7fc1727f5b75a6421a1f95c73bbdb23580c48e5",
        "SHA256": "88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0",
        "SHA384": "a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"
      },
      "ValidFrom": "2004-07-16 00:00:00",
      "ValidTo": "2014-07-15 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Signature": "35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.",
      "TBS": {
        "MD5": "dfda998e348c0cd822de571eefd95842",
        "SHA1": "873c99b0c3d5715130af541dcaed94e096c665b3",
        "SHA256": "747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6",
        "SHA384": "0a5669530912b1b0e566b775057dfe6f8b8611a780e59eaae90d95dfa3d36ae7cc509713e739453471cded2cf6807d86"
      },
      "ValidFrom": "2006-11-30 00:00:00",
      "ValidTo": "2010-01-29 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameWinRing0x64.sys
    Creation Timestamp2008-07-26 07:29:37
    MD50c0195c48b6b8582fa6f6373032118da
    SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
    SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
    Authentihash MD52bab314d894a026ac6073efe43c14a3d
    Authentihash SHA1266821a39174d29f6f8791cf9f44f1a1f3439dda
    Authentihash SHA2561b845e5e43ce9e9b645ac198549e81f45c08197aad69708d96cdb9a719eb0e29
    RichPEHeaderHash MD56c9272bb390e89b75934eea3b15a1858
    RichPEHeaderHash SHA116dab615286d22f060143bb9316a28122f8e4d1b
    RichPEHeaderHash SHA2564a41cc91e3a5794be7d9088e93b0277f123a88d3b6568c5f92fe084bb5c78b4a
    CompanyOpenLibSys.org
    DescriptionWinRing0
    ProductWinRing0
    OriginalFilenameWinRing0.sys

    Download

    Certificates

    Expand
    Certificate 01000000000115372421a8
    FieldValue
    ToBeSigned (TBS) MD5c11203d7c1fcb38e1eaff246bb8e7595
    ToBeSigned (TBS) SHA199f00de6eefb2076662465e682a2429373ebcb26
    ToBeSigned (TBS) SHA25608a073aa77d42d608a9457a6b1d63eadcf5113407d8a55025ea1bbef0716dca5
    SubjectC=JP, CN=Noriyuki MIYAZAKI, emailAddress=hiyohiyo@crystalmark.info
    ValidFrom2007-09-24 10:50:55
    ValidTo2008-09-24 10:50:55
    Signature4b6c4ea808b550cbae0f97c27726a0445d0e3e021ee0e0087bfe5bbc290e3e45ca35333f2a97fb7667f64326629f7a99fe2fec4da9fe14f0d858419982b983457848fbd6a9115769db6c5626b4d2f87fc77019a755a9efdf81b1968dfbfa638bf87bd25a8adf1c6c3bba3735f06b54d127462ed40dc364ad4c4f29c9f9692b29ff9557300a7c0d395f250172e312ff253b7ce8885ef8c1fe60c448676180e4ca09b34b52ae116b01f22b446b827a748ca80aee5f8e9ff6725e1dce5a7984c26eb72a615a9ef272f6f7b2e03e6d34665caf506b93cb5a2de127177eb1923cf5bc499e312d6c43ff5a26124ea63a4dc9a3340daa6449c2322857adf98166423cfb
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber01000000000115372421a8
    Version3
    Certificate 040000000000f97faa2e1e
    FieldValue
    ToBeSigned (TBS) MD559466cb0c1788b2f251fce3495837102
    ToBeSigned (TBS) SHA1c5cfc5f6a131a3a77c3905c9893c99bb1b2baa0b
    ToBeSigned (TBS) SHA256eedda02668f7636eeec69429a7164cc47ca3de0539122d37f5b8078df7ee56db
    SubjectCN=GlobalSign RootSign Partners CA, OU=RootSign Partners CA, O=GlobalSign nv,sa, C=BE
    ValidFrom2003-12-16 13:00:00
    ValidTo2014-01-27 11:00:00
    Signature5c2f2e674a26b3e7b53f353cdda003ed569af9443752163065c7d14ea20f8db7b6b6678ee74cec8d95bee6cea7227874acd7f87499b3f7ce8b1338d596cc8d76c52f38b23aae61be0b8799e321626423398d84f6858df777ffb03806f07ec1485fb5ee582606660522749283a7dbb5f992e3e8c3192c2e63efbb1fdff9f70747660d0789977ef8332c9ecbae143df11cdfa3f179afc8928f9471c4d144c554db1eb50b0aa942a3afd643391dee8f9398585bbe6e9c0bf563ec5e99c2f954fa010746da0db06424cf8ed1061d4f3ca26377455ba4bc5fb080bb31e00b54015c161d724ed52a6947d11b667e5f016ef135916be02efeb045d81627b5c58bc2da53
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber040000000000f97faa2e1e
    Version3
    Certificate 04000000000108d9611cd6
    FieldValue
    ToBeSigned (TBS) MD5698f075151097d84c0b1f3e7bc3d6fca
    ToBeSigned (TBS) SHA1041750993d7c9e063f02dfe74699598640911aab
    ToBeSigned (TBS) SHA256a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8
    SubjectC=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA
    ValidFrom1999-01-28 12:00:00
    ValidTo2014-01-27 11:00:00
    Signaturea0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber04000000000108d9611cd6
    Version3
    Certificate 0400000000011092eb8295
    FieldValue
    ToBeSigned (TBS) MD511d73a3638fc78e0bac6c459feadcc42
    ToBeSigned (TBS) SHA16636f7dcf81b370b919966f9063295ec84422f91
    ToBeSigned (TBS) SHA2561eb5fc1d2e3254b1e3c4587a6efed87ee65306525e684b4cfa4b51893cfe86a3
    SubjectO=GlobalSign, CN=GlobalSign Time Stamping Authority, emailAddress=timestampinfo@globalsign.com
    ValidFrom2007-02-05 09:00:00
    ValidTo2014-01-27 09:00:00
    Signature649b07caaccc411e37ef6f349cb5e8ca48f9daeafaf7172e5cad193b7311ec5adbfd7b213161c092515bb166b07c64d8fe10b471a8bc9e75379c5f6ff2da0437b8ecc003e256b7785995581d7a7c3e18d74c32bdf91ee723457fdee08d65825b45fd64c66fc3d7ea12411d0c395ef696f8c3cd9e1fff51886976988b8eb42788821ad63c7aabb04eb73ee8d434d2c1a439533cb2747b15373054a6ebb924cc2f084b4364f14aaf8d9ce8546cb2dbdc3bb1c722849f558e72a8b2a8f6f0ff03c996ebab8273dabe45561936fdba6cbc71f0d3c7c376d7e4bce2a1a67200cfbdb200ed92aa39ab09d16e3953862ad43b517398b754e9972d9977ee123e3642257f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0400000000011092eb8295
    Version3
    Certificate 04000000000108d9612448
    FieldValue
    ToBeSigned (TBS) MD52fc76031fc24eec1ef3db2d246d21d6a
    ToBeSigned (TBS) SHA175c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d
    ToBeSigned (TBS) SHA2569238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9
    SubjectC=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA
    ValidFrom2004-01-22 09:00:00
    ValidTo2014-01-27 10:00:00
    Signature11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber04000000000108d9612448
    Version3
    Certificate 610b7f6b000000000019
    FieldValue
    ToBeSigned (TBS) MD54798d55be7663a75649cda4dedc686ef
    ToBeSigned (TBS) SHA10f1ab2937b245d9466ea6f9bf056a5942e3989cf
    ToBeSigned (TBS) SHA256ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1
    SubjectC=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
    ValidFrom2006-05-23 17:00:51
    ValidTo2016-05-23 17:10:51
    Signature13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610b7f6b000000000019
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • IoDeleteSymbolicLink
    • RtlInitUnicodeString
    • IoDeleteDevice
    • IoCreateDevice
    • MmMapIoSpace
    • KeBugCheckEx
    • IoCreateSymbolicLink
    • MmUnmapIoSpace
    • IofCompleteRequest
    • __C_specific_handler
    • HalSetBusDataByOffset
    • HalGetBusDataByOffset

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "3825d7faf861af9ef490e726b5d65ad5",
      "Signature": "50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2",
      "TBS": {
        "MD5": "d6c7684e9aaa508cf268335f83afe040",
        "SHA1": "18066d20ad92409c567cdfde745279ff71c75226",
        "SHA256": "a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff",
        "SHA384": "35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"
      },
      "ValidFrom": "2007-06-15 00:00:00",
      "ValidTo": "2012-06-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "47bf1995df8d524643f7db6d480d31a4",
      "Signature": "4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA",
      "TBS": {
        "MD5": "518d2ea8a21e879c942d504824ac211c",
        "SHA1": "21ce87d827077e61abddf2beba69fde5432ea031",
        "SHA256": "1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7",
        "SHA384": "53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"
      },
      "ValidFrom": "2003-12-04 00:00:00",
      "ValidTo": "2013-12-03 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "4191a15a3978dfcf496566381d4c75c2",
      "Signature": "ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "TBS": {
        "MD5": "41011f8d0e7c7a6408334ca387914c61",
        "SHA1": "c7fc1727f5b75a6421a1f95c73bbdb23580c48e5",
        "SHA256": "88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0",
        "SHA384": "a00aa5ed457c41e37967882644d63366bae014f03a986576d8514164d7027acf7d0b5e03d764db2558f60db148954459"
      },
      "ValidFrom": "2004-07-16 00:00:00",
      "ValidTo": "2014-07-15 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Signature": "35f3925f76c3466b8c0daadad42eb075428bf02b75db96deb7707f1c83e412baede827abc43aa2ec558328ebdd68366e3b218e534ac5e9d1df82072d5256a2cd701f2bd3548a3c18cf5264763f06886720342754f9279d80d673e9f2b2637e470ad966c0fefcc280b24786dd8fbe2f36c5e4d64376fd5d92a86d27312afdf6f6694c2954a180da2d67eeda7f61f86118b7fec7d4ac4492896c151497239031ebfaa871f762f67eed10288530df1949b56799160071956db962d3bec37a6cdcbdae597a2c2299a6c07beb4746824bc4db989f9debabf682f36ed8597e3a1123267e0cb8ec2337daf0b0b5c03d6ac0167cca5ee4ff0c9cef4b0215801bd32c9cdb",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, ST=California, L=Irvine, O=TOSHIBA AMERICA INFORMATION SYSTEMS, INC., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=TOSHIBA AMERICA INFORMATION SYSTEMS, INC.",
      "TBS": {
        "MD5": "dfda998e348c0cd822de571eefd95842",
        "SHA1": "873c99b0c3d5715130af541dcaed94e096c665b3",
        "SHA256": "747e487b2ba3288953bdeaf49c199766b2be332796fae6a41c3fbd0ff81611c6",
        "SHA384": "0a5669530912b1b0e566b775057dfe6f8b8611a780e59eaae90d95dfa3d36ae7cc509713e739453471cded2cf6807d86"
      },
      "ValidFrom": "2006-11-30 00:00:00",
      "ValidTo": "2010-01-29 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA",
      "SerialNumber": "450d3382b4c87b8d7220cff8951f1aa2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2024-04-09