c67ad48b-223e-40f8-bfc7-0cb904d0a3d7

pskmad_64.sys :inline

Description

Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. The tracked 1.0.0.16 and 1.0.0.17 builds expose IOCTL 0xB3702C08 through \Device\PSMEMDriver. After a fixed magic value, the request accepts a process, address, and caller-controlled length without relating that length to the fixed buffered-I/O header, allowing kernel-memory disclosure and buffered-output corruption.

  • UUID: c67ad48b-223e-40f8-bfc7-0cb904d0a3d7
  • Created: 2026-08-31
  • Author: Michael Haag
  • Acknowledgement: fluffycats31 | @fluffycats31

Download

This download link contains the vulnerable driver!

Block pskmad_64.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create PSKMAD type= kernel binPath= C:\\windows\\temp\\pskmad_64.sys && sc.exe start PSKMAD
Use CasePrivilegesOperating System
Read kernel memory and corrupt non-paged kernel memoryAdministratorWindows

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/magicsword-io/LOLDrivers/issues/409
  • https://github.com/fluffycats31/vulnerable-drivers
  • https://www.sophos.com/en-us/blog/multiple-vulnerabilities-discovered-in-widely-used-security-driver
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00001
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00002
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00003

    • CVE

  • CVE-2023-6330
  • CVE-2023-6331
  • CVE-2023-6332

    • Known Vulnerable Samples

    PropertyValue
    Filenamepskmad_64.sys
    Creation Timestamp2016-08-08 02:59:58
    MD59746d407113028f9cdac7031d717203e
    SHA1c582269f43c2d4e1894ff53116bccb9f4abc5acc
    SHA2567f9a397038732678c52a73e5e2238ab3619e3c1fcb2ce41efc8e5bd38d77f83e
    Authentihash MD57ff742e9f4770bf2edec876f4bd3042a
    Authentihash SHA1f3872dc5b28aaad25b16712ed0adb79eafcaf4bc
    Authentihash SHA256cf92fa9fb3067b134f3ae49b981c19bb785e90c8d6348e76f346aa12afc211dc
    RichPEHeaderHash MD5ef3d067a6fc8aaf14d02b0d9f1cc15e3
    RichPEHeaderHash SHA112994df17aa0c486650d12b437c6a69445ee5580
    RichPEHeaderHash SHA256b682b41b221846f76894542c1ed0d433443707c3b99ad2afaa2ba95b87abefee
    CompanyPanda Security, S.L.
    DescriptionPanda Kernel Memory Access Driver (x64)
    ProductPanda Technologies
    OriginalFilenamePSKMAD_64

    Download

    Certificates

    Expand
    Certificate 04000000000125071df9af
    FieldValue
    ToBeSigned (TBS) MD5f47739306d14722e670d9436eadb8e4f
    ToBeSigned (TBS) SHA1457d9df00a652cb4c3356d00145d9528fc309172
    ToBeSigned (TBS) SHA256bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7
    SubjectOU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign
    ValidFrom2009-11-18 10:00:00
    ValidTo2019-03-18 10:00:00
    Signature4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber04000000000125071df9af
    Version3
    Certificate 0400000000013189c64de1
    FieldValue
    ToBeSigned (TBS) MD5b3d3ff804abcd2e7686c126c98cc2c10
    ToBeSigned (TBS) SHA1358391557c2b6213777e282ad8efe9c8112d1b0e
    ToBeSigned (TBS) SHA2569467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca
    SubjectC=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2
    ValidFrom2011-08-02 10:00:00
    ValidTo2019-08-02 10:00:00
    Signatureaaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber0400000000013189c64de1
    Version3
    Certificate 6129152700000000002a
    FieldValue
    ToBeSigned (TBS) MD50bb058d116f02817737920f112d9fd3b
    ToBeSigned (TBS) SHA1fd116235171a4feafedee586b7a59185fb5fd7e6
    ToBeSigned (TBS) SHA256f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4
    SubjectC=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
    ValidFrom2011-04-15 19:55:08
    ValidTo2021-04-15 20:05:08
    Signature5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber6129152700000000002a
    Version3
    Certificate 11219873654df7d712c9fe7c2d374eefa7ab
    FieldValue
    ToBeSigned (TBS) MD59d408b0c2e5a1520b0508a7b242c0a5d
    ToBeSigned (TBS) SHA1a4c64020ee78bca379a16e301b527ff47862ee81
    ToBeSigned (TBS) SHA2566db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e
    SubjectBUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.
    ValidFrom2015-11-27 15:16:51
    ValidTo2016-11-27 15:16:51
    Signature24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber11219873654df7d712c9fe7c2d374eefa7ab
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • ExAllocatePoolWithTag
    • IoWMIRegistrationControl
    • ExFreePoolWithTag
    • IoWMIWriteEvent
    • RtlInitUnicodeString
    • MmGetSystemRoutineAddress
    • IoGetCurrentProcess
    • IofCompleteRequest
    • RtlCompareMemory
    • sprintf
    • ZwCreateKey
    • ExInitializeNPagedLookasideList
    • IoDeleteDevice
    • RtlGetVersion
    • ZwQueryValueKey
    • ZwClose
    • RtlCharToInteger
    • IoCreateSymbolicLink
    • wcscspn
    • ExDeleteNPagedLookasideList
    • MmSystemRangeStart
    • MmUnmapLockedPages
    • PsProcessType
    • KeSetTargetProcessorDpc
    • KeQueryActiveProcessors
    • ZwFsControlFile
    • PsLookupProcessByProcessId
    • InitializeSListHead
    • ZwQuerySymbolicLinkObject
    • ZwSetEaFile
    • ZwReadFile
    • ZwMapViewOfSection
    • ExpInterlockedPushEntrySList
    • IoCreateFile
    • MmHighestUserAddress
    • KeInitializeDpc
    • KeAcquireQueuedSpinLock
    • ExpInterlockedPopEntrySList
    • KeReleaseQueuedSpinLock
    • MmUnmapIoSpace
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ZwSetInformationFile
    • KeDetachProcess
    • KeDelayExecutionThread
    • MmGetPhysicalAddress
    • ZwWaitForSingleObject
    • PsCreateSystemThread
    • MmMapLockedPagesSpecifyCache
    • ZwUnmapViewOfSection
    • ZwQueryDirectoryFile
    • PsTerminateSystemThread
    • MmIsDriverVerifying
    • MmMapIoSpace
    • KeInsertQueueDpc
    • ZwQueryEaFile
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByHandle
    • MmProbeAndLockPages
    • KeRevertToUserAffinityThread
    • RtlEnumerateGenericTableAvl
    • MmUnlockPages
    • PsGetCurrentProcessId
    • KeSetSystemAffinityThread
    • MmIsAddressValid
    • ObfDereferenceObject
    • ZwCreateSection
    • KeNumberProcessors
    • ZwQueryInformationFile
    • ZwWriteFile
    • ObReferenceObjectByPointer
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • IoAllocateMdl
    • ZwQuerySystemInformation
    • KeBugCheckEx
    • IoCreateDevice
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • _snwprintf
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • wcschr
    • _wcsnicmp
    • RtlLengthSid
    • RtlAddAccessAllowedAce
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwOpenKey
    • ZwSetValueKey
    • RtlFreeUnicodeString
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "04000000000125071df9af",
      "Signature": "4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign",
      "TBS": {
        "MD5": "f47739306d14722e670d9436eadb8e4f",
        "SHA1": "457d9df00a652cb4c3356d00145d9528fc309172",
        "SHA256": "bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7",
        "SHA384": "b8b268a1bdf388be66a1c969b7b353cb2bbc9fad446049b7efa05a9ab3b714494e97f4d1ee1c0bae35bfd9bf6ef275b3"
      },
      "ValidFrom": "2009-11-18 10:00:00",
      "ValidTo": "2019-03-18 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0400000000013189c64de1",
      "Signature": "aaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "TBS": {
        "MD5": "b3d3ff804abcd2e7686c126c98cc2c10",
        "SHA1": "358391557c2b6213777e282ad8efe9c8112d1b0e",
        "SHA256": "9467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca",
        "SHA384": "936a127c2d468f5e4edb642c82bed11fb5df99b87cf34b8d7ddc136e979183d133dae715146d98c63af32186eb8d1bbd"
      },
      "ValidFrom": "2011-08-02 10:00:00",
      "ValidTo": "2019-08-02 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "6129152700000000002a",
      "Signature": "5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA",
      "TBS": {
        "MD5": "0bb058d116f02817737920f112d9fd3b",
        "SHA1": "fd116235171a4feafedee586b7a59185fb5fd7e6",
        "SHA256": "f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4",
        "SHA384": "c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"
      },
      "ValidFrom": "2011-04-15 19:55:08",
      "ValidTo": "2021-04-15 20:05:08",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Signature": "24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "BUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.",
      "TBS": {
        "MD5": "9d408b0c2e5a1520b0508a7b242c0a5d",
        "SHA1": "a4c64020ee78bca379a16e301b527ff47862ee81",
        "SHA256": "6db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e",
        "SHA384": "96a2b733af62a8c25756513e6f0234767176a610a44536fb728b9879aeb4dadd79fd9d54b55becc727e7b8d0036e7bac"
      },
      "ValidFrom": "2015-11-27 15:16:51",
      "ValidTo": "2016-11-27 15:16:51",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenamePSKMAD_64.sys
    Creation Timestamp2015-05-22 02:31:12
    MD5f803473cd0e5d36d02eb58109f1294cd
    SHA1afa8295865d8a9b1d35522bf2e49ced6f2294f4f
    SHA256db6ffb4100bd35d491ff1c61fb3073049c2c18038d004a6d1e279a95ab8ba2ec
    Authentihash MD596e50bd954df7b979be7da555fcb1941
    Authentihash SHA1bc2a5e5347cc2e9bc09bf269da5bf7ca1cd8bc15
    Authentihash SHA256897b1107e11dab0029bd31582a84a08e70e0f98aff3179b86cc5a0fabcec95b6
    RichPEHeaderHash MD5ef3d067a6fc8aaf14d02b0d9f1cc15e3
    RichPEHeaderHash SHA112994df17aa0c486650d12b437c6a69445ee5580
    RichPEHeaderHash SHA256b682b41b221846f76894542c1ed0d433443707c3b99ad2afaa2ba95b87abefee
    CompanyPanda Security, S.L.
    DescriptionPanda Kernel Memory Access Driver (x64)
    ProductPanda Technologies
    OriginalFilenamePSKMAD_64

    Download

    Certificates

    Expand
    Certificate 330000000cd4840c29fd1712a000000000000c
    FieldValue
    ToBeSigned (TBS) MD5518cec47456b7d55c36f58bea9c68476
    ToBeSigned (TBS) SHA1923bc6e21aaa6802adeb82ca7be7558e86eaa13f
    ToBeSigned (TBS) SHA2566a24dbb4e4809ba56db48ae26fd75677d721c6b93f36e6310c2df699ca2f55f6
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows Hardware Compatibility Publisher
    ValidFrom2015-01-14 21:31:25
    ValidTo2016-04-14 21:31:25
    Signature6285e319cd93cdbfa9ec995bc47fdeed4e31621fb94f9f16f5a59fb8bf40b0505236402f00491c6e04e1bd038d782b5b4f293cef521d23515d0b7a887566f976fe2d030d642c183c685b271b1048d1221270cc0fabce8a7404a8cffad985638f6795f93a1dd6c3f0e41fc127dbb9a423db4123559188c9e2b22f7eaf050520f62495c98a1eaa89b653ec29d6dcab6edbbd6e059698150611aaecc716071a9929c737c2be38639df5866d6a75495664f36c76431bab6c9a691b745516640ba37de6ec0c0f73c861dd63415fb387d6f638db87c6fa9a367d773cf51d67dcb50b1fb762360a27ef110ce853e604fb1c18606841c8025fe50ece666a0e7cbae169f2cb6e8552e875ae9534e48eab7d45f1737ef360c2ea87417460289a7ffd47f0f02926fcde5a9651ee492ce071c31c0637d18a5601ee903610d875c8ec0b793f08cde325da3a7b69dba7b157138cae71ed7f79ae3f1083b29a3a6392e260aa1452d6c607ba0392d9b972a7914c902c95cfbeaf95433d581f889cc7c3db6da5c4b646001d116b0d370793f8ed5210026b55d6594c07e28d555ccb3cb3a12331f8caec7ab669ffed9411385cdc43a80d85dd7ea08f5e1e4f02326a4d98c3bf6995f2b3fb044382ac7d9f6ea4d42b379630ae4846a2919a4215eaac5a331753e9f2d053c90cb41ef5ed3b1aca322b1012cb30621855734405c82c46565060d1134c6c
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber330000000cd4840c29fd1712a000000000000c
    Version3
    Certificate 330000000d690d5d7893d076df00000000000d
    FieldValue
    ToBeSigned (TBS) MD583f69422963f11c3c340b81712eef319
    ToBeSigned (TBS) SHA10c5e5f24590b53bc291e28583acb78e5adc95601
    ToBeSigned (TBS) SHA256d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014
    ValidFrom2014-10-15 20:31:27
    ValidTo2029-10-15 20:41:27
    Signature96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber330000000d690d5d7893d076df00000000000d
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • ExAllocatePoolWithTag
    • IoWMIRegistrationControl
    • ExFreePoolWithTag
    • IoWMIWriteEvent
    • RtlInitUnicodeString
    • MmGetSystemRoutineAddress
    • IoGetCurrentProcess
    • IofCompleteRequest
    • RtlCompareMemory
    • sprintf
    • ZwCreateKey
    • ExInitializeNPagedLookasideList
    • IoDeleteDevice
    • RtlGetVersion
    • ZwQueryValueKey
    • ZwClose
    • RtlCharToInteger
    • IoCreateSymbolicLink
    • wcscspn
    • ExDeleteNPagedLookasideList
    • MmSystemRangeStart
    • MmUnmapLockedPages
    • PsProcessType
    • KeSetTargetProcessorDpc
    • KeQueryActiveProcessors
    • ZwFsControlFile
    • PsLookupProcessByProcessId
    • InitializeSListHead
    • ZwQuerySymbolicLinkObject
    • ZwSetEaFile
    • ZwReadFile
    • ZwMapViewOfSection
    • ExpInterlockedPushEntrySList
    • IoCreateFile
    • MmHighestUserAddress
    • KeInitializeDpc
    • KeAcquireQueuedSpinLock
    • ExpInterlockedPopEntrySList
    • KeReleaseQueuedSpinLock
    • MmUnmapIoSpace
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ZwSetInformationFile
    • KeDetachProcess
    • KeDelayExecutionThread
    • MmGetPhysicalAddress
    • ZwWaitForSingleObject
    • PsCreateSystemThread
    • MmMapLockedPagesSpecifyCache
    • ZwUnmapViewOfSection
    • ZwQueryDirectoryFile
    • PsTerminateSystemThread
    • MmIsDriverVerifying
    • MmMapIoSpace
    • KeInsertQueueDpc
    • ZwQueryEaFile
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByHandle
    • MmProbeAndLockPages
    • KeRevertToUserAffinityThread
    • RtlEnumerateGenericTableAvl
    • MmUnlockPages
    • PsGetCurrentProcessId
    • KeSetSystemAffinityThread
    • MmIsAddressValid
    • ObfDereferenceObject
    • ZwCreateSection
    • KeNumberProcessors
    • ZwQueryInformationFile
    • ZwWriteFile
    • ObReferenceObjectByPointer
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • IoAllocateMdl
    • ZwQuerySystemInformation
    • KeBugCheckEx
    • IoCreateDevice
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • _snwprintf
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • wcschr
    • _wcsnicmp
    • RtlLengthSid
    • RtlAddAccessAllowedAce
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwOpenKey
    • ZwSetValueKey
    • RtlFreeUnicodeString
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "04000000000125071df9af",
      "Signature": "4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign",
      "TBS": {
        "MD5": "f47739306d14722e670d9436eadb8e4f",
        "SHA1": "457d9df00a652cb4c3356d00145d9528fc309172",
        "SHA256": "bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7",
        "SHA384": "b8b268a1bdf388be66a1c969b7b353cb2bbc9fad446049b7efa05a9ab3b714494e97f4d1ee1c0bae35bfd9bf6ef275b3"
      },
      "ValidFrom": "2009-11-18 10:00:00",
      "ValidTo": "2019-03-18 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0400000000013189c64de1",
      "Signature": "aaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "TBS": {
        "MD5": "b3d3ff804abcd2e7686c126c98cc2c10",
        "SHA1": "358391557c2b6213777e282ad8efe9c8112d1b0e",
        "SHA256": "9467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca",
        "SHA384": "936a127c2d468f5e4edb642c82bed11fb5df99b87cf34b8d7ddc136e979183d133dae715146d98c63af32186eb8d1bbd"
      },
      "ValidFrom": "2011-08-02 10:00:00",
      "ValidTo": "2019-08-02 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "6129152700000000002a",
      "Signature": "5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA",
      "TBS": {
        "MD5": "0bb058d116f02817737920f112d9fd3b",
        "SHA1": "fd116235171a4feafedee586b7a59185fb5fd7e6",
        "SHA256": "f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4",
        "SHA384": "c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"
      },
      "ValidFrom": "2011-04-15 19:55:08",
      "ValidTo": "2021-04-15 20:05:08",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Signature": "24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "BUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.",
      "TBS": {
        "MD5": "9d408b0c2e5a1520b0508a7b242c0a5d",
        "SHA1": "a4c64020ee78bca379a16e301b527ff47862ee81",
        "SHA256": "6db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e",
        "SHA384": "96a2b733af62a8c25756513e6f0234767176a610a44536fb728b9879aeb4dadd79fd9d54b55becc727e7b8d0036e7bac"
      },
      "ValidFrom": "2015-11-27 15:16:51",
      "ValidTo": "2016-11-27 15:16:51",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-09-08