e6378671-986d-42a1-8e7a-717117c83751

BioNTdrv.sys :inline

Description

Paragon Hard Disk Manager BioNTdrv.sys versions 10.1.x and older, 1.0.0.0, 1.1.0.0, 1.3.0.0, 1.4.0.0, and 1.5.1.0 contain five vulnerabilities that expose arbitrary kernel-memory mapping, write, and move operations, insecure kernel resource access, and a null-pointer dereference. Local attackers can use the affected driver to elevate to SYSTEM or cause a denial of service. CVE-2025-0289 has been observed in ransomware BYOVD attacks. Version 2.0.0 fixes the flaws.

  • UUID: e6378671-986d-42a1-8e7a-717117c83751
  • Created: 2025-03-02
  • Author: Swachchhanda Shrawan Poudel

Download

This download link contains the vulnerable driver!

Block BioNTdrv.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create BioNTdrv.sys binPath=C:\windows\temp\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/magicsword-io/LOLDrivers/issues/409
  • https://github.com/fluffycats31/vulnerable-drivers
  • https://kb.cert.org/vuls/id/726882
  • https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/
  • https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
  • https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

    • CVE

  • CVE-2025-0285
  • CVE-2025-0286
  • CVE-2025-0287
  • CVE-2025-0288
  • CVE-2025-0289

    • Known Vulnerable Samples

    PropertyValue
    FilenameBioNTdrv.sys
    Creation Timestamp2020-12-07 08:03:10
    MD5414904e1562e3fd9ea5d9539989b3f03
    SHA13e2b19b7111393987f0f8ba99693baef3ced5d56
    SHA256f83560719a0054cb9911811372d0fcb2d8b3704d30c5503cd0aeeccda3dc6b4b
    Authentihash MD5ed52d9d3f5f21a926a5223d5e2e6abe2
    Authentihash SHA1980f3b4a77d2fc3183d3772cd7f68edc45030ab7
    Authentihash SHA2567cb0ab6ed54b51910f2970a2a43513fdd7caa7bb0676d31578e75ac5482722ad
    RichPEHeaderHash MD57401aa3df24fbfc370032cadfb358eb4
    RichPEHeaderHash SHA14aa0997457e2a5e84ac8524ec463d41a66645afb
    RichPEHeaderHash SHA2565ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 0409181b5fd5bb66755343b56f955008
    FieldValue
    ToBeSigned (TBS) MD59359496ca4f021408b9d8923cab8b179
    ToBeSigned (TBS) SHA12aed40d7759997830870769be250199fd609e40e
    ToBeSigned (TBS) SHA256e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA
    ValidFrom2013-10-22 12:00:00
    ValidTo2028-10-22 12:00:00
    Signature3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber0409181b5fd5bb66755343b56f955008
    Version3
    Certificate 611cb28a000000000026
    FieldValue
    ToBeSigned (TBS) MD5983a0c315a50542362f2bd6a5d71c8d0
    ToBeSigned (TBS) SHA18047f476001f5cb16a661d2a3fd0c3576168f5e2
    ToBeSigned (TBS) SHA2565f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
    ValidFrom2011-04-15 19:41:37
    ValidTo2021-04-15 19:51:37
    Signature5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611cb28a000000000026
    Version3
    Certificate 02cebbc9e735228e41dbae6cfcc8a1db
    FieldValue
    ToBeSigned (TBS) MD5e911e9028e84035051ad808ae54bc34b
    ToBeSigned (TBS) SHA1d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40
    ToBeSigned (TBS) SHA256db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45
    SubjectC=DE, ST=Baden,Württemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2020-08-15 00:00:00
    ValidTo2021-11-05 12:00:00
    Signature9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber02cebbc9e735228e41dbae6cfcc8a1db
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • ExGetPreviousMode
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • IoIs32bitProcess
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • ObReferenceObjectByHandle
    • KeInitializeEvent
    • ZwOpenFile
    • ZwClose
    • ZwOpenProcess
    • PsLookupProcessByProcessId
    • KeAttachProcess
    • KeDetachProcess
    • ZwDuplicateObject
    • ObQueryNameString
    • SePrivilegeCheck
    • __C_specific_handler
    • IoFileObjectType
    • ObfDereferenceObject
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameBioNTdrv.sys
    Creation Timestamp2017-01-19 02:12:21
    MD542e7463e46255bf19b9b540d65ed304c
    SHA121da44b8390a07dfa88bc3cc3d100b6ee1ce7c6c
    SHA2566415b01fbe1e2694547c472f3fad6e17ffb33efdfb44a89cbb623cbd4f731f2a
    Authentihash MD5d03a562dd5f28d6febb14fcfb7649b83
    Authentihash SHA1408490a6ab7e91c0e7b84bc933baccae2b65d02f
    Authentihash SHA2560fd3e7810b7af01db22a46964389f4483ef8d58b3468f32fd1b034bf80d63c2e
    RichPEHeaderHash MD57401aa3df24fbfc370032cadfb358eb4
    RichPEHeaderHash SHA14aa0997457e2a5e84ac8524ec463d41a66645afb
    RichPEHeaderHash SHA2565ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 6ec648737d66ea562d9822552e1bce55
    FieldValue
    ToBeSigned (TBS) MD5b54dac562b3e3a8db6def401f69acac3
    ToBeSigned (TBS) SHA1c412007e64e320f1e126a230e98676a58bfb1ec2
    ToBeSigned (TBS) SHA2567632d627cfc09fff7b7dd7201a7b2b17d5abc1dc9a6b92c2079812705a528efb
    SubjectC=DE, ST=Germany, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2016-07-14 00:00:00
    ValidTo2017-09-11 23:59:59
    Signature1199beae5e515ec84e737e0a25151a401914f99f5719a180106167aca6b849ede224eee294e58ddc2d3f08af3b67d5d295f3db95d302ce3f2856c0421f9ab82ab67ad09f1a8fbf092fad4f4808b3b18d34d1f32f7a4287f578e119bc37bda40aa7c51f0365546bbce2e55fb407f28eaffd68162d74b2457b29ebbdcf4698d6ebf005bf2261a267bd88d71d4311a6e29c85e609a2f5f428e21f3bc3ba121f88024257dd939891786ef106a130dc216fe09d4b58a6f4a1f52fa43664e099d92300c15c2d6f5f3ac058903b43e2023c66c41e97b015b40c048e07d8d7fcbfecb419e91a3853bd395d30d68e796da621a04e70776cdeba1689e8d78cc639bc645384
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber6ec648737d66ea562d9822552e1bce55
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • ExGetPreviousMode
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • IoIs32bitProcess
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • ObReferenceObjectByHandle
    • KeInitializeEvent
    • ZwOpenFile
    • ZwClose
    • ZwOpenProcess
    • PsLookupProcessByProcessId
    • KeAttachProcess
    • KeDetachProcess
    • ZwDuplicateObject
    • ObQueryNameString
    • SePrivilegeCheck
    • __C_specific_handler
    • IoFileObjectType
    • ObfDereferenceObject
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameBioNTdrv.sys
    Creation Timestamp2017-01-19 02:12:20
    MD5bee39ff7c8be071f14d1285596e6c34b
    SHA15cc6394fbfc6ea3638df534e0e069de536899171
    SHA25669a9c8f3134130617f3bbe19a7221752d98f029763cd2d9100fec4680333ed16
    Authentihash MD58a073d569af673fd00a46eea75cb5a57
    Authentihash SHA17816451a304e92aa6f975e62bcee0746892ac8ca
    Authentihash SHA256c5062c8d91eda5579ee627746b367e37f60eb717f7148f6885ad6bcf315203d6
    RichPEHeaderHash MD51e7257fad0156a8620120920a4eba3d1
    RichPEHeaderHash SHA181c0a25338b94e6f37fd4b008a96ec206578ae8c
    RichPEHeaderHash SHA25628b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 6ec648737d66ea562d9822552e1bce55
    FieldValue
    ToBeSigned (TBS) MD5b54dac562b3e3a8db6def401f69acac3
    ToBeSigned (TBS) SHA1c412007e64e320f1e126a230e98676a58bfb1ec2
    ToBeSigned (TBS) SHA2567632d627cfc09fff7b7dd7201a7b2b17d5abc1dc9a6b92c2079812705a528efb
    SubjectC=DE, ST=Germany, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2016-07-14 00:00:00
    ValidTo2017-09-11 23:59:59
    Signature1199beae5e515ec84e737e0a25151a401914f99f5719a180106167aca6b849ede224eee294e58ddc2d3f08af3b67d5d295f3db95d302ce3f2856c0421f9ab82ab67ad09f1a8fbf092fad4f4808b3b18d34d1f32f7a4287f578e119bc37bda40aa7c51f0365546bbce2e55fb407f28eaffd68162d74b2457b29ebbdcf4698d6ebf005bf2261a267bd88d71d4311a6e29c85e609a2f5f428e21f3bc3ba121f88024257dd939891786ef106a130dc216fe09d4b58a6f4a1f52fa43664e099d92300c15c2d6f5f3ac058903b43e2023c66c41e97b015b40c048e07d8d7fcbfecb419e91a3853bd395d30d68e796da621a04e70776cdeba1689e8d78cc639bc645384
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber6ec648737d66ea562d9822552e1bce55
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • KeInitializeEvent
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwClose
    • __C_specific_handler
    • IoFileObjectType
    • InbvAcquireDisplayOwnership
    • InbvDisplayString
    • InbvEnableDisplayString
    • InbvIsBootDriverInstalled
    • InbvResetDisplay
    • InbvSetScrollRegion
    • InbvSetTextColor
    • InbvSolidColorFill
    • InbvNotifyDisplayOwnershipLost
    • ObReferenceObjectByHandle
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    FilenameBioNTdrv.sys
    Creation Timestamp2018-01-30 11:32:17
    MD5d2fdad79aa8fc5c66687dc8516cab756
    SHA16ac13b7105b6bab8bfed4fe6f3d218c114aa7474
    SHA256e78f14d0adf4c5599b09d3995f84d265dbea20fc25112a9c3227b7a35910ca90
    Authentihash MD5edf14b6e661abc745b49e10e3da97bd4
    Authentihash SHA1aa141feaf476984e17aa906e9d80ea659e504d53
    Authentihash SHA2560da70668222c4472540ff820f70b70fa3a0243595880d9401adf60572c24b464
    RichPEHeaderHash MD57401aa3df24fbfc370032cadfb358eb4
    RichPEHeaderHash SHA14aa0997457e2a5e84ac8524ec463d41a66645afb
    RichPEHeaderHash SHA2565ea2ff69bec066985311b0965abbaf459d5c93254341b3271bee683957588a38
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 247d157352d5671a5e44263793df43d2
    FieldValue
    ToBeSigned (TBS) MD51a2e03e5b6dc284e5d998e6158740a72
    ToBeSigned (TBS) SHA11d0ed63f8c96e325d1ffb31c332f8596c305793d
    ToBeSigned (TBS) SHA2563900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1
    SubjectC=DE, ST=Baden,Württemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2017-08-28 00:00:00
    ValidTo2018-09-16 23:59:59
    Signatureb6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber247d157352d5671a5e44263793df43d2
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • ExGetPreviousMode
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • IoIs32bitProcess
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • ObReferenceObjectByHandle
    • KeInitializeEvent
    • ZwOpenFile
    • ZwClose
    • ZwOpenProcess
    • PsLookupProcessByProcessId
    • KeAttachProcess
    • KeDetachProcess
    • ZwDuplicateObject
    • ObQueryNameString
    • SePrivilegeCheck
    • __C_specific_handler
    • IoFileObjectType
    • ObfDereferenceObject
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    Filename
    Creation Timestamp2018-01-30 13:32:16
    MD5ef32d203a12462403c205b39eb4eef5b
    SHA1b31a85406ac9a6a69bfbee74d6dc67d9d7bddee6
    SHA256fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0
    Authentihash MD58d1f5412cc6e58af2bdbff2e179f298d
    Authentihash SHA15d01cd9701213f7fd4073507cdbe18f4b742baf7
    Authentihash SHA256efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d
    RichPEHeaderHash MD51e7257fad0156a8620120920a4eba3d1
    RichPEHeaderHash SHA181c0a25338b94e6f37fd4b008a96ec206578ae8c
    RichPEHeaderHash SHA25628b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 247d157352d5671a5e44263793df43d2
    FieldValue
    ToBeSigned (TBS) MD51a2e03e5b6dc284e5d998e6158740a72
    ToBeSigned (TBS) SHA11d0ed63f8c96e325d1ffb31c332f8596c305793d
    ToBeSigned (TBS) SHA2563900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1
    SubjectC=DE, ST=Baden,Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2017-08-28 00:00:00
    ValidTo2018-09-16 23:59:59
    Signatureb6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber247d157352d5671a5e44263793df43d2
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • KeInitializeEvent
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwClose
    • __C_specific_handler
    • IoFileObjectType
    • InbvAcquireDisplayOwnership
    • InbvDisplayString
    • InbvEnableDisplayString
    • InbvIsBootDriverInstalled
    • InbvResetDisplay
    • InbvSetScrollRegion
    • InbvSetTextColor
    • InbvSolidColorFill
    • InbvNotifyDisplayOwnershipLost
    • ObReferenceObjectByHandle
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    Filename
    Creation Timestamp2022-08-11 08:04:23
    MD5525ef6014f0ef20e44fe47c1d9980b69
    SHA1cab45e9d03efa8a09595b99b275caadb8f250811
    SHA256174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe
    Authentihash MD5778ca6c522c672bdd509cd37339916c8
    Authentihash SHA166f199e8edc9580a33c81d056b34b590481a7f01
    Authentihash SHA256015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615
    RichPEHeaderHash MD5103ed1ac1ea56c3cc7db32fa7d2eae72
    RichPEHeaderHash SHA14888504201b2e54209e2098252644cf9c7dac7ba
    RichPEHeaderHash SHA256180e1ac2cc854b49c7afdf2bd752147097fb55f5a5199a831885db6a4957ec10
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 08ad40b260d29c4c9f5ecda9bd93aed9
    FieldValue
    ToBeSigned (TBS) MD55d8003a64dfa5a4d88365da1566038cb
    ToBeSigned (TBS) SHA179465b56bc7ad55a37bdf633943da8bfc84db228
    ToBeSigned (TBS) SHA25684bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332
    SubjectC=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    ValidFrom2021-04-29 00:00:00
    ValidTo2036-04-28 23:59:59
    Signature3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber08ad40b260d29c4c9f5ecda9bd93aed9
    Version3
    Certificate 046a6191017da49a025dd21aa76934f7
    FieldValue
    ToBeSigned (TBS) MD5c7f1b7cbb054ecb1a659ffeafd5975fa
    ToBeSigned (TBS) SHA16b17d9dd7483829600f8e94e6134ad87fb667a78
    ToBeSigned (TBS) SHA256d1a7a9b52e70c6bb75ec4b9a509be4367fc0e5d5edfcbeb62e443eda89596bef
    SubjectC=DE, ST=Baden,Wrttemberg, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2021-10-27 00:00:00
    ValidTo2022-11-09 23:59:59
    Signature60efe8e490f73560084068cb01097a77ddc92a2b0a0c4fc2d148becc30dc16ca81fa83edad0813b37ad623ada902100d64b4b3e75cd38a858ca11a068b2b70a80ad3be0edd05f449b254108d9fcdf04bfefbcf2e976b3be1c5190efcadfddd3a98493c0e088b4e5d67396054d593fa176999cd14f49d928a36aec45214539d624cfda6f97dc77691dc4155a4b8348ce3910588c7a6c309c63e2b7ab45d4b09228f62b6127c094171c5e533a69eba287b1c15aa5797f79debf5ff378692cbe41925ff5a226bf3b521ce8c988cf7ecb655bba8e5b3a6ae70792df23b1bdc86cf1d5f43aa0cddd6fb1bc9ea7c70aae4e161e7abbb12a9c63b5cccbb4efd9cd680c1c126151746b996517a083eb73c6d30b7255e38c8e52f105a58969f53f7c64811a285629b1ffc1b364342680e55c26532a8eaae218430598031cc94c37adf26f80018bbfc6d54fcbd351683f2bcd61ab84af6ef2d9ab3322b0437343c6f69ad6bfafa56e6e0cd0ba5a769bb53772b2546d43d38375d224375bb29adf2a495f5c44b04a3efb9130594ab0690bc85538a4a612efb47d6dd0bb032196eb47e00c4a150052c860a112f46163c6cf071f6ee9ef928f5c895a206a9886f23f58e394f28415dcaf227cf2dc0690a0880362bb558ba140d084966593754a8dd896ff67e5e1b7abe130c2b503406d0c7ac387422b83973c4dffe8f4b7c0d17dc800463091e
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber046a6191017da49a025dd21aa76934f7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • RtlValidSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • KeInitializeEvent
    • KeWaitForSingleObject
    • ExGetPreviousMode
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • SeAccessCheck
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • IoIs32bitProcess
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • ObReferenceObjectByHandle
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwClose
    • ZwOpenProcess
    • RtlCreateSecurityDescriptor
    • KeAttachProcess
    • KeDetachProcess
    • ZwDuplicateObject
    • ObQueryNameString
    • SePrivilegeCheck
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlLengthSid
    • RtlCreateAcl
    • RtlAddAccessAllowedAce
    • RtlSetGroupSecurityDescriptor
    • RtlSetOwnerSecurityDescriptor
    • RtlAllocateHeap
    • RtlFreeHeap
    • RtlCreateHeap
    • RtlDestroyHeap
    • __C_specific_handler
    • IoFileObjectType
    • PsLookupProcessByProcessId
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0409181b5fd5bb66755343b56f955008",
      "Signature": "3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "TBS": {
        "MD5": "9359496ca4f021408b9d8923cab8b179",
        "SHA1": "2aed40d7759997830870769be250199fd609e40e",
        "SHA256": "e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65",
        "SHA384": "5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"
      },
      "ValidFrom": "2013-10-22 12:00:00",
      "ValidTo": "2028-10-22 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611cb28a000000000026",
      "Signature": "5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA",
      "TBS": {
        "MD5": "983a0c315a50542362f2bd6a5d71c8d0",
        "SHA1": "8047f476001f5cb16a661d2a3fd0c3576168f5e2",
        "SHA256": "5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83",
        "SHA384": "5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"
      },
      "ValidFrom": "2011-04-15 19:41:37",
      "ValidTo": "2021-04-15 19:51:37",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Signature": "9622380ef13a031db389b47ece3ee471a23bb756af377734de4f3e4ea2fc8fa2315cbd29e8324d53e5ff738aeeceda98b677f10f912073bf3663b15cac0fb2b0aa6b8990053270c5d4041beffd3063b593f837957f0c8211fbcaf0f02737d9ff3f177584b66c32620ad4933ce99b8179c5d06d0a58b336adab54bbc57034067e731e816c1fe3f6e868aa2c9d0a7451751d4320e4c75d102499771983af1ad8bcc5e69266b0127e0da20cc69c16d00a36c49bc42c83935038f0df255b7fa4c0da7e85fbd1acfda8f68696a02313fa45322b9bb788cf46d3252dbdf5b2c693013d3aeb4eb1a00bed922951deca941bb891d21f4f68f104f4b41f73a942b6f92df9",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=DE, ST=Baden,W\u00fcrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "e911e9028e84035051ad808ae54bc34b",
        "SHA1": "d12a639cc1e73ed90d8d7b315b4f34f4bd85ca40",
        "SHA256": "db2e9de1c73af80a23240b503c92ecd7075e2829d3a2a4a3e798137da93a4d45",
        "SHA384": "825fa5fb3a18e926574f85285f1bb18817a09c76da2c7f249cae9698ec5d45a05df69d5a59d3d3ab934984e3c3e77ecb"
      },
      "ValidFrom": "2020-08-15 00:00:00",
      "ValidTo": "2021-11-05 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA",
      "SerialNumber": "02cebbc9e735228e41dbae6cfcc8a1db",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-09-08