← Back to driver explorer
Driver intelligenceVulnerableVerified
WinRing0.sys
OpenLibSys WinRing0 hardware-access drivers expose MSR, I/O-port, and physical-memory operations to user mode. Attackers can abuse these primitives for kernel-memory access and security-control tampering.
Known samples 10
1 recorded TRUE · 9 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
WinRing0.sysSample 1 · HVCI FALSE
- MD5
828bb9cb1dd449cd65a29b18ec46055f- SHA1
558aad879b6a47d94a968f39d0a4e3a3aaef1ef1- SHA256
3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8- Imphash
d6f977640d4810a784d152e4d3c63a6b- Authentihash MD5
650fa4b522e8d06d0cdfa4bf278e85f1- Authentihash SHA1
dfe2533a4398d67dfc722eb8d9f8ffa3a823a721- Authentihash SHA256
7188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3- Machine
- AMD64
- Version
- 1.0.1.2
- Publisher
- OpenLibSys.org
WinRing0.sysSample 2 · HVCI FALSE
- MD5
12cecc3c14160f32b21279c1a36b8338- SHA1
7fb52290883a6b69a96d480f2867643396727e83- SHA256
47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84- Imphash
d6f977640d4810a784d152e4d3c63a6b- Authentihash MD5
650fa4b522e8d06d0cdfa4bf278e85f1- Authentihash SHA1
dfe2533a4398d67dfc722eb8d9f8ffa3a823a721- Authentihash SHA256
7188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3- Machine
- AMD64
- Version
- 1.0.1.2
- Publisher
- OpenLibSys.org
WinRing0.sysSample 3 · HVCI TRUE
- MD5
27bcbeec8a466178a6057b64bef66512- SHA1
012db3a80faf1f7f727b538cbe5d94064e7159de- SHA256
a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062- Imphash
d6f977640d4810a784d152e4d3c63a6b- Authentihash MD5
c4355451eccb590e5e6d817760d2d2ef- Authentihash SHA1
7aed8186977fcf7ee219da493baecdb95ec8040d- Authentihash SHA256
9305f0834e67aa16fb252bd30927e5f835639ef4b868f20d232260edffefd6f0- Machine
- AMD64
- Version
- 1.2.0.5
- Publisher
- OpenLibSys.org
WinRing0x64.sysSample 4 · HVCI FALSE
- MD5
0c0195c48b6b8582fa6f6373032118da- SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299- SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5- Imphash
d41fa95d4642dc981f10de36f4dc8cd7- Authentihash MD5
2bab314d894a026ac6073efe43c14a3d- Authentihash SHA1
266821a39174d29f6f8791cf9f44f1a1f3439dda- Authentihash SHA256
1b845e5e43ce9e9b645ac198549e81f45c08197aad69708d96cdb9a719eb0e29- Machine
- AMD64
- Version
- 1.2.0.5
- Publisher
- OpenLibSys.org
WinRing0.sysSample 5 · HVCI FALSE
- MD5
845af1ba23c8d5e64def61bcc441604c- SHA1
8ac34eb21b9b38f67cd29684c45696c20ab2e75a- SHA256
206ee7a7c3f4d9496f742ccb84718f556ecb4ba2a95fe7e0cdf3a003ffbe4597- Imphash
7cf815757705e26b809574488ed56d0e- Authentihash MD5
4f656b084d9df85129cddc642ae8a5e7- Authentihash SHA1
a04d7019946d9dd3516150b4789de92fd31870af- Authentihash SHA256
b051e5898c7154161b57a6acc7595873c44a3772bd48da71f14a9204cd46babe- Machine
- I386
- Version
- 1.2.0.5
- Publisher
- OpenLibSys.org
WinRing0x64.sysSample 6 · HVCI FALSE
- MD5
1c57d067b9fc5e9ef9aeb14223481243- SHA1
4ee59164d3259667d3cade58f4c93b4dddf5a92b- SHA256
d5bca2ca464a6cc91344bd85e812a7bac6e7c67038c4929a29e0bc60c7eabe4d- Imphash
345a00bc31828117dd5247b4d3d32ee3- Authentihash MD5
c8bddfc109c3949bd94893036cb8fe23- Authentihash SHA1
c678f2d2c64fd4b2141958ed4bbf552a29dd81f4- Authentihash SHA256
93ae26aa102215c0e9aa3b4f2f5a480c9c9b8a18f102c5fd87979d8697a69a69- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinRing0x64.sysSample 7 · HVCI FALSE
- MD5
6174b6fcd8815c6c6945ac972be924a4- SHA1
6a22a46f613ed4518d2b971da01b5099e2ea6ec9- SHA256
14d00976162a5d3238d183704fd84b50c3c5dcc762cab3c8adb5faf0a3caab99- Imphash
b62e9f4f8363c29992802646a5b4fa4b- Authentihash MD5
63266815c692055530654c1e7ed02d94- Authentihash SHA1
34702488beaa60358d989fb3f97c39469fe4ebdb- Authentihash SHA256
ecf58fd2ad36e4d1462f7f9c697ea73e94f5160953ca0b5c34076786c8efc745- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinRing0.sysSample 8 · HVCI FALSE
- MD5
bc273c0f3c14e19822114cd2bc5b6a97- SHA1
64b2a9ec6f8bf2ad27bc4aa75aefd0cb17b7119f- SHA256
a3e3cdbd8c781960a77efb5655a6b7c3bac8d5926aaf687108a57d99b78538fc- Imphash
b62e9f4f8363c29992802646a5b4fa4b- Authentihash MD5
b3bcb9e9b3c87b982b4d63a08d5c5e18- Authentihash SHA1
c974c8ca7a715070ae261fab586035545f56a3fe- Authentihash SHA256
0fffcee9a0270a8160b48885799d2ac099f2e4ee915d3fc3302786e7b83a9429- Machine
- AMD64
- Version
- 1.2.0.5
- Publisher
- OpenLibSys.org
WinRing0.sysSample 9 · HVCI FALSE
- MD5
b94c5984c8328ef8c8a5533ee10b59e2- SHA1
9c249d366ab4bca598cb4213a474a56b960cef6d- SHA256
489c0e3a8d70037eba46810c0d1c93a10e2796d809eb35023e5977d6902cb744- Imphash
d909815ce3d795b1d2854e16592b5f5c- Authentihash MD5
0ad2e067ce9a16248f279c193f0f4534- Authentihash SHA1
57828b17ad80cfeb14defd996fe6523dba165651- Authentihash SHA256
46a02c4a9e9fd3700544ff7053ef6b599f7145cbbed25380269af35a1dc35a05- Machine
- AMD64
- Version
- 1.2.0.6
- Publisher
- OpenLibSys.org
WinRing0.sysSample 10 · HVCI FALSE
- MD5
3eb13af71e265728e7cb06c4e958c3f8- SHA1
d08d07a760eaebfda0fb1a44ece35af13172a02f- SHA256
3eb166c2117da2dd9a43bd2fbb083d2d4535e9f57c5060053986c06bf3dd275f- Imphash
a095f31019d7a32d0a0507879a1822b1- Authentihash MD5
95fd5c10a29ef9e123ed2be259da0c76- Authentihash SHA1
555d877accd5071da2e0af4b353c9a6f33514fa6- Authentihash SHA256
50a6984729650cd8019484e6f19bc63cd4615199031e873c2093cdd6fb86ee14- Machine
- AMD64
- Version
- 1.2.0.5
- Publisher
- OpenLibSys.org
Recorded command
sc.exe create WinRing0.sys binPath=C:\windows\temp\WinRing0.sys type=kernel && sc.exe start WinRing0.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: fluffycats31 @fluffycats31